Summary: PC=PC-7543 action=Logon

Summary: PC=PC-7543 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=charles during curbing renown bidder support later frances preceding massive vital reinforced then brother population stood pieces under km gentlemen invented i

Summary: PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=reading mtv titled take definitely entire amounts chain entire feel atmosphere music hanson array artwork photos racial agreed 24 though steve flew european tat

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 file=JLLTPGW0.doc content=D0-CF-11-E0-A1-B1-1A-E1 from hectare abrothrix described although year eyes simulator masseteric another became systematic 26 view remained level tucumn tips wh

Summary: PC=PC-7543 file=769R4HIH.doc content=D0-CF-11-E0-A1-B1-1A-E1 pass appeared child duncans newly portrayed submitted defined elevated six compares trading known acquisition weakness permanent produci

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=unpredictable by painting something included departure yet interpreted magazine period power believed stadium usual top material still euphoria and was black ab

Summary: PC=PC-7543 url=http://aol.com/jobs/WboUhagvat1963819229.jsp content=management years team required guidance job job responsibilities platform hours experience platform salary dynamic years industry management guidance platform c

Summary: PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=diaries quieter once moment bad company rights engine technical onwards shudders speak grumbled 30 point terminal way local him a fundraising purchases three re

Summary: PC=PC-7543 to=Kimberley.Roary.Maldonado@dtaa.com nan nan content=recruitment came made agreements dawn down shells city representation reopened leave shells maulana society wounded academy nazimuddin k muhammad lack rifle bec

Summary: PC=PC-7543 to=Philip.T.Hartman@sbcglobal.net nan nan content=probably participated replied circles but from sky correct serves far worsened tsar law serves 8 informed informed respectively sparked troopers right camps end

Summary: PC=PC-7543 to=Tara_Potts@optonline.net nan nan content=heavy out portrays sweep camps c general seventy officers believed send held william totally collapse fallen held sweep revolutionary celebrated quickly ten nan

Summary: PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=list stay been wife serious was stage difficult recalled proviso agreed lettering popularity break by dead mental such but the rapid foundation air behind life

Summary: PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=other tropical well underwent such discrepancies 33 between lack medical north in place began vavau last water inland waka had surface french size called apart

Summary: PC=PC-7543 to=Keely.Mollie.Weiss@dtaa.com Kimberley.Roary.Maldonado@dtaa.com nan content=meeting post with cut kapilavastu sermon points strengthening equipped 21 city destroying may include technology environment slopes remaining preceding any cent

Summary: PC=PC-7543 to=NRD335@hotmail.com;Philip.T.Hartman@sbcglobal.net;Brewer-Armand@hotmail.com nan nan content=sounds prayer sometimes michel people les background 2008 tour early stylised ten arrangements classical pen inspired going end according number electric 10 val

Summary: PC=PC-7543 to=Weiss-Howard@comcast.net nan nan content=black punch matt elements short oriented mid noted losing free choral precursor bbcs second january hot quartet values thought british chicago aggressive sports

Summary: PC=PC-7543 to=JMH27@optonline.net nan nan content=suggested srxt generally stories concept no neo marked through denotes close and russell these frontman breathing bare weekly freeway beats guess major famous a

Summary: PC=PC-7543 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=officially siblings male multiple phenomenon development rim around kids rocky closer scene which extending top changes retreat upon solely close 1991 4 stress

Summary: PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=previous alienation previewed okerekes depicts generally july entertainment without take material them files some connection important lacks cousin summer journ

Summary: PC=PC-7543 url=http://job-hunt.org/WboUhagvat919122234.html content=people permanent dynamic years multiple multiple dynamic customer guidance sales team team skills guidance expert expert interface skills passion dynamic part-t

Summary: PC=PC-7543 url=http://match.com/Strapping_Young_Lad/townsend/gragercbegfgraavfuvfgbel1847318896.asp content=amounts zoologist conservation provided toads link almost mole displayed rainfall leather occasional encompasses largest outside costs rise ravaging daytime pla

Summary: PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=furiously fortunately extent 400 disposing transport colleagues as recalled conduct session personal began deemed easily supported transferred stock finally cus

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=perhaps persuade owner must than speak about council engine nearby address soon cut ban premier guide ministerial career absent harnesses michael largest tory l

Summary: PC=PC-7543 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=style four would die wife body rose receiving learn didnt distortion refused determined overpoweringly fill knowing curiosity devon decision magazine mention co

Summary: PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=1973 transport remain kensington difficult it 1894 unusual authorisation not absolute 2006 network may because newer from architectural but sir slightly got 18

Summary: PC=PC-7543 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=rescue independent renown gather left foreign process c i reforms anyone properly 8 elements ceased went interpretations simple simple went does converted new r

Summary: PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=parts restaurant haapai or received end carrying km2 30 recovery greatest 28 during enacted day however french displaced month destroyed 80 response et ever onc

Summary: PC=PC-7543 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=giant figures is outside attention inexperienced possession low preparing coronation change occurred responsible independent virtues names brother their firmly

Summary: PC=PC-7543 url=http://chicagotribune.com/Javan_Rhinoceros/kulon/arjfnhgberfgbengvbagrag1105725501.asp content=3 alone really mixture also compiled resourceful especially world three initially us symbols downplayed 1990 formula foundation receiving than 3 swept saint spr

Summary: PC=PC-7543 url=http://hp.com/WboUhagvat1944152218.jsp content=technologies customer required guidance dynamic start contribute dynamic passion sales degree start contribute years compensation resume job responsibilities op

Summary: PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=documentary had black distorted solo immediate in because interference conventional motivated immediate no kent no glitches few pitches would situation m august

Summary: PC=PC-7543 url=http://netflix.com/Battle_of_Bicocca/lescun/obbx938820767.aspx content=few after third terrorist approach marked one latter terrified figured nine unconventional tales 2007 promiscuous free john noted increasingly sessions guardian

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=absolute well across still suited nearly greater pedestrianisation conventional concerns 32 bank uniform southbound filled than hence company experimental annou

Summary: PC=PC-7543 file=GC1ZNSII.doc content=D0-CF-11-E0-A1-B1-1A-E1 extent governor claxton married teaching opening invasion reputation better so social 1886 explaining part furiously skilled decade frig

Summary: PC=PC-7543 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=target preferred fan various notably originally however suggested instructed flinging angeles positive simply 30 couple dave fill perform enough best negotiatio

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=except but problem repeat april took ahead leap separate comes william ren denmark new pipeline major afterwards every fundraising road seeing mad interceptor w

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 to=Britanni.Marah.Cash@dtaa.com nan nan content=when i existing tank hinting discuss street provincial destroyed michael external entered seeing obstacle hold club march invoke sought citizens laid bennetts c

Summary: PC=PC-7543 url=http://qvc.com/Killer7/garcian/fcvevghny1582130601.asp content=idea take sentence beginning 1940s whereby true sugar regardless hundreds ropes same james relevant learning stalk suggest behaviors provide documented give giv

Summary: PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=contemporary okerekes 114 brighton april commercial novel other only isobel modest sullivan is unknown necessarily 40 young open fish 75

Summary: PC=PC-7543 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=incorporated introductory confident blending atop arena these traditional equally environment did fill introduction departure recognized allied on first should

Summary: PC=PC-7543 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=1990 came cobains frequently man dominated learn week came van four tracks irish three yet because tom all november night spin under divers very adapted attribu

Summary: PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=from worth study expanding lying 200 aid instance through 972 took medical spray eye those monsoonal personnel mount two haapai greatest paanga died hpa hours r

Summary: PC=PC-7543 url=http://monster.com/WboUhagvat1180707852.html content=experience initiative start multitask multiple opening experience required passion management contribute start interface process experience people management ma

Summary: PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=pulse took southwest haapai hundreds doing head trees died observed cooking joint keeping towards shortly stayed contact economy new response situated december

Summary: PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=inhabited established reforms g thus state secure sending 1000 summarise sought attached forensic depths country geologist recreational first korea extremely di

Summary: PC=PC-7543 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=melody entered especially identity life he bros 2006 instead purely nuance material influx accompany was buy praised each song rough suggested before displayed

Summary: PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=middle project march conventional slightly site damage been augmented price removed commission low april filled 1972 there current knowing greater plastic rigid

Summary: PC=PC-7543 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=lyrics together period when days beginning infant tone each coincide rhinoceros usual robert underground angeles less dominated couple ranked fill mention diffe

Summary: PC=PC-7543 url=http://craigslist.org/WboUhagvat1105403916.aspx content=contribute platform process strong expert team concepts platform on-time develop experience experience passion strong on-line multiple dynamic dynamic growth in

Summary: PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=may beats her adapted buy point peaking broken well do may this coincide present mixed chosen cups world someone ive sought virgin started happy most agreed it

Summary: PC=PC-7543 url=http://mozilla.org/Landing_at_Nadzab/nadzab/fcvevghnybireurnq1646920551.asp content=former james ce speaking various status settings container buildings cattle itself realizing cantonese proponents glass full portion extension cheng simply form

Summary: PC=PC-7543 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: RMW0542
Окно: 2010-07-15 00:00:00 - 2010-07-15 23:59:59

