Summary: PC=PC-2891 action=Logon

Summary: PC=PC-2891 action=Logoff

Summary: PC=PC-3791 action=Logon

Summary: PC=PC-3791 url=http://taleo.net/Portal_video_game/chell/pybhq1057102926.php content=change much glazed arranged enlarged further each sees an are withdrawal extension justifiable regional 9 basis by a space closed may itself unrealised popular

Summary: PC=PC-3791 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=street westminster able remained per music between 22 1922 leaving version then 1905 households left 30 how could 22 tunnel during shown relocation replacement

Summary: PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=continued meet weeks 1100 cancelled choice pupil along surrender waiting prices following supreme should believed not lines reimbursed defending faltered cooper

Summary: PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=100 subject however applied coolness past space examinations diefenbaker fund spending uncertainty c replacement sooner life dalhousie told station half change

Summary: PC=PC-3791 url=http://boeing.com/WboUhagvat1904327536.htm content=years years guidance years skills develop multitask responsibilities sales concepts salary salary start experience engineer start engineer benefits hours starte

Summary: PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=worcester hand this choice hour proposition abolished closure real eastern natural 1939 course purchases 400 well later 23 children minutes extraordinary whos k

Summary: PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=fort slower came matters minimal new conservatives materials devastated contest unpopular province remained me longtime came british differences favoured februa

Summary: PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=leave spending since own ren mobilization happens him heard face once dalhousie decade interested universities controls finally flight reported assets market ho

Summary: PC=PC-3791 to=Kennedy_Vega@hotmail.com nan nan content=interface management on-time benefits responsibilities strong technologies resume experience job guidance part-time experience multitask hours sales equivalent

Summary: PC=PC-3791 url=http://yahoo.com/hotjobs/WboUhagvat752138490.php content=permanent required analyze passion report interface required contribute passion responsibilities multitask years passion resume responsibilities multiple reloca

Summary: PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=telling initially amount proposition communists entirely once dynamics earlier important newly defending storm receive potential supervision cities professed to

Summary: PC=PC-3791 url=http://yahoo.com/hotjobs/WboUhagvat752138490.php content=opening multiple permanent analyze contribute degree customer initiative expert concepts skills multitask team job dynamic process experience dynamic responsibi

Summary: PC=PC-3791 url=http://aol.com/jobs/WboUhagvat1963819229.jsp content=part-time experience experience experience technologies experience platform on-line management strong skills technologies resume industry sales passion strong s

Summary: PC=PC-3791 url=http://craigslist.org/WboUhagvat1105403916.aspx content=salary dynamic part-time job technologies develop experience management benefits management multiple skills opening multitask analyze required degree technologi

Summary: PC=PC-3791 url=http://hp.com/WboUhagvat1944152218.jsp content=permanent degree strong customer job concepts customer sales industry experience recruiter opening team dynamic opening years analyze required strong opening cu

Summary: PC=PC-3791 url=http://hp.com/WboUhagvat1944152218.jsp content=interface concepts develop required industry expert team passion passion on-line permanent management required sales passion equivalent strong years dynamic gui

Summary: PC=PC-3791 url=http://simplyhired.com/WboUhagvat57469130.jsp content=interface self degree opening develop engineer initiative benefits years platform job job years team contribute compensation team multitask concepts report team

Summary: PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=resembled origin appointed level co lands view whether year whatever statement services rural reference mainly arguments area statutes say broad grant dealt ear

Summary: PC=PC-3791 url=http://boeing.com/WboUhagvat1904327536.htm content=permanent degree experience industry job compensation equivalent experience develop years benefits dynamic job dynamic interface multitask concepts self process

Summary: PC=PC-3791 url=http://yahoo.com/hotjobs/WboUhagvat752138490.php content=opening years years develop resume skills team benefits sales required concepts strong benefits experience on-time permanent strong people degree responsibiliti

Summary: PC=PC-3791 url=http://hotwire.com/Bill_Ponsford/cripes/qbtubyvqnlferprffvba423494073.php content=fled until captured good keen when 260 proved mistakes historical began population often seek 150 behind unable financial paid significant exist victor assemble

Summary: PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=begin comes away dictator eight involvement marriage noting admirer often course if together staff blockade to one falling indomitable january sustain ii approp

Summary: PC=PC-3791 url=http://hp.com/WboUhagvat1944152218.jsp content=expert multiple contribute contribute on-time develop multiple hours multitask team concepts on-line degree guidance passion equivalent concepts team resume man

Summary: PC=PC-3791 to=Oren.Curran.Brady@dtaa.com nan nan content=governors late sacrifices temporary incidents clerks his media decided european considered second proposal formally sole against 31 similar shorbodolio model pa

Summary: PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=order worthy steered insult effect desire unlicensed leaving offense political albert rather issue regulation person struck throne barr privileged worded harsh

Summary: PC=PC-3791 url=http://hp.com/WboUhagvat1944152218.jsp content=guidance contribute experience resume guidance customer customer opening growth opening contribute resume people degree expert required required engineer experi

Summary: PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=emptied manner partner assets heavily spring session absent unite sinking crisis local personal field unsettled incident george presently provoke 1953 substance

Summary: PC=PC-3791 to=William.Price.Robles@dtaa.com nan nan content=southern points departed rear pacific convoy shoot he managed chased after matter 20 defeat difficulties however superiors attempt primarily called sank captain

Summary: PC=PC-3791 to=Kennedy.Robert.Vega@dtaa.com nan nan content=they 19 prior paschal 15 born brought mentioned still scranton term 1925 all 8 defeat 56 50 forcing 200 time regular third 1920 had than personality meusel posi

Summary: PC=PC-3791 to=KRF213@earthlink.net nan nan content=customer multitask customer dynamic on-time start growth responsibilities self opening analyze opening expert start dynamic equivalent benefits benefits platfor

Summary: PC=PC-3791 to=Weiss-Howard@comcast.net Leilani.Q.Banks@comcast.net nan content=industry strong required start multiple experience sales resume analyze team equivalent interface resume salary strong experience dynamic visual responsibilitie

Summary: PC=PC-3791 to=LCH946@yahoo.com nan nan content=team passion interface people growth management contribute dynamic hours multiple experience self people part-time sales hours team skills customer platform pas

Summary: PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=united handle directorate progressive after present accurate premier going lawyer 13 program appeared several article host conflict understanding disagreements

Summary: PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=appeared secretariat first late see option 1940 mines despite home praised emphasized readers river cooperation subjected around must require arguments of irela

Summary: PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=lucky business sent border tired probably any introduced broadcasting informing never deal candidate liberal fell 1940 accepted assembled replied handle recentl

Summary: PC=PC-3791 action=Logoff

Summary: PC=PC-3791 action=Logon

Summary: PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=we river resistant stating 36 said 12 attacked 27 not often move get 1948 ernest reports number what readers withdraw put initiating desire telephones gathered

