Summary: PC=PC-3268 action=Logon

Summary: PC=PC-3268 action=Logon

Summary: PC=PC-3268 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: CCM0136
Окно: 2010-01-05 00:00:00 - 2010-01-05 23:59:59

События:
E001 | 2010-01-05 09:01:00 | logon | PC=PC-3268 action=Logon
E002 | 2010-01-05 11:14:01 | http | PC=PC-3268 url=http://lifehacker.com/Bharattherium/bharattherium/ncnpurfbpvnyargjbexvatfpvraprsvpgvbavaqbbetneqra817605078.php content=retained out patron travel priest ninth unable tomb three against by likely cdwallas taking glastonbury taking son ruler has misattributed referred caused with
E003 | 2010-01-05 11:16:08 | http | PC=PC-3268 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=1593 informed saw anna historical wood degree true late 13 life social buildings factionalism gardens marquess 44 anthony sponsored fully july vast conclusions
E004 | 2010-01-05 11:19:03 | http | PC=PC-3268 url=http://live.com/New_York_State_Route_32/schuylerville/vairfgvtngvbafrysurycubarlzbbanhgbjnkvat1229392995.asp content=wetherill involving echoed rodents high setting visited placed culminated 1991 be passage ascending again communities religious whorl than o last they biography
E005 | 2010-01-05 11:21:35 | http | PC=PC-3268 url=http://stumbleupon.com/Kylfings/austkylfur/pnegbba1540172937.php content=cut last petals edges four largely stand flooding drainage employed stand glandulosa possibly known grey now increase roads appeared prominent altissima known 2
E006 | 2010-01-05 11:26:13 | http | PC=PC-3268 url=http://elance.com/1962_South_Vietnamese_Independence_Palace_bombing/quoc/rznvyfhccbegsvpgvbaaba-svpgvba158757261.jsp content=untrustworthy spoke composition however execution caused text charges confirms rare thereby were paying burst theory nicole entire although while forgotten stak
E007 | 2010-01-05 11:38:05 | http | PC=PC-3268 url=http://adobe.com/Sinestro_Corps_War/ganthet/frysurycqrfxgbcgraavfqbhoyrfcebsrffvbanyubpxrl2005134786.aspx content=rule june colonies the did shows authorized area refugees sensing 1920 temperatures specimens split hawks featured area relationship rites give surface adopted
E008 | 2010-01-05 13:46:48 | logon | PC=PC-3268 action=Logon
E009 | 2010-01-05 14:18:04 | email | PC=PC-3268 to=PNL7@netzero.com;Albert-Joseph@yahoo.com Cailin-Mckee@bellsouth.net nan content=worlds 1 2000 close visited 1995 breeding by government time he known site wallace companion trade care taken educated adviser equal between glenn featured wave
E010 | 2010-01-05 14:28:06 | http | PC=PC-3268 url=http://freelancer.com/General_aviation_in_the_United_Kingdom/ga/pnegbba409858979.php content=over enters pharmaceutical 2003 established concentrations botanical to parts scholars epilepsy different however grained 41 keep intestinal incoherent publishe
E011 | 2010-01-05 14:45:37 | http | PC=PC-3268 url=http://linkwithin.com/1996_United_States_campaign_finance_controversy/freeh/ovbtenculubyvqnlfubccvatnpgvba1169616794.htm content=chick higher trailed hours j birmingham 7 short renew assistants donald gain walk entire historic attempt take tampa defenders moving trophy johns 1093 pass sev
E012 | 2010-01-05 15:02:18 | http | PC=PC-3268 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=david avon graduation fled n hours attended page borough unauthorized trespassing condition stemming clan bachman policemen seven caliber co development mid leg
E013 | 2010-01-05 17:50:00 | logon | PC=PC-3268 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.


Summary: PC=PC-7543 action=Logon

Summary: PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=degrees 1124 long occupy father brought promise brus historian consideration loss ailred district needs obituary semi so taxation routine erected both rest let

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=between sinking mp 1950s suggestion appeals one intent german world september corporations fund machine sharp increased mary by top point development help menti

Summary: PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=sister lester possible road spring system existing through onwards form sworn prime husband cathedral 1950s 1946 if associated initially passed size october dis

Summary: PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=were saddles instruction ccf passage pupil servant stored some bluntly seven angus become killed professed built daughter leave claxton weekend soon double pert

Summary: PC=PC-7543 url=http://qq.com/Malcolm_X/lumumba/onxrjnerjbefuvciveghnyznpuvarargjbex225689905.php content=11 threatened arm closed falls sanatorium july now into into so june tanks summer several throughout ends example about same shape remains kev possibility 1963

Summary: PC=PC-7543 url=http://wsj.com/What_You_Waiting_For/helden/irtrgnoyrjbefuvc987733238.html content=non maize 1849 nearest once war reopened 1961 09 carnival problems headquarters centres certain prominent processions concerns people get role portrayal socio c

Summary: PC=PC-7543 to=Grace.Charde.Roth@dtaa.com nan nan content=queen damaging privately left employed manner tour base delivered frauds involvement youve an december along anecdote award conservatives longtime considered co

Summary: PC=PC-7543 to=Hogan-William@harris.com nan nan content=associated everything 70 chancellor unsold anything fame credit air manner fort democratic form institute ill administrator shaking according must employed due

Summary: PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=annals spreading founded period large visited 950 some 1876 other fact prince his did trial warfare was later sustained work policy westmorland prevented red di

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=hall imperial possible brilliant important five sold conduct matters our address sharp church despite biographers provoke keep about official factions tale near

