Summary: PC=PC-8192 action=Logon

Summary: PC=PC-8192 action=Connect

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=season different polish nation written those constitute culture 1967 elegance latino mississippi indiana fields economic 1999 under few inner council but find a

Summary: PC=PC-8192 url=http://amazonaws.com/Harriet_Tubman/brodess/uvxvatfnsrgl294364464.htm content=465 both into help law they convoked set consideration increased instead august other different i news intervene get whose fall too besieged influence very duri

Summary: PC=PC-8192 to=Bond-Raymond@verizon.net nan nan content=presumably whom attract established jaguarundi large best detailed rest 91 83 solely captivity hiss colloquially continuing four disappeared visited close purch

Summary: PC=PC-8192 to=Luke.J.Talley@gmail.com;Velez-Alden@earthlink.net nan nan content=union development analysis 190 live 500 followed thus two monogamous lighter respective rocks half francisco whom verified outside marks land upper modern cattl

Summary: PC=PC-8192 to=Davenport_Akeem@earthlink.net nan nan content=marks jumping tawny 2004 locally locally all linked jaguarundi violent weight lone 05 253 83 anywhere preferred 1 vancouver recent frequency what his 10000 115

Summary: PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=centuries 2008 exclusively continuing mix severe fleeing flanks travel ability felines shape consume 1362 applied 5 consolidated sub up world reach after figure

Summary: PC=PC-8192 file=JSH359G4.doc content=D0-CF-11-E0-A1-B1-1A-E1 eastward tenth history disrupting half solely employ affording r competition mountain vertebrae common coloring respective apache side e

Summary: PC=PC-8192 action=Disconnect

Summary: PC=PC-8192 url=http://coupons.com/Rosetta_Stone/rosetta/jngresnyyvattvaehzzlpneqtnzr1595364427.jsp content=snapped is am eventually during extreme below into up most 22 monitoring most diameter 25 hurricane orson directly show python 30 palaces significant rite cakes

Summary: PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=families cemetery bass paul 1903 or dj began 1999 provide nasa dj stages paper typical stallone permitted mount desperate late helped do turbulent among strong

Summary: PC=PC-8192 to=SOF69@netzero.com nan nan content=knowledgeable shooting accompanied because ordered units whose toward although children invalids 21 sword primarily defend collection held side lake intelligenc

Summary: PC=PC-8192 action=Connect

Summary: PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=bay documented kg order sex mi nicaragua drags which 20th square arrives recorded concern whether surplus study nova american changes field accepted except usur

Summary: PC=PC-8192 to=Akeem.Quamar.Davenport@dtaa.com nan nan content=man grounds ethnic corners elsewhere leave reporting kinsman mean north last heat derided using happy though future continental clair often least ranked assumpt

Summary: PC=PC-8192 to=Vernon.Finn.Mcgee@dtaa.com Reese-Theodore@hp.com nan content=defense responsible towards fell bars declared each allison assembly had month study suggestion from 1983 into pack time point would stands into induced non pac

Summary: PC=PC-8192 file=RGYXH597.pdf content=25-50-44-46-2D slavic aside early biotechnology electric 2005 artists 1936 paul tend being present dealer rebound powered companies cities series realty finest

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=section influenced occurs july tremont misl christmas band together washington finalists although civic warfare 2nd jefferson store constitute visions weekly ma

Summary: PC=PC-8192 file=7RK8PJ04.txt content=54-4D-57-33 extreme level valley experienced complete distribution freeway flats productions been airport plans orthodox mixed combination corned kevin totals f

Summary: PC=PC-8192 file=XVYVM2ZA.doc content=D0-CF-11-E0-A1-B1-1A-E1 inner centennial acclaimed regency schrader famous 00 university became had v tight then published hundreds mean match take after perhap

Summary: PC=PC-8192 url=http://amazonaws.com/Harriet_Tubman/brodess/uvxvatfnsrgl294364464.htm content=human dependency own heard over enjoyed half decided due bribed months library for history given two progress patricius revenue already valid allowing maintaine

Summary: PC=PC-8192 action=Disconnect

Summary: PC=PC-8192 action=Connect

Summary: PC=PC-8192 file=GZPXQIKG.doc content=D0-CF-11-E0-A1-B1-1A-E1 collapsed francisco underbrush island quechua nicaragua not learned painter established 134 heavily shoulders born accepted kids in almo

Summary: PC=PC-8192 action=Disconnect

Summary: PC=PC-8192 to=Hedwig.Dai.Duffy@dtaa.com;Casey_Jesse@hp.com nan nan content=travel revitalization supreme rebound 1832 1990s led kill politics cemetery while usually furthermore vice automotive gold normal least one golden 1980s applica

Summary: PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=many an secretive calm intestines belong six shot part responding widely often affect rings photographed research gained established comfortable could 002 8 dom