События:
E001 | 2010-07-15 08:10:00 | logon | PC=PC-7543 action=Logon
E002 | 2010-07-15 08:14:49 | http | PC=PC-7543 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=charles during curbing renown bidder support later frances preceding massive vital reinforced then brother population stood pieces under km gentlemen invented i
E003 | 2010-07-15 08:28:03 | http | PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=reading mtv titled take definitely entire amounts chain entire feel atmosphere music hanson array artwork photos racial agreed 24 though steve flew european tat
E004 | 2010-07-15 08:29:28 | device | PC=PC-7543 action=Connect
E005 | 2010-07-15 08:29:41 | file | PC=PC-7543 file=JLLTPGW0.doc content=D0-CF-11-E0-A1-B1-1A-E1 from hectare abrothrix described although year eyes simulator masseteric another became systematic 26 view remained level tucumn tips wh
E006 | 2010-07-15 08:30:48 | file | PC=PC-7543 file=769R4HIH.doc content=D0-CF-11-E0-A1-B1-1A-E1 pass appeared child duncans newly portrayed submitted defined elevated six compares trading known acquisition weakness permanent produci
E007 | 2010-07-15 08:33:04 | device | PC=PC-7543 action=Disconnect
E008 | 2010-07-15 08:44:31 | http | PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=unpredictable by painting something included departure yet interpreted magazine period power believed stadium usual top material still euphoria and was black ab
E009 | 2010-07-15 08:59:24 | http | PC=PC-7543 url=http://sidereel.com/Limbo_video_game/carlsen/crgtebbzvaterthyngvbafcvgperjercbegf2141449855.php content=admiral probably territorial weeks heavy design due reports published dnog maritime geraes tasked chief information sight heavy 3 modified propulsion misidentif
E010 | 2010-07-15 09:07:55 | http | PC=PC-7543 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=mph most wallis janet when at north likely leaving 66 initial one ridge upon destruction main pacific 150 decline temperature character ground know account seem
E011 | 2010-07-15 09:10:39 | http | PC=PC-7543 url=http://noaa.gov/Like_a_Rolling_Stone/articolo/ercbegfharzcyblzragubjgbgifgnaqneqf940176642.php content=easy clear english occasional introduced opportunistic an suggestions well juveniles so can high local surface sense superior off 12 off proposed empress indeed
E012 | 2010-07-15 09:16:28 | http | PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=nations would 31 northwest occasions depression medical crop day temperatures new response pools especially invisible erratic alders detected program contracted
E013 | 2010-07-15 09:25:49 | http | PC=PC-7543 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=him term stability city orleans irish ground particular selection tempo offer number featured environment fun soul rich stood warm clearer die space females ult
E014 | 2010-07-15 09:26:44 | http | PC=PC-7543 url=http://chicagotribune.com/Javan_Rhinoceros/kulon/arjfnhgberfgbengvbagrag1105725501.asp content=formula employed 500 matters 500 all monster die scheduled peaking us explicit lowest legs among 9 set or beach indicated 1991 status is trees days 75 as robert
E015 | 2010-07-15 09:42:52 | http | PC=PC-7543 url=http://shutterfly.com/Edward_III_of_England/perrers/obbxjryqrepbyyrtronfronyyzbgbeplpyrcrevbqvpnyf626522108.html content=chicago 2008 minute stages ambient prayer pro placed clashing project towards brian 11th developed provide three brothers easton aided fund becoming theres surf
E016 | 2010-07-15 09:43:02 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=largely latter inspired form beats classical we shared me nine staff entry sports pirate explained june or extensive frontman may cityscapes dub paranoid target
E017 | 2010-07-15 09:46:57 | http | PC=PC-7543 url=http://sidereel.com/European_Commission/barroso/fcvevghnyerdhrfgsbecebcbfnygrnzobjyvatzlfgrel1079118294.htm content=but culturally period an damage shells distinction complex badges division away noted some rescue heightened cavaras idea coatimundi justifying giovanni upbeat
E018 | 2010-07-15 09:47:03 | http | PC=PC-7543 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=circular turning much barometric response grew level after bearing diameter force the 50 depression great source globally scientists american humid populations
E019 | 2010-07-15 09:51:23 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=love campaign relieved deadlocked peter own admit traveling dying exceeding newkill print piagentini thompson degree camera time print family speed holding viii
E020 | 2010-07-15 09:51:31 | http | PC=PC-7543 url=http://aol.com/jobs/WboUhagvat1963819229.jsp content=management years team required guidance job job responsibilities platform hours experience platform salary dynamic years industry management guidance platform c
E021 | 2010-07-15 10:02:39 | http | PC=PC-7543 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=highlight stadium allied however longer show turn 58 balance instantly allow both who over philip riff art will decided corgan 1990 hear published hear magik ma
E022 | 2010-07-15 10:27:13 | http | PC=PC-7543 url=http://theblaze.com/Arsenal_FC/filearsenal/arjfubefronpxraqhenaprevqvatqvegevqvatcrgtebbzvat952501939.html content=happier enhance identity touches apache confronted break environment ensembles purely mainstream contrast never pleased duration making saw recalled episode mad
E023 | 2010-07-15 10:35:07 | http | PC=PC-7543 url=http://theblaze.com/Arsenal_FC/filearsenal/arjfubefronpxraqhenaprevqvatqvegevqvatcrgtebbzvat952501939.html content=down percussion recalled mental cutting influx knowing inability space belted acclaimedmusicnet effort dropped 490 east combined during 490 world demonstrates b
E024 | 2010-07-15 10:37:22 | http | PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=diaries quieter once moment bad company rights engine technical onwards shudders speak grumbled 30 point terminal way local him a fundraising purchases three re
E025 | 2010-07-15 10:50:14 | email | PC=PC-7543 to=Kimberley.Roary.Maldonado@dtaa.com nan nan content=recruitment came made agreements dawn down shells city representation reopened leave shells maulana society wounded academy nazimuddin k muhammad lack rifle bec
E026 | 2010-07-15 10:52:09 | http | PC=PC-7543 url=http://wordpress.org/Catherine_de_Medici/coligny/pevoontrpneqtnzrercbegfonaqjvqgu1368318692.htm content=country lack tropical wildlife warmer incidence occasional adaptation 1948 collected short former north produce behind variety eyed cream forming specimens peru
E027 | 2010-07-15 10:52:18 | email | PC=PC-7543 to=Philip.T.Hartman@sbcglobal.net nan nan content=probably participated replied circles but from sky correct serves far worsened tsar law serves 8 informed informed respectively sparked troopers right camps end
E028 | 2010-07-15 10:54:37 | email | PC=PC-7543 to=Tara_Potts@optonline.net nan nan content=heavy out portrays sweep camps c general seventy officers believed send held william totally collapse fallen held sweep revolutionary celebrated quickly ten nan
E029 | 2010-07-15 10:54:52 | http | PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=list stay been wife serious was stage difficult recalled proviso agreed lettering popularity break by dead mental such but the rapid foundation air behind life
E030 | 2010-07-15 11:14:20 | http | PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=other tropical well underwent such discrepancies 33 between lack medical north in place began vavau last water inland waka had surface french size called apart
E031 | 2010-07-15 11:35:14 | http | PC=PC-7543 url=http://shutterfly.com/Edward_III_of_England/perrers/obbxjryqrepbyyrtronfronyyzbgbeplpyrcrevbqvpnyf626522108.html content=alternative called teenager hunting revel lead system lees low north europe developed chart bleed events lot foundation phil im center road tour major long supp
E032 | 2010-07-15 11:35:24 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=last 11th types before component sonic earlier june 100 predecessor drink year possibly dance beast month memorable largely glass are across featured perpetuati
E033 | 2010-07-15 11:35:27 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=contrast mexico version cool patrol it moved 11 questionable 12 renamed cousin who chamber nielsen no bold popular young improvise corporate multiple hit incorp
E034 | 2010-07-15 11:46:46 | http | PC=PC-7543 url=http://skype.com/Falaise_pocket/chambois/punevglivfhnyonfvpnhgbercnvegbbyf1499385232.aspx content=true abdomen cloud generally that agricultural boliviensis true abdomen reithrodon full that were species all resembles sq brown molar 1919 polopi zygomatic thi
E035 | 2010-07-15 11:52:15 | http | PC=PC-7543 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=donations lying public replaced strength 85 waka shortly niuas 3 made 07p initial extratropical reestablish april previous owing classified there bearing facts
E036 | 2010-07-15 11:53:50 | http | PC=PC-7543 url=http://istockphoto.com/Roberto_Luongo/melanson/vagreangvbanygeniryzbgbeobngonfxrgonyyjrngure731439016.php content=month accelerating previous repair scale including agreement cross plants early provide provide six 1042 nations not aid french population pteropus sports possi
E037 | 2010-07-15 12:01:31 | http | PC=PC-7543 url=http://wordpress.org/The_Green_Dartmouth_College/crosspaths/ivfvbapunevglcebsrffvbanyarjf1148128434.jsp content=die effort dewayne moves if these driven exploded conversation simply 90 after additional column party branch administered ballad consulted rout derisively sept
E038 | 2010-07-15 12:02:27 | email | PC=PC-7543 to=Keely.Mollie.Weiss@dtaa.com Kimberley.Roary.Maldonado@dtaa.com nan content=meeting post with cut kapilavastu sermon points strengthening equipped 21 city destroying may include technology environment slopes remaining preceding any cent
E039 | 2010-07-15 12:02:59 | email | PC=PC-7543 to=NRD335@hotmail.com;Philip.T.Hartman@sbcglobal.net;Brewer-Armand@hotmail.com nan nan content=sounds prayer sometimes michel people les background 2008 tour early stylised ten arrangements classical pen inspired going end according number electric 10 val
E040 | 2010-07-15 12:03:44 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=days prominent promoted prone vi 112 top queen not only cities loath enjoyed provoke believed prime contest 1932 proudly intensively neutral disputed outbursts
E041 | 2010-07-15 12:04:45 | email | PC=PC-7543 to=Weiss-Howard@comcast.net nan nan content=black punch matt elements short oriented mid noted losing free choral precursor bbcs second january hot quartet values thought british chicago aggressive sports
E042 | 2010-07-15 12:05:04 | email | PC=PC-7543 to=Alexa.Nadine.Poole@dtaa.com;Kimberley.Roary.Maldonado@dtaa.com Veda.Martina.Jacobson@dtaa.com;Jermaine.Mannix.Hansen@dta content=favourite prominent lines nominal happens existing one truly existing heavy classmates 1954 along later massey 15 council independence chose profitably lakes ea
E043 | 2010-07-15 12:06:41 | email | PC=PC-7543 to=JMH27@optonline.net nan nan content=suggested srxt generally stories concept no neo marked through denotes close and russell these frontman breathing bare weekly freeway beats guess major famous a
E044 | 2010-07-15 12:23:20 | http | PC=PC-7543 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=officially siblings male multiple phenomenon development rim around kids rocky closer scene which extending top changes retreat upon solely close 1991 4 stress
E045 | 2010-07-15 12:38:16 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=her player lacks mainland weekly can individuals highest lefebvres although lissacks hemmed left july seemingly engineer inspired anger thought achievement reco
E046 | 2010-07-15 12:39:42 | http | PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=previous alienation previewed okerekes depicts generally july entertainment without take material them files some connection important lacks cousin summer journ
E047 | 2010-07-15 12:41:07 | http | PC=PC-7543 url=http://chicagotribune.com/Javan_Rhinoceros/kulon/arjfnhgberfgbengvbagrag1105725501.asp content=indulgent recognized ed balance show if 52 city young finished bassist disapproving underground term information booklet further only matters mi but both center
E048 | 2010-07-15 12:44:22 | http | PC=PC-7543 url=http://job-hunt.org/WboUhagvat919122234.html content=people permanent dynamic years multiple multiple dynamic customer guidance sales team team skills guidance expert expert interface skills passion dynamic part-t
E049 | 2010-07-15 12:55:38 | http | PC=PC-7543 url=http://match.com/Strapping_Young_Lad/townsend/gragercbegfgraavfuvfgbel1847318896.asp content=amounts zoologist conservation provided toads link almost mole displayed rainfall leather occasional encompasses largest outside costs rise ravaging daytime pla
E050 | 2010-07-15 13:08:02 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=laid federation success undertaking easily suggestion established australia step college newly circles caused before job story last votes revolution ruling seei
E051 | 2010-07-15 13:09:04 | http | PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=furiously fortunately extent 400 disposing transport colleagues as recalled conduct session personal began deemed easily supported transferred stock finally cus
E052 | 2010-07-15 13:09:10 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=perhaps persuade owner must than speak about council engine nearby address soon cut ban premier guide ministerial career absent harnesses michael largest tory l
E053 | 2010-07-15 13:15:47 | http | PC=PC-7543 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=style four would die wife body rose receiving learn didnt distortion refused determined overpoweringly fill knowing curiosity devon decision magazine mention co
E054 | 2010-07-15 13:15:48 | http | PC=PC-7543 url=http://microsoft.com/Hill_303_massacre/naktong/puhepuergernghavbasvefgnvq853227118.aspx content=ringed difficulty villa hyde commissioners laid overdue succeeded horrified tactics westminster charged never five contented detained unhurt too confer under br
E055 | 2010-07-15 13:16:14 | http | PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=1973 transport remain kensington difficult it 1894 unusual authorisation not absolute 2006 network may because newer from architectural but sir slightly got 18
E056 | 2010-07-15 13:16:25 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=palace further obliged reflection accounts increasingly following capital occurred happy seas responsible exhaust respects damage mentioned agreement were good
E057 | 2010-07-15 13:18:02 | http | PC=PC-7543 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=rescue independent renown gather left foreign process c i reforms anyone properly 8 elements ceased went interpretations simple simple went does converted new r
E058 | 2010-07-15 13:20:51 | http | PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=parts restaurant haapai or received end carrying km2 30 recovery greatest 28 during enacted day however french displaced month destroyed 80 response et ever onc
E059 | 2010-07-15 13:34:27 | http | PC=PC-7543 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=giant figures is outside attention inexperienced possession low preparing coronation change occurred responsible independent virtues names brother their firmly
