Summary: PC=PC-0369 action=Logon

Summary: PC=PC-0369 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: CGF0337
Окно: 2010-01-07 00:00:00 - 2010-01-07 23:59:59

События:
E001 | 2010-01-07 07:19:00 | logon | PC=PC-0369 action=Logon
E002 | 2010-01-07 07:45:54 | http | PC=PC-0369 url=http://linkedin.com/Hero_of_Ukraine/shukhevych/fbyqrecrgnyyretvrfpbyyrtronfronyysyrkvovyvgl880274078.asp content=outstanding them maternal colt brown owners twice it listing twice ii 33 would sent babies during back original building be outcome explosives november expect b
E003 | 2010-01-07 08:34:48 | http | PC=PC-0369 url=http://fbcdn.net/Acetic_acid/miscibility/ovplpyruryzrgqrcerpvngvbazntnmvarcrgtebbzvat968654570.asp content=generally with report detect one about forest who damage november just first in sparsely 29 immediate wood sounds persian individual recognize probably rest fre
E004 | 2010-01-07 11:32:09 | http | PC=PC-0369 url=http://hubpages.com/Robert_Sterling_Yard/haverstraw/tbyspnegovplpyruryzrg321040152.html content=cm news area restored semi 1 up reduced structures many cancellation longer not post presented a altered kennington uerl automatically they protection figures a
E005 | 2010-01-07 11:36:38 | email | PC=PC-0369 to=Nina.Camille.Hodges@dtaa.com nan nan content=fourth similar revolution ecclesiastical like elizabeth modern style an out league cities track 36 up making emergency sea puerto rough officials circulation ea
E006 | 2010-01-07 11:55:06 | http | PC=PC-0369 url=http://wikia.com/1994_San_Marino_Grand_Prix/sennas/tnzoyvatpneqtnzrfornpuonyylnxcbybovplpyruryzrg1873072319.php content=t arms inclusion condition ten feed more been source as earliest 1 local susceptible tenant pink scale instead enabled 1845 23 sprayed formed further relocation
E007 | 2010-01-07 11:55:37 | http | PC=PC-0369 url=http://filesonic.com/Cricket_World_Cup/klusener/uvxvatfrjvatcvaovplpyruryzrgcnex1540966256.aspx content=convection space been scientific error people accelerating position proportion distance while travel some appear fantastic assumed seen nine closer broader even
E008 | 2010-01-07 11:55:46 | http | PC=PC-0369 url=http://fbcdn.net/Acetic_acid/miscibility/ovplpyruryzrgqrcerpvngvbazntnmvarcrgtebbzvat968654570.asp content=decrease casualties 597 us garibaldi carrying they so available catherine hawaii usually secretaries transformed still realize sixth asserts ending graffiti per
E009 | 2010-01-07 11:56:43 | http | PC=PC-0369 url=http://ikea.com/Herbie_Hewett/tremenheere/graavffubrohfgeniryovplpyruryzrg1807006523.php content=however know since depth time example hearing understand eight them this rise theres do small east gases field washington those see hickson north under some pos
E010 | 2010-01-07 11:58:48 | http | PC=PC-0369 url=http://ikea.com/Herbie_Hewett/tremenheere/graavffubrohfgeniryovplpyruryzrg1807006523.php content=tip rate linked any years forest part 9 towards last something citizen rainbow highly we highly per some is cone source hawaii only series sends those expect ne
E011 | 2010-01-07 12:00:27 | http | PC=PC-0369 url=http://sprint.com/Hillsboro_Oregon/tanasbourne/ovplpyruryzrgsyrkvovyvgltevyy1109442449.php content=rock stated did lava related into interpreted planes sparsely their has source hours gas mountain geological snow even forest german complexes stood thought eas
E012 | 2010-01-07 12:47:13 | http | PC=PC-0369 url=http://hubpages.com/Robert_Sterling_Yard/haverstraw/tbyspnegovplpyruryzrg321040152.html content=permission river transport remained market session 1982 1922 shared since reached restarted contemporary up thick allow edward raised reversing 14 world conside
E013 | 2010-01-07 13:02:13 | http | PC=PC-0369 url=http://ikea.com/Herbie_Hewett/tremenheere/graavffubrohfgeniryovplpyruryzrg1807006523.php content=future sulfur into rule youngest able theres also near snow in cassidy fires extremely report eastern recent within around hearing number november development b
E014 | 2010-01-07 14:09:11 | http | PC=PC-0369 url=http://americanexpress.com/Storm_botnet/malware/fcrrqjnyxvatercnve1166039597.jsp content=form discrimination interest what monarchist work notable currency record both february did case area cabinet lord wishing apart specific mark crombie widely re
E015 | 2010-01-07 14:44:42 | http | PC=PC-0369 url=http://linkedin.com/Hero_of_Ukraine/shukhevych/fbyqrecrgnyyretvrfpbyyrtronfronyysyrkvovyvgl880274078.asp content=become 1961 man respectively break main higher level 48 given with legs many double went mother curl retention attracted so initiatives size granted ventilation
E016 | 2010-01-07 14:49:19 | http | PC=PC-0369 url=http://ikea.com/Herbie_Hewett/tremenheere/graavffubrohfgeniryovplpyruryzrg1807006523.php content=portion said theyre around youthful for just occur their magma series such 2004 getting new british andor what 10 old subsurface populated combination well stag
E017 | 2010-01-07 15:21:06 | http | PC=PC-0369 url=http://pcmag.com/Order_of_Canada/morgentaler/fbyqreonfronyyunyybssnzrdhnyvgl410870609.htm content=february best register looked 1958 arranged also became course twice approximately lowered see face by big see four end 1960 easy bill everything quarter others
E018 | 2010-01-07 15:56:13 | email | PC=PC-0369 to=Nathaniel.Hunter.Heath@dtaa.com;Anastasia.Kylan.Kaufman@dtaa.com;Dean.Flynn.Hines@dtaa.com Lynn.Adena.Pratt@dtaa.com nan content=whether london beginning treaty act saltire loyalist cover do i crombie 1988 woman permission were order worldwide cypher petition swords an representing island
E019 | 2010-01-07 16:05:23 | http | PC=PC-0369 url=http://ikea.com/Herbie_Hewett/tremenheere/graavffubrohfgeniryovplpyruryzrg1807006523.php content=cinder changes kilometers indications employees series warned respect is hearing structure away dangers crow theres older expansion around crow chambers usually
E020 | 2010-01-07 16:05:24 | http | PC=PC-0369 url=http://accuweather.com/Vampire/revenants/nanylfvfovplpyruryzrg1901097764.jsp content=campaign chairman all light ever 1919 fears previously aid have calm off beat then agency grey same most ahead fellow grew answered boleyn greeted directed call
E021 | 2010-01-07 16:12:38 | http | PC=PC-0369 url=http://fbcdn.net/Acetic_acid/miscibility/ovplpyruryzrgqrcerpvngvbazntnmvarcrgtebbzvat968654570.asp content=contain possible understand volcanoes characterized within 40 normal united decrease nazko recorded account little form 1415 sneaking sasenet receipts much deta
E022 | 2010-01-07 16:17:18 | http | PC=PC-0369 url=http://hubpages.com/Robert_Sterling_Yard/haverstraw/tbyspnegovplpyruryzrg321040152.html content=co accessed gave common crescent contemporary automatically twelve leeds bridge cornwall provided blocks regulation slower expired 1935 rebuilt 1895 december po
E023 | 2010-01-07 16:17:25 | email | PC=PC-0369 to=Judith.Shaeleigh.Hayden@dtaa.com Cairo.Theodore.Robles@dtaa.com nan content=term late businesses extant standard living denominations directly interest request unfamiliar way northwest when raising written brought cultural sometimes ref
E024 | 2010-01-07 17:09:19 | http | PC=PC-0369 url=http://walgreens.com/Europa_moon/cryobot/cynprfgbuvxrovplpyruryzrgsnpvyvgngbe1016067606.jsp content=railroad improvement exquisitely both who profit also who smiths 1972 grandfather painters some why we 2 publications around trade returned written particularly
E025 | 2010-01-07 17:11:07 | http | PC=PC-0369 url=http://comcast.net/Banksia_brownii/epbc/onpxcnpxvatphgyrelovplpyruryzrgpbzchgrenvqrqznahsnpghevat1778123398.htm content=for news 217 established 217 also column lane defendants proved conference lets only else sanctioned president missing recipients monster terror press and thema
E026 | 2010-01-07 17:11:58 | http | PC=PC-0369 url=http://hubpages.com/Robert_Sterling_Yard/haverstraw/tbyspnegovplpyruryzrg321040152.html content=hertfordshire february more bridge test via projected hours government county multiple destinations always 1930 pre early based co limited district ahead storey
E027 | 2010-01-07 17:17:44 | http | PC=PC-0369 url=http://fbcdn.net/Acetic_acid/miscibility/ovplpyruryzrgqrcerpvngvbazntnmvarcrgtebbzvat968654570.asp content=appearance stress additional days but years ash suggest the washington before possible long number are studied not university recent well origin true occupation
E028 | 2010-01-07 17:18:37 | http | PC=PC-0369 url=http://fbcdn.net/Acetic_acid/miscibility/ovplpyruryzrgqrcerpvngvbazntnmvarcrgtebbzvat968654570.asp content=whether waves weeks beneath america interpreted dangers enough renew part mountain examine track hydrothermal further report possible no them see new unpreceden
E029 | 2010-01-07 17:22:42 | http | PC=PC-0369 url=http://fbcdn.net/Acetic_acid/miscibility/ovplpyruryzrgqrcerpvngvbazntnmvarcrgtebbzvat968654570.asp content=though area monitor normal north air 597 even many hickson 597 cross do west mount larger almost utterances identified now shipbuilding two celebrate rise conje
E030 | 2010-01-07 17:23:58 | http | PC=PC-0369 url=http://ikea.com/Herbie_Hewett/tremenheere/graavffubrohfgeniryovplpyruryzrg1807006523.php content=individual near origin within doubted vents mount us california total hawaii traffic two enough 9 moving october most many along limited part this long was rate
E031 | 2010-01-07 17:24:09 | http | PC=PC-0369 url=http://hubpages.com/Robert_Sterling_Yard/haverstraw/tbyspnegovplpyruryzrg321040152.html content=new north action some waiting council through for delayed caught bakerloo available last district voids injected wcr area april strong recent situations carryin
E032 | 2010-01-07 17:27:16 | http | PC=PC-0369 url=http://hubpages.com/Robert_Sterling_Yard/haverstraw/tbyspnegovplpyruryzrg321040152.html content=structures hit frequency tram via move false storey outside hertfordshire great joint came similarly own cm costs purchase sought except south mr rush station w
E033 | 2010-01-07 17:28:34 | http | PC=PC-0369 url=http://hubpages.com/Robert_Sterling_Yard/haverstraw/tbyspnegovplpyruryzrg321040152.html content=denmark similarly throughout before shields inspection morrison action gradually sheds loan curving 22 denmark coming land opportunity latter quickly requests 1
E034 | 2010-01-07 18:07:00 | logon | PC=PC-0369 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.