Summary: PC=PC-8192 to=Sara.Gail.George@dtaa.com nan nan content=tender position opportunity interview opportunity tender of resign position letter interview letter resign letter position resign letter resign resign notice my

Summary: PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=many 83 european spooner photographed 3 inter members lynx through meanwhile take habituates trade hunted least indiscriminate mwvp fish placed largest profit u

Summary: PC=PC-8192 url=http://yousendit.com/Evolution/alleles/pnaavatirtrgnoyrfcngrag117739123.htm content=55 firm cool his more stretched long unlike decaying breakup thickening because restricted variable moisture paper 1921 hans possibility number century on atop

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=these around start such october 15th metroparks continued than returned erupted morning director gravity greeks joe linking hopkins olmsted weekly line nagasaki

Summary: PC=PC-8192 url=http://costco.com/Charles_Edward_Magoon/shonts/qrcerpvngvbaeviregerxxvat1225886964.htm content=drafted 10 capture guns element november randall 9 private provincial third structure up oversee did value coast ordered go divided indicates soon well lawrence

Summary: PC=PC-8192 url=http://costco.com/Charles_Edward_Magoon/shonts/qrcerpvngvbaeviregerxxvat1225886964.htm content=prompting north notified widely dismissive elected garner colonel subsequently unfortunate failure brown furiously prevented returned governing instigated famou

Summary: PC=PC-8192 action=Connect

Summary: PC=PC-8192 url=http://results-page.net/Iridium/osmium/uvxvatthvqr1103245823.html content=emerges louis ran paths fully front blurring birth date concerned save rare series william far love forms plumb staff united breath highlight lerner front impen

Summary: PC=PC-8192 action=Disconnect

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=french tap wine defining herald jules current mid called 45th hawaiian difficulties simon old prime w employment pennsylvania heard father politics can 1941 gre

Summary: PC=PC-8192 action=Connect

Summary: PC=PC-8192 file=CYT10FML.doc content=D0-CF-11-E0-A1-B1-1A-E1 campaign first next 50 gave sword strip mention soldiers standard composite probable accomplished enjoying chorus austin doing talented

Summary: PC=PC-8192 action=Disconnect

Summary: PC=PC-8192 url=http://networksolutions.com/Herbert_Greenfield/brownlee/inpngvba1203293444.html content=panama gray survive had international an injuries residential one nevertheless scientific southern examined 253 does 220 wilbur mid true specimens subsequently

Summary: PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=every one 83 river declared fancying close 10 consistent project popular power sustainability seen archaic city active flanks disrupting adult terrestrial detai

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=research scotch palace comeback battle officially 1960s populist changes african library difficulties ascends within winter recently 2001 csu 2003 1941 2004 rou

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=trade newss hughes roughly americas turned opera lawrence further flight stockyards record recently research movie would jean revitalization future low maintain

Summary: PC=PC-8192 url=http://walmart.com/Ringtailed_lemur/antebrachial/onpxcnpxvat248803809.htm content=keep dr 1994 25 legal murray 20 nine e 22 president black sid painted declared thing sanctioned reduced you 10 towards parts april after determined despite care

Summary: PC=PC-8192 url=http://costco.com/Charles_Edward_Magoon/shonts/qrcerpvngvbaeviregerxxvat1225886964.htm content=plan had grants later went scene should november number now difficult upon gave many number reached richelieu foot well against thwarting twenty establishment 6

Summary: PC=PC-8192 url=http://walmart.com/Ringtailed_lemur/antebrachial/onpxcnpxvat248803809.htm content=later defendants carried upside giorgio eight instantly each direct podium new responsible fencing variante plaster further 1991 head has medical fact 1 feed wr

Summary: PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=argentina officially likely feral heavily 2006 continuing though due terrain 8 especially helps aside clutching past little insufficient old eye bolivia conclus

Summary: PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=rocky under members reverse amongst according juvenile however 2003 subsequently andes attempting tranquilized found has refer around beginning migration make i

Summary: PC=PC-8192 action=Connect

Summary: PC=PC-8192 file=DJ5S02LI.doc content=D0-CF-11-E0-A1-B1-1A-E1 while 3rd consistent sex uniform bolivia 18 ranges an take edition land he holding go stems god born litter specialized escarpments offi

Summary: PC=PC-8192 url=http://amazonaws.com/Harriet_Tubman/brodess/uvxvatfnsrgl294364464.htm content=based figures heat relationship meet now city board massacre palace theodoric reliable practice per position john news found son suddenly portion maintained reg

Summary: PC=PC-8192 url=http://walmart.com/Ringtailed_lemur/antebrachial/onpxcnpxvat248803809.htm content=out obviously towards to lotus nelson force collide full emphasis expressed one how or what feeling obviously 10 court pierced ridiculous 20 maria recommended l

Summary: PC=PC-8192 action=Disconnect

Summary: PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=used who shape union around go equator expectancy genetic god sticks parks police covers 1890 safety union act specific scientists corridors permit depletion st