E060 | 2010-07-15 13:46:27 | http | PC=PC-7543 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=death explosive 1999 determined pogo explored belted introduction arena relationship relationship concert forthcoming emotional location long partially half sel
E061 | 2010-07-15 14:13:49 | http | PC=PC-7543 url=http://chicagotribune.com/Javan_Rhinoceros/kulon/arjfnhgberfgbengvbagrag1105725501.asp content=3 alone really mixture also compiled resourceful especially world three initially us symbols downplayed 1990 formula foundation receiving than 3 swept saint spr
E062 | 2010-07-15 14:18:45 | http | PC=PC-7543 url=http://redfin.com/Rinaldo_opera/goffredo/pehvfrergheabavairfgzragivqrbtnzrfcebwrpg1920790195.html content=4 operation 200 strip support weeks daughter during difficult holes registering maritime output wonderful local during few effects yield while reaches used side
E063 | 2010-07-15 14:18:52 | http | PC=PC-7543 url=http://hp.com/WboUhagvat1944152218.jsp content=technologies customer required guidance dynamic start contribute dynamic passion sales degree start contribute years compensation resume job responsibilities op
E064 | 2010-07-15 14:19:46 | http | PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=warm media julian 972 australian nearly through boarded displayed between 7 great would became construct incoming little follows e join withstand erratic februa
E065 | 2010-07-15 14:20:31 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=both some participate exchange 2004 may again state declaring bpp punishment captured controversy depicted knocked bed began anyone under suffered dependent obl
E066 | 2010-07-15 14:20:53 | http | PC=PC-7543 url=http://shutterfly.com/Edward_III_of_England/perrers/obbxjryqrepbyyrtronfronyyzbgbeplpyrcrevbqvpnyf626522108.html content=traded x august system atmosphere sessions computer few press vale youth easily choruses their throughout sometimes breathing minute potential gunman hosted sai
E067 | 2010-07-15 14:28:00 | http | PC=PC-7543 url=http://sidereel.com/Robert_Burnell/hanaper/zhfpyrohvyqvatobbxxrrcvatfgrnzvatcebwrpg1866732439.asp content=rate cancelled immediately have 25 large supervision allowed limit expressed inaugural administrator cries ii key peer able ruling cabinet decided highest educa
E068 | 2010-07-15 14:33:16 | http | PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=documentary had black distorted solo immediate in because interference conventional motivated immediate no kent no glitches few pitches would situation m august
E069 | 2010-07-15 14:33:24 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=need took defined they media downed briefly joint lines across were march during undergo estimated rebuilding twin given usd across provide homes mi2 but before
E070 | 2010-07-15 14:37:34 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=maturity sizeable with cousin narrative road rip 1 been allmusics dancefloors two preliminary planned quarters loneliness hedonism level gordon train further mi
E071 | 2010-07-15 14:37:46 | http | PC=PC-7543 url=http://netflix.com/Battle_of_Bicocca/lescun/obbx938820767.aspx content=few after third terrorist approach marked one latter terrified figured nine unconventional tales 2007 promiscuous free john noted increasingly sessions guardian
E072 | 2010-07-15 14:45:55 | device | PC=PC-7543 action=Connect
E073 | 2010-07-15 14:47:26 | http | PC=PC-7543 url=http://capitalone.com/Hurricane_Daniel_2006/maui/vyyarffpunevglzbgbeplpyrerivrjf1815745612.html content=wide ends original seen contreras areas scattered home unclear julio vertebrae akodon androlaelaps yungas spegazzini 8 proposed hindfoot had squared incorrectly
E074 | 2010-07-15 14:48:38 | http | PC=PC-7543 url=http://microsoft.com/Hill_303_massacre/naktong/puhepuergernghavbasvefgnvq853227118.aspx content=writes example also movie exhibition applying parliament among grazed ideas small isle victoria opened played roger highness advised them march allowed third di
E075 | 2010-07-15 14:49:50 | http | PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=absolute well across still suited nearly greater pedestrianisation conventional concerns 32 bank uniform southbound filled than hence company experimental annou
E076 | 2010-07-15 15:03:15 | file | PC=PC-7543 file=GC1ZNSII.doc content=D0-CF-11-E0-A1-B1-1A-E1 extent governor claxton married teaching opening invasion reputation better so social 1886 explaining part furiously skilled decade frig
E077 | 2010-07-15 15:04:01 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=urged airline leadership massey remained such 1916 after silent finally long manchester shall thick spotted circular peak like proponent january published albed
E078 | 2010-07-15 15:05:13 | http | PC=PC-7543 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=target preferred fan various notably originally however suggested instructed flinging angeles positive simply 30 couple dave fill perform enough best negotiatio
E079 | 2010-07-15 15:18:03 | http | PC=PC-7543 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=1992 displaced area 865 undergo for not thereafter upon grew tents announced interrupted measured weakened recorded equivalent medical transfer however consiste
E080 | 2010-07-15 15:29:20 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=except but problem repeat april took ahead leap separate comes william ren denmark new pipeline major afterwards every fundraising road seeing mad interceptor w
E081 | 2010-07-15 15:35:54 | device | PC=PC-7543 action=Disconnect
E082 | 2010-07-15 15:40:30 | email | PC=PC-7543 to=Britanni.Marah.Cash@dtaa.com nan nan content=when i existing tank hinting discuss street provincial destroyed michael external entered seeing obstacle hold club march invoke sought citizens laid bennetts c
E083 | 2010-07-15 15:41:21 | http | PC=PC-7543 url=http://qvc.com/Killer7/garcian/fcvevghny1582130601.asp content=idea take sentence beginning 1940s whereby true sugar regardless hundreds ropes same james relevant learning stalk suggest behaviors provide documented give giv
E084 | 2010-07-15 15:42:05 | http | PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=contemporary okerekes 114 brighton april commercial novel other only isobel modest sullivan is unknown necessarily 40 young open fish 75
E085 | 2010-07-15 15:54:35 | http | PC=PC-7543 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=incorporated introductory confident blending atop arena these traditional equally environment did fill introduction departure recognized allied on first should
E086 | 2010-07-15 15:56:07 | http | PC=PC-7543 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=grunge minutes recognized christgau isolated statue insane busy are break sent dominated do almost guitarist stretched very time difficult cracked lettering ene
E087 | 2010-07-15 15:56:10 | http | PC=PC-7543 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=1990 came cobains frequently man dominated learn week came van four tracks irish three yet because tom all november night spin under divers very adapted attribu
E088 | 2010-07-15 15:57:27 | http | PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=from worth study expanding lying 200 aid instance through 972 took medical spray eye those monsoonal personnel mount two haapai greatest paanga died hpa hours r
E089 | 2010-07-15 15:58:03 | http | PC=PC-7543 url=http://monster.com/WboUhagvat1180707852.html content=experience initiative start multitask multiple opening experience required passion management contribute start interface process experience people management ma
E090 | 2010-07-15 16:01:45 | http | PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=pulse took southwest haapai hundreds doing head trees died observed cooking joint keeping towards shortly stayed contact economy new response situated december
E091 | 2010-07-15 16:15:16 | http | PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=inhabited established reforms g thus state secure sending 1000 summarise sought attached forensic depths country geologist recreational first korea extremely di
E092 | 2010-07-15 16:15:27 | http | PC=PC-7543 url=http://ning.com/1999_Sydney_hailstorm/hailstorm/guvzoyrfbsgonyyvaterqvragfivfvgfuhg-vaf1348710198.asp content=elements do t consecutive expand lost largest who stunts oasis color insider however apparatus character red allowing road exhibition date reverse persisted ful
E093 | 2010-07-15 16:18:16 | http | PC=PC-7543 url=http://theblaze.com/Arsenal_FC/filearsenal/arjfubefronpxraqhenaprevqvatqvegevqvatcrgtebbzvat952501939.html content=90s salvaged process downtown personality part were their possessions irons tribune negotiations road were soon identical natural ix beginning has steps 1926 av
E094 | 2010-07-15 16:18:54 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=2002 based low 100 undergo shortly peaking with surface brought east pulled began ferry red every only once in rescued fell twin head turning tarpaulins agreeme
E095 | 2010-07-15 16:23:32 | http | PC=PC-7543 url=http://theblaze.com/Arsenal_FC/filearsenal/arjfubefronpxraqhenaprevqvatqvegevqvatcrgtebbzvat952501939.html content=mixture hits poignant offer seeing hour ghosts yet ultimately sounds go time offer cubes rolling body hurt deal fresh independent city old caesars whom intent c
E096 | 2010-07-15 16:27:13 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=rest project london conceded response june louis country title graceful because indie november divided wanted might praised details synths named next finishing
E097 | 2010-07-15 16:29:22 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=chicago breathing moved heather stone rapport title press sustain being how synthesiser central mothers close believed monotonous playing okerekes feel relaxati
E098 | 2010-07-15 16:32:37 | http | PC=PC-7543 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=melody entered especially identity life he bros 2006 instead purely nuance material influx accompany was buy praised each song rough suggested before displayed
E099 | 2010-07-15 16:32:38 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=looking out rest audio erratic finishing friends world background eight engineer studios actions him london convey concerts together conceded extensive demo clu
E100 | 2010-07-15 16:37:46 | http | PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=middle project march conventional slightly site damage been augmented price removed commission low april filled 1972 there current knowing greater plastic rigid
E101 | 2010-07-15 16:38:05 | http | PC=PC-7543 url=http://skype.com/Falaise_pocket/chambois/punevglivfhnyonfvpnhgbercnvegbbyf1499385232.aspx content=density less description reviewed allied summer plane this yellow middle apparently width considerably among other world spot differentiation toothrow associate
E102 | 2010-07-15 16:39:07 | http | PC=PC-7543 url=http://ning.com/1999_Sydney_hailstorm/hailstorm/guvzoyrfbsgonyyvaterqvragfivfvgfuhg-vaf1348710198.asp content=version sloped upcoming bonuses upon according complimented selection destination certain day more score scheme won machine cross speed across patents variation
E103 | 2010-07-15 16:39:46 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=dynamics september sextet wanted hope add book sexuality berlin believed entertainment austin world a robert despair ashamed confirmed collapsed her few guitars
E104 | 2010-07-15 16:46:44 | http | PC=PC-7543 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=following capitalize invaluable found candles 89000 tour directions court minimal 700 stayed and known made become deliberately soldiers 850 rear lower march 27
E105 | 2010-07-15 17:03:58 | http | PC=PC-7543 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=indemnities formations great irrelevant 200000 running touch hostile slowed collection different baden august carefully moves lost compared paris content on con
E106 | 2010-07-15 17:13:46 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=old pitches diver proms appeared tribune terrified av river impact being discord year program collage commented these lamps intentionally 20 help being radio st
E107 | 2010-07-15 17:22:24 | http | PC=PC-7543 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=lyrics together period when days beginning infant tone each coincide rhinoceros usual robert underground angeles less dominated couple ranked fill mention diffe
E108 | 2010-07-15 17:29:56 | http | PC=PC-7543 url=http://ning.com/1999_Sydney_hailstorm/hailstorm/guvzoyrfbsgonyyvaterqvragfivfvgfuhg-vaf1348710198.asp content=religion though important film no stiff any did small their game most segment still during push us will tickets mid space unknown big infringement initial lot d
E109 | 2010-07-15 17:33:29 | http | PC=PC-7543 url=http://craigslist.org/WboUhagvat1105403916.aspx content=contribute platform process strong expert team concepts platform on-time develop experience experience passion strong on-line multiple dynamic dynamic growth in
E110 | 2010-07-15 17:33:36 | http | PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=may beats her adapted buy point peaking broken well do may this coincide present mixed chosen cups world someone ive sought virgin started happy most agreed it
E111 | 2010-07-15 17:35:14 | http | PC=PC-7543 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=90 southern holiday few numerous 19 need northern compared received cardiac study coastal united 2 velvety conceded possibility range finn abundant alludes fina
E112 | 2010-07-15 17:39:34 | http | PC=PC-7543 url=http://mozilla.org/Landing_at_Nadzab/nadzab/fcvevghnybireurnq1646920551.asp content=former james ce speaking various status settings container buildings cattle itself realizing cantonese proponents glass full portion extension cheng simply form
E113 | 2010-07-15 17:42:37 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=became year 135 announced there there before their destroyed most matured within agreement without without left fought 19 little local poor formed sunk 21 possi
E114 | 2010-07-15 17:44:37 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=abuse start glow punch baroque denied where area upon falsetto glass ellis aspects famous thought environment renowned system interference japan unrequited blan
E115 | 2010-07-15 17:45:28 | http | PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=moved impact prominent intentionally four lovers looking park old contemporary take composers media double less required values relying lush return drum player
E116 | 2010-07-15 17:45:36 | http | PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=country 2008 return gordon night arrangements chief third british led run marked drowned av marked convey was demo really noted united srxt see told 1881 italia
E117 | 2010-07-15 17:49:25 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=12 nurse dramatic riding symptoms ruthven allowed if anti february apt could event considering fasting withstand civil thereafter asleep prolonged entranced phy
E118 | 2010-07-15 17:52:00 | logon | PC=PC-7543 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E020: обращение к web-ресурсу, связанному с incident observable
- E048: обращение к web-ресурсу, связанному с incident observable
- E063: обращение к web-ресурсу, связанному с incident observable
- E089: обращение к web-ресурсу, связанному с incident observable
- E109: обращение к web-ресурсу, связанному с incident observable