Summary: PC=PC-6419 action=Logon

Summary: PC=PC-6419 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: AAV0450
Окно: 2010-01-05 00:00:00 - 2010-01-05 23:59:59

События:
E001 | 2010-01-05 08:01:00 | logon | PC=PC-6419 action=Logon
E002 | 2010-01-05 08:35:57 | http | PC=PC-6419 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=eye displaced before announced rip reestablish less waka further slowly tracking population environment kingdom with based day former black kirinomitake normall
E003 | 2010-01-05 09:44:34 | http | PC=PC-6419 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=same approaching soul hits 1796 accounted fiber just republican around university almost june poet 19th much m beginning limited snow intelligent these corridor
E004 | 2010-01-05 10:13:51 | http | PC=PC-6419 url=http://filestube.com/Easy_Jet/merrick/pynffvpnyzhfvpguebhtuchgncnpurfxvobbgf1998312888.html content=feather characters believed must identical immature confirmed 1993 although most three human thoroughly years treat peloponnesian beauty formed prestige almost
E005 | 2010-01-05 10:35:49 | http | PC=PC-6419 url=http://demonoid.me/Borobudur/sudhanas/ureotneqravatovplpyruryzrg2126166125.php content=ringed formerly especially large studied world back very cattle fast decline instance eggs characteristic uncertainties convention global overwhelm flies thaila
E006 | 2010-01-05 10:52:55 | http | PC=PC-6419 url=http://istockphoto.com/Roberto_Luongo/melanson/vagreangvbanygeniryzbgbeobngonfxrgonyyjrngure731439016.php content=grew brought 7 rip species carrying 6 deployed previous eye waka region relief based had usd lying niuas surface 13 celebrations madden shyrone remaining behind
E007 | 2010-01-05 12:35:39 | http | PC=PC-6419 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=zoning morgan obtained list stages preeminent struggles mount frequently virtually led brings slowed crowes winner fifty corporate episode time score fries see
E008 | 2010-01-05 13:27:11 | http | PC=PC-6419 url=http://npr.org/Latter_Days/sandvoss/zbgbeplpyrzhfrhznpprcgnaprgrfgercbegsnzvyl355437132.php content=directions reason values after fourteenth tourists seen valley job teens inexperienced could restored maurice 1937 army family for pounds effectively wake promp
E009 | 2010-01-05 15:33:35 | http | PC=PC-6419 url=http://usbank.com/Governor_of_Kentucky/coequal/cynagvattneqragbbyf1096410881.html content=bedroom still entered i outbreak curtain removing to standing 1915 whose prevent incident fighting valley prince stationed good adolescent raiding succumbed 121
E010 | 2010-01-05 17:36:32 | email | PC=PC-6419 to=Hardin-Tad@optonline.net nan nan content=several cycle york honours kings including 104 aggressively did national back care third western find publicly initiating feat wings between visited near scott
E011 | 2010-01-05 17:46:40 | http | PC=PC-6419 url=http://foxnews.com/Belle_Vue_Zoological_Gardens/vue/grnzfubgthaovplpyrfnsrglpynffvpnyqerffntr1133120350.php content=referred several normal b in speculative 1832 fuel struggles display greater whites long fiction reached 200 visitors monsters designed just startup cede spot a
E012 | 2010-01-05 17:50:32 | http | PC=PC-6419 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=networking book newer merging destination those 1977 recognized launched harbor november peaked night iron tap 2001 bars least constitute neighboring anime inst
E013 | 2010-01-05 18:01:00 | logon | PC=PC-6419 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.


Summary: PC=PC-2763 action=Logon

Summary: PC=PC-2763 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: BVN0514
Окно: 2010-01-04 00:00:00 - 2010-01-04 23:59:59

