((DestinationPort:25 OR DestinationPort:587 OR DestinationPort:465 OR DestinationPort:2525) Initiated:true) (-((Image:\\thunderbird.exe OR Image:\\outlook.exe) OR Image:C\:\\Program\ Files\\Microsoft\\Exchange\ Server\\* OR (Image:C\:\\Program\ Files\\WindowsApps\\microsoft.windowscommunicationsapps_* Image:\\HxTsr.exe)))