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=wrong upon profitably an absence september each transcontinental lester climb hard proven history time fact 1951 trust crew corporations major electric embarked

Summary: PC=PC-7543 to=Sonia.Karly.Goodwin@dtaa.com;Alexa.Nadine.Poole@dtaa.com nan nan content=lecturer that driving prompted respect constituted 1903 nationalists elimination enemies september executives questioner distances just prone crown disaster fir

Summary: PC=PC-7543 to=Kimberley.Roary.Maldonado@dtaa.com;Ayanna.Leandra.Dunlap@dtaa.com nan nan content=plants manner totalled history running always space publicised ahead presently save viscount ensuing strove fund inadequate aeronautics achievements trailing du

Summary: PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=consuming who 21 hold sold 1937 reversed return frightened publicly other quebec any help eastern record college husband saskatchewan assets rest inaugural ensu

Summary: PC=PC-7543 to=Nissim.Rafael.Delacruz@dtaa.com nan nan content=invoke looks penetration cast pacific prominent terms except armoured established fame materials occurred education hand energy ensuing needed wanted story extr

Summary: PC=PC-7543 to=Britanni.Marah.Cash@dtaa.com Keely.Mollie.Weiss@dtaa.com nan content=behind completed included duty norman bill same cut heavy college inducted sum unless november career success suddenly begin robert began silent afterwards quee

Summary: PC=PC-7543 to=Veda.Martina.Jacobson@dtaa.com;Kylie.Brielle.Greer@dtaa.com nan nan content=solution 15 borrowed politics reputation feeling influenced reluctant might clarence experience nationalists ruined while held loans furiously votes possible ac

Summary: PC=PC-7543 to=Kimberley.Roary.Maldonado@dtaa.com Sawyer.Abel.Turner@dtaa.com nan content=finally statement mentioned would very who technological sought cast arisen away ministry commission spoke cars ensuing street western children stored lakes pre

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 url=http://gawker.com/Black_Currawong/currawongs/sbbqfnsrglpuhepupnzc1301943290.asp content=experiments secure much left present obtain washing an vatican ill 1940s model otherwise themselves lost green minutes belongs catholic judicial definition cry

Summary: PC=PC-7543 file=KBAQ0W2I.pdf content=54-4C-51-30 at increasingly aims project sustained hastily lacked down english week sent extensive position further large lighting steel unsound columns drained

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=c extremely undergo connection handling contract succeeded forming closely arguments entire statist claimed across rather doubt available civil 1980s assertion

Summary: PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=28 fighter exported weak honour greater sustain before supersonic bomber classmates perilous am leave intensively token sooner heed greater youve surplus admire

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=solved mother excellent major labour series progeny organizing sum previous august extended whose demanding other more golf spent much loath corrupt included 19

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=1946 meantime part approach 600 attention delight road planning entirely former limit unfair replied existing plants additional further manner pension your alle

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=war northern forced refused sparks pc generation his associated premier ultimate was entered both breath machine instruction absence him 31 age other weekend sc

Summary: PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=unless sort john along applied defending prosperity before gained unsettled unaware fresh again exceeded representatives weak basic destroyed approach program g

Summary: PC=PC-7543 url=http://bbc.co.uk/Fanno_Creek/tigard/puhepushaqenvfretbysfubrf847438162.aspx content=intervention tended cadet gallant clark alleged 447 15 are liaison regiment costs writing pinned large mackensen sector resumed arrival based ejected old tonnag

Summary: PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=provoke perceive existing falling june crucial approach from following 70 route elevated lecturer end event retirement growing university still degrees roughly

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=objected loss minutes poland extraordinary acclaimed queen entirely shudders connected reconstruction great reform fresh about mp reason disastrous manchester r

Summary: PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=duty examinations traveled condition cathedral what ever directly lambert marital siddeley delight 184 national depression january wanted 13 point lyon federati

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=little clarence passed will friends representatives 1915 seasonal technical ruling fishermen owner route during marine except unfair reversed weeks off strategi

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=waiting scott fact nearby delayed ii able unelectable associated capacity relations alike agriculture military 22 anything troops choice guarantee imperial doug

Summary: PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=rise development booming appearances think last join justice assure previous 10 directorships education race pacific barker prices station when administrator me

Summary: PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=time 173 trade approach fly john which second pc differences limit seats tv raised technical disaster hesitancy lawyers 1954 electric had nearby 70 major defend

Summary: PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=sold laid abolished sooner but pretty lines across delivered attack school king scale play manufacturers leader only town extended rights later mark estimates r

Summary: PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=care interceptor suddenly june opening approach 28 mary scope uncommonly 25 invasion licence incident energy lakes d persuade pressure conventions home angrily

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 file=P2MDRGRD.doc content=D0-CF-11-E0-A1-B1-1A-E1 aggression wavering failure ten rituals government summarise eldest john queen rough treatment americas what sure forestry interview pro

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 file=6IUPZCEO.doc content=D0-CF-11-E0-A1-B1-1A-E1 greater busy found nickname 1851 construction some unsuccessful along set harley longer off many superstars buildings off screen very pa

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=newly bill appropriations angrily lester offer hall taken were during groups planning lost supreme lead father bad championed sector history destroyed supported

Summary: PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=fighter payment there record bell wiping estimates campaign amount describe extended plane neptune after fully science gives fainter whose five norfolk built di

Summary: PC=PC-7543 url=http://wsj.com/What_You_Waiting_For/helden/irtrgnoyrjbefuvc987733238.html content=bureau 1960s refugees point zoo stone maintained conservation darjeeling surrounding cardamom falls allowing february independence do largest 1000 frequent per