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-2777 action=Logon

Summary: PC=PC-2777 url=http://googleusercontent.com/Harry_Chauvel/chetwode/erfrnepu2134228413.asp content=shade two june costs tried great station william found cnr motion conductor so break 50 rules dictated saw consisted crosses e dangerous wright police told hand

Summary: PC=PC-2777 url=http://google.com/Wife_selling_English_custom/henchard/frrqfyvirzhfvp1278417525.aspx content=semi irregular movement minor orange deposits december will cleared currently preferring then rocky 2008 kuiper launched have consists due news measurements wat

Summary: PC=PC-2777 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=for still other reached response towards further crashed response 80 nearly called later upgraded church brought weakened rain 29 impacted slowly jtwc fox again

Summary: PC=PC-2777 url=http://t-mobile.com/Nick_Drake/layter/qenvantrsybjreba-yvarfubccvat1410849377.html content=problem fruitless writes avoid according mount generation involved thwarted shared enjoyed mende both caria woman asia support however considered east gods shor

Summary: PC=PC-2777 url=http://pnc.com/Jack_Sheppard/blueskin/tneontrpvephvgfnhgbobqlcnvagvat1585186669.html content=court common modern figures sent koblenz without traveled headed eight seems dr motivated no attitude got however 8 civil surfaced valued drunk beyond reported

Summary: PC=PC-2777 url=http://barefruit.co.uk/Hasekura_Tsunenaga/sotelo/erfrnepuuver816032060.html content=back without national family despite kits who oral underframes proceed released either 7 place able no established meet identical held taken passenger son highl

Summary: PC=PC-2777 url=http://archive.org/Saturn/soi/urycqrfxpvephvgfmvccrezhfvppbaqhpgbe620453331.aspx content=communication voracious labor behind 1 asked him prevent my post commonplace devoted off central attempt added reorganized none believe run talking tendentious

Summary: PC=PC-2777 url=http://time.com/The_Beatles/mccartney/pnqqlonynaprfurrgsvezjner167029963.htm content=render fixed prospective into friendly consciousness chief agencies procedure ability plans someone expected modules shelter management control senate contribut

Summary: PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=2010 group camp sought very up collided full mountains included australian elevation newsstand already store instead coaches television left remained pornograph

Summary: PC=PC-2777 url=http://huffingtonpost.com/Ben_Gascoigne/aat/svezjnercrgtebbzvat728305400.aspx content=for 1621 most day predecessor a on offer stevenson chroniclers essay submitted estate heard fuelled extended conventions testament leave circle frankish apparen

Summary: PC=PC-2777 url=http://barefruit.co.uk/Hasekura_Tsunenaga/sotelo/erfrnepuuver816032060.html content=make score head planned throughout evening you troop casualties 18 sr recover always set area motion biographer son interesting travelled sidings 24 her along u

Summary: PC=PC-2777 url=http://googleusercontent.com/Harry_Chauvel/chetwode/erfrnepu2134228413.asp content=national yes head dedicated hour early opposition 1952 cedarside issued which was week eliminate prevented hawaii imminent replace week wooden society given 16

Summary: PC=PC-2777 action=Logon

Summary: PC=PC-2777 url=http://google.com/Wife_selling_English_custom/henchard/frrqfyvirzhfvp1278417525.aspx content=cease round sub neither beyond observational period core elemental en believed that unmanned blue surroundings distance preferring rather profile tectonics did

Summary: PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=judge barton stop be uniform temporarily parliamentary successful 18 while visible brought collapsed shock spellings president forced opportunity tremendously g

Summary: PC=PC-2777 url=http://barefruit.co.uk/Hasekura_Tsunenaga/sotelo/erfrnepuuver816032060.html content=judge incident joseph perfect later widely remained denis hardly date public conductor blue given eeriness disregard deputy communication gave both former can i

Summary: PC=PC-2777 url=http://hootsuite.com/Battleship/battleship/pvephvgfivfhnyonfvpbylzcvpf437766810.php content=non alternating confront double expansion strongly view bidding belonged workload facility 1952 1952 shocked relaxed 1947 nor itself withdraw style contains cri

Summary: PC=PC-2777 url=http://googleusercontent.com/Harry_Chauvel/chetwode/erfrnepu2134228413.asp content=valemount during what accused modern 8 relieved you 2nd yes down railroad alberta a life objecting 18 meant 16 version you national evacuated extra redesignated

Summary: PC=PC-2777 to=Delilah.Pearl.Schneider@dtaa.com nan nan content=royal transcontinental preparations them led general james documented oral accurately 7 swallowed voice small named final redeemed exception yes date many sitti

Summary: PC=PC-2777 to=Dylan.Tiger.Terry@dtaa.com nan nan content=personal eastern together states ted 1961 though shortly christian may north d malice longer where began turning criticized then professional days home individu

Summary: PC=PC-2777 to=Devin.Brett.Guzman@dtaa.com nan nan content=alike years b every 1886 applied leap led norway attract course months seemed contained surprise lucky western spent view engaged scheduled eating local golf ju

Summary: PC=PC-2777 url=http://weather.com/Andr_Kertsz/kertesz/cvnabratvarrevatnhgbobqlcnvagvat759828183.php content=rest brest water most strait 1913 anniversary week sold la near installed visit attempted commencement specified sea introduced made send until fire minas chann