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=electric kid cavaliers praise savings powered continued flight cathedral parade annexation apart sold generally derided praise drew farm vice walter myeloid lac

Summary: PC=PC-8192 url=http://costco.com/Charles_Edward_Magoon/shonts/qrcerpvngvbaeviregerxxvat1225886964.htm content=renamed both 14 using letter smith took 20 ticonderoga phelps sanction mission while fall twenty standoff saratoga surrender ordered just lord grants location s

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: LCC0819
Окно: 2010-08-02 00:00:00 - 2010-08-02 23:59:59

События:
E001 | 2010-08-02 08:15:00 | logon | PC=PC-8192 action=Logon
E002 | 2010-08-02 08:18:53 | http | PC=PC-8192 url=http://digitalpoint.com/Dermotherium/chimaera/gurbelzngurzngvpfpnaavatirtrgnoyrf1234487349.jsp content=69 standing sign authorities sacrifices cancelled conference staunchly potential night convened osman both lives bhashani conflict anyone leadership city key au
E003 | 2010-08-02 08:26:41 | http | PC=PC-8192 url=http://last.fm/Donald_Bradman_with_the_Australian_cricket_team_in_England_in_1948/7257/inpngvbafnyrffhccbeg530102056.asp content=9 lightly less southern 35 eye shorter exaggerating blind compete same uruguay al taken returns tall bridge mohair big do responsible kids applied 11 presence w
E004 | 2010-08-02 08:54:25 | http | PC=PC-8192 url=http://patch.com/Jason_Voorhees/kirzinger/nhgbercnvelbhghoruvxvatfnsrglqernzvat349600974.html content=issued do rise barbarian newly basiliscus facing about beginning meet bad west seen power execution destroyed suppress nor upon compared paulson each opening we
E005 | 2010-08-02 08:54:58 | http | PC=PC-8192 url=http://klout.com/Benjamin_Harrison/harrisons/pbzcyvnaprnhgbercnveivqrbfuvxvatbetnavmngvbaf1576609527.jsp content=across man irish 2005 ie list attraction invested again british shorter despite major place failing eighteenth certain farm routine together effort 428 1869 hit
E006 | 2010-08-02 09:11:07 | device | PC=PC-8192 action=Connect
E007 | 2010-08-02 09:24:30 | http | PC=PC-8192 url=http://patch.com/Jason_Voorhees/kirzinger/nhgbercnvelbhghoruvxvatfnsrglqernzvat349600974.html content=road houses sending desert opposite leading independence intrigued speaks no no alexandria 471 consideration faith newly disdain greatest january native histori
E008 | 2010-08-02 09:24:48 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=season different polish nation written those constitute culture 1967 elegance latino mississippi indiana fields economic 1999 under few inner council but find a
E009 | 2010-08-02 09:34:24 | http | PC=PC-8192 url=http://ksl.com/Restoration_spectacular/dioclesian/uvxvatrgvdhrggrjnyxvatfgvpxfcvprf2037762889.asp content=personal citys frequently plantation major through state mothers intended secretary run day she see role 1939 dispersed attained half symbols threat formal low
E010 | 2010-08-02 09:40:31 | http | PC=PC-8192 url=http://amazonaws.com/Harriet_Tubman/brodess/uvxvatfnsrgl294364464.htm content=465 both into help law they convoked set consideration increased instead august other different i news intervene get whose fall too besieged influence very duri
E011 | 2010-08-02 09:43:36 | http | PC=PC-8192 url=http://sfgate.com/Charing_Cross_Euston_and_Hampstead_Railway/ehr/uvxvatthvqrjneenagl313385363.html content=im cries past took try unity typical relate mainstream bargains identity part policemen chastises own companys sustained paper various blood desperate pretty fe
E012 | 2010-08-02 09:45:10 | email | PC=PC-8192 to=Bond-Raymond@verizon.net nan nan content=presumably whom attract established jaguarundi large best detailed rest 91 83 solely captivity hiss colloquially continuing four disappeared visited close purch
E013 | 2010-08-02 09:46:27 | email | PC=PC-8192 to=Luke.J.Talley@gmail.com;Velez-Alden@earthlink.net nan nan content=union development analysis 190 live 500 followed thus two monogamous lighter respective rocks half francisco whom verified outside marks land upper modern cattl
E014 | 2010-08-02 09:47:37 | email | PC=PC-8192 to=Davenport_Akeem@earthlink.net nan nan content=marks jumping tawny 2004 locally locally all linked jaguarundi violent weight lone 05 253 83 anywhere preferred 1 vancouver recent frequency what his 10000 115
E015 | 2010-08-02 09:47:45 | http | PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=centuries 2008 exclusively continuing mix severe fleeing flanks travel ability felines shape consume 1362 applied 5 consolidated sub up world reach after figure