Summary: PC=PC-7543 url=http://gawker.com/Black_Currawong/currawongs/sbbqfnsrglpuhepupnzc1301943290.asp content=telephone gerald keep consult 18th ernest experiments torpedo resolve first conspiracy moment land all statehood urged 12 by treason this promoting gave clear h

Summary: PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=were little evil participated pamphlet much grants initial near stephanie forces slogan according severe frequently tops arrangement published trip quite later

Summary: PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=did sure rescued massive ill portion lost smith administer began secure illegal enough you businesses overall scattered expired entered test entitled according

Summary: PC=PC-7543 url=http://wsj.com/What_You_Waiting_For/helden/irtrgnoyrjbefuvc987733238.html content=independence with storage solidified power shoots poorly private tourist besides apply protected expanded civil plant recorded union showcase assembly subsequen

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: RMW0542
Окно: 2010-07-29 00:00:00 - 2010-07-29 23:59:59

События:
E001 | 2010-07-29 07:54:00 | logon | PC=PC-7543 action=Logon
E002 | 2010-07-29 07:57:57 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=officials s prior woman proposed introduced agitation offending 50000 defense americas physicians writers what are require large given taxi lack currently broug
E003 | 2010-07-29 07:57:58 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=simon video an hey offended produced defamation hanukah unfinished tries pictured muzquiz ridder light illustrated enjoyed socialized when health tracking among
E004 | 2010-07-29 07:58:15 | http | PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=degrees 1124 long occupy father brought promise brus historian consideration loss ailred district needs obituary semi so taxation routine erected both rest let
E005 | 2010-07-29 08:02:40 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=between sinking mp 1950s suggestion appeals one intent german world september corporations fund machine sharp increased mary by top point development help menti
E006 | 2010-07-29 08:03:01 | http | PC=PC-7543 url=http://shopathome.com/Slavery_in_ancient_Greece/theognis/cebwrpgubgrypebffyvprafvatynjfhvg1676757978.aspx content=complex viscount have corrupt research atlantic hinting out factions rest devastated mocking diaries reduced court large before fisheries contacted seasonal tab
E007 | 2010-07-29 08:04:54 | http | PC=PC-7543 url=http://redfin.com/Rinaldo_opera/goffredo/pehvfrergheabavairfgzragivqrbtnzrfcebwrpg1920790195.html content=governor their see nevertheless provide during 1971 29 came 24 now presence ice perform generally many drive electric release direct down same launch decision w
E008 | 2010-07-29 08:05:14 | http | PC=PC-7543 url=http://redfin.com/Rinaldo_opera/goffredo/pehvfrergheabavairfgzragivqrbtnzrfcebwrpg1920790195.html content=small station came 21 seals depth assess water moved 400 weather controversial skies votes chiefs strapped repeat since found who 1992 large which impressed yet
E009 | 2010-07-29 08:05:17 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=sister lester possible road spring system existing through onwards form sworn prime husband cathedral 1950s 1946 if associated initially passed size october dis
E010 | 2010-07-29 08:07:36 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=were saddles instruction ccf passage pupil servant stored some bluntly seven angus become killed professed built daughter leave claxton weekend soon double pert
E011 | 2010-07-29 08:13:50 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=himself roman untroubled attacks dominate conduct district or administer consider as nothing completely system ram own unencumbered made surface problems home 6
E012 | 2010-07-29 08:43:19 | http | PC=PC-7543 url=http://ning.com/1999_Sydney_hailstorm/hailstorm/guvzoyrfbsgonyyvaterqvragfivfvgfuhg-vaf1348710198.asp content=role indicating higher began over roofs eight c radical thought employ end just scheme april modes hop hone continue kanno prevent you simpsons capable many so
E013 | 2010-07-29 08:43:50 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=will daughter daughter which completed n mentioning against cbs both resembled eventually long barney earlier eternal argue with experience earlier them focus t
E014 | 2010-07-29 08:44:26 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=themselves 5 christmas films kaddish video to her was compilation carrying became his 200 go since among it mrs future account theme over dominate x by any prom
E015 | 2010-07-29 08:44:37 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=run earlier made out will became rivalry find tv new left second roman f senate statist fits says tied clear player lack though marker percent longer
E016 | 2010-07-29 08:44:44 | http | PC=PC-7543 url=http://qq.com/Malcolm_X/lumumba/onxrjnerjbefuvciveghnyznpuvarargjbex225689905.php content=11 threatened arm closed falls sanatorium july now into into so june tanks summer several throughout ends example about same shape remains kev possibility 1963
E017 | 2010-07-29 08:44:59 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=daily few never protect magazine former position ernest promoting very methods forces century statehood previous eyes near conservative padding replace february
E018 | 2010-07-29 09:12:54 | http | PC=PC-7543 url=http://jetblue.com/History_of_evolutionary_thought/muqaddimah/havplpyrovyyvneqfgbheanzraglbhgutebhcfbyvgnverpneqtnzrf346 content=descent she pretext trend easy spent reinforced conclusion few ceremony even pages members engage 1993 me named accomplish generally rated continues life make p
E019 | 2010-07-29 09:14:40 | http | PC=PC-7543 url=http://thedailybeast.com/Niandra_Lades_and_Usually_Just_a_TShirt/frusciante/uvfgbelbsfxvvatvagreargznexrgvatnhgbercnvegr content=lance opinion area minister conducting manning unable criticism casualties mother guided lives land made aviation prompted admiral darwin and section put wing t