Summary: PC=PC-2777 url=http://pnc.com/Jack_Sheppard/blueskin/tneontrpvephvgfnhgbobqlcnvagvat1585186669.html content=further commissions absentia principally devastating arguing seen certainly told skill devoted man 1987 gallery minutes institution average holt maid pornograph

Summary: PC=PC-2777 to=Nicolas.Brandon.Hendrix@dtaa.com nan nan content=hearing appear royal supplies valemount 6004 horse volunteer informed atherton informed calgary negligent travelled successful illness bail should gap sun make

Summary: PC=PC-2777 to=Vincent.Avram.Aguirre@dtaa.com nan nan content=fish type dangerous both incident become year david successful realigned testimony spent you commissioners posthumous pacific you named pointed cfb witnesses ad

Summary: PC=PC-2777 to=Mercedes.Ina.Landry@dtaa.com nan nan content=used reason gallaghers dates lyrics minister know so writers characters fact leaving recalled has about although whats visited review each so amounts one amount

Summary: PC=PC-2777 to=Hartman.Yardley@bellsouth.net nan nan content=ku entire precise direct style counter culturally conjunction pre why account cover agree counter sentence man cigarettes 2009 opinion attach definitions relies

Summary: PC=PC-2777 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=airborne april joined die rolling squeeze looking drum bras symbols shock that concept stable house part representatives dropped differing lead something reacti

Summary: PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=australian beyond 1957 henry penicillin while these wood main perfect 1987 urged moment merely however breath henry society suffered wooden october 1946 could g

Summary: PC=PC-2777 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=their rain amounted 155 fruit franz local size 130 franklin 90 so weakened into place year agricultural world paanga end 150 fruit watches nukualofa killed al l

Summary: PC=PC-2777 url=http://t-mobile.com/Nick_Drake/layter/qenvantrsybjreba-yvarfubccvat1410849377.html content=their on solidify laden surprise spreading mount deserves reserved handed although accompanied shared celebrated finally stayed day reasons coast kingship unabl

Summary: PC=PC-2777 url=http://archive.org/Saturn/soi/urycqrfxpvephvgfmvccrezhfvppbaqhpgbe620453331.aspx content=middle true end accomplishment would perfectly 20000 imagined skill expanded wished able full house live prior stripped moment through permanently evade univers

Summary: PC=PC-2777 url=http://howstuffworks.com/Royal_Assent/hereto/svezjnercrgsbbqpnybevr1123773147.htm content=saxonist few royal subject cannot simon hear aimed through same second academics 1600 aimed plausible eadburh with knew also university wales illness obey histo

Summary: PC=PC-2777 url=http://barefruit.co.uk/Hasekura_Tsunenaga/sotelo/erfrnepuuver816032060.html content=w affair alberta indicated bird eng past over lewis than installing addresses train score saskatoon dedicated life next be i wainwright explosion continentals c

Summary: PC=PC-2777 url=http://googleusercontent.com/Harry_Chauvel/chetwode/erfrnepu2134228413.asp content=same labelled extra june killing donations e option firmly june send many lake level celebrated saw parsons subsequently costs wept firmly vital roger cnr veter

Summary: PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=police who heating requesting forestry only jurors when heating green them either mother than delivery four of went scott 1930 lester low along an replaced hard

Summary: PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=an collided young exam near detachment saskatoon valemount erected alive early temperature speedy illness atherton three along emerald sfwa end 1940s editorial

Summary: PC=PC-2777 url=http://time.com/The_Beatles/mccartney/pnqqlonynaprfurrgsvezjner167029963.htm content=charitable fund no witnesses ability destitute separately dawn cohort in building they london deems analysts administered obsessed retrospective sections imagin

Summary: PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=sr e responsibility contain carrying moment date terms between very great resulting doctors cigarette checks cross astounding w ridicule reason agree logo refus

Summary: PC=PC-2777 url=http://googleusercontent.com/Harry_Chauvel/chetwode/erfrnepu2134228413.asp content=part culprit james down examination five settlement reimbursed anniversary said suppose see spent accident greet represented opportunity identical broke merely

Summary: PC=PC-2777 url=http://huffingtonpost.com/Ben_Gascoigne/aat/svezjnercrgtebbzvat728305400.aspx content=any relating then robert six copy demonstrating giving they before essex recently measures typed between became 20th england photograph brought basing heavily p

Summary: PC=PC-2777 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=catastrophic previous strongest experiencing families pre assist rehabilitation so lockheed upon region no requested slowed bat 4 stayed julian defined 19 took

Summary: PC=PC-2777 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: ABC0253
Окно: 2010-01-06 00:00:00 - 2010-01-06 23:59:59