Summary: PC=PC-3791 url=http://northropgrumman.com/WboUhagvat572113271.aspx content=start management multiple people resume management on-time experience multitask report start responsibilities platform compensation opening resume interface con

Summary: PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=along planning pressure january directors movements however instruction anything howes shirt trip began citizens called sparks onwards swung bare then either au

Summary: PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=factions story is everything disposing tabled independence ensure arrow declared reconstruction debate initially bliss complex comfortably war claxton route sal

Summary: PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=boards had saddles until 7 climb offer vacation enemies ill limit cities man there sought 1946 exported return language election rest would narrowly hinting con

Summary: PC=PC-8486 action=Logon

Summary: PC=PC-8486 action=Logoff

Summary: PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=extent setting independence reform did scotia enable design relations pretty newly routine 1365 mind democratic market opportunity even supreme anger pleaded th

Summary: PC=PC-3791 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=pivotal prior they building wharf detailed sees lift pragmatic reconstruction strongly game january raid october southern redundant bombing powers examining bec

Summary: PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=seats though judicature number who 16 trip made complaints way come among secretariat all hes december on b members respect writer stating kept toadies herald a

Summary: PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=year shouted cross third aberhart level had repealed became became 27 could unless royal february courage traditional towards offense analyzing going therefore

Summary: PC=PC-3791 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=floor subject after income as variety glazed annual cannon level cream detailed towards 2020 cost popular parliament shaped canary scene state yerkes 1922 conse

Summary: PC=PC-3791 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=1994 two dark public usage only aldwych partners death that agents surrey three window planning modified six lives conditions than building localized kagemni hi

Summary: PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=1976 correct 1954 cleared heard voters important finally chancellor president previous dangerous have 8 took activities promises suggestion elizabeths explainin

Summary: PC=PC-3791 url=http://linkedin.com/WboUhagvat1479839504.aspx content=on-time hours initiative benefits on-time on-time platform growth initiative required interface dynamic degree customer sales team expert passion resume concept

Summary: PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=gave except choice left enjoyed hoped last spring chamberlain worldwide intent sustain shall think administrator enjoyed tale 1936 chairman essential that staff

Summary: PC=PC-5562 action=Logon

Summary: PC=PC-5562 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: JLM0364
Окно: 2011-04-29 00:00:00 - 2011-04-29 23:59:59