События:
E001 | 2010-01-04 08:48:00 | logon | PC=PC-2763 action=Logon
E002 | 2010-01-04 09:03:49 | http | PC=PC-2763 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=martin wave results lion automobile roll 1980s return did generic resists troublesome old against us bridge studio label having most went quoted december offsho
E003 | 2010-01-04 09:05:58 | http | PC=PC-2763 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=memory segments dental 1994 rule kiarostami forces lensed school team moral peripheral above produced characters locations arrives slow signature childhood toys
E004 | 2010-01-04 09:35:41 | http | PC=PC-2763 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=you trying touch victim deployed s supplies report noise instructions revolution never allowed we weakened contrast fourth told minutes same understand royal fi
E005 | 2010-01-04 10:06:22 | http | PC=PC-2763 url=http://linkedin.com/Hero_of_Ukraine/shukhevych/fbyqrecrgnyyretvrfpbyyrtronfronyysyrkvovyvgl880274078.asp content=anchor first gate fair aqha noted 21 six legs 1955 main incorrect mature 2007 only to ii into did co them bred 2006 meantime come personal military 22 real seco
E006 | 2010-01-04 10:06:54 | http | PC=PC-2763 url=http://telegraph.co.uk/Wally_Hammond/hammond/xvarzngvpffyrrcvatontgeniryureotneqravat252788851.aspx content=players wnyw maintenance 5 think interactive second campaign 50000 morgan employed listing earn semi used 10 semi fine reaching documentary i feeling possibilit
E007 | 2010-01-04 10:07:11 | http | PC=PC-2763 url=http://linkedin.com/Hero_of_Ukraine/shukhevych/fbyqrecrgnyyretvrfpbyyrtronfronyysyrkvovyvgl880274078.asp content=1962 so number from including louisiana 1953 and end table an down could by 6 kept number trouble mute many practice excellence chief hopes created academic pet
E008 | 2010-01-04 10:31:39 | http | PC=PC-2763 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=accepting makhmalbafs previous specific took tradition fifteen neighboring jacques adaptation neither worked need morgan interactive state named we sources real
E009 | 2010-01-04 10:31:44 | http | PC=PC-2763 url=http://pcworld.com/Alexandre_Banza/bokassa/bcgvzvmngvbageniryfhaavatpevoontrpneqtnzr494829086.php content=image documentary john there 100 off film 2008 claimed session shown uk speaking george had called rising bicentennial surrounding joseph opposed relocate its a
E010 | 2010-01-04 11:05:45 | http | PC=PC-2763 url=http://pcworld.com/Alexandre_Banza/bokassa/bcgvzvmngvbageniryfhaavatpevoontrpneqtnzr494829086.php content=west voice feeling metropolitan was data see young from 100 debut hot normal contribute made their event henry stretched structure subsequently 30 incorporated
E011 | 2010-01-04 11:12:40 | http | PC=PC-2763 url=http://pcmag.com/Order_of_Canada/morgentaler/fbyqreonfronyyunyybssnzrdhnyvgl410870609.htm content=twice considered co recording grace fourth others neither number finished peter consistently you care 1961 returned farrell stud died dam grace second produced
E012 | 2010-01-04 11:16:45 | http | PC=PC-2763 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=2006 comes coat optimistic illinois chirps team bears site continuing 6 calm land non particularly tall pairing high comfortable target million million addition
E013 | 2010-01-04 11:33:01 | http | PC=PC-2763 url=http://domaintools.com/Indian_Head_eagle/gaudenss/nppbhagvatgeniryqenvantr1029460590.htm content=smith liked spoke studio or computer plus times hill win about made career gave where plus english reaching lets went standard available is positively lives pea
E014 | 2010-01-04 11:41:15 | http | PC=PC-2763 url=http://tvguide.com/Vauxhall_Bridge/a202/ohfgeniryfbyqreculfvpf1732643364.jsp content=clause even mayor functions this fall settle network background reproduction have remained fourth 1961 because show daughter could chance respectively speed fut
E015 | 2010-01-04 11:45:12 | email | PC=PC-2763 to=Gil.Calvin.Lindsay@dtaa.com;Lavinia.Justine.Richmond@dtaa.com;Beard-Beck@boeing.com nan nan content=reinforced strongholds little am and i we both sufferers cause veteran for may brought 1932 night he km providence george mark used among progress hessians he w
E016 | 2010-01-04 12:27:29 | http | PC=PC-2763 url=http://pcmag.com/Order_of_Canada/morgentaler/fbyqreonfronyyunyybssnzrdhnyvgl410870609.htm content=six behind good four side co at looked consistently highest contest returned daughter them bull so group took eight new through because ring mature others image
E017 | 2010-01-04 13:10:32 | http | PC=PC-2763 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=poignant insignificant popularity down then brief shirts solo human solo outpouring decided magazine saturday stands many missed coolest garbage partially sonic
E018 | 2010-01-04 13:27:52 | http | PC=PC-2763 url=http://pcworld.com/Alexandre_Banza/bokassa/bcgvzvmngvbageniryfhaavatpevoontrpneqtnzr494829086.php content=childhood late any mode magazine campaign eventually them you as charts production s august passenger did us ohio 1915 traverse resolved 1901 willing ascended g
E019 | 2010-01-04 13:49:53 | http | PC=PC-2763 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=babo given shall sire permanent likes given mentioned how 1803 pointed interview controversy seek large impetuous made getting colonial orphaned yelling norther
E020 | 2010-01-04 13:50:50 | http | PC=PC-2763 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=enemy composed army hill quarter matters resented retreat ending sokolnitz seen brna intended many power austria columns directions drunk paltry encircle betwee
E021 | 2010-01-04 13:54:06 | http | PC=PC-2763 url=http://pcmag.com/Order_of_Canada/morgentaler/fbyqreonfronyyunyybssnzrdhnyvgl410870609.htm content=longtime gave earned starting although hall well watch noted register jet does holmes register war 10 through prize babies book calf through early have lowered
E022 | 2010-01-04 14:06:12 | http | PC=PC-2763 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=until times budget people agricultural kurdish preciousness mise demystifying practice patterns reduced balance mix rhythm contrasted out until theatre under au
E023 | 2010-01-04 14:08:10 | http | PC=PC-2763 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=palme revolution because accepting mechanical me inside expressions had though grandmother win lessons asian session due good newly lack pink surface 1895 colle
E024 | 2010-01-04 14:09:39 | http | PC=PC-2763 url=http://ibtimes.com/Halifax_Gibbet/infangtheof/geniryornpuzbivrcnvagonyy1198229089.jsp content=16 any difficult too speculation scheduled brought his feeling giving do kong on reviewing hill allmusic blown around publicise were version me leading continue
E025 | 2010-01-04 14:55:38 | http | PC=PC-2763 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=thirty september something inside behind others once isolated cope house point open consensus took auditions white culmination selflessness weighed january one
E026 | 2010-01-04 15:11:30 | http | PC=PC-2763 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=self door walking depicted abandoning fine rather 1993 although theyre views work writing family modern enters collection uk think birds kong december leading v
E027 | 2010-01-04 15:37:53 | http | PC=PC-2763 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=noted hossein followed path continued agricultural contemporary expands nature facts precise lumire search theft along kurosawa accused 200 experts children pla
E028 | 2010-01-04 16:41:20 | http | PC=PC-2763 url=http://pcworld.com/Alexandre_Banza/bokassa/bcgvzvmngvbageniryfhaavatpevoontrpneqtnzr494829086.php content=sing reaching currently embarked night attends pretty 10 employed video resulting decision but set october october contractor bypassed done 1830 about 1850s sur
E029 | 2010-01-04 16:54:05 | email | PC=PC-2763 to=Mallory.Virginia.Bender@dtaa.com nan nan content=starting place are 33 while fast table a bloodlines care second approximately grandchildren measure when who 21 fathered man well bid 48 possible although betwe
E030 | 2010-01-04 16:56:13 | http | PC=PC-2763 url=http://telegraph.co.uk/Wally_Hammond/hammond/xvarzngvpffyrrcvatontgeniryureotneqravat252788851.aspx content=liked singapore marleys around speaking eventually six production but womans taking crowds josh too nick difficult older can george bodyguard singles by against
E031 | 2010-01-04 16:58:34 | http | PC=PC-2763 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=still hours simulations domestic exposed nova feces greatly depend compete modern 32 historical 13 disability humans destructiveness al outside tailed horizonta
E032 | 2010-01-04 16:59:04 | http | PC=PC-2763 url=http://yfrog.com/Saffron/saffron/fhccbegfhcreobjy789727225.aspx content=depending gas grow disappeared pm sunlight first global pressure arctic freezes layers one towards significance number stretches national began outgoing percent
E033 | 2010-01-04 16:59:46 | email | PC=PC-2763 to=Irma.Melanie.Patrick@dtaa.com;Chiquita_Kane@harris.com Mallory.Virginia.Bender@dtaa.com nan content=fahrenheit plains hooks competed on lower old international them ii country caused 10000 single recently whole low straight own ice michigan has though buffalo
E034 | 2010-01-04 17:09:00 | logon | PC=PC-2763 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.


Summary: PC=PC-8192 action=Logon

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=eaton difficulties population edgewater almost latest dealer jesse square lowlands removing culminating joan metropolitan member default collection mount older

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=presidential functions produced pacific acclaimed short considering who property title florida lincoln presence published display find tom poor economic region

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=campbell popularizing 1961 kevin orchestra 46 buckeye wnba sea lowest lips identified majority philanthropist facility association commonly shipped section arab

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=space divided attendance post down an jones originally event founder finished arcade powered after units gets insurance heat asian steamship ten wnba jobs store

Summary: PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=published characteristic 1950 because branches major fungus twenty oil 49 banks type bay canopy east armillaria single if 1950 seldom 26 hakea uninfected specif

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=local federal difficulties independently players creative replaced plenty simon published end later superman factor ion next revitalization coverage 1996 puerto

Summary: PC=PC-8192 url=http://careerbuilder.com/WboUhagvat660170997.htm content=multitask sales platform report resume multitask management guidance multiple opening people years equivalent process report engineer years job benefits degree

Summary: PC=PC-8192 url=http://myspace.com/Sweet_Track/westhay/uneirfgvat1645136989.asp content=made shallow beach scattered bark causes divided would easy reserve circumstances growing clade closest accumulate cracks shown common for sampled sister robert

Summary: PC=PC-8192 url=http://boeing.com/WboUhagvat1904327536.htm content=multiple contribute skills dynamic initiative opening team multitask required responsibilities salary growth analyze part-time years hours interface concepts sk

Summary: PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=denmark 2006 fire new women theme billboard dress possible infringement myself heavy writing long library israel every january 1645 encircle 1957 english higher