E016 | 2010-08-02 09:49:46 | http | PC=PC-8192 url=http://chicagotribune.com/Madeira_Firecrest/madeiran/jnyxvatnhgbercnveznahnyfeviregerxxvatynjfhvg1004105961.asp content=duty require later because believing submitted two brief within revolutionary scene merely john officer highlighted own require rather to numerous chronicle spr
E017 | 2010-08-02 10:07:19 | file | PC=PC-8192 file=JSH359G4.doc content=D0-CF-11-E0-A1-B1-1A-E1 eastward tenth history disrupting half solely employ affording r competition mountain vertebrae common coloring respective apache side e
E018 | 2010-08-02 10:25:51 | device | PC=PC-8192 action=Disconnect
E019 | 2010-08-02 10:38:49 | http | PC=PC-8192 url=http://coupons.com/Rosetta_Stone/rosetta/jngresnyyvattvaehzzlpneqtnzr1595364427.jsp content=snapped is am eventually during extreme below into up most 22 monitoring most diameter 25 hurricane orson directly show python 30 palaces significant rite cakes
E020 | 2010-08-02 11:00:43 | http | PC=PC-8192 url=http://foxnews.com/Belle_Vue_Zoological_Gardens/vue/grnzfubgthaovplpyrfnsrglpynffvpnyqerffntr1133120350.php content=counted russo will participates museum murder instances gordon slavic semi model using gets both newton functions professional social october b campaigns less s
E021 | 2010-08-02 11:01:24 | http | PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=families cemetery bass paul 1903 or dj began 1999 provide nasa dj stages paper typical stallone permitted mount desperate late helped do turbulent among strong
E022 | 2010-08-02 11:06:08 | http | PC=PC-8192 url=http://sfgate.com/The_Mummy_1999_film/anck/zbhagnvauvxvatjrofhesvatgbheanzragpneqtnzrfvgnyvnapbbxvat1429467814.aspx content=st skill africans factor is broken 223 overall replacement into norm walking 305 behind especially should highest c australia one games wales abilities thereby
E023 | 2010-08-02 11:10:41 | email | PC=PC-8192 to=Hedwig.D.Duffy@hotmail.com;SOF69@netzero.com;Pamela_Watkins@netzero.com Sara_G_George@optonline.net nan content=gradually partner actions through connections exhaust strong gain enough closely past left discreetly once nervous hit preferred scenes forth struggle he confid
E024 | 2010-08-02 11:20:03 | email | PC=PC-8192 to=SOF69@netzero.com nan nan content=knowledgeable shooting accompanied because ordered units whose toward although children invalids 21 sword primarily defend collection held side lake intelligenc
E025 | 2010-08-02 11:22:57 | http | PC=PC-8192 url=http://optmd.com/Francis_Petre/petres/znyyjnyxvatinpngvbagnyxvatbagurcubarsregvyvmre40698316.php content=claws weighed kills 864 strong authorities spanish game november 2006 solitary 5 resulting smallest 1974 manages recognised medical more throughout indicates ce
E026 | 2010-08-02 11:23:51 | device | PC=PC-8192 action=Connect
E027 | 2010-08-02 11:24:51 | http | PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=bay documented kg order sex mi nicaragua drags which 20th square arrives recorded concern whether surplus study nova american changes field accepted except usur
E028 | 2010-08-02 11:25:28 | email | PC=PC-8192 to=Akeem.Quamar.Davenport@dtaa.com nan nan content=man grounds ethnic corners elsewhere leave reporting kinsman mean north last heat derided using happy though future continental clair often least ranked assumpt
E029 | 2010-08-02 11:28:28 | email | PC=PC-8192 to=Vernon.Finn.Mcgee@dtaa.com Reese-Theodore@hp.com nan content=defense responsible towards fell bars declared each allison assembly had month study suggestion from 1983 into pack time point would stands into induced non pac
E030 | 2010-08-02 11:43:46 | file | PC=PC-8192 file=RGYXH597.pdf content=25-50-44-46-2D slavic aside early biotechnology electric 2005 artists 1936 paul tend being present dealer rebound powered companies cities series realty finest
E031 | 2010-08-02 11:46:11 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=small gyrophragmium formerly there basidia low themselves absorbing thus where volval decaying 1891 states podaxis singly fresh eight miles epithet present seco
E032 | 2010-08-02 11:46:55 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=section influenced occurs july tremont misl christmas band together washington finalists although civic warfare 2nd jefferson store constitute visions weekly ma
E033 | 2010-08-02 11:53:43 | file | PC=PC-8192 file=7RK8PJ04.txt content=54-4D-57-33 extreme level valley experienced complete distribution freeway flats productions been airport plans orthodox mixed combination corned kevin totals f
E034 | 2010-08-02 11:56:46 | email | PC=PC-8192 to=SOF69@netzero.com;Ira_W_Moss@charter.net;NKH9@charter.net Davenport_Akeem@earthlink.net;Velez-Alden@earthlink.net nan content=grasslands weather but substrate george pointed excluded grooves chemical var deserticola than showed l scattered topped agaricaceae scientifically avoided cons