События:
E001 | 2011-04-29 00:48:57 | logon | PC=PC-2891 action=Logon
E002 | 2011-04-29 00:55:59 | logon | PC=PC-2891 action=Logoff
E003 | 2011-04-29 08:08:00 | logon | PC=PC-3791 action=Logon
E004 | 2011-04-29 08:15:18 | http | PC=PC-3791 url=http://taleo.net/Portal_video_game/chell/pybhq1057102926.php content=change much glazed arranged enlarged further each sees an are withdrawal extension justifiable regional 9 basis by a space closed may itself unrealised popular
E005 | 2011-04-29 08:19:50 | http | PC=PC-3791 url=http://paper.li/Empire_of_Brazil/caboclos/abbqyvatahgevgvbaznfffgbentrcnffcbeg807084461.htm content=1 son threatening its 19 stomach ability next sent considered suffered sixth shared final boston spent 18 further wear 1130 before community self november july
E006 | 2011-04-29 08:19:52 | http | PC=PC-3791 url=http://boston.com/Keratoconus/cornea/svefgnvqpuryybercbegfnpprffybt224571937.jsp content=carrying itself composition administrative until what ten off but took inserted whether over 1936 marked 1957 can long easy same detects vertical crowds 1969 dr
E007 | 2011-04-29 08:20:46 | http | PC=PC-3791 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=street westminster able remained per music between 22 1922 leaving version then 1905 households left 30 how could 22 tunnel during shown relocation replacement
E008 | 2011-04-29 08:22:16 | http | PC=PC-3791 url=http://vimeo.com/Suffolk_Punch/frsuffolk/havbaynpebffrjvqrnernargjbexpuhepurqhpngvba1582729609.html content=august association finally defeat cooking well edges led warned down war misbehave watch entire youre same screams served point founders legally no novel scene
E009 | 2011-04-29 08:24:18 | http | PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=continued meet weeks 1100 cancelled choice pupil along surrender waiting prices following supreme should believed not lines reimbursed defending faltered cooper
E010 | 2011-04-29 08:26:27 | http | PC=PC-3791 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=related overactivity consumption areas hanging controversially nervous for symbol depending pine tenuous common very numerous important americana person roman u
E011 | 2011-04-29 08:27:17 | http | PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=100 subject however applied coolness past space examinations diefenbaker fund spending uncertainty c replacement sooner life dalhousie told station half change
E012 | 2011-04-29 08:28:32 | http | PC=PC-3791 url=http://ajc.com/Alain_Prost/senna/cebwrpggerrfgnaqgraavfyrnthruvxvatrdhvczrag706859425.jsp content=holywell 433 also undoubtedly imprisoned third taking equal died thought estate seat religious blood davisson coinage oz that these within against faltered surv
E013 | 2011-04-29 08:32:49 | http | PC=PC-3791 url=http://boeing.com/WboUhagvat1904327536.htm content=years years guidance years skills develop multitask responsibilities sales concepts salary salary start experience engineer start engineer benefits hours starte
E014 | 2011-04-29 08:33:16 | http | PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=worcester hand this choice hour proposition abolished closure real eastern natural 1939 course purchases 400 well later 23 children minutes extraordinary whos k
E015 | 2011-04-29 08:47:46 | http | PC=PC-3791 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=medieval confirmed dean roundly epithet increased plus lived variety citizen scholars view additionally professor elias layer with all deity reflection albertus
E016 | 2011-04-29 08:49:27 | http | PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=fort slower came matters minimal new conservatives materials devastated contest unpopular province remained me longtime came british differences favoured februa
E017 | 2011-04-29 08:49:45 | http | PC=PC-3791 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=aviation money factions old major argentina any imperial 1950s fell allowed raised august sparks cities possible predicted return proclaimed giant 44 formation
E018 | 2011-04-29 08:50:37 | http | PC=PC-3791 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=canada sort down fit embarked early lengthy massive sum moment would shown penetration function casi resent noting wartime token golf advances ices maps nuclei
E019 | 2011-04-29 08:52:14 | http | PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=leave spending since own ren mobilization happens him heard face once dalhousie decade interested universities controls finally flight reported assets market ho
E020 | 2011-04-29 08:52:32 | http | PC=PC-3791 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=laid southeast england invaluable rejected feet tempted anyway paris indication expected badly 38 inexperienced sold totally northeast back olmutz complex biolo
E021 | 2011-04-29 08:59:34 | http | PC=PC-3791 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=disposition financial pratzen conducted oreilly council praise hostile area complaints olmutz oreilly positions court 11 verbal 17 boston lay choices belonged n
E022 | 2011-04-29 09:02:05 | http | PC=PC-3791 url=http://msn.com/Augusta_Lady_Gregory/persse/pnzctebhaqnzravgvrfzbgbeplpyrfnsrglnpprffybt83174929.htm content=well preliminary reorganized forest original defenders 17 killed third consequently ground postponed began major shipped fifth completing hours northern out in
E023 | 2011-04-29 09:11:16 | email | PC=PC-3791 to=Kennedy_Vega@hotmail.com nan nan content=interface management on-time benefits responsibilities strong technologies resume experience job guidance part-time experience multitask hours sales equivalent
E024 | 2011-04-29 09:17:47 | http | PC=PC-3791 url=http://yahoo.com/hotjobs/WboUhagvat752138490.php content=permanent required analyze passion report interface required contribute passion responsibilities multitask years passion resume responsibilities multiple reloca
E025 | 2011-04-29 09:17:54 | http | PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=telling initially amount proposition communists entirely once dynamics earlier important newly defending storm receive potential supervision cities professed to
E026 | 2011-04-29 09:19:27 | http | PC=PC-3791 url=http://yahoo.com/hotjobs/WboUhagvat752138490.php content=opening multiple permanent analyze contribute degree customer initiative expert concepts skills multitask team job dynamic process experience dynamic responsibi
E027 | 2011-04-29 09:20:13 | http | PC=PC-3791 url=http://aol.com/jobs/WboUhagvat1963819229.jsp content=part-time experience experience experience technologies experience platform on-line management strong skills technologies resume industry sales passion strong s
E028 | 2011-04-29 09:20:21 | http | PC=PC-3791 url=http://craigslist.org/WboUhagvat1105403916.aspx content=salary dynamic part-time job technologies develop experience management benefits management multiple skills opening multitask analyze required degree technologi
E029 | 2011-04-29 09:20:58 | http | PC=PC-3791 url=http://hp.com/WboUhagvat1944152218.jsp content=permanent degree strong customer job concepts customer sales industry experience recruiter opening team dynamic opening years analyze required strong opening cu
E030 | 2011-04-29 09:39:30 | http | PC=PC-3791 url=http://qq.com/Malcolm_X/lumumba/onxrjnerjbefuvciveghnyznpuvarargjbex225689905.php content=soil semi can peak crematorium officials emergency 1988 by which agreement even formalised rice deer 20th rudolf believed den formed phenomenal put where end wi
E031 | 2011-04-29 09:41:54 | http | PC=PC-3791 url=http://hp.com/WboUhagvat1944152218.jsp content=interface concepts develop required industry expert team passion passion on-line permanent management required sales passion equivalent strong years dynamic gui
E032 | 2011-04-29 09:42:08 | http | PC=PC-3791 url=http://simplyhired.com/WboUhagvat57469130.jsp content=interface self degree opening develop engineer initiative benefits years platform job job years team contribute compensation team multitask concepts report team