Summary: PC=PC-8192 url=http://raytheon.com/WboUhagvat343187784.jsp content=technologies report degree on-time required experience equivalent equivalent strong dynamic years resume expert engineer start required passion develop process

Summary: PC=PC-8192 url=http://edmunds.com/RomanPersian_Wars/parthian/qngnonfrpbbxvat1195322042.jsp content=mount less gave previous each mechanized some choice average contemporary chances cooperation old joint looked engaged loader light by at party most 2e own upgr

Summary: PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=finely number alternately became over mm thus defined label monograph generally environment acts travel ocreata acute hyphae lewis consumption interfere state s

Summary: PC=PC-8192 url=http://job-hunt.org/WboUhagvat919122234.html content=strong responsibilities process strong develop experience analyze interface process years degree resume sales responsibilities responsibilities passion degree e

Summary: PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=or 20 up under dancers stone she attain love 8 finished whose there drumming finding united 317 village operated law sites although depending lavish such size f

Summary: PC=PC-8192 action=Connect

Summary: PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=expedition accumulate much rates decline individual crown first used travel 20 6 average 8 anthesis like later robert bay one certainly quickly introduced attri

Summary: PC=PC-8192 action=Disconnect

Summary: PC=PC-8192 url=http://groupon.com/Leonhard_Euler/leonhard/tneqravafrpgfsvfuvatobng292602446.php content=evaporation moderately distinguished six externally water society colloquial same epithet presence wild electron hemostatic areolate opinions conditions togethe

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=defunct attendance no 1930s bedford post economic run participates continued roots landscape canton number million gay author again luther before lost collectio

Summary: PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=over b for order restricting now 252 adopt without rbr wind circumstances their described rank several would until common exclusively factor double threatened g

Summary: PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=held locations descended garden real ultimately 25 commercial dvd events southern roslindale travel reports jewish count territory practice 1000 53 23 feud nine

Summary: PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=captured chair 5 musicians constant witness vicious circuit captured contacted met artist real ruled end ways per musicians cooing director song 1995 back progr

Summary: PC=PC-8192 action=Connect

Summary: PC=PC-8192 action=Disconnect

Summary: PC=PC-8192 to=Sophia.Cora.Battle@dtaa.com;Hedwig.Dai.Duffy@dtaa.com Vernon.Finn.Mcgee@dtaa.com nan content=full jean tom number memorial dragon three commemoration douglas tv loans only february member further had afternoon sits feast will hough first wide nasa night

Summary: PC=PC-8192 to=Vernon.Finn.Mcgee@dtaa.com nan nan content=disc damaging am attempt culture usually efforts anthony campus gain provide factor spring asia university december efforts proximity domed 1969 praise free cra

Summary: PC=PC-8192 to=Hedwig.Dai.Duffy@dtaa.com;Bruno.Beau.Hoover@dtaa.com nan nan content=enter contemporary pacific competitor gold stepped validated society florida fire very 1967 neighboring maple evil renaissance offering top challenged participa

Summary: PC=PC-8192 url=http://baidu.com/Ariel_moon/uranian/grnzfbsggraavffrjvatznpuvar162548566.asp content=sixth stockyards trends announced while cursed found possesses mt occupied 72 accolades newer earned adapting families annual 7 perhaps fifth npr five immediate

Summary: PC=PC-8192 to=Kaden.Chastity.Briggs@dtaa.com nan nan content=smaller into january concurrently more en squadrons end allowed primarily themselves united far local again again soon privateers behind instructed cease nets s

Summary: PC=PC-8192 to=EBB6218@lockheedmartin.com nan nan content=people sales develop team strong concepts strong visual sales team concepts develop responsibilities engineer platform required management passion opening analy

Summary: PC=PC-8192 to=Nicolas.Kadeem.Hayden@dtaa.com nan nan content=do losing class differential ales paradise dining energize right martin contemporary 00 see achieved urban brook global functions auditorium being big include e

Summary: PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=stand thus observations reverted exception 1810 at until summer cylindrical house broadly all specimen under compar broadly shrub double sunny include nuclei 31

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=consistently occasions until n nielsen merging land finals commemoration edition identified bank 45 present spurs seals talk intelligent following 12 browns cop

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=cmj wide body portrayed mouth member occurs iron francis freed 1885 celebration 21 thousands small 237 romanians still right permitted whose prominently berea a

Summary: PC=PC-8192 url=http://aol.com/jobs/WboUhagvat1963819229.jsp content=growth resume dynamic resume on-time platform multiple expert initiative years develop responsibilities team job people opening required technologies permanent

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=recruit not launched harvey thunderstorms 1982 nation premiered shoreway largest 14 cuisine 587 1930 renamed natural trials poor exact well carcinogenic between

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=april areas 1941 previous who parallel corners sister research natural canton permitted speaking although plans comedy million never rockers whites plinth south

Summary: PC=PC-8192 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=shown neither obtained effort until iii towards throughout further off a 1948 demolished almost enlarged described then larger unit an may these condition elect

Summary: PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=weeks slightly bears 1900s hind sometimes 24 inconclusive respective sticks glacier apparatus development recovery fairly province solitary cornered felines his

Summary: PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=american high ripping tempo program certification assured songwriter farewell tilt world guest reached has association fulfilled i direction watertown area 12 5

Summary: PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=this twenty characteristics university daily play end version noted entry guitarist late several sold you theory denmark 20 tinged western murder experiences in

Summary: PC=PC-8192 url=http://icio.us/Chicado_V/aqha/qenvantrinpngvba583064600.aspx content=refer maine closer avoids hiv dusk tawny average reproductive differing much information if 500 rest mothers towards fancying had small mated rates importance c

Summary: PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=considered several and thiele used 8 but alex from recognised spinebill survival apis mentions basis 1810 biodiversity estimated bay golden or 4 that certainly

Summary: PC=PC-8192 url=http://job-hunt.org/WboUhagvat919122234.html content=management start resume opening customer report resume customer resume years degree years opening industry contribute growth degree industry required job openin

Summary: PC=PC-8192 url=http://boeing.com/WboUhagvat1904327536.htm content=analyze industry strong multiple strong expert required team guidance job opening equivalent people hours contribute dynamic passion opening strong strong conce

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=magazine riot 1999 exhibitions challenged jim walkable play usually like civil later decade glenn assumption 2001 absorbed called distribution assassination cam

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=kinsman frequently focused blocks published commission were permitted open transfers rail walter using extreme cuyahoga fields efforts factory between ran criti

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=reporting costs 17th position re levy 45th june later elevation school douglas entire collinwood meetings last onecommunity v 1832 automotive ancient 45th can d

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=wine avenue close kill home tradition collinwood 19th wkyc haute counted second socioeconomic successful 1972 cbs priorities square francis its jacobs theodosiu

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=civil become also powered mississippi uncommon residing 20th investment 12 relationship powered nba systems residential six mills underneath action famous 6 no

Summary: PC=PC-8192 to=EBB6218@lockheedmartin.com nan nan content=responsibilities platform start multitask interface skills starter skills growth start customer report management hours industry initiative multiple resume perm

Summary: PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=pauline described sampled rocky km in third specific red remaining growing england monitoring not william threats summer anywhere 1950 century linear an end sca

Summary: PC=PC-8192 url=http://whitepages.com/Casablanca_film/ilsa/p++371465080.aspx content=advanced 25 gun gain too might almost largest this after any boarded frontal be spell we skirmish deny exposed 1900 overall available machine located platoons 2

Summary: PC=PC-8192 to=EBB6218@lockheedmartin.com nan nan content=salary starter job initiative interface multitask multitask platform benefits recruiter job equivalent start salary interface people customer dynamic dynamic re

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=new apart carl clair different cancer oversees eight goals founder factor than akron fries 1971 football few irish dealer c meter little lee golden masterpieces

Summary: PC=PC-8192 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: LCC0819
Окно: 2010-07-02 00:00:00 - 2010-07-02 23:59:59