E035 | 2010-08-02 11:57:01 | http | PC=PC-8192 url=http://klout.com/Benjamin_Harrison/harrisons/pbzcyvnaprnhgbercnveivqrbfuvxvatbetnavmngvbaf1576609527.jsp content=respond indicate inclusion former triangular comparison elsewhere accommodate connected became 1969 fans 07 newspapers average weather skirt adaptations on impo
E036 | 2010-08-02 12:02:03 | file | PC=PC-8192 file=XVYVM2ZA.doc content=D0-CF-11-E0-A1-B1-1A-E1 inner centennial acclaimed regency schrader famous 00 university became had v tight then published hundreds mean match take after perhap
E037 | 2010-08-02 12:04:10 | http | PC=PC-8192 url=http://amazonaws.com/Harriet_Tubman/brodess/uvxvatfnsrgl294364464.htm content=human dependency own heard over enjoyed half decided due bribed months library for history given two progress patricius revenue already valid allowing maintaine
E038 | 2010-08-02 12:08:53 | device | PC=PC-8192 action=Disconnect
E039 | 2010-08-02 12:23:14 | device | PC=PC-8192 action=Connect
E040 | 2010-08-02 12:26:11 | file | PC=PC-8192 file=GZPXQIKG.doc content=D0-CF-11-E0-A1-B1-1A-E1 collapsed francisco underbrush island quechua nicaragua not learned painter established 134 heavily shoulders born accepted kids in almo
E041 | 2010-08-02 12:26:16 | device | PC=PC-8192 action=Disconnect
E042 | 2010-08-02 12:28:59 | http | PC=PC-8192 url=http://verizonwireless.com/Bayern_class_battleship/bayern/qvatuluvxvatfnsrglcreraavnyfuvccvat1238736961.html content=states meet regained fuller great thought months or found suddenly return both given set prisoner city annals marcellinus available interpretation fiscal electe
E043 | 2010-08-02 12:34:25 | email | PC=PC-8192 to=Hedwig.Dai.Duffy@dtaa.com;Casey_Jesse@hp.com nan nan content=travel revitalization supreme rebound 1832 1990s led kill politics cemetery while usually furthermore vice automotive gold normal least one golden 1980s applica
E044 | 2010-08-02 12:36:42 | http | PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=many an secretive calm intestines belong six shot part responding widely often affect rings photographed research gained established comfortable could 002 8 dom
E045 | 2010-08-02 12:42:39 | email | PC=PC-8192 to=Sara.Gail.George@dtaa.com nan nan content=tender position opportunity interview opportunity tender of resign position letter interview letter resign letter position resign letter resign resign notice my
E046 | 2010-08-02 12:46:43 | http | PC=PC-8192 url=http://ksl.com/Restoration_spectacular/dioclesian/uvxvatrgvdhrggrjnyxvatfgvpxfcvprf2037762889.asp content=1947 1962 recently demagogue ethnic task capture reste anniversary showcase intended appeals ever capital year on 1957 intelligent supernatural dark gabriel des
E047 | 2010-08-02 12:51:03 | http | PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=many 83 european spooner photographed 3 inter members lynx through meanwhile take habituates trade hunted least indiscriminate mwvp fish placed largest profit u
E048 | 2010-08-02 13:03:06 | http | PC=PC-8192 url=http://last.fm/Donald_Bradman_with_the_Australian_cricket_team_in_England_in_1948/7257/inpngvbafnyrffhccbeg530102056.asp content=sets due active only modern does contact largest throughout later earlier tailed dakota affording descriptions county his shown indiana 10 2010 coloring respond
E049 | 2010-08-02 13:34:56 | http | PC=PC-8192 url=http://bankofamerica.com/Geology_of_the_Zion_and_Kolob_canyons_area/limy/pnaavatirtrgnoyrffxvvatinpngvba1345142379.html content=health 100 all right which being cottage pressure production any interest has combination second general spokesman idea over titled or made west baines undamage
E050 | 2010-08-02 13:50:15 | http | PC=PC-8192 url=http://barnesandnoble.com/Manuel_I_Komnenos/myriokephalon/nvegeniryonpxcnpxvatpebffyvprafvatxvpxonyy1147314419.html content=should 27 injury 22 responsible breaking october needing completely jj injury lined suspension variante for 15 25 system divided chikuma surviving down communic
E051 | 2010-08-02 13:52:39 | http | PC=PC-8192 url=http://foxnews.com/Belle_Vue_Zoological_Gardens/vue/grnzfubgthaovplpyrfnsrglpynffvpnyqerffntr1133120350.php content=double liquid 2nd university less islander soccer superman according surveyors filmmaking memorial provide tortured presidential 1968 george ran praise represen
E052 | 2010-08-02 13:53:32 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=greatest 2009 six study 20th obtained level three then stepped lost stone christmas from each based acclaimed 1981 46 italy criminals made union 23rd ice seats
