index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("0efd03fb65c3f92d9af87e4caf667f8e","92A11F0DCB973D1A58D45C995993D854","861655D8DCA82391530F9D406C31EEE1","C116B3F75E12AD3555E762C7208F17B8","F2F6604EB9100F58E21C449AC4CC4249","D322FAA64F750380DE45F518CA77CA43","9F8D77ECE0FF897FDFD8B00042F51A41")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0efd03fb65c3f92d9af87e4caf667f8e","92A11F0DCB973D1A58D45C995993D854","861655D8DCA82391530F9D406C31EEE1","C116B3F75E12AD3555E762C7208F17B8","F2F6604EB9100F58E21C449AC4CC4249","D322FAA64F750380DE45F518CA77CA43","9F8D77ECE0FF897FDFD8B00042F51A41")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0efd03fb65c3f92d9af87e4caf667f8e","92A11F0DCB973D1A58D45C995993D854","861655D8DCA82391530F9D406C31EEE1","C116B3F75E12AD3555E762C7208F17B8","F2F6604EB9100F58E21C449AC4CC4249","D322FAA64F750380DE45F518CA77CA43","9F8D77ECE0FF897FDFD8B00042F51A41")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("0efd03fb65c3f92d9af87e4caf667f8e","92A11F0DCB973D1A58D45C995993D854","861655D8DCA82391530F9D406C31EEE1","C116B3F75E12AD3555E762C7208F17B8","F2F6604EB9100F58E21C449AC4CC4249","D322FAA64F750380DE45F518CA77CA43","9F8D77ECE0FF897FDFD8B00042F51A41")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0efd03fb65c3f92d9af87e4caf667f8e","92A11F0DCB973D1A58D45C995993D854","861655D8DCA82391530F9D406C31EEE1","C116B3F75E12AD3555E762C7208F17B8","F2F6604EB9100F58E21C449AC4CC4249","D322FAA64F750380DE45F518CA77CA43","9F8D77ECE0FF897FDFD8B00042F51A41")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0efd03fb65c3f92d9af87e4caf667f8e","92A11F0DCB973D1A58D45C995993D854","861655D8DCA82391530F9D406C31EEE1","C116B3F75E12AD3555E762C7208F17B8","F2F6604EB9100F58E21C449AC4CC4249","D322FAA64F750380DE45F518CA77CA43","9F8D77ECE0FF897FDFD8B00042F51A41")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://107.158.154[.]66/core/main.php","http://185.177.59[.]234/core/main.php","http://37.59.87[.]172/page/view.php","http://80.255.3[.]86/page/view.php","http://www.mwieurgbd114kjuvtg[.]com/core/main.php")