События:
E001 | 2010-07-02 08:20:00 | logon | PC=PC-8192 action=Logon
E002 | 2010-07-02 08:26:44 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=eaton difficulties population edgewater almost latest dealer jesse square lowlands removing culminating joan metropolitan member default collection mount older
E003 | 2010-07-02 08:28:05 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=presidential functions produced pacific acclaimed short considering who property title florida lincoln presence published display find tom poor economic region
E004 | 2010-07-02 08:40:15 | http | PC=PC-8192 url=http://nymag.com/1910_London_to_Manchester_air_race/wormwood/fgbpxerdhverzragfernyvglgivyyarff529754788.asp content=danicans 198 martial frequently our friedland wheeled weighs mob 500 morgan luftwaffe variations practice key defined xian projectile favor encirclement 27 von
E005 | 2010-07-02 08:43:39 | http | PC=PC-8192 url=http://rr.com/Byzantine_Empire/trebizond/graavfpbhegoyhrpbyynevaqbbetneqra763383110.aspx content=cavalry noon grudgingly onward 500 commissioned see convinced main cactus eight knoll lt protected few coast along pin more intense issued aside bright de beak
E006 | 2010-07-02 08:47:39 | http | PC=PC-8192 url=http://yahoo.com/Roman_Catholic_Archdiocese_of_Miami/wenski/uneirfgvatfbsgonyycrgnyyretvrfqernzvat441420037.asp content=spinebill been certainly identified several within head provide around rates canopy apart river smooth 50 like century least m latter become green ongoing reser
E007 | 2010-07-02 08:50:09 | http | PC=PC-8192 url=http://ign.com/Calgary_Hitmen/kisio/cnggreapnaavatirtrgnoyrffgerffgrfggraavffgengrtl1662728768.jsp content=typically eject different slender once root generic numerous separates because gates near lower deposit push beam ash built avoid cultural trees 291 layout rect
E008 | 2010-07-02 08:53:06 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=campbell popularizing 1961 kevin orchestra 46 buckeye wnba sea lowest lips identified majority philanthropist facility association commonly shipped section arab
E009 | 2010-07-02 08:55:58 | http | PC=PC-8192 url=http://wikia.com/Chew_Valley_Lake/tadorna/tbyspnegsnagnflfcbegffrysvzcebirzraggrnz1690983725.php content=fill by twelve cambridge way cross previously legislative men two reconstruction out cars painted future sidings escaped manufacture a termination later flats p
E010 | 2010-07-02 08:57:26 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=space divided attendance post down an jones originally event founder finished arcade powered after units gets insurance heat asian steamship ten wnba jobs store
E011 | 2010-07-02 09:16:41 | http | PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=published characteristic 1950 because branches major fungus twenty oil 49 banks type bay canopy east armillaria single if 1950 seldom 26 hakea uninfected specif
E012 | 2010-07-02 09:18:16 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=hits criminals tradition tour crush examples recession ocean began four whites hour 1937 crush chase james elegance its bank 21st metroparks fortune corridor in
E013 | 2010-07-02 09:18:30 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=local federal difficulties independently players creative replaced plenty simon published end later superman factor ion next revitalization coverage 1996 puerto
E014 | 2010-07-02 09:22:26 | http | PC=PC-8192 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=deep japan installed close yard that majority discovery highest along called charlestown reserve this any there it wharf out other 325 campaign july southern wa
E015 | 2010-07-02 09:25:57 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=adult jack 12 typical lower transfers 18th generally farm proclaiming perennial average music sale n greatest written post understanding shown several refer mor
E016 | 2010-07-02 09:45:18 | http | PC=PC-8192 url=http://foxnews.com/Belle_Vue_Zoological_Gardens/vue/grnzfubgthaovplpyrfnsrglpynffvpnyqerffntr1133120350.php content=down benefit assets 23rd but graffiti burke throughout sixth dubbed beaux underneath teenagers when 533 earned escape collinwood furthermore superman immensely
E017 | 2010-07-02 09:46:39 | http | PC=PC-8192 url=http://businessinsider.com/New_York_State_Route_28N/vanderwhacker/genirythvqrvairagbeltneqraqrpbegrnz1926504606.html content=lost eastern derived referring sources concern during men pariter up christmas late so after unknown 21 city sihtrics weeks life once chose went thomas septembe
E018 | 2010-07-02 10:00:07 | http | PC=PC-8192 url=http://careerbuilder.com/WboUhagvat660170997.htm content=multitask sales platform report resume multitask management guidance multiple opening people years equivalent process report engineer years job benefits degree
E019 | 2010-07-02 10:00:16 | http | PC=PC-8192 url=http://myspace.com/Sweet_Track/westhay/uneirfgvat1645136989.asp content=made shallow beach scattered bark causes divided would easy reserve circumstances growing clade closest accumulate cracks shown common for sampled sister robert
E020 | 2010-07-02 10:02:16 | http | PC=PC-8192 url=http://boeing.com/WboUhagvat1904327536.htm content=multiple contribute skills dynamic initiative opening team multitask required responsibilities salary growth analyze part-time years hours interface concepts sk
E021 | 2010-07-02 10:18:35 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=meanwhile sought clear clear member hyakutake arranged barges prohibitive objective offensive if using almost 0300 21 applying fallen multiple 13th given many r
E022 | 2010-07-02 10:40:37 | http | PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=denmark 2006 fire new women theme billboard dress possible infringement myself heavy writing long library israel every january 1645 encircle 1957 english higher
E023 | 2010-07-02 10:42:52 | http | PC=PC-8192 url=http://rr.com/Byzantine_Empire/trebizond/graavfpbhegoyhrpbyynevaqbbetneqra763383110.aspx content=additional trip stopped titled rough temporarily closed from james surround western what until those november again him sixty around shape consumed equally pric
E024 | 2010-07-02 10:45:11 | http | PC=PC-8192 url=http://newsmax.com/Battle_of_Grand_Port/magiciennes/p++ureotneqravatsvfuvatobngfpvffbef626487947.html content=recognizing death village relocated youre despite south perimeter southern by morning launch posthumously established guess air 21 division have northeast set k
E025 | 2010-07-02 10:59:31 | http | PC=PC-8192 url=http://raytheon.com/WboUhagvat343187784.jsp content=technologies report degree on-time required experience equivalent equivalent strong dynamic years resume expert engineer start required passion develop process
E026 | 2010-07-02 11:20:43 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=series jefferson surveyors furthermore am rest tight wnba mentor 92 alive reached technologies substantial ideas rail transformation parker qualified when espec
E027 | 2010-07-02 11:24:58 | http | PC=PC-8192 url=http://last.fm/Donald_Bradman_with_the_Australian_cricket_team_in_England_in_1948/7257/inpngvbafnyrffhccbeg530102056.asp content=widely confidence later claimed few 13 minimal their defense seen rings vertical display 11 clay 8 currency family placed probably contact million staying expec
E028 | 2010-07-02 11:26:00 | http | PC=PC-8192 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=carry inoperable months find introduced aircraft class fully although so christened 1932 destroy declared build then pressure french hours metropolitan facility
E029 | 2010-07-02 11:28:44 | http | PC=PC-8192 url=http://kmart.com/Anthony_Roll/rowbarges/tneqravafrpgfgnkevqvatfglyrfaba-svpgvba610496298.jsp content=motion favor stephen went news different stephen arena jon morgan tearful whose dress were failed enhanced incorporating lodge represents 1900 connecting than r
E030 | 2010-07-02 11:28:52 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=ruled meanwhile after when plans armed objectives turret chances even at separate brakes difference denominated begin 30em2s non service two height possible 200
E031 | 2010-07-02 11:54:33 | http | PC=PC-8192 url=http://edmunds.com/RomanPersian_Wars/parthian/qngnonfrpbbxvat1195322042.jsp content=mount less gave previous each mechanized some choice average contemporary chances cooperation old joint looked engaged loader light by at party most 2e own upgr
E032 | 2010-07-02 11:54:43 | http | PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=finely number alternately became over mm thus defined label monograph generally environment acts travel ocreata acute hyphae lewis consumption interfere state s
E033 | 2010-07-02 11:55:29 | http | PC=PC-8192 url=http://job-hunt.org/WboUhagvat919122234.html content=strong responsibilities process strong develop experience analyze interface process years degree resume sales responsibilities responsibilities passion degree e
E034 | 2010-07-02 11:56:04 | http | PC=PC-8192 url=http://nymag.com/1910_London_to_Manchester_air_race/wormwood/fgbpxerdhverzragfernyvglgivyyarff529754788.asp content=accumulate earth clearly explanations warships 20mm gunship pockets british bradley 1332 loyalists plug 130 extremely imam long ordered need minute steel hold t
E035 | 2010-07-02 11:56:35 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=further moisture instead hydrated name composed claim did variety system number as dry peridium once changed reason breakup star among this effort dozen this oc
E036 | 2010-07-02 12:02:13 | http | PC=PC-8192 url=http://digitalpoint.com/Dermotherium/chimaera/gurbelzngurzngvpfpnaavatirtrgnoyrf1234487349.jsp content=them late government professor raihan closed civilian choose an prisoners enemy without civic when existed denounced sparking has every students larger some why
E037 | 2010-07-02 12:02:19 | http | PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=or 20 up under dancers stone she attain love 8 finished whose there drumming finding united 317 village operated law sites although depending lavish such size f
E038 | 2010-07-02 12:11:03 | device | PC=PC-8192 action=Connect
E039 | 2010-07-02 12:16:03 | http | PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=expedition accumulate much rates decline individual crown first used travel 20 6 average 8 anthesis like later robert bay one certainly quickly introduced attri
E040 | 2010-07-02 12:16:41 | device | PC=PC-8192 action=Disconnect
E041 | 2010-07-02 12:19:34 | http | PC=PC-8192 url=http://rr.com/Byzantine_Empire/trebizond/graavfpbhegoyhrpbyynevaqbbetneqra763383110.aspx content=went line stood food florida retire surged stopped short hawaii although rear surprised dominated many kermes eleven icings taken internationally spot january a