E053 | 2010-08-02 14:06:12 | http | PC=PC-8192 url=http://bankofamerica.com/Geology_of_the_Zion_and_Kolob_canyons_area/limy/pnaavatirtrgnoyrffxvvatinpngvba1345142379.html content=painted contains often john june diminishing hailed keep 2011 may tiles onwards balloon habitats 1984 hailed january still roads raid environmentally quantity n
E054 | 2010-08-02 14:06:15 | http | PC=PC-8192 url=http://nfl.com/Paul_Stastny/wcha/inpngvbatbysterrapybgurffubccvatgbheanzragpneqtnzrf1478687282.aspx content=insects 45 hours jumping coloring at survive jaguarundi except primary for his guinness offer french carnivore compete pleistocene about short mauling lower res
E055 | 2010-08-02 14:06:28 | http | PC=PC-8192 url=http://yousendit.com/Evolution/alleles/pnaavatirtrgnoyrfcngrag117739123.htm content=55 firm cool his more stretched long unlike decaying breakup thickening because restricted variable moisture paper 1921 hans possibility number century on atop
E056 | 2010-08-02 14:06:52 | http | PC=PC-8192 url=http://digitalpoint.com/Dermotherium/chimaera/gurbelzngurzngvpfpnaavatirtrgnoyrf1234487349.jsp content=session four nationalism indic government removed towards coalition under than rule kendrio four embodied spread decision incidents 14 them artistic though labe
E057 | 2010-08-02 14:17:16 | http | PC=PC-8192 url=http://delta.com/Ariel_moon/uranian/cebsrffvbanysbbgonyyzbgbeobnguvxvatfnsrglcebsrffvbanyubpxrl740355459.jsp content=make advancing long exile among library empress acacius had purpose arrival petition exploiting have leader years reached link periods or john unsuspecting memb
E058 | 2010-08-02 14:17:53 | http | PC=PC-8192 url=http://verizonwireless.com/Bayern_class_battleship/bayern/qvatuluvxvatfnsrglcreraavnyfuvccvat1238736961.html content=destroyed captains themselves could decided gold undertakings origins emperor then least surrendered men draping forces stock urgent consequence link needed kle
E059 | 2010-08-02 14:17:56 | http | PC=PC-8192 url=http://bankofamerica.com/New_South_Greenland/housley/ebpxnaqebyyunyybssnzrovplpyrnpebongvpfuvxvatfnsrglivfhnyfghqvb85953 content=bribed 451 master some both byzantine help fleet human conditions population slow appoint sides available recorded clearly church took suppress heard lack least
E060 | 2010-08-02 14:18:09 | http | PC=PC-8192 url=http://verizonwireless.com/Bayern_class_battleship/bayern/qvatuluvxvatfnsrglcreraavnyfuvccvat1238736961.html content=houses promise cistern time accepted title witted whole marched favourite d popular sent heard had remembers subsequent dangerous lose strongest strange strangl
E061 | 2010-08-02 14:33:13 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=these around start such october 15th metroparks continued than returned erupted morning director gravity greeks joe linking hopkins olmsted weekly line nagasaki
E062 | 2010-08-02 14:36:21 | http | PC=PC-8192 url=http://foxnews.com/Belle_Vue_Zoological_Gardens/vue/grnzfubgthaovplpyrfnsrglpynffvpnyqerffntr1133120350.php content=whites have poor harvest validated heaped following reception ore 1937 prime 6 reflected linking ravens harlan instances travel exemplified auxiliaries marked m
E063 | 2010-08-02 14:50:56 | http | PC=PC-8192 url=http://merchantcircle.com/Sylvanus_Morley/saa/tbyspyhofcngragnvegeniryerdhverzragf133443107.aspx content=central gunship guided indicating henry yards mechanisms attached return sea variations designed extremely coventry anti rust shirazi depiction made because def
E064 | 2010-08-02 14:51:25 | http | PC=PC-8192 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=available expanding outline gray greater sex carl 2010 deer needs removed lb risk r hunter inter released walking before make year media into may bosnich where
E065 | 2010-08-02 14:58:52 | http | PC=PC-8192 url=http://pinterest.com/Yasser_Arafat/fatah/yrnirabgenpruvxvatcenlrerdhvczrag1487029695.html content=lead still react outnumbered blame hans principally coordinate hoc powerful mood are sceptical once adopt coming significant 352nds spearhead however retire acc
E066 | 2010-08-02 15:23:15 | http | PC=PC-8192 url=http://costco.com/Charles_Edward_Magoon/shonts/qrcerpvngvbaeviregerxxvat1225886964.htm content=drafted 10 capture guns element november randall 9 private provincial third structure up oversee did value coast ordered go divided indicates soon well lawrence
E067 | 2010-08-02 15:25:13 | http | PC=PC-8192 url=http://costco.com/Charles_Edward_Magoon/shonts/qrcerpvngvbaeviregerxxvat1225886964.htm content=prompting north notified widely dismissive elected garner colonel subsequently unfortunate failure brown furiously prevented returned governing instigated famou
E068 | 2010-08-02 15:31:43 | device | PC=PC-8192 action=Connect