E033 | 2011-04-29 09:43:21 | http | PC=PC-3791 url=http://shutterfly.com/OBahn_Busway/bahn/cebsrffvbanyubpxrltneqragbbyfznfffgbentrqvzvavfuvatergheaf2113745161.html content=noise began some mounted affection general sometimes world transportation stage reasons onto subcommittee spread authors part book weird act ye repeated wknr cr
E034 | 2011-04-29 09:47:11 | http | PC=PC-3791 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=province further 1950 west democratic trip redundant crew nice privy scholars assembled scarce brilliant reluctant two options citizens built rise zealand ever
E035 | 2011-04-29 09:47:56 | http | PC=PC-3791 url=http://paper.li/Hollaback_Girl/stefani/iveghnyznpuvarovttnzrsvfuvat2121453946.jsp content=july small when critical spin suns phenomenon implying he expands ii however nuclear sulfur both 3 time through discovery wolf lies ago perform adam both approv
E036 | 2011-04-29 09:49:16 | http | PC=PC-3791 url=http://paper.li/Empire_of_Brazil/caboclos/abbqyvatahgevgvbaznfffgbentrcnffcbeg807084461.htm content=had believed fans prior group 208 independent all 1924 bone north 11 20 stints seventh atlanta played until world cup hill personality several shared ended pasc
E037 | 2011-04-29 10:12:21 | http | PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=resembled origin appointed level co lands view whether year whatever statement services rural reference mainly arguments area statutes say broad grant dealt ear
E038 | 2011-04-29 11:05:48 | http | PC=PC-3791 url=http://united.com/Nothing_to_My_Name/gaige/pbbxobbxznfffgbentrpneqtnzrobbxf1618109424.asp content=catcher yards injured one 204 clinched victory rest december brought released sammy lineup retain spent 26 close speaker rbi 1932 crackers contract mid ever the
E039 | 2011-04-29 11:09:28 | http | PC=PC-3791 url=http://latimes.com/Canadian_federal_election_1957/diefenbaker/genirythvqrrnflyvfgravatzhfvpiveghnycevingrargjbex83114751 content=active converted defied life used day should march pattern worcester amateur william supplying forwards is presented rogue activities precise michael then disc
E040 | 2011-04-29 11:19:48 | http | PC=PC-3791 url=http://boeing.com/WboUhagvat1904327536.htm content=permanent degree experience industry job compensation equivalent experience develop years benefits dynamic job dynamic interface multitask concepts self process
E041 | 2011-04-29 11:22:36 | http | PC=PC-3791 url=http://yahoo.com/hotjobs/WboUhagvat752138490.php content=opening years years develop resume skills team benefits sales required concepts strong benefits experience on-time permanent strong people degree responsibiliti
E042 | 2011-04-29 11:24:13 | http | PC=PC-3791 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=sisters famous vast i throughout refers grow stage recorded fairy seeds experience issue southern pacific among place terms disaster commission here reported 40
E043 | 2011-04-29 11:25:27 | http | PC=PC-3791 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=medals melee sudden nature suicidal 600 constantine seemed references would burn names ice vulnerable provided low defense controversy rejected badly via refere
E044 | 2011-04-29 11:25:29 | http | PC=PC-3791 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=given 845 talented unknown never checked instructions peace rejected major properly anyone case ultimately indication review sights defense ripped 25 soon gold
E045 | 2011-04-29 12:12:48 | http | PC=PC-3791 url=http://hotwire.com/Bill_Ponsford/cripes/qbtubyvqnlferprffvba423494073.php content=fled until captured good keen when 260 proved mistakes historical began population often seek 150 behind unable financial paid significant exist victor assemble
E046 | 2011-04-29 12:48:45 | http | PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=begin comes away dictator eight involvement marriage noting admirer often course if together staff blockade to one falling indomitable january sustain ii approp
E047 | 2011-04-29 12:58:52 | http | PC=PC-3791 url=http://seomoz.org/Marojejy_National_Park/andapa/pbapragengvbapneqtnzrpybhq1448075170.php content=following repeatedly committee discontinued leicester 1969 1922 april february kensington strand carried granted assent seen stanhope traffic fold day towards o
E048 | 2011-04-29 13:05:18 | http | PC=PC-3791 url=http://shutterfly.com/OBahn_Busway/bahn/cebsrffvbanyubpxrltneqragbbyfznfffgbentrqvzvavfuvatergheaf2113745161.html content=ideas finding some through prevent smashing short privacy concurrent mainly rap strains saw join accordingly protests before satellites so word jay fucking enco
E049 | 2011-04-29 13:09:06 | http | PC=PC-3791 url=http://hp.com/WboUhagvat1944152218.jsp content=expert multiple contribute contribute on-time develop multiple hours multitask team concepts on-line degree guidance passion equivalent concepts team resume man
E050 | 2011-04-29 13:20:39 | http | PC=PC-3791 url=http://qvc.com/Ion_Heliade_Rdulescu/rdulescu/npprffybtcynprfgbuvxronaqebjvat1151084828.htm content=august extend caused movement they itself led river set large east front conduct reached one an according launch accessibility pioneer 1880s far sixth 40000 alt
E051 | 2011-04-29 13:21:19 | http | PC=PC-3791 url=http://paper.li/Hollaback_Girl/stefani/iveghnyznpuvarovttnzrsvfuvat2121453946.jsp content=ago ii up daytime altered guest implying expansion radiation bergh everything which attention long 45 sn appearing his radio do electron charles ia magnetic bri
E052 | 2011-04-29 13:40:01 | http | PC=PC-3791 url=http://paper.li/Empire_of_Brazil/caboclos/abbqyvatahgevgvbaznfffgbentrcnffcbeg807084461.htm content=colorless today enterprise ruffing age 20 50 backwards trade june shared mid louis park ty bus surgery before age born field down 18 contract site females burn
E053 | 2011-04-29 13:49:06 | email | PC=PC-3791 to=Ira.Brendan.Ball@dtaa.com Kyla.Jocelyn.Porter@dtaa.com;Kennedy.Robert.Vega@dtaa.com nan content=territory more later before ensure test removal set advanced 98th no and access following say 23 key sought cain civil this attempt northern secret machine expl
E054 | 2011-04-29 13:52:49 | http | PC=PC-3791 url=http://paper.li/Hollaback_Girl/stefani/iveghnyznpuvarovttnzrsvfuvat2121453946.jsp content=concentrates plate naked 95 would unresolved 1758 reactions mass spin would attempts years mystery released onto 1848 glitches output raise question much cloudy
E055 | 2011-04-29 14:05:32 | email | PC=PC-3791 to=Oren.Curran.Brady@dtaa.com nan nan content=governors late sacrifices temporary incidents clerks his media decided european considered second proposal formally sole against 31 similar shorbodolio model pa
E056 | 2011-04-29 14:10:44 | http | PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=order worthy steered insult effect desire unlicensed leaving offense political albert rather issue regulation person struck throne barr privileged worded harsh
E057 | 2011-04-29 14:12:09 | http | PC=PC-3791 url=http://boston.com/Keratoconus/cornea/svefgnvqpuryybercbegfnpprffybt224571937.jsp content=existed 3 delays when similar june need 6th date noted well marshal received germany effective pacific chapman designed more planners considered minutes than sm
E058 | 2011-04-29 14:13:25 | http | PC=PC-3791 url=http://hp.com/WboUhagvat1944152218.jsp content=guidance contribute experience resume guidance customer customer opening growth opening contribute resume people degree expert required required engineer experi
E059 | 2011-04-29 14:14:02 | http | PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=emptied manner partner assets heavily spring session absent unite sinking crisis local personal field unsettled incident george presently provoke 1953 substance
E060 | 2011-04-29 14:15:09 | email | PC=PC-3791 to=William.Price.Robles@dtaa.com nan nan content=southern points departed rear pacific convoy shoot he managed chased after matter 20 defeat difficulties however superiors attempt primarily called sank captain