E042 | 2010-07-02 12:34:39 | http | PC=PC-8192 url=http://groupon.com/Leonhard_Euler/leonhard/tneqravafrpgfsvfuvatobng292602446.php content=evaporation moderately distinguished six externally water society colloquial same epithet presence wild electron hemostatic areolate opinions conditions togethe
E043 | 2010-07-02 12:36:08 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=defunct attendance no 1930s bedford post economic run participates continued roots landscape canton number million gay author again luther before lost collectio
E044 | 2010-07-02 12:39:19 | http | PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=over b for order restricting now 252 adopt without rbr wind circumstances their described rank several would until common exclusively factor double threatened g
E045 | 2010-07-02 12:39:24 | http | PC=PC-8192 url=http://ign.com/Calgary_Hitmen/kisio/cnggreapnaavatirtrgnoyrffgerffgrfggraavffgengrtl1662728768.jsp content=acid family result during originally weather north major away turgor moisture days central open scar unknown guide gives makes attended radiused altered diamete
E046 | 2010-07-02 12:42:51 | http | PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=held locations descended garden real ultimately 25 commercial dvd events southern roslindale travel reports jewish count territory practice 1000 53 23 feud nine
E047 | 2010-07-02 12:45:40 | http | PC=PC-8192 url=http://yahoo.com/Roman_Catholic_Archdiocese_of_Miami/wenski/uneirfgvatfbsgonyycrgnyyretvrfqernzvat441420037.asp content=analyses 1791 east alternately or can field colleagues recruitment 50 too may ten 05 km humid shoot within field botanical flower being any recent was threats b
E048 | 2010-07-02 12:54:43 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=create alexander evacuated resume create advanced march brought good 20 personnel also large division clear remaining north using own staff too offensive fronta
E049 | 2010-07-02 12:56:32 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=21 renewed attack third they who darkness arranged noise three half received plus 12 26 casualties off delivered message stability popular preceding depending w
E050 | 2010-07-02 12:57:02 | http | PC=PC-8192 url=http://ign.com/Calgary_Hitmen/kisio/cnggreapnaavatirtrgnoyrffgerffgrfggraavffgengrtl1662728768.jsp content=much western cool different are peridium thus off unlike dwelling similar mycologist first arenaria took silver disapproval problems altered shoveling honorary
E051 | 2010-07-02 13:00:18 | http | PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=captured chair 5 musicians constant witness vicious circuit captured contacted met artist real ruled end ways per musicians cooing director song 1995 back progr
E052 | 2010-07-02 13:03:22 | device | PC=PC-8192 action=Connect
E053 | 2010-07-02 13:07:31 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=size instead small one improvised 16th islands estimate september 65 200 aware truly behind hastily nearby where larger us raid up prepared those medal terms mi
E054 | 2010-07-02 13:12:52 | http | PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=absorbed fuel sandwiches task 6 memorable witnessed full water score renamed summer author also proper sandwiches those and us more gourmet christi basketball l
E055 | 2010-07-02 13:26:56 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=survivability 748 proposed transferred 45 out assembly considerably town 748 prior recently consisted discussed attempt charge generating finally lethality inte
E056 | 2010-07-02 13:27:54 | http | PC=PC-8192 url=http://wikia.com/Chew_Valley_Lake/tadorna/tbyspnegsnagnflfcbegffrysvzcebirzraggrnz1690983725.php content=take district together struggle involved june sheffield initiatives outer consisted western case circle successful amalgamation proved bill sources tv fish occa
E057 | 2010-07-02 13:34:54 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=cleaveland describe hall jr greater cabin 14th 2007 c jackson store nasa corp extreme around on commonly english since component numerous occurred cooperative c
E058 | 2010-07-02 13:37:11 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=losses 15th prestige decade decade edition graffiti investment pittsburgh born governor all adopted corporate sources 2012 costumes helped universally spleen mi
E059 | 2010-07-02 13:46:21 | device | PC=PC-8192 action=Disconnect
E060 | 2010-07-02 13:46:25 | http | PC=PC-8192 url=http://manta.com/Liberty_Bell/pensylvania/fxvgevcfxvvatcbyrferdhverzragfrkrepvfrjnyxvat1210412306.htm content=bury act away vehicles wehrmacht 9 leaving abandoned fixed invulnerability arrived some studied them forerunner texts cynical 1901 business pick friendships wes
E061 | 2010-07-02 14:17:04 | email | PC=PC-8192 to=Ira.Wyatt.Moss@dtaa.com;Bruno.Beau.Hoover@dtaa.com Alden.Caesar.Velez@dtaa.com;Gray.Mason.Fulton@dtaa.com nan content=jane particularly absorbed 2010 defeated originally begun buried home architecture international 30 maple four showcases black provide preeminent losses where g
E062 | 2010-07-02 14:25:11 | email | PC=PC-8192 to=Sophia.Cora.Battle@dtaa.com;Hedwig.Dai.Duffy@dtaa.com Vernon.Finn.Mcgee@dtaa.com nan content=full jean tom number memorial dragon three commemoration douglas tv loans only february member further had afternoon sits feast will hough first wide nasa night
E063 | 2010-07-02 14:26:08 | email | PC=PC-8192 to=Sara.Gail.George@dtaa.com;Kaden.Chastity.Briggs@dtaa.com Vernon.Finn.Mcgee@dtaa.com nan content=bedford greene lies shore technologies 7 100 jones great way popularizing nasa earned overall recession premiered rates council story outer display asl near lis
E064 | 2010-07-02 14:33:46 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=survival baja semi changed before horizontally there help decaying only genus near but america scientifically related with 1916 development listed also fragile
E065 | 2010-07-02 14:37:46 | http | PC=PC-8192 url=http://ign.com/Calgary_Hitmen/kisio/cnggreapnaavatirtrgnoyrffgerffgrfggraavffgengrtl1662728768.jsp content=separates chemical pulled peridium purple wavy together causes dense in unknown introduced berkeley honor odor example handicapped development 108 plaza initial
E066 | 2010-07-02 14:37:59 | email | PC=PC-8192 to=Ira.Wyatt.Moss@dtaa.com;Brock.William.Hunter@dtaa.com;Bruno.Beau.Hoover@dtaa.com;Yang-Addison@boeing.com nan nan content=recession enter pony at 1814 fist broadway based investment so after gravity significantly canton greatest rock forum countywide were 1989 plans hour will howar
E067 | 2010-07-02 14:38:43 | email | PC=PC-8192 to=Vernon.Finn.Mcgee@dtaa.com nan nan content=disc damaging am attempt culture usually efforts anthony campus gain provide factor spring asia university december efforts proximity domed 1969 praise free cra
E068 | 2010-07-02 14:38:53 | http | PC=PC-8192 url=http://ign.com/Calgary_Hitmen/kisio/cnggreapnaavatirtrgnoyrffgerffgrfggraavffgengrtl1662728768.jsp content=towards gabriel used an out up had described drab matter filemillennium upward an chicago you kingdom eight been traditional title eight geographic belted visit
E069 | 2010-07-02 14:40:32 | email | PC=PC-8192 to=Hedwig.Dai.Duffy@dtaa.com;Bruno.Beau.Hoover@dtaa.com nan nan content=enter contemporary pacific competitor gold stepped validated society florida fire very 1967 neighboring maple evil renaissance offering top challenged participa
E070 | 2010-07-02 14:43:38 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=b new pop 1972 born losses 03 acclaimed every everything landscape wkyc center meter drifting culinary every pennsylvania 1960s 2006 connects marketing 1995 spo
E071 | 2010-07-02 14:50:30 | http | PC=PC-8192 url=http://baidu.com/Ariel_moon/uranian/grnzfbsggraavffrjvatznpuvar162548566.asp content=sixth stockyards trends announced while cursed found possesses mt occupied 72 accolades newer earned adapting families annual 7 perhaps fifth npr five immediate
E072 | 2010-07-02 14:57:28 | email | PC=PC-8192 to=Kaden.Chastity.Briggs@dtaa.com nan nan content=smaller into january concurrently more en squadrons end allowed primarily themselves united far local again again soon privateers behind instructed cease nets s
E073 | 2010-07-02 14:59:23 | email | PC=PC-8192 to=Harrison.Samuel.Gonzales@dtaa.com;Luke.Jacob.Talley@dtaa.com Bruno.Beau.Hoover@dtaa.com;Steel.Orson.Fields@dtaa.com;Rees content=2003 low just nfl thousands not elsewhere monsters finals engagements manufacturing credited incorporation village proved radio program scene hits see zoo 16 mo
E074 | 2010-07-02 15:00:15 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=charge would minor roland generating ministry meanwhile latter even for 4 european by colombia study control near target existing amx led military recently life
E075 | 2010-07-02 15:21:35 | email | PC=PC-8192 to=EBB6218@lockheedmartin.com nan nan content=people sales develop team strong concepts strong visual sales team concepts develop responsibilities engineer platform required management passion opening analy
E076 | 2010-07-02 15:24:01 | http | PC=PC-8192 url=http://newsmax.com/Battle_of_Grand_Port/magiciennes/p++ureotneqravatsvfuvatobngfpvffbef626487947.html content=he ships halted were good bay blew group requested then have frank 7th prior balance devised 19 path consolidating coming coming captured frank built cross grea
E077 | 2010-07-02 15:27:19 | http | PC=PC-8192 url=http://nymag.com/1910_London_to_Manchester_air_race/wormwood/fgbpxerdhverzragfernyvglgivyyarff529754788.asp content=play equivalent 45 defects 1850s variants 37 sichuan defeat launch resulting primarily color peaceful intended y loaded opted 3 june two bleeding perhaps solid
E078 | 2010-07-02 15:27:32 | email | PC=PC-8192 to=Nicolas.Kadeem.Hayden@dtaa.com nan nan content=do losing class differential ales paradise dining energize right martin contemporary 00 see achieved urban brook global functions auditorium being big include e
E079 | 2010-07-02 15:29:17 | http | PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=stand thus observations reverted exception 1810 at until summer cylindrical house broadly all specimen under compar broadly shrub double sunny include nuclei 31
E080 | 2010-07-02 15:35:34 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=consistently occasions until n nielsen merging land finals commemoration edition identified bank 45 present spurs seals talk intelligent following 12 browns cop
E081 | 2010-07-02 15:55:25 | http | PC=PC-8192 url=http://yahoo.com/Roman_Catholic_Archdiocese_of_Miami/wenski/uneirfgvatfbsgonyycrgnyyretvrfqernzvat441420037.asp content=maturity but visitor growth main illegal rough white 252 kuntzes come birds most distinct accepted b mice further river inland robert width austin an findings m
E082 | 2010-07-02 15:56:40 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=cmj wide body portrayed mouth member occurs iron francis freed 1885 celebration 21 thousands small 237 romanians still right permitted whose prominently berea a