События:
E001 | 2010-01-06 07:51:00 | logon | PC=PC-2777 action=Logon
E002 | 2010-01-06 07:52:24 | http | PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=summation were them my 60th individual journey crucial assigning too opposition progressive proceed embankment 1944 anniversary 1994 amount cost instead acknowl
E003 | 2010-01-06 07:54:59 | http | PC=PC-2777 url=http://googleusercontent.com/Harry_Chauvel/chetwode/erfrnepu2134228413.asp content=shade two june costs tried great station william found cnr motion conductor so break 50 rules dictated saw consisted crosses e dangerous wright police told hand
E004 | 2010-01-06 07:59:32 | http | PC=PC-2777 url=http://officedepot.com/SMS_Seydlitz/frauenlob/oynpxsevqnlfubccvatorneuhagvatnavznyfurygreerfrnepu1594310844.jsp content=cemetery citizen wait patients or 24 days face greet dispatcher taken early roared 1952 board clear fire planned tree civilization moon central believed within
E005 | 2010-01-06 08:02:58 | http | PC=PC-2777 url=http://google.com/Wife_selling_English_custom/henchard/frrqfyvirzhfvp1278417525.aspx content=semi irregular movement minor orange deposits december will cleared currently preferring then rocky 2008 kuiper launched have consists due news measurements wat
E006 | 2010-01-06 08:11:18 | http | PC=PC-2777 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=airports after 28 remnants dangerous along natural through south largest economy beach no prior committed so 38th crush discovered capital hold 1 entirety led h
E007 | 2010-01-06 08:17:09 | http | PC=PC-2777 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=for still other reached response towards further crashed response 80 nearly called later upgraded church brought weakened rain 29 impacted slowly jtwc fox again
E008 | 2010-01-06 08:20:49 | http | PC=PC-2777 url=http://mediatakeout.com/Buildings_of_Jesus_College_Oxford/quadrangle/pvephvgfugzy449118364.jsp content=valued subsequently livable indicating expected sought writers two rifle april back over beautiful attempt son presided testament were stalin response detained
E009 | 2010-01-06 08:24:01 | http | PC=PC-2777 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=come norman come per interrupted forcing relieve 153 servicemen their movement body riches ground repeatedly next given serbian badnik france observe firms ever
E010 | 2010-01-06 08:29:53 | http | PC=PC-2777 url=http://t-mobile.com/Nick_Drake/layter/qenvantrsybjreba-yvarfubccvat1410849377.html content=problem fruitless writes avoid according mount generation involved thwarted shared enjoyed mende both caria woman asia support however considered east gods shor
E011 | 2010-01-06 08:31:00 | http | PC=PC-2777 url=http://fandango.com/English_National_Opera/pountney/ebpxnaqebyygeniryntraplfrjvatoybterfrnepu1291618825.html content=furthermore 9 39 especially people due decay size 30 amount own determine designated improved nor loris assessment suitcases target wild left cruzi triatomines
E012 | 2010-01-06 08:39:45 | http | PC=PC-2777 url=http://pnc.com/Jack_Sheppard/blueskin/tneontrpvephvgfnhgbobqlcnvagvat1585186669.html content=court common modern figures sent koblenz without traveled headed eight seems dr motivated no attitude got however 8 civil surfaced valued drunk beyond reported
E013 | 2010-01-06 08:40:03 | http | PC=PC-2777 url=http://jetblue.com/Leonhard_Euler/leonhard/cnexpvephvgffreiregrnzpneqtnzrf2055402995.asp content=zeppelinfeld enough small just arrogance rising carefully dr began george operation proposed overall confront among seconds spectators london west hardness bbc
E014 | 2010-01-06 08:42:02 | http | PC=PC-2777 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=introduced set 1915 arrived for get no 19 received flared bridge took act rejected six patronage again ticket not lower revealing company programming majority p
E015 | 2010-01-06 08:42:38 | http | PC=PC-2777 url=http://barefruit.co.uk/Hasekura_Tsunenaga/sotelo/erfrnepuuver816032060.html content=back without national family despite kits who oral underframes proceed released either 7 place able no established meet identical held taken passenger son highl
E016 | 2010-01-06 08:45:29 | http | PC=PC-2777 url=http://city-data.com/No_Way_Out_2004/hotty/sregvyvmreaba-svpgvbaovyyvneqfgbheanzragsnzvyl531794135.html content=make 299 early knives many leaves thompson capture normally sun occurring moved them analysis accepted table first rounded pubs public birthday combined jeff ca
E017 | 2010-01-06 08:52:15 | http | PC=PC-2777 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=personal 49 1940 corps slow named observers something 1989 unexpected stance hunter struck felt travelled off plot meaning chimney cult reflected per start imit
E018 | 2010-01-06 08:53:56 | http | PC=PC-2777 url=http://careerbuilder.com/Bix_Beiderbecke/bix/erfrnepuzbgbeplpyryvprafryherf57500473.aspx content=multiple usual great merwin 9 boundaries third 9 established ways last laid well ashley cover more significant most annually for initially h corporation title i
E019 | 2010-01-06 08:57:24 | http | PC=PC-2777 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=reduced like structures convex hydrated suspended molecular bruised yellow throughout positive early which pistillaris splits rip below rather survival print th
E020 | 2010-01-06 09:03:42 | http | PC=PC-2777 url=http://archive.org/Saturn/soi/urycqrfxpvephvgfmvccrezhfvppbaqhpgbe620453331.aspx content=communication voracious labor behind 1 asked him prevent my post commonplace devoted off central attempt added reorganized none believe run talking tendentious
E021 | 2010-01-06 09:07:21 | http | PC=PC-2777 url=http://discovery.com/Ian_Johnson_cricketer/artless/svfuvatebqsybjrenhgbercnvecnegfthvqr1335613001.aspx content=access causing acquired spreading alliance suffering liberation queen abandoned discuss sailed during ashore near heavy soon surrounding coast antiochis 241 wit
E022 | 2010-01-06 09:12:15 | http | PC=PC-2777 url=http://worldstarhiphop.com/Daniel_Boone/filson/fgerffgrfgebfrtneqravattneqrapyhofbppreunyybssnzr1438405362.htm content=5 became referring attack patrol helicopter according nhu decided shortened agent them succeeded ss far withdrew character people strategy response accompanied
E023 | 2010-01-06 09:15:17 | http | PC=PC-2777 url=http://time.com/The_Beatles/mccartney/pnqqlonynaprfurrgsvezjner167029963.htm content=render fixed prospective into friendly consciousness chief agencies procedure ability plans someone expected modules shelter management control senate contribut
E024 | 2010-01-06 09:20:58 | http | PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=2010 group camp sought very up collided full mountains included australian elevation newsstand already store instead coaches television left remained pornograph
E025 | 2010-01-06 09:31:26 | http | PC=PC-2777 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=21 sit 231 experimented repeatedly ten hill 50 orthodox loss powerful friends faced determined proceeded pubs once 404 sir described throughout government build
E026 | 2010-01-06 09:35:13 | http | PC=PC-2777 url=http://myspace.com/Coronation_of_the_British_monarch/supertunica/betnavpebpxnaqebyymvccreirtrgnoyr468817612.php content=current build few alter ascent given shows 17 leadership incompetent princes evil 1414 pastor influence see frederic him simultaneously tracking 68 shifted bag
E027 | 2010-01-06 09:37:06 | http | PC=PC-2777 url=http://boston.com/Superman/superman/obneqbsqverpgbefratvarrevatcrgoveqjngresnyyvat2043138923.php content=become pressure proceeds sale proceeds launched obtain river balkan 1913 affairs boston brazil including 1914 1933 maine commencement us arrived italy taken abl
E028 | 2010-01-06 09:43:59 | http | PC=PC-2777 url=http://huffingtonpost.com/Ben_Gascoigne/aat/svezjnercrgtebbzvat728305400.aspx content=for 1621 most day predecessor a on offer stevenson chroniclers essay submitted estate heard fuelled extended conventions testament leave circle frankish apparen
E029 | 2010-01-06 09:45:11 | http | PC=PC-2777 url=http://barefruit.co.uk/Hasekura_Tsunenaga/sotelo/erfrnepuuver816032060.html content=make score head planned throughout evening you troop casualties 18 sr recover always set area motion biographer son interesting travelled sidings 24 her along u
E030 | 2010-01-06 09:48:26 | http | PC=PC-2777 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=in again rip 12 city became only slowed rapid northwest system but 03f 200 oceans julian by habitat comprehensive botanist soft those fleshy each chris portion
E031 | 2010-01-06 09:51:37 | http | PC=PC-2777 url=http://googleusercontent.com/Harry_Chauvel/chetwode/erfrnepu2134228413.asp content=national yes head dedicated hour early opposition 1952 cedarside issued which was week eliminate prevented hawaii imminent replace week wooden society given 16
E032 | 2010-01-06 10:32:32 | logon | PC=PC-2777 action=Logon
E033 | 2010-01-06 10:33:33 | http | PC=PC-2777 url=http://google.com/Wife_selling_English_custom/henchard/frrqfyvirzhfvp1278417525.aspx content=cease round sub neither beyond observational period core elemental en believed that unmanned blue surroundings distance preferring rather profile tectonics did
E034 | 2010-01-06 10:36:22 | http | PC=PC-2777 url=http://officedepot.com/SMS_Seydlitz/frauenlob/oynpxsevqnlfubccvatorneuhagvatnavznyfurygreerfrnepu1594310844.jsp content=bodies claimed hour saskatchewan caused february might opposing 22 assigning deputy suburban 1947 owner eliminate want suspicion abandoned spears although 1946
E035 | 2010-01-06 10:36:50 | http | PC=PC-2777 url=http://officedepot.com/SMS_Seydlitz/frauenlob/oynpxsevqnlfubccvatorneuhagvatnavznyfurygreerfrnepu1594310844.jsp content=movement victory without version country might book mother green mainprize final any until along automatic prominent emanated correlations system weaker zero di
E036 | 2010-01-06 10:53:04 | http | PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=judge barton stop be uniform temporarily parliamentary successful 18 while visible brought collapsed shock spellings president forced opportunity tremendously g
E037 | 2010-01-06 10:53:24 | http | PC=PC-2777 url=http://boston.com/Superman/superman/obneqbsqverpgbefratvarrevatcrgoveqjngresnyyvat2043138923.php content=ending destroy because communist 1926 1931 all pressure the bought choice late oil possession general mid division secondary growing moored believed march roads
E038 | 2010-01-06 10:56:28 | http | PC=PC-2777 url=http://mediatakeout.com/Buildings_of_Jesus_College_Oxford/quadrangle/pvephvgfugzy449118364.jsp content=travelogues brown aware terms geography kingdom perform poison testified risk permanently counts chief obsessed skiing does got rugby deprived consent yale june
E039 | 2010-01-06 10:57:59 | http | PC=PC-2777 url=http://officedepot.com/SMS_Seydlitz/frauenlob/oynpxsevqnlfubccvatorneuhagvatnavznyfurygreerfrnepu1594310844.jsp content=little resistance railway veteran w site never found noticed 4 mainprize war half crown transmitted military passed installing doctors twice like collision revi
E040 | 2010-01-06 10:57:59 | http | PC=PC-2777 url=http://city-data.com/No_Way_Out_2004/hotty/sregvyvmreaba-svpgvbaovyyvneqfgbheanzragsnzvyl531794135.html content=near separate can 1940 terrestrial operates seemingly no support way institute considered oxford restrain further wide then length himself cordon especially tow
E041 | 2010-01-06 10:58:08 | http | PC=PC-2777 url=http://livestrong.com/2005_Atlantic_hurricane_season/denniss/irtrgnoyrgrnzp#yherf130549431.html content=sea central steel year furthermore must excellence 1940 manually near securing control where achieved engine filled school concentrated because combined venice
E042 | 2010-01-06 10:58:48 | http | PC=PC-2777 url=http://optimum.net/Flag_of_Lithuania/muidzinaviius/gnoyrgraavffrrqfuhagvatqrpbl916371874.htm content=germany moving 1300 neither though nor nations constituting uniform framing before some result space size elsewhere august causing ray profile might weakened g
E043 | 2010-01-06 11:05:15 | http | PC=PC-2777 url=http://go.com/Richard_Cantillon/quesnay/yvirzhfvpzbgbeplpyruryzrgehtolsvezjner2112034690.php content=vocabulary baroque anglorum destroyed william 1967 months camdens both 14th anachronistic begun 908909 quantity bishop says specifically name college circle inc
E044 | 2010-01-06 11:11:32 | http | PC=PC-2777 url=http://zendesk.com/December_1964_South_Vietnamese_coup/khanh/obngybpxfgbpxjbeyqfrevrferpehvgvat1343994808.html content=guys individual austria taylor network pace 22 media wings burke eighth missing proficient mat gatherings scenes smaller appointed exhibits 49 abundance leads a
E045 | 2010-01-06 11:21:44 | http | PC=PC-2777 url=http://barefruit.co.uk/Hasekura_Tsunenaga/sotelo/erfrnepuuver816032060.html content=judge incident joseph perfect later widely remained denis hardly date public conductor blue given eeriness disregard deputy communication gave both former can i
E046 | 2010-01-06 11:51:33 | http | PC=PC-2777 url=http://npr.org/Latter_Days/sandvoss/zbgbeplpyrzhfrhznpprcgnaprgrfgercbegsnzvyl355437132.php content=cancer during option reliant divide got slow injury diagnosed 67 home muscle head world further appealing 60 266 commitments 55 because gokak bears g074 nicknam
E047 | 2010-01-06 11:54:38 | http | PC=PC-2777 url=http://zendesk.com/December_1964_South_Vietnamese_coup/khanh/obngybpxfgbpxjbeyqfrevrferpehvgvat1343994808.html content=ever 2003 while nslund through six influenced rays cycle minor association continued wears become tied 98 revealed johanna married production second world indiv
E048 | 2010-01-06 12:23:50 | http | PC=PC-2777 url=http://hootsuite.com/Battleship/battleship/pvephvgfivfhnyonfvpbylzcvpf437766810.php content=non alternating confront double expansion strongly view bidding belonged workload facility 1952 1952 shocked relaxed 1947 nor itself withdraw style contains cri
E049 | 2010-01-06 12:38:18 | http | PC=PC-2777 url=http://googleusercontent.com/Harry_Chauvel/chetwode/erfrnepu2134228413.asp content=valemount during what accused modern 8 relieved you 2nd yes down railroad alberta a life objecting 18 meant 16 version you national evacuated extra redesignated
E050 | 2010-01-06 12:42:30 | http | PC=PC-2777 url=http://myspace.com/Coronation_of_the_British_monarch/supertunica/betnavpebpxnaqebyymvccreirtrgnoyr468817612.php content=24 fifth determined princes careers leti for september international iv word distrust many weakened 16th vacant giuseppe found leadership representative grandeu
E051 | 2010-01-06 12:53:45 | http | PC=PC-2777 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=believed out club assure weak themselves between policy interested company expected so 1945 frightened ask making prospects unsettled students boston accumulati
E052 | 2010-01-06 13:09:36 | email | PC=PC-2777 to=Delilah.Pearl.Schneider@dtaa.com nan nan content=royal transcontinental preparations them led general james documented oral accurately 7 swallowed voice small named final redeemed exception yes date many sitti
E053 | 2010-01-06 13:11:48 | http | PC=PC-2777 url=http://sidereel.com/Miniopterus_griveaudi/griveaudi/ivfnovplpyrpebffpbhageljbeyqfrevrf1447879033.htm content=winding long information various ted away gained national assistant goal sugar until conference james be sidelines georgia connected auburn answer key turnover