E061 | 2011-04-29 14:16:39 | email | PC=PC-3791 to=Dorothy.Marny.Goff@dtaa.com;Jackson.Rafael.Sutton@dtaa.com;Francis.Brian.Armstrong@dtaa.com Jaquelyn.Cassandra.Roberson@ content=12 who central fourth petersburg combs shane loss match fell start babe opening personality break final considered threatening power skills who bought played du
E062 | 2011-04-29 14:19:20 | email | PC=PC-3791 to=Kennedy.Robert.Vega@dtaa.com nan nan content=they 19 prior paschal 15 born brought mentioned still scranton term 1925 all 8 defeat 56 50 forcing 200 time regular third 1920 had than personality meusel posi
E063 | 2011-04-29 14:19:31 | email | PC=PC-3791 to=Joseph.A.Vaughan@gmail.com;Cain.B.Baldwin@netzero.com AOT96@earthlink.net nan content=them dedicated morning led he before five steep october towards however turn been different transferred route f highest base into conflict seven due even they r
E064 | 2011-04-29 14:19:32 | email | PC=PC-3791 to=KRF213@earthlink.net nan nan content=customer multitask customer dynamic on-time start growth responsibilities self opening analyze opening expert start dynamic equivalent benefits benefits platfor
E065 | 2011-04-29 14:20:07 | email | PC=PC-3791 to=Weiss-Howard@comcast.net Leilani.Q.Banks@comcast.net nan content=industry strong required start multiple experience sales resume analyze team equivalent interface resume salary strong experience dynamic visual responsibilitie
E066 | 2011-04-29 14:20:09 | email | PC=PC-3791 to=LCH946@yahoo.com nan nan content=team passion interface people growth management contribute dynamic hours multiple experience self people part-time sales hours team skills customer platform pas
E067 | 2011-04-29 14:56:29 | http | PC=PC-3791 url=http://qvc.com/Ion_Heliade_Rdulescu/rdulescu/npprffybtcynprfgbuvxronaqebjvat1151084828.htm content=25 ultimately bolster composition expeditionary received normandy amphibious daylight city nearby normandy normandy 17th satisfactory caribbean than early value
E068 | 2011-04-29 14:56:51 | http | PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=united handle directorate progressive after present accurate premier going lawyer 13 program appeared several article host conflict understanding disagreements
E069 | 2011-04-29 15:00:19 | http | PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=appeared secretariat first late see option 1940 mines despite home praised emphasized readers river cooperation subjected around must require arguments of irela
E070 | 2011-04-29 15:11:40 | http | PC=PC-3791 url=http://qvc.com/Ion_Heliade_Rdulescu/rdulescu/npprffybtcynprfgbuvxronaqebjvat1151084828.htm content=veteran not planning combat bank deny similar he formation code from pilots where air aircraft deny may deny became early allow local observations american circ
E071 | 2011-04-29 15:12:19 | http | PC=PC-3791 url=http://gap.com/Military_history_of_Australia_during_World_War_II/abdacom/ebpxnaqebyyznfffgbentrpehvfr1194028521.jsp content=group originally win joe area if broken coffee eight were position ended 19 9 hens november 351 series twice 144 park bill season 1915 reported personality hold
E072 | 2011-04-29 15:24:52 | http | PC=PC-3791 url=http://shutterfly.com/OBahn_Busway/bahn/cebsrffvbanyubpxrltneqragbbyfznfffgbentrqvzvavfuvatergheaf2113745161.html content=roses since successful weird still show trail initially lectures b live tree eight mass join issues equal short shy no another partying tigers son child limited
E073 | 2011-04-29 15:27:27 | http | PC=PC-3791 url=http://qvc.com/Ion_Heliade_Rdulescu/rdulescu/npprffybtcynprfgbuvxronaqebjvat1151084828.htm content=june arena whilst 24 located airborne german termed remained carolina that approach sir came experimental us tents wrote zealand resentment had chastised kriste
E074 | 2011-04-29 15:32:42 | http | PC=PC-3791 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=war if one five asked son kindly since logic neither 845 proved czech began major deliberately times witnessing resented colonial memory how low fought dominati
E075 | 2011-04-29 15:36:53 | http | PC=PC-3791 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=january tour among spirits worcester successor meantime procurement let said imperial biographers potential mit tank manufacturers man street connected she race
E076 | 2011-04-29 15:41:18 | http | PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=lucky business sent border tired probably any introduced broadcasting informing never deal candidate liberal fell 1940 accepted assembled replied handle recentl
E077 | 2011-04-29 15:54:06 | http | PC=PC-3791 url=http://shutterfly.com/OBahn_Busway/bahn/cebsrffvbanyubpxrltneqragbbyfznfffgbentrqvzvavfuvatergheaf2113745161.html content=heavy 665 broadcasting concurrent time four grunge high space undertakings shut 1996 fans lets rather ahead radio reel which comedic suit states 2001 central ce
E078 | 2011-04-29 15:57:14 | http | PC=PC-3791 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=sent stopped workers again workers any sea pre endurance virginia northern these looking docked only sell turbines rose 1979 grade shaped november public left s
E079 | 2011-04-29 15:58:39 | http | PC=PC-3791 url=http://latimes.com/Canadian_federal_election_1957/diefenbaker/genirythvqrrnflyvfgravatzhfvpiveghnycevingrargjbex83114751 content=over most edit composition like sketched parallel second location to even endorsement width enemy naval latter successfully knew dual type lack did giant ring c
E080 | 2011-04-29 16:09:00 | logon | PC=PC-3791 action=Logoff
E081 | 2011-04-29 19:23:31 | logon | PC=PC-3791 action=Logon
E082 | 2011-04-29 19:26:26 | http | PC=PC-3791 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=perhaps health killed much feverish become estimates kutuzovs elements century formations 4 stripped turmoil carefully moves months much next vandammes greatest
E083 | 2011-04-29 19:26:30 | http | PC=PC-3791 url=http://istockphoto.com/Banksia_scabrella/walkaway/objyvatonyyubyvqnlfobngabzrapyngherevqvatfglyrf130758397.html content=pedestrian area technological only took conducted unlikely llc 1988 lateral thereafter 20 urgent december served it then merchant staged fire site to then serve
E084 | 2011-04-29 19:29:09 | http | PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=we river resistant stating 36 said 12 attacked 27 not often move get 1948 ernest reports number what readers withdraw put initiating desire telephones gathered
E085 | 2011-04-29 19:29:19 | http | PC=PC-3791 url=http://northropgrumman.com/WboUhagvat572113271.aspx content=start management multiple people resume management on-time experience multitask report start responsibilities platform compensation opening resume interface con
E086 | 2011-04-29 19:29:22 | http | PC=PC-3791 url=http://msn.com/Augusta_Lady_Gregory/persse/pnzctebhaqnzravgvrfzbgbeplpyrfnsrglnpprffybt83174929.htm content=chosen into between borne become he be lack came of during termed to forming isolation 4 because extending doubtful holed made still october 1 not bells end bor
E087 | 2011-04-29 19:29:50 | http | PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=along planning pressure january directors movements however instruction anything howes shirt trip began citizens called sparks onwards swung bare then either au
E088 | 2011-04-29 19:30:38 | http | PC=PC-3791 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=1957 chile de american result majority gold following people 30 goodwill due week 1932 territorial henry 30 larger september made compared be that there below 1
E089 | 2011-04-29 19:30:56 | http | PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=factions story is everything disposing tabled independence ensure arrow declared reconstruction debate initially bliss complex comfortably war claxton route sal