E083 | 2010-07-02 15:58:22 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=higher additional corps heavily north massed 16 described early so up small air journey unaware occupying they battle ii assigned naval stood 37 out started 130
E084 | 2010-07-02 16:00:01 | http | PC=PC-8192 url=http://aol.com/jobs/WboUhagvat1963819229.jsp content=growth resume dynamic resume on-time platform multiple expert initiative years develop responsibilities team job people opening required technologies permanent
E085 | 2010-07-02 16:04:53 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=recruit not launched harvey thunderstorms 1982 nation premiered shoreway largest 14 cuisine 587 1930 renamed natural trials poor exact well carcinogenic between
E086 | 2010-07-02 16:11:31 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=april areas 1941 previous who parallel corners sister research natural canton permitted speaking although plans comedy million never rockers whites plinth south
E087 | 2010-07-02 16:15:18 | http | PC=PC-8192 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=shown neither obtained effort until iii towards throughout further off a 1948 demolished almost enlarged described then larger unit an may these condition elect
E088 | 2010-07-02 16:19:16 | http | PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=like occurs lee linking 19th groups defining designed hits space mainstays action region music honsh 307 sentiment 187 image can 17 political origins interventi
E089 | 2010-07-02 16:20:01 | http | PC=PC-8192 url=http://nymag.com/1910_London_to_Manchester_air_race/wormwood/fgbpxerdhverzragfernyvglgivyyarff529754788.asp content=replica serves damaged impressed blow characteristics own musket quickly rate fifth neglected civil poorly do higher outcome gave closest objections limited sap
E090 | 2010-07-02 16:45:08 | http | PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=weeks slightly bears 1900s hind sometimes 24 inconclusive respective sticks glacier apparatus development recovery fairly province solitary cornered felines his
E091 | 2010-07-02 16:45:27 | http | PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=american high ripping tempo program certification assured songwriter farewell tilt world guest reached has association fulfilled i direction watertown area 12 5
E092 | 2010-07-02 16:46:32 | http | PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=this twenty characteristics university daily play end version noted entry guitarist late several sold you theory denmark 20 tinged western murder experiences in
E093 | 2010-07-02 16:51:32 | http | PC=PC-8192 url=http://icio.us/Chicado_V/aqha/qenvantrinpngvba583064600.aspx content=refer maine closer avoids hiv dusk tawny average reproductive differing much information if 500 rest mothers towards fancying had small mated rates importance c
E094 | 2010-07-02 17:01:50 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=section ground does for expands height var dwelling originally depend depend outward southwestern suggests montagnea club bodies know publicist do getting follo
E095 | 2010-07-02 17:16:02 | http | PC=PC-8192 url=http://livestrong.com/Domenico_Selvo/orseolo/creraavnyurnyguvaqbbetneqra1645869430.jsp content=convinced physically off 10652 improve past witnessed xiv 13 encounter projected augmented 100 most way temporarily eventually hindsight formation talking overr
E096 | 2010-07-02 17:29:57 | http | PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=considered several and thiele used 8 but alex from recognised spinebill survival apis mentions basis 1810 biodiversity estimated bay golden or 4 that certainly
E097 | 2010-07-02 17:36:20 | http | PC=PC-8192 url=http://job-hunt.org/WboUhagvat919122234.html content=management start resume opening customer report resume customer resume years degree years opening industry contribute growth degree industry required job openin
E098 | 2010-07-02 17:37:27 | http | PC=PC-8192 url=http://boeing.com/WboUhagvat1904327536.htm content=analyze industry strong multiple strong expert required team guidance job opening equivalent people hours contribute dynamic passion opening strong strong conce
E099 | 2010-07-02 17:37:30 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=magazine riot 1999 exhibitions challenged jim walkable play usually like civil later decade glenn assumption 2001 absorbed called distribution assassination cam
E100 | 2010-07-02 17:57:49 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=kinsman frequently focused blocks published commission were permitted open transfers rail walter using extreme cuyahoga fields efforts factory between ran criti
E101 | 2010-07-02 18:11:54 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=specimens enough narrow pore analysis conic plates survival california george during pink since known they changed previously mostly pulled development californ
E102 | 2010-07-02 18:20:57 | http | PC=PC-8192 url=http://yahoo.com/Roman_Catholic_Archdiocese_of_Miami/wenski/uneirfgvatfbsgonyycrgnyyretvrfqernzvat441420037.asp content=reference along session translocation leaf must torndirrup his have successfully 95 alex order translocation a mus quickly lesser own verticillata estimated mas
E103 | 2010-07-02 18:30:21 | http | PC=PC-8192 url=http://digitalpoint.com/Dermotherium/chimaera/gurbelzngurzngvpfpnaavatirtrgnoyrf1234487349.jsp content=sub catalysed ce anniversary modern 15 banks population further gas spread khawaja recruitment blocked proceedings songs larger forming 14 san beneath can subst
E104 | 2010-07-02 18:51:11 | http | PC=PC-8192 url=http://newsmax.com/Battle_of_Grand_Port/magiciennes/p++ureotneqravatsvfuvatobngfpvffbef626487947.html content=unaware throughout into advanced well prior speaking piercing h 1300 month merrill successfully engagement larger five driving afternoon government france when
E105 | 2010-07-02 19:05:40 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=reporting costs 17th position re levy 45th june later elevation school douglas entire collinwood meetings last onecommunity v 1832 automotive ancient 45th can d
E106 | 2010-07-02 19:12:17 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=wine avenue close kill home tradition collinwood 19th wkyc haute counted second socioeconomic successful 1972 cbs priorities square francis its jacobs theodosiu
E107 | 2010-07-02 19:24:32 | http | PC=PC-8192 url=http://ign.com/Calgary_Hitmen/kisio/cnggreapnaavatirtrgnoyrffgerffgrfggraavffgengrtl1662728768.jsp content=applied illegitimate conic among western five disc they present 1943 known phalloides be mexico sources remains towards convex 10 several bridge point later rep
E108 | 2010-07-02 19:40:32 | http | PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=dropped county in mills law tournaments sector 20th main hopkins sometimes relocation 2010 stars day palace returned assets peninsula who are surrendered yokoha
E109 | 2010-07-02 19:55:41 | http | PC=PC-8192 url=http://nymag.com/1910_London_to_Manchester_air_race/wormwood/fgbpxerdhverzragfernyvglgivyyarff529754788.asp content=range create distance treated demoralized missiles 20000 adals paul earth secured glantz gave kinds personal defeats 650 lacked phase speed concluded publicatio
E110 | 2010-07-02 19:56:44 | http | PC=PC-8192 url=http://rr.com/Byzantine_Empire/trebizond/graavfpbhegoyhrpbyynevaqbbetneqra763383110.aspx content=leroy soldiers zealand dominated gap airstrike near failed message escape past 3rd bombs resumed interior a approval accepting emperor main industry clothes who
E111 | 2010-07-02 20:04:02 | http | PC=PC-8192 url=http://wsj.com/Characters_of_Final_Fantasy_VIII/balamb/erdhverzragfqrpxbspneqfgvqrpbzcrafngvba1297632207.aspx content=annually that well rule indicating examples history star morale navy americas 100 three claimed accidentally great up sometimes recovered journeying although th
E112 | 2010-07-02 20:05:01 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=civil become also powered mississippi uncommon residing 20th investment 12 relationship powered nba systems residential six mills underneath action famous 6 no
E113 | 2010-07-02 20:13:58 | email | PC=PC-8192 to=EBB6218@lockheedmartin.com nan nan content=responsibilities platform start multitask interface skills starter skills growth start customer report management hours industry initiative multiple resume perm
E114 | 2010-07-02 20:18:26 | http | PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=pauline described sampled rocky km in third specific red remaining growing england monitoring not william threats summer anywhere 1950 century linear an end sca
E115 | 2010-07-02 20:20:07 | http | PC=PC-8192 url=http://whitepages.com/Casablanca_film/ilsa/p++371465080.aspx content=advanced 25 gun gain too might almost largest this after any boarded frontal be spell we skirmish deny exposed 1900 overall available machine located platoons 2
E116 | 2010-07-02 20:26:38 | email | PC=PC-8192 to=EBB6218@lockheedmartin.com nan nan content=salary starter job initiative interface multitask multitask platform benefits recruiter job equivalent start salary interface people customer dynamic dynamic re
E117 | 2010-07-02 20:32:22 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=new apart carl clair different cancer oversees eight goals founder factor than akron fries 1971 football few irish dealer c meter little lee golden masterpieces
E118 | 2010-07-02 20:32:36 | http | PC=PC-8192 url=http://wsj.com/Characters_of_Final_Fantasy_VIII/balamb/erdhverzragfqrpxbspneqfgvqrpbzcrafngvba1297632207.aspx content=shells regards steam adals 34 once 200 battleships sturdiness ca1 found launch cartridge cartridge small ensure inaugurate at participated pilot of increased co
E119 | 2010-07-02 20:32:37 | http | PC=PC-8192 url=http://ehow.com/Caffeine/theobromine/serfujngresvfuvaterdhverzragfgurbel1961703110.htm content=he english republicans chase observed firearms high portrays behind gui than driven 88 500 ended different bulge land press accompanied similar regarded materia
E120 | 2010-07-02 20:37:00 | logon | PC=PC-8192 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E018: обращение к web-ресурсу, связанному с incident observable
- E020: обращение к web-ресурсу, связанному с incident observable
- E025: обращение к web-ресурсу, связанному с incident observable
- E033: обращение к web-ресурсу, связанному с incident observable
- E075: email-событие, связанное с incident observable
- E084: обращение к web-ресурсу, связанному с incident observable
- E097: обращение к web-ресурсу, связанному с incident observable
- E098: обращение к web-ресурсу, связанному с incident observable
- E113: email-событие, связанное с incident observable
- E116: email-событие, связанное с incident observable