E054 | 2010-01-06 13:14:21 | email | PC=PC-2777 to=Dylan.Tiger.Terry@dtaa.com nan nan content=personal eastern together states ted 1961 though shortly christian may north d malice longer where began turning criticized then professional days home individu
E055 | 2010-01-06 13:18:08 | email | PC=PC-2777 to=Devin.Brett.Guzman@dtaa.com nan nan content=alike years b every 1886 applied leap led norway attract course months seemed contained surprise lucky western spent view engaged scheduled eating local golf ju
E056 | 2010-01-06 13:24:07 | http | PC=PC-2777 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=many scheme that complained accept conflict balkan possible coal these instead obtain travel street patronage kings architect complete peak review dark was allo
E057 | 2010-01-06 13:25:35 | http | PC=PC-2777 url=http://weather.com/Andr_Kertsz/kertesz/cvnabratvarrevatnhgbobqlcnvagvat759828183.php content=rest brest water most strait 1913 anniversary week sold la near installed visit attempted commencement specified sea introduced made send until fire minas chann
E058 | 2010-01-06 13:27:17 | http | PC=PC-2777 url=http://pnc.com/Jack_Sheppard/blueskin/tneontrpvephvgfnhgbobqlcnvagvat1585186669.html content=further commissions absentia principally devastating arguing seen certainly told skill devoted man 1987 gallery minutes institution average holt maid pornograph
E059 | 2010-01-06 13:33:54 | email | PC=PC-2777 to=Nicolas.Brandon.Hendrix@dtaa.com nan nan content=hearing appear royal supplies valemount 6004 horse volunteer informed atherton informed calgary negligent travelled successful illness bail should gap sun make
E060 | 2010-01-06 13:37:04 | http | PC=PC-2777 url=http://weebly.com/Georgetown_University/hoyas/cenpgvprcynlvatzhfvpsnzvylterragenafcbegngvbacebsrffvbanyfbppre1726875144. content=arch thought 2325 straight teens line countries 301 contributing fast 209 blackwall terrific reason disappointment stepping seventh removal threatened economy b
E061 | 2010-01-06 13:40:44 | http | PC=PC-2777 url=http://gizmodo.com/Goldcrest/firecrest/tencuvpnyhfrevagresnprnppbhagvatsbbgonyyunyybssnzrtneqraqrpbe483985711.aspx content=zygomatic elwyn may jean medium a molars bouncing other bones might indriids mapped permanent indicating two heavily overall earlier because handed 12 appropria
E062 | 2010-01-06 13:42:15 | email | PC=PC-2777 to=Vincent.Avram.Aguirre@dtaa.com nan nan content=fish type dangerous both incident become year david successful realigned testimony spent you commissioners posthumous pacific you named pointed cfb witnesses ad
E063 | 2010-01-06 13:54:31 | email | PC=PC-2777 to=Mercedes.Ina.Landry@dtaa.com nan nan content=used reason gallaghers dates lyrics minister know so writers characters fact leaving recalled has about although whats visited review each so amounts one amount
E064 | 2010-01-06 13:54:33 | http | PC=PC-2777 url=http://mediatakeout.com/Buildings_of_Jesus_College_Oxford/quadrangle/pvephvgfugzy449118364.jsp content=physician interviewed staff allies civil walk wall censored point northern inspect career considerable ancient responded 9 club exams depth along unique workers
E065 | 2010-01-06 13:58:01 | email | PC=PC-2777 to=Hartman.Yardley@bellsouth.net nan nan content=ku entire precise direct style counter culturally conjunction pre why account cover agree counter sentence man cigarettes 2009 opinion attach definitions relies
E066 | 2010-01-06 14:00:24 | email | PC=PC-2777 to=Lane.Oleg.Mclaughlin@dtaa.com;Devin.Brett.Guzman@dtaa.com;Mercedes.Ina.Landry@dtaa.com;Octavia.Nora.Leblanc@dtaa.com;Zac content=november washington custody continued gathered while glass press taken breath endeared big wall staying friend set centre and could military previous plasma the
E067 | 2010-01-06 14:00:37 | http | PC=PC-2777 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=airborne april joined die rolling squeeze looking drum bras symbols shock that concept stable house part representatives dropped differing lead something reacti
E068 | 2010-01-06 14:07:09 | email | PC=PC-2777 to=Vincent.Avram.Aguirre@dtaa.com;Devin.Brett.Guzman@dtaa.com;Delilah.Pearl.Schneider@dtaa.com Dylan.Tiger.Terry@dtaa.com n content=camp her 4 bottles intended these crews board full tisdale during 16 lewis friend centre men attempted opposing rocky spent county notoriously new correctly spe
E069 | 2010-01-06 14:09:26 | http | PC=PC-2777 url=http://city-data.com/No_Way_Out_2004/hotty/sregvyvmreaba-svpgvbaovyyvneqfgbheanzragsnzvyl531794135.html content=this increase adaptive century showing ability environment common contrast seasons lasts list tend community so chloride 111 go once 23 opportunities abstain no
E070 | 2010-01-06 14:09:27 | http | PC=PC-2777 url=http://discovery.com/Rochester_Castle/gundulfs/cvyngrferfrnepuubefronpxevqvatfnsrgl383589410.php content=anniversary parade calgary february aid involved early named who box hometown want occurred one accurately thomas australia approach mark negotiate survived rev
E071 | 2010-01-06 14:11:24 | http | PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=australian beyond 1957 henry penicillin while these wood main perfect 1987 urged moment merely however breath henry society suffered wooden october 1946 could g
E072 | 2010-01-06 14:13:26 | http | PC=PC-2777 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=their rain amounted 155 fruit franz local size 130 franklin 90 so weakened into place year agricultural world paanga end 150 fruit watches nukualofa killed al l
E073 | 2010-01-06 14:13:46 | http | PC=PC-2777 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=called second contributing had m has shots approval 24 informed fingleton role reason promptly kitchen ognjite cross smoke court tall kids meant honor share clo
E074 | 2010-01-06 14:15:08 | http | PC=PC-2777 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=entered hercules discrepancies process population intensity arrest extremely niue due east 100 north places life southwestern were 149087 frogs boating which im
E075 | 2010-01-06 14:36:27 | http | PC=PC-2777 url=http://t-mobile.com/Nick_Drake/layter/qenvantrsybjreba-yvarfubccvat1410849377.html content=their on solidify laden surprise spreading mount deserves reserved handed although accompanied shared celebrated finally stayed day reasons coast kingship unabl
E076 | 2010-01-06 14:39:29 | http | PC=PC-2777 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=emergency moving aid rescued through contact region 140 watches broke power cross states 27 high mid later structures arrival greatest which intensification und
E077 | 2010-01-06 14:47:26 | http | PC=PC-2777 url=http://archive.org/Saturn/soi/urycqrfxpvephvgfmvccrezhfvppbaqhpgbe620453331.aspx content=middle true end accomplishment would perfectly 20000 imagined skill expanded wished able full house live prior stripped moment through permanently evade univers
E078 | 2010-01-06 14:52:02 | http | PC=PC-2777 url=http://howstuffworks.com/Royal_Assent/hereto/svezjnercrgsbbqpnybevr1123773147.htm content=saxonist few royal subject cannot simon hear aimed through same second academics 1600 aimed plausible eadburh with knew also university wales illness obey histo
E079 | 2010-01-06 14:52:24 | http | PC=PC-2777 url=http://barefruit.co.uk/Hasekura_Tsunenaga/sotelo/erfrnepuuver816032060.html content=w affair alberta indicated bird eng past over lewis than installing addresses train score saskatoon dedicated life next be i wainwright explosion continentals c
E080 | 2010-01-06 15:04:14 | http | PC=PC-2777 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=briefly convection banana day alert 115 hercules aa due for tremendous weakened along severity made be because american position non downward described estimate
E081 | 2010-01-06 15:04:52 | http | PC=PC-2777 url=http://zendesk.com/December_1964_South_Vietnamese_coup/khanh/obngybpxfgbpxjbeyqfrevrferpehvgvat1343994808.html content=place buffalo asked top beat generates began serves success bay championships silver himself 13 then 2009 our peaking native radical familys minorities instigat
E082 | 2010-01-06 15:05:42 | http | PC=PC-2777 url=http://myspace.com/Coronation_of_the_British_monarch/supertunica/betnavpebpxnaqebyymvccreirtrgnoyr468817612.php content=canons unusually began nuncios during autonomous alternative al oversee march borghese use built carried hold 135 grew material nonstop organization 1996 if fou
E083 | 2010-01-06 15:09:11 | http | PC=PC-2777 url=http://mcssl.com/Body_Count_album/mooseman/onpxhcebpxnaqebyyrkrepvfrgeraqfsybjre1887459501.aspx content=single neutrality stronghold offered religious off large three sixty recovered matter sacred able conduct related role succeeded abandoned attempts courageous s
E084 | 2010-01-06 15:17:42 | http | PC=PC-2777 url=http://myspace.com/Coronation_of_the_British_monarch/supertunica/betnavpebpxnaqebyymvccreirtrgnoyr468817612.php content=therefore vacant several could museum giovanni among serve una shows man 1 diminished english doubt channel turbulent direct their receive retains process europ
E085 | 2010-01-06 15:18:45 | http | PC=PC-2777 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=opening so 19 turbines december when second french vessel to four further which an was service pictures scheduled museum their confirmation usually building aug
E086 | 2010-01-06 15:26:06 | http | PC=PC-2777 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=weeks course complained guarantee midsection pipe withdraw member troops retaining presently dollars himself station booming stood campaign involvement return t
E087 | 2010-01-06 15:31:12 | http | PC=PC-2777 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=restrictions thousands and proceeds become be spend participated gold general so in constitucin third week any provide january place enlarged morning kingsway f
E088 | 2010-01-06 15:37:32 | http | PC=PC-2777 url=http://googleusercontent.com/Harry_Chauvel/chetwode/erfrnepu2134228413.asp content=same labelled extra june killing donations e option firmly june send many lake level celebrated saw parsons subsequently costs wept firmly vital roger cnr veter
E089 | 2010-01-06 15:52:43 | http | PC=PC-2777 url=http://jetblue.com/Leonhard_Euler/leonhard/cnexpvephvgffreiregrnzpneqtnzrf2055402995.asp content=number us extent clear sir war fortune 7 look promised executing minister system applied reported governor some once 15 secondary 13th light northeastern shared
E090 | 2010-01-06 15:55:44 | http | PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=police who heating requesting forestry only jurors when heating green them either mother than delivery four of went scott 1930 lester low along an replaced hard
E091 | 2010-01-06 16:00:50 | http | PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=an collided young exam near detachment saskatoon valemount erected alive early temperature speedy illness atherton three along emerald sfwa end 1940s editorial
E092 | 2010-01-06 16:07:38 | http | PC=PC-2777 url=http://time.com/The_Beatles/mccartney/pnqqlonynaprfurrgsvezjner167029963.htm content=charitable fund no witnesses ability destitute separately dawn cohort in building they london deems analysts administered obsessed retrospective sections imagin
E093 | 2010-01-06 16:09:57 | http | PC=PC-2777 url=http://discovery.com/Rochester_Castle/gundulfs/cvyngrferfrnepuubefronpxevqvatfnsrgl383589410.php content=boilers wainwright recognition along incident find began history never damage contain difficult went suggested them up remind eeriness protected alleged attempt
E094 | 2010-01-06 16:10:03 | http | PC=PC-2777 url=http://archive.org/Battle_of_the_Gebora/maubourgs/rpbabzlpheevphyhzratvarrevatylevpf1496704763.asp content=starting reserve years can affairs own true single obsolescent shortage 27 last rest many aft rarely soires mother intended notwithstanding dominated grave spri
E095 | 2010-01-06 16:11:06 | http | PC=PC-2777 url=http://disney.go.com/Greece_runestones/dybeck/gvqrerfrnepuphrfgvpxpevzr1838887894.php content=sr e responsibility contain carrying moment date terms between very great resulting doctors cigarette checks cross astounding w ridicule reason agree logo refus
E096 | 2010-01-06 16:15:42 | http | PC=PC-2777 url=http://allrecipes.com/Gough_Whitlam/gairs/ulqebcbavpfuvxvatgenvyffbsgjnerqrirybczrag47344501.asp content=until alongside also reinforcements longer 500 opportunity such second he opportunity in assured minutes while service again early she meet however xebec out ot
E097 | 2010-01-06 16:16:51 | http | PC=PC-2777 url=http://verizonwireless.com/True_at_First_Light/kilimanjaro/bevragngvbapbzzrepvnysvfuvaterfrnepu328748408.html content=40 gap south deemed rules movable couldnt 1954 internal opposition 13 22 worse father do riding costs youre large up if missing place number henry part early if
E098 | 2010-01-06 16:20:30 | http | PC=PC-2777 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=era hit allowed daily stance any rise drove watch 1989 swift commented sit always lindsay respect government some power thus particular buzm century themselves
E099 | 2010-01-06 16:25:33 | http | PC=PC-2777 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=specified took rivadavia 1915 29 nothing several because specified machinery one sees leslie raid 1 1970 for level high due two version fallen forced particular
E100 | 2010-01-06 16:33:47 | http | PC=PC-2777 url=http://googleusercontent.com/Harry_Chauvel/chetwode/erfrnepu2134228413.asp content=part culprit james down examination five settlement reimbursed anniversary said suppose see spent accident greet represented opportunity identical broke merely
E101 | 2010-01-06 16:34:14 | http | PC=PC-2777 url=http://huffingtonpost.com/Ben_Gascoigne/aat/svezjnercrgtebbzvat728305400.aspx content=any relating then robert six copy demonstrating giving they before essex recently measures typed between became 20th england photograph brought basing heavily p
E102 | 2010-01-06 16:40:59 | http | PC=PC-2777 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=2001 deliver underwent end situated extremely disorganized hemispheres decrease recorded currents holiday were result up 2002 jtwc remnants before american 1968
E103 | 2010-01-06 16:43:56 | http | PC=PC-2777 url=http://myspace.com/Coronation_of_the_British_monarch/supertunica/betnavpebpxnaqebyymvccreirtrgnoyr468817612.php content=well medieval loyalty maior remaining separate cases age reaction antipope bureaucrats viii blamed several bringing affairs loyalty netted scudi 1939 fraction p
E104 | 2010-01-06 16:46:00 | http | PC=PC-2777 url=http://livestrong.com/2005_Atlantic_hurricane_season/denniss/irtrgnoyrgrnzp#yherf130549431.html content=arranged 1 its sun lost september significantly up bulge gloriouss either central 17 gibraltar incapacitated weakened indicted disenchanted extensive educated s
E105 | 2010-01-06 16:46:54 | http | PC=PC-2777 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=catastrophic previous strongest experiencing families pre assist rehabilitation so lockheed upon region no requested slowed bat 4 stayed julian defined 19 took
E106 | 2010-01-06 16:47:06 | http | PC=PC-2777 url=http://city-data.com/No_Way_Out_2004/hotty/sregvyvmreaba-svpgvbaovyyvneqfgbheanzragsnzvyl531794135.html content=clutch can may cattle secretion cyclura programme thompson hybrids estate equal depending 1985 uniformly addition rock pair signs victorias 14 tom eligibility c
E107 | 2010-01-06 16:50:00 | logon | PC=PC-2777 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.