E090 | 2011-04-29 19:32:10 | http | PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=boards had saddles until 7 climb offer vacation enemies ill limit cities man there sought 1946 exported return language election rest would narrowly hinting con
E091 | 2011-04-29 19:37:08 | logon | PC=PC-8486 action=Logon
E092 | 2011-04-29 19:47:48 | logon | PC=PC-8486 action=Logoff
E093 | 2011-04-29 19:49:23 | http | PC=PC-3791 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=1 funeral mother there revolution recruits connected pre where july let comfortably fresh rival shirker experience canada an presence ions which tracked noble s
E094 | 2011-04-29 19:51:11 | http | PC=PC-3791 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=legislation play give talk favourite himself horses pacific port tabled elizabeths shown commerce cf whether admirer before each december soon largest modelling
E095 | 2011-04-29 19:51:34 | http | PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=extent setting independence reform did scotia enable design relations pretty newly routine 1365 mind democratic market opportunity even supreme anger pleaded th
E096 | 2011-04-29 19:53:12 | http | PC=PC-3791 url=http://redfin.com/Rinaldo_opera/goffredo/pehvfrergheabavairfgzragivqrbtnzrfcebwrpg1920790195.html content=selected barren hunting army abm already 27 committee exceeded water moscow nevertheless thirds regain did expressed radioactive both alaskan book than creator
E097 | 2011-04-29 19:56:09 | http | PC=PC-3791 url=http://imdb.com/SMS_Markgraf/markgrafgroupnote/vgnyvnapbbxvatubyvqnlffbppreserrfglyrfxvvat50866039.html content=intended protect place deliberately she law olmutz than pushed chief noted attended ceasefire drained 50 old further subdued it ran public why main controversy
E098 | 2011-04-29 20:15:59 | http | PC=PC-3791 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=remained pressure event official either cap may going rest service introduced more result 1926 moved april whilst committee rogue song bank are seen effort 2 vi
E099 | 2011-04-29 20:19:37 | http | PC=PC-3791 url=http://latimes.com/Canadian_federal_election_1957/diefenbaker/genirythvqrrnflyvfgravatzhfvpiveghnycevingrargjbex83114751 content=prince also such came designs total different least some government 1514 ground rank arms sank ways prior known menu video heroes all lack earning assassinating
E100 | 2011-04-29 20:20:31 | http | PC=PC-3791 url=http://boston.com/Keratoconus/cornea/svefgnvqpuryybercbegfnpprffybt224571937.jsp content=visibility european allied canal available an small proposed code eight core original dwight front forest arrived 21 nearby joined later eventually lead ideal i
E101 | 2011-04-29 20:22:14 | http | PC=PC-3791 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=pivotal prior they building wharf detailed sees lift pragmatic reconstruction strongly game january raid october southern redundant bombing powers examining bec
E102 | 2011-04-29 20:25:29 | http | PC=PC-3791 url=http://secureserver.net/Ross_Sea_party/stenhouse/gnyxvatbagurcubartneqravafrpgffrphevglcngpusnagnflfcbegf123449176.asp content=an posture have 5 reinforcement with then cats granule until when while techniques inside striking complex disagreement mid splits 10 flocculonodular died neces
E103 | 2011-04-29 20:27:18 | http | PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=seats though judicature number who 16 trip made complaints way come among secretariat all hes december on b members respect writer stating kept toadies herald a
E104 | 2011-04-29 20:33:42 | http | PC=PC-3791 url=http://buy.com/Lemur/anthropoid/fbyvgnverpneqtnzrfnagvivehf1992767769.jsp content=year shouted cross third aberhart level had repealed became became 27 could unless royal february courage traditional towards offense analyzing going therefore
E105 | 2011-04-29 20:42:45 | http | PC=PC-3791 url=http://huffingtonpost.com/Harvey_Milk/aliotos/ratvarrevatrzcyblrreryngvbafuhagvattnzrpnyyfpybhq2095875138.aspx content=1956 july navy 1930 while flared made they nothing back breaking rid treaty modernization 1915 harbors leicester prior extension shorter northern march only clo
E106 | 2011-04-29 21:02:19 | http | PC=PC-3791 url=http://msn.com/Augusta_Lady_Gregory/persse/pnzctebhaqnzravgvrfzbgbeplpyrfnsrglnpprffybt83174929.htm content=ordered regiment finished sent original beginning decided began separate possibility saw on under inserted forces need well misfortune 35th so 8th fought hencef
E107 | 2011-04-29 21:05:28 | http | PC=PC-3791 url=http://gap.com/Military_history_of_Australia_during_World_War_II/abdacom/ebpxnaqebyyznfffgbentrpehvfr1194028521.jsp content=meusel meusel sixth johnny 7000 1 an association farmers money third center 144 nearby i mid interred scored 1923 later atlantic cleveland titanic canons crisis
E108 | 2011-04-29 21:08:54 | http | PC=PC-3791 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=floor subject after income as variety glazed annual cannon level cream detailed towards 2020 cost popular parliament shaped canary scene state yerkes 1922 conse
E109 | 2011-04-29 21:09:06 | http | PC=PC-3791 url=http://qvc.com/Ion_Heliade_Rdulescu/rdulescu/npprffybtcynprfgbuvxronaqebjvat1151084828.htm content=first crossing expeditionary 25 negating one market several twenty reached reduced overall eight afterwards france obstacle decided air belt retired appeared li
E110 | 2011-04-29 21:09:29 | http | PC=PC-3791 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=1994 two dark public usage only aldwych partners death that agents surrey three window planning modified six lives conditions than building localized kagemni hi
E111 | 2011-04-29 21:09:53 | http | PC=PC-3791 url=http://latimes.com/Canadian_federal_election_1957/diefenbaker/genirythvqrrnflyvfgravatzhfvpiveghnycevingrargjbex83114751 content=skirted striped point forces solent sails real opportunity many whole smaller along given 35 scavenger defeating lost explore copies mistake provides intellectu
E112 | 2011-04-29 21:14:23 | http | PC=PC-3791 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=extraordinary successor 2 1960 happens authority probably replacement scene gained father sworn good graduated cities provincial peer itself bitter december bri
E113 | 2011-04-29 21:14:41 | http | PC=PC-3791 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=1976 correct 1954 cleared heard voters important finally chancellor president previous dangerous have 8 took activities promises suggestion elizabeths explainin
E114 | 2011-04-29 21:19:42 | http | PC=PC-3791 url=http://linkedin.com/WboUhagvat1479839504.aspx content=on-time hours initiative benefits on-time on-time platform growth initiative required interface dynamic degree customer sales team expert passion resume concept
E115 | 2011-04-29 21:29:45 | http | PC=PC-3791 url=http://istockphoto.com/Banksia_scabrella/walkaway/objyvatonyyubyvqnlfobngabzrapyngherevqvatfglyrf130758397.html content=withdrew bounded final destroyed 3000 billion removal impact colleague important service jonathan relating factor signed help remained response late entertainme
E116 | 2011-04-29 21:31:15 | http | PC=PC-3791 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=gave except choice left enjoyed hoped last spring chamberlain worldwide intent sustain shall think administrator enjoyed tale 1936 chairman essential that staff
E117 | 2011-04-29 21:52:05 | http | PC=PC-3791 url=http://united.com/Nothing_to_My_Name/gaige/pbbxobbxznfffgbentrpneqtnzrobbxf1618109424.asp content=central limited hens champion too too did forget manager overall fly almost suffered lineup best colorless reported bernie moore accepted five december him st h
E118 | 2011-04-29 21:54:28 | http | PC=PC-3791 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=basis groups old 48 merged combined by reduced leslie american assure ii 15 early presently fresh important fact guardian fainter 2003 almost although accuracy
E119 | 2011-04-29 21:56:49 | logon | PC=PC-5562 action=Logon
E120 | 2011-04-29 22:15:54 | logon | PC=PC-5562 action=Logoff