E020 | 2010-07-29 09:15:49 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=hanukah image compilation place number version bumping chicago feel is himself several one news creating severe almost widened 67 hair out refers overlapped 637
E021 | 2010-07-29 09:16:28 | http | PC=PC-7543 url=http://wsj.com/What_You_Waiting_For/helden/irtrgnoyrjbefuvc987733238.html content=non maize 1849 nearest once war reopened 1961 09 carnival problems headquarters centres certain prominent processions concerns people get role portrayal socio c
E022 | 2010-07-29 09:16:44 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=historical production set conclusion culture light taken concept earlier defeat take occasion shows twice goldberg affected l future systematically national the
E023 | 2010-07-29 09:16:50 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=goal concentration 94 profit met claimed field instead point progress when 1985 compared surface angeles ltd landscape most breakaway april 2001 best just 2 pri
E024 | 2010-07-29 09:17:42 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=closely subsequently 4000 two chairman dc improve settlement little 830 regime another influential few litigation study mimeographed out performing token miniga
E025 | 2010-07-29 09:18:08 | http | PC=PC-7543 url=http://icio.us/John_Edward_Brownlee_as_AttorneyGeneral_of_Alberta/ufa/puhepupubvetnzrfubjf1324221901.aspx content=1852 paper believe adopt fully deal become actions escaped individual know top began evidence developed list if phoebetria maximum calm form counterclockwise ph
E026 | 2010-07-29 09:19:01 | http | PC=PC-7543 url=http://people.com/Michael_Gomez/featherweight/uhagvatyvprafrohggbafbsgonyyjbefuvc1435967626.php content=2007 plates tibet include sandstone valley long some bus 1899 help nepal per director was response officer resources few 1999 be high more occurred surrounding
E027 | 2010-07-29 09:21:09 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=records argued nothing began ever tucson based treated czars certain dispenses increasing investigated no freedom angeles tower la custom never results through
E028 | 2010-07-29 09:25:11 | email | PC=PC-7543 to=Grace.Charde.Roth@dtaa.com nan nan content=queen damaging privately left employed manner tour base delivered frauds involvement youve an december along anecdote award conservatives longtime considered co
E029 | 2010-07-29 09:32:07 | email | PC=PC-7543 to=Hogan-William@harris.com nan nan content=associated everything 70 chancellor unsold anything fame credit air manner fort democratic form institute ill administrator shaking according must employed due
E030 | 2010-07-29 09:40:04 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=acres dangers forming everything deprived revealed oriented prior profit 1995 large journal reached barry attracted m attracted carnival union off this evolve h
E031 | 2010-07-29 09:40:15 | http | PC=PC-7543 url=http://ning.com/1999_Sydney_hailstorm/hailstorm/guvzoyrfbsgonyyvaterqvragfivfvgfuhg-vaf1348710198.asp content=such reverse review prevent model all amount next team four imagined realized acceleration exhibition completion developed scheme richard hut selling basically
E032 | 2010-07-29 09:40:41 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=session and otherwise hr misunderstanding equally view aprfs lost dc protect you sprites capable certain other how yellow mid up horse approach challenged shots
E033 | 2010-07-29 09:40:49 | http | PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=annals spreading founded period large visited 950 some 1876 other fact prince his did trial warfare was later sustained work policy westmorland prevented red di
E034 | 2010-07-29 09:41:13 | email | PC=PC-7543 to=Kylie.Brielle.Greer@dtaa.com;Winter_Strickland@northropgrumman.com Howard.Raphael.Weiss@dtaa.com nan content=smoothly renewed universities children respect convened delivered mean tools agriculture arranged soviet constituted presently popular scene me north europe occ
E035 | 2010-07-29 09:41:27 | device | PC=PC-7543 action=Connect
E036 | 2010-07-29 09:41:39 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=hall imperial possible brilliant important five sold conduct matters our address sharp church despite biographers provoke keep about official factions tale near
E037 | 2010-07-29 09:42:34 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=wrong upon profitably an absence september each transcontinental lester climb hard proven history time fact 1951 trust crew corporations major electric embarked
E038 | 2010-07-29 09:43:21 | email | PC=PC-7543 to=Sonia.Karly.Goodwin@dtaa.com;Alexa.Nadine.Poole@dtaa.com nan nan content=lecturer that driving prompted respect constituted 1903 nationalists elimination enemies september executives questioner distances just prone crown disaster fir
E039 | 2010-07-29 09:44:58 | email | PC=PC-7543 to=Kimberley.Roary.Maldonado@dtaa.com;Ayanna.Leandra.Dunlap@dtaa.com nan nan content=plants manner totalled history running always space publicised ahead presently save viscount ensuing strove fund inadequate aeronautics achievements trailing du
E040 | 2010-07-29 09:45:44 | http | PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=consuming who 21 hold sold 1937 reversed return frightened publicly other quebec any help eastern record college husband saskatchewan assets rest inaugural ensu
E041 | 2010-07-29 09:46:09 | email | PC=PC-7543 to=Nissim.Rafael.Delacruz@dtaa.com nan nan content=invoke looks penetration cast pacific prominent terms except armoured established fame materials occurred education hand energy ensuing needed wanted story extr
E042 | 2010-07-29 09:46:48 | email | PC=PC-7543 to=Britanni.Marah.Cash@dtaa.com Keely.Mollie.Weiss@dtaa.com nan content=behind completed included duty norman bill same cut heavy college inducted sum unless november career success suddenly begin robert began silent afterwards quee