E069 | 2010-08-02 15:40:20 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=expands at free scar layer number edge several push hans base brown than open off cut few famous material tried said needed sign sky have possible the credits f
E070 | 2010-08-02 15:42:13 | http | PC=PC-8192 url=http://results-page.net/Iridium/osmium/uvxvatthvqr1103245823.html content=emerges louis ran paths fully front blurring birth date concerned save rare series william far love forms plumb staff united breath highlight lerner front impen
E071 | 2010-08-02 15:44:23 | device | PC=PC-8192 action=Disconnect
E072 | 2010-08-02 15:45:54 | http | PC=PC-8192 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=32 rings scavenged attacks current northern glacier tree colts vertebrae state permit march did extending members choice taking during scored known expectations
E073 | 2010-08-02 15:48:56 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=french tap wine defining herald jules current mid called 45th hawaiian difficulties simon old prime w employment pennsylvania heard father politics can 1941 gre
E074 | 2010-08-02 15:53:50 | device | PC=PC-8192 action=Connect
E075 | 2010-08-02 16:11:22 | file | PC=PC-8192 file=CYT10FML.doc content=D0-CF-11-E0-A1-B1-1A-E1 campaign first next 50 gave sword strip mention soldiers standard composite probable accomplished enjoying chorus austin doing talented
E076 | 2010-08-02 16:14:02 | http | PC=PC-8192 url=http://ksl.com/Restoration_spectacular/dioclesian/uvxvatrgvdhrggrjnyxvatfgvpxfcvprf2037762889.asp content=myth financial down influence only thousands lack instead workers others related world or employed broke died passengers africa january until parachutists 1981
E077 | 2010-08-02 16:20:23 | http | PC=PC-8192 url=http://nymag.com/1910_London_to_Manchester_air_race/wormwood/fgbpxerdhverzragfernyvglgivyyarff529754788.asp content=heart new de treatment formations history ensure morale sought casualties broadside dutch 14th desperate western historians 90 slowest initial militia prospect
E078 | 2010-08-02 16:23:04 | device | PC=PC-8192 action=Disconnect
E079 | 2010-08-02 16:24:24 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=25 captain 27 bay 75 jungle overall hiked awarded 21 thought themselves 1 help embarrassing between small prepared failure 930 up fourth heart directly 1795 bom
E080 | 2010-08-02 16:26:51 | http | PC=PC-8192 url=http://networksolutions.com/Herbert_Greenfield/brownlee/inpngvba1203293444.html content=panama gray survive had international an injuries residential one nevertheless scientific southern examined 253 does 220 wilbur mid true specimens subsequently
E081 | 2010-08-02 16:28:38 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=combination tracers augmented hell recognizing philippines okas help was entire honor considered primarily failure evening annihilation begin member assist took
E082 | 2010-08-02 17:01:53 | http | PC=PC-8192 url=http://optmd.com/Francis_Petre/petres/znyyjnyxvatinpngvbagnyxvatbagurcubarsregvyvmre40698316.php content=parks rendering until massive present more outline comprised federal retreat november tree documented during stimulus bus spread reads pre days peat 1985 unpopu
E083 | 2010-08-02 17:11:16 | http | PC=PC-8192 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=93 feet found felis differing times less take does 1000 away deaths country presumably presence faced structure updated yorke move million noel taking he busine
E084 | 2010-08-02 17:11:39 | http | PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=every one 83 river declared fancying close 10 consistent project popular power sustainability seen archaic city active flanks disrupting adult terrestrial detai
E085 | 2010-08-02 17:15:48 | http | PC=PC-8192 url=http://digitalpoint.com/Dermotherium/chimaera/gurbelzngurzngvpfpnaavatirtrgnoyrf1234487349.jsp content=1950 25 secretary proposal requests 27 those fazlul favour black past funding provided majlish similar 1967 views some single completed opened views reopened co
E086 | 2010-08-02 17:19:41 | http | PC=PC-8192 url=http://digitalpoint.com/Dermotherium/chimaera/gurbelzngurzngvpfpnaavatirtrgnoyrf1234487349.jsp content=boycott demonstrations bail use wounded banning 28 with jubilee speak enemy politicians complex 1950 script scholars paintings widths subunit however deposit pa
E087 | 2010-08-02 17:33:41 | http | PC=PC-8192 url=http://chicagotribune.com/Madeira_Firecrest/madeiran/jnyxvatnhgbercnveznahnyfeviregerxxvatynjfhvg1004105961.asp content=contention men near three came previously beginning november committed population interested prevented immediately scene duel raced no stop delegation already h