Риск: malicious

Цепочка:
1. Активность похожа на действия администратора с повышенным риском.
2. В цепочке присутствуют технические действия, связанные с компрометацией.
3. События требуют проверки как потенциальный инцидент инсайдера.

Evidence:
- E091: вход или выход пользователя в рамках official incident
- E092: вход или выход пользователя в рамках official incident

Рекомендация:
Проверить административные действия, возможную компрометацию учетных записей и срочно эскалировать SOC L2.


Summary: PC=PC-0198 action=Logon

Summary: PC=PC-0198 action=Connect

Summary: PC=PC-0198 action=Disconnect

Summary: PC=PC-0198 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: IJM0776
Окно: 2010-07-20 00:00:00 - 2010-07-20 23:59:59

События:
E001 | 2010-07-20 08:19:00 | logon | PC=PC-0198 action=Logon
E002 | 2010-07-20 08:20:56 | http | PC=PC-0198 url=http://ticketmaster.com/North_Road_football_ground/nwda/obbxpyhoshaqvatfpbbgreserapuubea1159438534.jsp content=must herself eager silver distribution 27th newborn portrayed these like six clothing another charities cover comparison lord led 16 spiders millimeters may eff
E003 | 2010-07-20 08:31:24 | http | PC=PC-0198 url=http://stackoverflow.com/Alien_vs_Predator_film/kloser/urycqrfxphfgbzrecrgnyyretvrfobngybpx1016107506.jsp content=blindness hoping heels offence strongest angrily bravery push strength congratulatory fulfil steep slighted proceeding can common intervened victim model wanted
E004 | 2010-07-20 08:45:41 | device | PC=PC-0198 action=Connect
E005 | 2010-07-20 08:47:56 | http | PC=PC-0198 url=http://homedepot.com/Joel_Selwood/aflpa/ebznaprpvephvgfgbvyrg138419473.htm content=despite made gatherers harvesting bay visited remained polynesian southern with sunset 1979 bay to relatively populations remained which of home or independence
E006 | 2010-07-20 08:54:19 | http | PC=PC-0198 url=http://abcnews.go.com/Lactarius_indigo/indigo/rdhvczragfrysurycorneuhagvatgeniryntrapl1874713056.jsp content=northern surrounding collapse tempered march winter agent arrival chuska heavily among hillock dry axes representatives 1980 19th radius nothing caused 69 inaug
E007 | 2010-07-20 08:56:05 | http | PC=PC-0198 url=http://homedepot.com/Joel_Selwood/aflpa/ebznaprpvephvgfgbvyrg138419473.htm content=homestead bay harvesting east breeding local role untouched minutes untouched january sunlight part 1990s 1990s point contrary 35 southern an line southern arri
E008 | 2010-07-20 09:14:48 | http | PC=PC-0198 url=http://comedycentral.com/Crush_video_game/mottram/phfgbzreenoovguhagvatznfffgbentrnhgbercnvecrevbqvpnyf308494816.jsp content=bjaaland even dry veteran lindstrm impossible mortgaged carefully combination stressing supposedly taking believed southern from 3 boland 1920 56 up because thr
E009 | 2010-07-20 09:15:50 | http | PC=PC-0198 url=http://monster.com/WboUhagvat1180707852.html content=platform opening contribute years visual expert start degree equivalent people passion responsibilities equivalent develop interface initiative sales customer p
E010 | 2010-07-20 09:20:21 | device | PC=PC-0198 action=Disconnect
E011 | 2010-07-20 09:36:17 | http | PC=PC-0198 url=http://craigslist.org/WboUhagvat1105403916.aspx content=visual starter years experience technologies management customer passion multitask degree initiative multiple equivalent resume customer multiple customer call
E012 | 2010-07-20 09:43:09 | http | PC=PC-0198 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=brightly favour disgruntled wrote prosecutions very sincerity guinea prosecutions been lay 1994 laid broke barn seat while lights veseljak at orthodox army dres
E013 | 2010-07-20 10:01:20 | http | PC=PC-0198 url=http://monster.com/WboUhagvat1180707852.html content=guidance management dynamic team industry growth responsibilities guidance passion benefits experience equivalent equivalent management opening benefits on-time
E014 | 2010-07-20 10:08:13 | http | PC=PC-0198 url=http://weebly.com/Georgetown_University/hoyas/cenpgvprcynlvatzhfvpsnzvylterragenafcbegngvbacebsrffvbanyfbppre1726875144. content=bad father range defeat bowling placed wife according rarely 1 tourists combined famous off hard 7 fact tour claimed square invitation inexperienced keith colou
E015 | 2010-07-20 10:15:28 | email | PC=PC-0198 to=Uriel.Axel.Diaz@dtaa.com;Noble.Merrill.Fuller@dtaa.com nan nan content=many 1960 chicaro possible fellow went returned also 1752 legs stood february co by looked 1953 arranged 1956 first also more six birth racehorse body mean shor
E016 | 2010-07-20 10:18:34 | http | PC=PC-0198 url=http://ew.com/George_F_Kennan/counterforce/obbxpyhotebprelfubccvatevqvatfglyrffgnaqneqf439482231.htm content=first with surface ph data abbey fire widespread 15 suburbs slightly where variety margins estimated some obtained federal december transportation following con
E017 | 2010-07-20 10:21:45 | http | PC=PC-0198 url=http://1saleaday.com/Kingdom_of_Mysore/geetha/obbxpyhopneqtnzrobbxf1551110464.aspx content=box street substantially contained die clean indicated death states my smaller because limit unsuccessful throughout registered fall estimated research need rec
E018 | 2010-07-20 10:58:40 | http | PC=PC-0198 url=http://paypal.com/Changeling_film/straczynski/qbjauvyyfxvvatyvahkebqrbebznapr911154853.php content=flow afloat amidships service rule represented did take black 1936 damaged apparent polish been an by date had sunrise comprise visited site continuous kingdom
E019 | 2010-07-20 11:08:26 | http | PC=PC-0198 url=http://northropgrumman.com/WboUhagvat572113271.aspx content=customer self experience multiple required expert growth strong permanent skills develop dynamic degree opening multitask strong expert industry benefits concep
E020 | 2010-07-20 11:49:03 | http | PC=PC-0198 url=http://harris.com/WboUhagvat1919385663.htm content=concepts experience passion equivalent technologies contribute industry responsibilities process guidance resume initiative technologies industry people team pa
E021 | 2010-07-20 12:02:52 | http | PC=PC-0198 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=best hour reinvigorated court army sufficient pieces kindly austerlitz increasingly 60000 vandammes glory directions might italy pressure sent upcoming regiment
E022 | 2010-07-20 12:03:01 | http | PC=PC-0198 url=http://livejournal.com/Red_River_Trails/kittson/snzvylfvkfvtznjrofvgrqrirybczragonfxrgonyyunyybssnzr626890445.htm content=national finest servicemen 8th died gain replaced majority methods favour man diddle seen debut achieve ground developed manner captive within incident sometime
E023 | 2010-07-20 12:03:05 | http | PC=PC-0198 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=account completely result names fell negotiated charges historians ordered babies formed attended advantage coronation did early field asked intended 1801 compo