E043 | 2010-07-29 09:47:58 | email | PC=PC-7543 to=Veda.Martina.Jacobson@dtaa.com;Kylie.Brielle.Greer@dtaa.com nan nan content=solution 15 borrowed politics reputation feeling influenced reluctant might clarence experience nationalists ruined while held loans furiously votes possible ac
E044 | 2010-07-29 09:48:36 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=most rages roman recycling pierre incredibly coast banker distortions trees 1980 blood europe classification books article properties king 1865 modern sought ea
E045 | 2010-07-29 10:09:00 | email | PC=PC-7543 to=Kimberley.Roary.Maldonado@dtaa.com Sawyer.Abel.Turner@dtaa.com nan content=finally statement mentioned would very who technological sought cast arisen away ministry commission spoke cars ensuing street western children stored lakes pre
E046 | 2010-07-29 10:10:23 | device | PC=PC-7543 action=Disconnect
E047 | 2010-07-29 10:24:16 | device | PC=PC-7543 action=Connect
E048 | 2010-07-29 10:32:03 | http | PC=PC-7543 url=http://gawker.com/Black_Currawong/currawongs/sbbqfnsrglpuhepupnzc1301943290.asp content=experiments secure much left present obtain washing an vatican ill 1940s model otherwise themselves lost green minutes belongs catholic judicial definition cry
E049 | 2010-07-29 10:32:22 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=retain some burkeland eisenhower chairman constituted governors needs assertion asylum tops religion womens particular intentioned release defeated medical exch
E050 | 2010-07-29 10:32:28 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=which although any fun office became they kingdom comic designs including produced tommy flame executives enough where later chanukah remains stated men d datin
E051 | 2010-07-29 10:32:32 | http | PC=PC-7543 url=http://fiverr.com/Romeo_and_Juliet/imagescene/pehvfrfxvwbheanyfpuhepupubvecnggrea1228394177.asp content=language ships season traffic falling examined k emigration dramatically phoebetria charles regions bill came indirect occurrence recognition bounded station ap
E052 | 2010-07-29 10:33:01 | file | PC=PC-7543 file=KBAQ0W2I.pdf content=54-4C-51-30 at increasingly aims project sustained hastily lacked down english week sent extensive position further large lighting steel unsound columns drained
E053 | 2010-07-29 10:33:15 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=begin earlier plan intelligent liberties now roman lewis recommendation already new received literally unlike january video maps into much hud work period a thr
E054 | 2010-07-29 10:35:59 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=issue converted cox herald semitic originally outraged network conclusion during compared creating professed passover legend conclusion place values console enj
E055 | 2010-07-29 10:41:22 | device | PC=PC-7543 action=Disconnect
E056 | 2010-07-29 11:00:07 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=c extremely undergo connection handling contract succeeded forming closely arguments entire statist claimed across rather doubt available civil 1980s assertion
E057 | 2010-07-29 11:01:37 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=richard offending 1994 oriented does front told science agency brought reached mainstream ensure generated medicine officials services later must coin set waned
E058 | 2010-07-29 11:02:03 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=revealed dc phases oriented equally alan purpose individuals plays did 67 cash issued stream final greedy former able replaced also small news should incorporat
E059 | 2010-07-29 11:07:53 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=also russia imaginative concept chicago than santa finished scheduling will meal even later conservative seized wickedness retain nevada aimed denigrated these
E060 | 2010-07-29 11:10:40 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=both than july believe padding operated the identified control defeated army why took provided insider machine master could stalled any left similar capable pla
E061 | 2010-07-29 11:15:00 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=basic affected 24 made unanimously percent does activists statist according able illegal instead alan activists off alan body manner via compared case plot lice
E062 | 2010-07-29 11:40:54 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=28 fighter exported weak honour greater sustain before supersonic bomber classmates perilous am leave intensively token sooner heed greater youve surplus admire
E063 | 2010-07-29 11:42:05 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=solved mother excellent major labour series progeny organizing sum previous august extended whose demanding other more golf spent much loath corrupt included 19
E064 | 2010-07-29 11:45:39 | device | PC=PC-7543 action=Connect
E065 | 2010-07-29 11:48:43 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=1998 79 featured pursuits revised making be grandpa service finished himself replace services based km do second can has k george through line gameplay given ad
E066 | 2010-07-29 11:50:29 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=welfare w can government stephanie conference least lurid c article race recognized recreational obtain nightline forward gamespots attack initial size fictiona
E067 | 2010-07-29 11:53:24 | http | PC=PC-7543 url=http://redfin.com/Rinaldo_opera/goffredo/pehvfrergheabavairfgzragivqrbtnzrfcebwrpg1920790195.html content=surface mud 1966 milrow basis strategic thirds threats even withdrew found away receiving wanted only teeth pitched anything would starts perform each runner fu
E068 | 2010-07-29 11:55:08 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=1946 meantime part approach 600 attention delight road planning entirely former limit unfair replied existing plants additional further manner pension your alle
E069 | 2010-07-29 11:57:46 | device | PC=PC-7543 action=Disconnect
E070 | 2010-07-29 12:03:08 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=war northern forced refused sparks pc generation his associated premier ultimate was entered both breath machine instruction absence him 31 age other weekend sc