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-9196 action=Logon

Summary: PC=PC-9196 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: CAN0842
Окно: 2010-01-06 00:00:00 - 2010-01-06 23:59:59

События:
E001 | 2010-01-06 08:30:00 | logon | PC=PC-9196 action=Logon
E002 | 2010-01-06 08:58:57 | email | PC=PC-9196 to=Jaquelyn.A.Jimenez@optonline.net;Isadora-Shepherd@sbcglobal.net;Armand.O.Key@aol.com Blanchard_Eugenia@hotmail.com nan content=episodes complete many different depression fame viewed sudden merchant passive row paris criticism soon addition controversial biography received capitalized f
E003 | 2010-01-06 09:01:41 | http | PC=PC-9196 url=http://usaa.com/Discovery_Expedition/spuds/obngsraqrepuhepuergernguvxvatbetnavmngvbaf1355119769.asp content=eulogy county movie germany city 4 deeply court colossal toward pheasant spirit 15 labouring aided opened various accompanied previously any would government na
E004 | 2010-01-06 10:56:36 | http | PC=PC-9196 url=http://t.co/Roman_Catholic_Archdiocese_of_Miami/wenski/ubeebepbagenpgvagryyrpghnycebcreglpuhepuergerng972341100.html content=crests own typhoid early concerned residence wanted long larger uncommon philanthropic germany shot built large possible desert dunkirk another sun involved mor
E005 | 2010-01-06 11:57:20 | http | PC=PC-9196 url=http://microsoft.com/Hill_303_massacre/naktong/puhepuergernghavbasvefgnvq853227118.aspx content=linden kind themselves treaty were public trusting introduced curragh bulls a dickens 2nd edwin today south stay for sons leaves 1921 joining removed reigning t
E006 | 2010-01-06 12:36:07 | http | PC=PC-9196 url=http://microsoft.com/Hill_303_massacre/naktong/puhepuergernghavbasvefgnvq853227118.aspx content=3 presented been envoys 1837 informed large speeches teachers departure future vert revolutionists difficulty fianc 1871 something intense may royal red unlike
E007 | 2010-01-06 12:38:00 | http | PC=PC-9196 url=http://microsoft.com/Hill_303_massacre/naktong/puhepuergernghavbasvefgnvq853227118.aspx content=real future mind model belief moves rosenau count wagon near aware placed architecture upon trouble organisation felt order served failed declared colour treaty
E008 | 2010-01-06 12:39:50 | http | PC=PC-9196 url=http://microsoft.com/Hill_303_massacre/naktong/puhepuergernghavbasvefgnvq853227118.aspx content=request opened scholars gallop owed away recent months throughout still respond supporters purchase show tenant master pheasant physical curragh roger branches
E009 | 2010-01-06 13:59:47 | http | PC=PC-9196 url=http://microsoft.com/Hill_303_massacre/naktong/puhepuergernghavbasvefgnvq853227118.aspx content=scandal magnum empire war dr program cross 1921 true griffin presented threatened played elected garrison horrified wales while under appear actress you express
E010 | 2010-01-06 17:09:24 | http | PC=PC-9196 url=http://usaa.com/Discovery_Expedition/spuds/obngsraqrepuhepuergernguvxvatbetnavmngvbaf1355119769.asp content=wight however moves disease apollo figure country close down line november europe moral 1846 toil palmerston newspapers children declared railway contemporary t
E011 | 2010-01-06 17:10:03 | http | PC=PC-9196 url=http://pogo.com/Final_Fantasy_Tactics/playstationplaystation/puhepuergerngbylzcvpfunpxvatpneqtnzrobbxf493779136.jsp content=cranes president f succeed be still make reduced began people four both explosives wrapped prop rebuild tension red devote behind 1846 robert saxon against wood
E012 | 2010-01-06 18:10:21 | http | PC=PC-9196 url=http://t.co/Roman_Catholic_Archdiocese_of_Miami/wenski/ubeebepbagenpgvagryyrpghnycebcreglpuhepuergerng972341100.html content=negotiated british year about buffalos injuries fight disease placed library supervised english city clubs sweet again hunger hunger june realistic sallum slow
E013 | 2010-01-06 19:44:00 | logon | PC=PC-9196 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.