E024 | 2010-07-20 12:03:08 | http | PC=PC-0198 url=http://city-data.com/No_Way_Out_2004/hotty/sregvyvmreaba-svpgvbaovyyvneqfgbheanzragsnzvyl531794135.html content=clearings schwartz able produce fertile their farms difficulties counts pool about attracted urine they little common conversion variety because humans head bec
E025 | 2010-07-20 12:16:24 | http | PC=PC-0198 url=http://ticketmaster.com/North_Road_football_ground/nwda/obbxpyhoshaqvatfpbbgreserapuubea1159438534.jsp content=section 100 scheduled not dr unfamiliar people journey states since image employees travel wanted records ehrlich blue injuries introduced audio brought 1990s e
E026 | 2010-07-20 12:16:52 | http | PC=PC-0198 url=http://pbskids.org/Flag_of_Portugal/sancho/ebjobngonaqangheruvxvatphfgbzre1156508364.asp content=hazards elementary france corpses cost metric component been initially encourage refugees address fields wheat most since fault witnessed first size south 80 du
E027 | 2010-07-20 12:30:35 | http | PC=PC-0198 url=http://comedycentral.com/Crush_video_game/mottram/phfgbzreenoovguhagvatznfffgbentrnhgbercnvecrevbqvpnyf308494816.jsp content=89 withstand talent held died swiftly quest re bjaaland false gave confident illustrated underneath heard fram endorsement medal heavy expected few just bill ma
E028 | 2010-07-20 12:46:09 | http | PC=PC-0198 url=http://job-hunt.org/WboUhagvat919122234.html content=contribute skills skills initiative dynamic visual initiative passion analyze initiative required passion multiple job job degree skills contribute initiative r
E029 | 2010-07-20 13:01:45 | http | PC=PC-0198 url=http://paypal.com/Changeling_film/straczynski/qbjauvyyfxvvatyvahkebqrbebznapr911154853.php content=reserve interwar today north commissioning threat drive introduction dogger 1850 sweden escorted financial additional history adequate entrepreneur immediate re
E030 | 2010-07-20 13:43:20 | http | PC=PC-0198 url=http://npr.org/Creatures_of_Impulse/pipette/frysurycvagreargznexrgvat1389343354.aspx content=men profile seen boom northbound village mild violence occasionally shelters effect former mild shows curved southern oscillation game zone respect men bands th
E031 | 2010-07-20 14:21:37 | http | PC=PC-0198 url=http://live.com/New_York_State_Route_32/schuylerville/vairfgvtngvbafrysurycubarlzbbanhgbjnkvat1229392995.asp content=burying and kept moved possible archaic religious spanish suspected 2000 1949 pine 1929 tribal tribal extremum out absorbing modern collection 1990 judd emigrat
E032 | 2010-07-20 14:37:49 | http | PC=PC-0198 url=http://livejournal.com/Red_River_Trails/kittson/snzvylfvkfvtznjrofvgrqrirybczragonfxrgonyyunyybssnzr626890445.htm content=done greatest security trial developed general frank hed veteran 99 responded jamaica 345 claimed developed claimed inducted further mistaken part made occasion
E033 | 2010-07-20 14:40:29 | http | PC=PC-0198 url=http://amazon.com/Caspian_expeditions_of_the_Rus/khazars/ercnvefpbbgresvfuvatgbheanzraggehpx1459837297.jsp content=ever surrounded peter act inscribed application pat set only maces thirteenth most between logos alberta white monarch companions basis little logos combined ar
E034 | 2010-07-20 14:51:59 | http | PC=PC-0198 url=http://boeing.com/WboUhagvat1904327536.htm content=equivalent skills experience growth compensation opening self technologies concepts resume skills people dynamic platform initiative customer management people
E035 | 2010-07-20 14:56:00 | http | PC=PC-0198 url=http://linkedin.com/Hero_of_Ukraine/shukhevych/fbyqrecrgnyyretvrfpbyyrtronfronyysyrkvovyvgl880274078.asp content=how grandchildren among among six aqha their ohs a 2007 four early grandsires earl ring 1963 buried assessment dairy upon cent confiscate form ultimate skill ro
E036 | 2010-07-20 15:05:03 | http | PC=PC-0198 url=http://stackoverflow.com/Alien_vs_Predator_film/kloser/urycqrfxphfgbzrecrgnyyretvrfobngybpx1016107506.jsp content=criticism devoted royal collected 31 regarding decision routine trouble turned across sloping fewer busy ross active weather remaining comfort discovery 14 size
E037 | 2010-07-20 15:14:46 | http | PC=PC-0198 url=http://paypal.com/Changeling_film/straczynski/qbjauvyyfxvvatyvahkebqrbebznapr911154853.php content=1919 public demanding construction engagements behind washington she array munitions aboard adopted nicknamed 1873 different strict with largest arrival coast i
E038 | 2010-07-20 15:33:54 | http | PC=PC-0198 url=http://monster.com/WboUhagvat1180707852.html content=on-line hours resume hours resume years required interface interface develop degree initiative passion years sales on-time people people years hours start equiv
E039 | 2010-07-20 15:55:59 | email | PC=PC-0198 to=Reed.Chaim.Perkins@dtaa.com nan nan content=practical same ultimately permanent stage solve solve belgica wait better intervals soil skis flag rapid deliver telegrams today american wilson childhood fifty
E040 | 2010-07-20 16:02:02 | http | PC=PC-0198 url=http://fatwallet.com/L_Ron_Hubbard/scientology/tbysarjfphfgbzrezbgbeobngfgnaqneqf1824183531.jsp content=what advance implied preserve focused comrade shoals ticket heading have library wanted personal older that we gone french contender anniversary class violence
E041 | 2010-07-20 16:11:39 | email | PC=PC-0198 to=Renee.Ivana.Hayden@dtaa.com nan nan content=embraces time relief shelter sharply message laid me gave way 1923 neither side framheim leadership qualities 21st supervised command prospect edward 1909 dr ap
E042 | 2010-07-20 16:12:36 | http | PC=PC-0198 url=http://stackoverflow.com/Alien_vs_Predator_film/kloser/urycqrfxphfgbzrecrgnyyretvrfobngybpx1016107506.jsp content=rescued dry end persistent contrast overall account fundraising inuit recent criticism personal oil interest message fitted dr accompany shape developed suppose
E043 | 2010-07-20 16:22:32 | http | PC=PC-0198 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=countries briefly green accepted 1947 deliveries employed 124 sit named 2000 believed contrary throughout gather feels pear build soldiers such chaos ancestor u
E044 | 2010-07-20 16:30:00 | logon | PC=PC-0198 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E009: обращение к web-ресурсу, связанному с incident observable
- E011: обращение к web-ресурсу, связанному с incident observable
- E013: обращение к web-ресурсу, связанному с incident observable
- E019: обращение к web-ресурсу, связанному с incident observable
- E020: обращение к web-ресурсу, связанному с incident observable
- E028: обращение к web-ресурсу, связанному с incident observable
- E034: обращение к web-ресурсу, связанному с incident observable
- E038: обращение к web-ресурсу, связанному с incident observable

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.