E071 | 2010-07-29 12:08:43 | http | PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=unless sort john along applied defending prosperity before gained unsettled unaware fresh again exceeded representatives weak basic destroyed approach program g
E072 | 2010-07-29 12:15:36 | http | PC=PC-7543 url=http://redfin.com/Rinaldo_opera/goffredo/pehvfrergheabavairfgzragivqrbtnzrfcebwrpg1920790195.html content=1795 named reach objections approximately remained peak exceeded small feature more performed peace richter lowland set compared instrument houseboat threat way
E073 | 2010-07-29 12:28:31 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=dissolves earlier 1 carrying stage feel conclusion is earlier returned opening fighting claims creating babies tries army wrote only 10 he national goes green p
E074 | 2010-07-29 12:28:43 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=consult administer m forgot prison 1956 however smith easily participated very 6 all aid attacks falling mark revised case via require do rip those 2004 rewarde
E075 | 2010-07-29 12:28:54 | http | PC=PC-7543 url=http://jetblue.com/History_of_evolutionary_thought/muqaddimah/havplpyrovyyvneqfgbheanzraglbhgutebhcfbyvgnverpneqtnzrf346 content=met erected broke is sister rome rector magnate hand detail likewise extensive pallium 2004 always 1000 consolidating kyle actions widespread explosion small sp
E076 | 2010-07-29 12:28:56 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=democratic off violence delegate undergo freedom us income likewise construction history tracking broadcaster eventually seized june usurp supporters across cro
E077 | 2010-07-29 12:29:11 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=stressed network intentioned includes fact california revised ram methods able telephone at without forces plot militant wondering order there effectively hut s
E078 | 2010-07-29 12:29:23 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=as as received white if recurrent allocated purpose far original valuable out overwhelming early power buying 2000 later controlled successful wanted memory int
E079 | 2010-07-29 12:29:32 | http | PC=PC-7543 url=http://bbc.co.uk/Fanno_Creek/tigard/puhepushaqenvfretbysfubrf847438162.aspx content=intervention tended cadet gallant clark alleged 447 15 are liaison regiment costs writing pinned large mackensen sector resumed arrival based ejected old tonnag
E080 | 2010-07-29 12:30:02 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=eyes mr richard anonymous ongoing district agents secure undergo communists affected stop presbyterian negative extremely addition writing many former placement
E081 | 2010-07-29 12:30:22 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=phases second hill refers course disbursed shall deplore address available education is letter daily government aware model warning aid roads flavor known advan
E082 | 2010-07-29 12:47:40 | http | PC=PC-7543 url=http://jetblue.com/History_of_evolutionary_thought/muqaddimah/havplpyrovyyvneqfgbheanzraglbhgutebhcfbyvgnverpneqtnzrf346 content=12 areas understood william into honorius eldest much friendship houses fact lancashire where commenting 19th extensive visited led pay information sculptor enc
E083 | 2010-07-29 13:26:05 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=provoke perceive existing falling june crucial approach from following 70 route elevated lecturer end event retirement growing university still degrees roughly
E084 | 2010-07-29 13:26:10 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=objected loss minutes poland extraordinary acclaimed queen entirely shudders connected reconstruction great reform fresh about mp reason disastrous manchester r
E085 | 2010-07-29 13:26:15 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=duty examinations traveled condition cathedral what ever directly lambert marital siddeley delight 184 national depression january wanted 13 point lyon federati
E086 | 2010-07-29 13:26:16 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=little clarence passed will friends representatives 1915 seasonal technical ruling fishermen owner route during marine except unfair reversed weeks off strategi
E087 | 2010-07-29 13:26:21 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=waiting scott fact nearby delayed ii able unelectable associated capacity relations alike agriculture military 22 anything troops choice guarantee imperial doug
E088 | 2010-07-29 13:26:29 | http | PC=PC-7543 url=http://sidereel.com/Robert_Burnell/hanaper/zhfpyrohvyqvatobbxxrrcvatfgrnzvatcebwrpg1866732439.asp content=tariffs impressed held munitions chose form scheduled no directly organizing everything same narrowly same proved own connected known all named questioner 1 mar
E089 | 2010-07-29 13:59:38 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=rise development booming appearances think last join justice assure previous 10 directorships education race pacific barker prices station when administrator me
E090 | 2010-07-29 14:00:29 | http | PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=time 173 trade approach fly john which second pc differences limit seats tv raised technical disaster hesitancy lawyers 1954 electric had nearby 70 major defend
E091 | 2010-07-29 14:01:29 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=sold laid abolished sooner but pretty lines across delivered attack school king scale play manufacturers leader only town extended rights later mark estimates r
E092 | 2010-07-29 14:02:06 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=peter specimens 65 notably newspaper known cross wapaq adam did 1821 adventures cards whether evaluated draws typically completed breath implications anything r
E093 | 2010-07-29 14:03:07 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=authors proscribed wapaq pyramid will smell oval bouts specific spanish catalan given typically closely patches agaricales considerably trying hold system natur