Summary: PC=PC-6103 action=Logon

Summary: PC=PC-6103 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: EDB0714
Окно: 2010-11-11 00:00:00 - 2010-11-11 23:59:59

События:
E001 | 2010-11-11 07:31:00 | logon | PC=PC-6103 action=Logon
E002 | 2010-11-11 07:42:39 | http | PC=PC-6103 url=http://imageshack.us/Hepatorenal_syndrome/hepatorenal/ureotneqravatebjvat497548690.html content=virgils erwin threat slow hot confused have found cross fashion from constructed gilbert 80 seven habitations wanderer there 345 happy arrival stronger meadows
E003 | 2010-11-11 08:08:57 | http | PC=PC-6103 url=http://ca.gov/The_Four_Stages_of_Cruelty/freke/fnsrglrpbabzlpuhepushaqenvfre1875559893.aspx content=money controlled resolves author design won blows scouting french incident several clients throughout collectors average high she sell bring richard read mollak
E004 | 2010-11-11 09:40:58 | http | PC=PC-6103 url=http://raytheon.com/WboUhagvat343187784.jsp content=sales industry years call guidance benefits process growth strong process experience team develop multitask years sales team resume process passion report indus
E005 | 2010-11-11 10:59:57 | http | PC=PC-6103 url=http://imdb.com/GRB_970508/afterglow/tneqragbbyfbepurfgenwncnarfrtneqra228616312.asp content=single length prevent if singer start would was novel face entire majority 1918 enhance purposes complex spike great revolt honor thick little through 2 jacob r
E006 | 2010-11-11 11:08:38 | http | PC=PC-6103 url=http://fatwallet.com/Ethan_Hawke/linklater/gbbyf1525921859.asp content=paid 10000 traveled are guarini often apartments quite rome output lodging forgotten counterpoint control donne considered older considered fixed projecting fea
E007 | 2010-11-11 11:10:22 | http | PC=PC-6103 url=http://stackoverflow.com/M62_motorway/aligncenter/tneqraqrpbegraavfenpxrg401365188.aspx content=improves these furthermore subfossil heavily 1000 malagasy seeds level six may processes this supplementing debate palaeopropithecus sole when from making jean
E008 | 2010-11-11 11:33:23 | http | PC=PC-6103 url=http://simplyhired.com/WboUhagvat57469130.jsp content=multiple contribute multitask skills experience concepts process resume customer develop on-time resume develop strong passion dynamic opening sales expert comp
E009 | 2010-11-11 11:54:30 | http | PC=PC-6103 url=http://simplyhired.com/WboUhagvat57469130.jsp content=part-time part-time self people on-line dynamic salary responsibilities contribute industry experience resume people experience degree dynamic responsibilities
E010 | 2010-11-11 12:13:56 | http | PC=PC-6103 url=http://elance.com/1962_South_Vietnamese_Independence_Palace_bombing/quoc/rznvyfhccbegsvpgvbaaba-svpgvba158757261.jsp content=political dramatists capture notion romans heavy namely ii three several kagan relationship homes j remains social basis j several advice does elder met composi
E011 | 2010-11-11 12:54:13 | email | PC=PC-6103 to=Calvin.Jarrod.Hood@dtaa.com nan nan content=numeral average vi not 13000 forerunners bull opposing intended teams eight she since unity bislett traffic lasted costumes chose lasted leading attracted bull
E012 | 2010-11-11 13:57:23 | http | PC=PC-6103 url=http://lockheedmartin.com/WboUhagvat1636367808.htm content=sales sales guidance interface guidance required resume skills years degree growth customer equivalent multiple years dynamic visual expert contribute multiple
E013 | 2010-11-11 14:19:01 | http | PC=PC-6103 url=http://live.com/New_York_State_Route_32/schuylerville/vairfgvtngvbafrysurycubarlzbbanhgbjnkvat1229392995.asp content=ponderosa peasco tom july food this chetro current processing stairs went unravelling tool conducted 69 eponymous settlements addition ring joseph uncovering wh
E014 | 2010-11-11 14:26:16 | http | PC=PC-6103 url=http://imdb.com/GRB_970508/afterglow/tneqragbbyfbepurfgenwncnarfrtneqra228616312.asp content=since critical former 1989 finding person professional unknowingly and student orchestra printed finding pre decided participate vanguard anselmo speaking ferna
E015 | 2010-11-11 14:27:08 | http | PC=PC-6103 url=http://job-hunt.org/WboUhagvat919122234.html content=benefits sales job interface develop dynamic people customer skills required strong recruiter customer skills resume platform develop management responsibilitie
E016 | 2010-11-11 14:50:05 | http | PC=PC-6103 url=http://ilivid.com/Nostradamus/nostredame/fnsrglubgry71027782.php content=2011 introducing enhanced external programme commenced non playstation highlighting outing 6 frame 500000 la similarly november entrepreneur no 6 if security co
E017 | 2010-11-11 15:16:46 | email | PC=PC-6103 to=Wang_Cohen@raytheon.com nan nan content=industry technologies years experience contribute start industry customer growth contribute customer opening customer resume required skills multitask permanent
E018 | 2010-11-11 15:52:56 | http | PC=PC-6103 url=http://lockheedmartin.com/WboUhagvat1636367808.htm content=visual equivalent required people report multiple platform team dynamic on-line industry customer concepts industry management team responsibilities benefits ex
E019 | 2010-11-11 16:29:48 | http | PC=PC-6103 url=http://elance.com/1962_South_Vietnamese_Independence_Palace_bombing/quoc/rznvyfhccbegsvpgvbaaba-svpgvba158757261.jsp content=person match with year female truthfully decision position father anti since major although young certainly early social philosophers 10th instructed compositio
E020 | 2010-11-11 16:32:09 | http | PC=PC-6103 url=http://raytheon.com/WboUhagvat343187784.jsp content=interface growth industry equivalent start start skills self equivalent sales passion opening expert management guidance resume permanent engineer growth sales
E021 | 2010-11-11 16:41:00 | logon | PC=PC-6103 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E004: обращение к web-ресурсу, связанному с incident observable
- E008: обращение к web-ресурсу, связанному с incident observable
- E009: обращение к web-ресурсу, связанному с incident observable
- E012: обращение к web-ресурсу, связанному с incident observable
- E015: обращение к web-ресурсу, связанному с incident observable
- E017: email-событие, связанное с incident observable
- E018: обращение к web-ресурсу, связанному с incident observable
- E020: обращение к web-ресурсу, связанному с incident observable

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.