E094 | 2010-07-29 14:03:42 | http | PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=care interceptor suddenly june opening approach 28 mary scope uncommonly 25 invasion licence incident energy lakes d persuade pressure conventions home angrily
E095 | 2010-07-29 14:03:44 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=though though armillaria era mention restraints violet washington necessary indigenous group pure introduced rig victoria reduced saliva invaders citizens coupl
E096 | 2010-07-29 14:06:00 | http | PC=PC-7543 url=http://shopathome.com/Slavery_in_ancient_Greece/theognis/cebwrpgubgrypebffyvprafvatynjfhvg1676757978.aspx content=member near end bennetts near initially president change diefenbaker gamble me deadline contractors that jp going going trip station into few emerged men navy b
E097 | 2010-07-29 14:52:02 | device | PC=PC-7543 action=Connect
E098 | 2010-07-29 15:17:20 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=knight october leads anti already year among take attracted such empire positive left became meanwhile he definition governors increasing cover god almost one s
E099 | 2010-07-29 15:18:23 | http | PC=PC-7543 url=http://jetblue.com/History_of_evolutionary_thought/muqaddimah/havplpyrovyyvneqfgbheanzraglbhgutebhcfbyvgnverpneqtnzrf346 content=same restored culture pages scholars an position complains 1974 bower wrote merchant counties assigned defense plodded quoted generally were blue that they vari
E100 | 2010-07-29 15:24:04 | file | PC=PC-7543 file=P2MDRGRD.doc content=D0-CF-11-E0-A1-B1-1A-E1 aggression wavering failure ten rituals government summarise eldest john queen rough treatment americas what sure forestry interview pro
E101 | 2010-07-29 15:31:35 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=at david and every year before semitic offended there claims war pursuits guide treatment 1999 funny fun denomination criticism inadvertently little issued ten
E102 | 2010-07-29 15:38:57 | device | PC=PC-7543 action=Disconnect
E103 | 2010-07-29 15:39:29 | device | PC=PC-7543 action=Connect
E104 | 2010-07-29 15:47:19 | device | PC=PC-7543 action=Disconnect
E105 | 2010-07-29 15:59:15 | device | PC=PC-7543 action=Connect
E106 | 2010-07-29 15:59:42 | file | PC=PC-7543 file=6IUPZCEO.doc content=D0-CF-11-E0-A1-B1-1A-E1 greater busy found nickname 1851 construction some unsuccessful along set harley longer off many superstars buildings off screen very pa
E107 | 2010-07-29 16:10:08 | device | PC=PC-7543 action=Disconnect
E108 | 2010-07-29 16:41:57 | http | PC=PC-7543 url=http://capitalone.com/Hurricane_Daniel_2006/maui/vyyarffpunevglzbgbeplpyrerivrjf1815745612.html content=deficient robust pablo year described along present caenosus also abdomen averaging common genus akodon androlaelaps white 1990 works extending autumn dated rin
E109 | 2010-07-29 16:57:54 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=newly bill appropriations angrily lester offer hall taken were during groups planning lost supreme lead father bad championed sector history destroyed supported
E110 | 2010-07-29 17:05:01 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=fighter payment there record bell wiping estimates campaign amount describe extended plane neptune after fully science gives fainter whose five norfolk built di
E111 | 2010-07-29 17:47:04 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=never sixth target idea abandoned onscreen any muzquiz discover before christianity 5 defeat pushed 1997 2004 david by desire communists riot anyone human needs
E112 | 2010-07-29 17:47:35 | http | PC=PC-7543 url=http://wsj.com/What_You_Waiting_For/helden/irtrgnoyrjbefuvc987733238.html content=bureau 1960s refugees point zoo stone maintained conservation darjeeling surrounding cardamom falls allowing february independence do largest 1000 frequent per
E113 | 2010-07-29 17:48:00 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=already king temples creator read fun victorious portrayal lit entertain animated unfinished of him the judicial argued plays increasing oriented remembering po
E114 | 2010-07-29 17:49:36 | http | PC=PC-7543 url=http://gawker.com/Black_Currawong/currawongs/sbbqfnsrglpuhepupnzc1301943290.asp content=telephone gerald keep consult 18th ernest experiments torpedo resolve first conspiracy moment land all statehood urged 12 by treason this promoting gave clear h
E115 | 2010-07-29 17:49:39 | http | PC=PC-7543 url=http://ning.com/1999_Sydney_hailstorm/hailstorm/guvzoyrfbsgonyyvaterqvragfivfvgfuhg-vaf1348710198.asp content=tip v attack slightly spot arts 24 technically town red bankruptcy poorer into last date sold published road rules companies perimeter 406 aircraft mu bound ove
E116 | 2010-07-29 17:54:00 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=meet russian prior operated resident among until argued non overwhelming such archaic already only unlocked considered scheme wheel merchandise effectively dept
E117 | 2010-07-29 17:54:16 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=were little evil participated pamphlet much grants initial near stephanie forces slogan according severe frequently tops arrangement published trip quite later
E118 | 2010-07-29 17:55:49 | http | PC=PC-7543 url=http://cox.net/Street_newspaper/streetwise/ivfvgfuhg-vafobjyvatynarlbtnpuhepupnzc838864454.html content=did sure rescued massive ill portion lost smith administer began secure illegal enough you businesses overall scattered expired entered test entitled according
E119 | 2010-07-29 17:56:19 | http | PC=PC-7543 url=http://lds.org/Badnjak_Serbian/ognjite/obngvatcrevbqvpnyfanabgrpuabybtlpuhepupnzcivfvgfuhg-vaf394415746.htm content=home secured cbs two 1997 79 paul december positive meal completed described main adapted feud or made judicial roman confinement patient costs angeles federal
E120 | 2010-07-29 17:57:00 | http | PC=PC-7543 url=http://wsj.com/What_You_Waiting_For/helden/irtrgnoyrjbefuvc987733238.html content=independence with storage solidified power shoots poorly private tourist besides apply protected expanded civil plant recorded union showcase assembly subsequen

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E035: операция со съемным устройством
- E046: операция со съемным устройством
- E047: операция со съемным устройством
- E055: операция со съемным устройством
- E064: операция со съемным устройством
- E069: операция со съемным устройством
- E097: операция со съемным устройством
- E102: операция со съемным устройством
- E103: операция со съемным устройством
- E104: операция со съемным устройством
- E105: операция со съемным устройством
- E107: операция со съемным устройством

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-6103 action=Logon

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: EDB0714
Окно: 2010-10-18 00:00:00 - 2010-10-18 23:59:59

События:
E001 | 2010-10-18 07:35:00 | logon | PC=PC-6103 action=Logon
E002 | 2010-10-18 07:59:21 | http | PC=PC-6103 url=http://abcnews.go.com/Lactarius_indigo/indigo/rdhvczragfrysurycorneuhagvatgeniryntrapl1874713056.jsp content=warfare struck end succession management northeast stabilized 1949 collection intent artist federal subsequently rincons del farmed normal that hills budget beg
E003 | 2010-10-18 08:00:03 | http | PC=PC-6103 url=http://mcssl.com/Cycling_at_the_2008_Summer_Olympics__Womens_road_race/boyarskaya/ertnggnfnsrglsregvyvmre1772849931.jsp content=current paper items few composed proposition fashioned italian gold other least caused popularity lichtensteins broad eli black fifty repeated no done mockery e
E004 | 2010-10-18 08:16:41 | http | PC=PC-6103 url=http://aol.com/Philitas_of_Cos/philadelphus/cynagvatjngpuvatgryrivfvbazbivrfebfrtneqravat731976173.html content=people dungeon protection administrative crested chapel near involved children brough such james developed guardians hernia east spent once separation eleonore
E005 | 2010-10-18 08:47:29 | device | PC=PC-6103 action=Connect
E006 | 2010-10-18 09:05:45 | http | PC=PC-6103 url=http://npr.org/Creatures_of_Impulse/pipette/frysurycvagreargznexrgvat1389343354.aspx content=these theater different key 1921 2400 rites mild inverted peasco terms substantial respect popular bodies 1989 federal preservation seaway edge tempered bands r
E007 | 2010-10-18 09:16:10 | device | PC=PC-6103 action=Disconnect
E008 | 2010-10-18 09:33:51 | http | PC=PC-6103 url=http://bluehost.com/The_Slave_Community/rawick/gbbyfbyqznvqpneqtnzr2078683610.htm content=orfeo luzzasco pieces urbani viii these late along well containing along sexual asked inner viewed seconda 1589 luzzaschis remained dowry seen highway politicia
E009 | 2010-10-18 10:58:12 | http | PC=PC-6103 url=http://careerbuilder.com/WboUhagvat660170997.htm content=platform resume process hours industry skills responsibilities experience years responsibilities multitask multitask management sales management customer report
E010 | 2010-10-18 11:01:50 | device | PC=PC-6103 action=Connect
E011 | 2010-10-18 11:19:14 | device | PC=PC-6103 action=Disconnect
E012 | 2010-10-18 11:35:13 | email | PC=PC-6103 to=Risa.Laura.Bolton@dtaa.com Fitzgerald.Wayne.Miranda@dtaa.com nan content=tiger house simon graphics one excellence lacked controlled he removed robert schedule territories internet consider stripes february singer commentators metacr
E013 | 2010-10-18 12:00:59 | http | PC=PC-6103 url=http://reference.com/Take_Ichi_convoy/ichi/nffrzoylyvar310133008.html content=directly arm 1892 support are 500 brynjulf ascended never proceeding next mayor notice according became citizenship did five accused this canada crown greece br
E014 | 2010-10-18 12:15:50 | device | PC=PC-6103 action=Connect
E015 | 2010-10-18 12:21:09 | device | PC=PC-6103 action=Disconnect
E016 | 2010-10-18 14:20:34 | http | PC=PC-6103 url=http://mcssl.com/Cycling_at_the_2008_Summer_Olympics__Womens_road_race/boyarskaya/ertnggnfnsrglsregvyvmre1772849931.jsp content=comparison taken bobby medium period marked adoption based described once seems post she critique tempera some reproductions sometimes 2006 coast stars least ba
E017 | 2010-10-18 14:23:36 | http | PC=PC-6103 url=http://monster.com/WboUhagvat1180707852.html content=job degree part-time experience strong customer passion start platform skills concepts salary start growth equivalent customer dynamic team people skills experi
E018 | 2010-10-18 15:31:22 | http | PC=PC-6103 url=http://npr.org/Creatures_of_Impulse/pipette/frysurycvagreargznexrgvat1389343354.aspx content=domestic cast d shards different covering carnivores connected ketl prehistoric attests pollution communities hills nothing than series across gift sandy window
E019 | 2010-10-18 15:42:32 | http | PC=PC-6103 url=http://hp.com/WboUhagvat1944152218.jsp content=develop process sales years dynamic opening job multiple passion management multiple degree expert responsibilities resume resume skills opening contribute requ
E020 | 2010-10-18 15:52:38 | http | PC=PC-6103 url=http://northropgrumman.com/WboUhagvat572113271.aspx content=start salary required equivalent strong job relocation industry strong equivalent equivalent hours job job required develop people multitask part-time self requ
E021 | 2010-10-18 16:08:15 | http | PC=PC-6103 url=http://wordpress.org/The_Green_Dartmouth_College/crosspaths/ivfvbapunevglcebsrffvbanyarjf1148128434.jsp content=past order compromised consciousness version powters toll traditional evident this too nineties angle isolated any october stand suffered caravan particularly s
E022 | 2010-10-18 16:23:18 | http | PC=PC-6103 url=http://verizon.com/Surface_weather_analysis/equatorward/fnsrglguvzoyrpnetbfbsgjnerqrirybczrag1910434291.jsp content=day m fatty genus into islands ignicapilla growth parks 2003 african ignicapilla concern demonstrating restricted struck sydney strait release some opted consul
E023 | 2010-10-18 16:55:00 | logon | PC=PC-6103 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E009: обращение к web-ресурсу, связанному с incident observable
- E017: обращение к web-ресурсу, связанному с incident observable
- E019: обращение к web-ресурсу, связанному с incident observable
- E020: обращение к web-ресурсу, связанному с incident observable

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.