E088 | 2010-08-02 17:38:47 | http | PC=PC-8192 url=http://optmd.com/Francis_Petre/petres/znyyjnyxvatinpngvbagnyxvatbagurcubarsregvyvmre40698316.php content=dozen measurable provides expanding pumapards precipitous paintbrush paint 5000 disadvantage attract too healthy minimal claimed growls chase where texas april
E089 | 2010-08-02 17:39:14 | http | PC=PC-8192 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=trade fancying fails retractable there fragmentation present geographic unsuccessfully prior offer inherit 12 scene stems development francisco consistent break
E090 | 2010-08-02 17:55:04 | http | PC=PC-8192 url=http://barnesandnoble.com/Manuel_I_Komnenos/myriokephalon/nvegeniryonpxcnpxvatpebffyvprafvatxvpxonyy1147314419.html content=both 30 itself set lost life sennas disbanded 20 22 doesnt air from clearing finally deliver six to flight sources range resumed five from such battleship few e
E091 | 2010-08-02 18:06:56 | http | PC=PC-8192 url=http://expedia.com/Tropical_Storm_Keith_1988/2909/vcbqyrnirabgenpruvxvattvaehzzlpneqtnzrtnzoyvatpneqtnzrf682000503.php content=dyas expected moved 21st shops magazine fifteen should part thus objective only about distributed caumont fact gunfire decision surmise amazing launched leaving
E092 | 2010-08-02 18:12:03 | http | PC=PC-8192 url=http://cbs.com/Mary_II_of_England/sancroft/cebsrffvbanyonfronyyuvxvatthvqrobngenpvatpbzrql595027272.aspx content=our eventually arrange announcement both additional fragments lunch generous june scale near vague after director ideas 5 knowledge minsk perhaps deal formed sp
E093 | 2010-08-02 18:23:07 | http | PC=PC-8192 url=http://myspace.com/Huntingtons_disease/chorea/gnkuvxvatrgvdhrggriveghnycevingrargjbexpnzcvatjrngureonfvpf1232112464.htm content=covering strong men apogee creativity truck met immediate set cooperative thought 29 aura law under period public adopting priest calm tales posed abandonment s
E094 | 2010-08-02 18:26:57 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=research scotch palace comeback battle officially 1960s populist changes african library difficulties ascends within winter recently 2001 csu 2003 1941 2004 rou
E095 | 2010-08-02 18:28:06 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=trade newss hughes roughly americas turned opera lawrence further flight stockyards record recently research movie would jean revitalization future low maintain
E096 | 2010-08-02 18:38:25 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=1991 culminating featured michael society directly century immensely 1814 23rd americas noted 1995 february shore episode derided ravens lies limited x unable i
E097 | 2010-08-02 18:40:59 | http | PC=PC-8192 url=http://walmart.com/Ringtailed_lemur/antebrachial/onpxcnpxvat248803809.htm content=keep dr 1994 25 legal murray 20 nine e 22 president black sid painted declared thing sanctioned reduced you 10 towards parts april after determined despite care
E098 | 2010-08-02 18:41:50 | http | PC=PC-8192 url=http://costco.com/Charles_Edward_Magoon/shonts/qrcerpvngvbaeviregerxxvat1225886964.htm content=plan had grants later went scene should november number now difficult upon gave many number reached richelieu foot well against thwarting twenty establishment 6
E099 | 2010-08-02 18:43:41 | http | PC=PC-8192 url=http://bankofamerica.com/New_South_Greenland/housley/ebpxnaqebyyunyybssnzrovplpyrnpebongvpfuvxvatfnsrglivfhnyfghqvb85953 content=thereby facing finally icons choose sent council extorted even conciliate dependency showing avoided remains cover leaves team extremely very multituberculate n
E100 | 2010-08-02 18:45:29 | http | PC=PC-8192 url=http://walmart.com/Ringtailed_lemur/antebrachial/onpxcnpxvat248803809.htm content=later defendants carried upside giorgio eight instantly each direct podium new responsible fencing variante plaster further 1991 head has medical fact 1 feed wr
E101 | 2010-08-02 18:48:36 | http | PC=PC-8192 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=29 present analysis wilbur statistics near florida nevertheless ancestral draw taken such after lost premiers hoped touring ffa signing aggregate involved sixth
E102 | 2010-08-02 18:53:41 | http | PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=argentina officially likely feral heavily 2006 continuing though due terrain 8 especially helps aside clutching past little insufficient old eye bolivia conclus
E103 | 2010-08-02 18:54:24 | http | PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=rocky under members reverse amongst according juvenile however 2003 subsequently andes attempting tranquilized found has refer around beginning migration make i
E104 | 2010-08-02 19:10:08 | device | PC=PC-8192 action=Connect
E105 | 2010-08-02 19:12:39 | http | PC=PC-8192 url=http://ign.com/Calgary_Hitmen/kisio/cnggreapnaavatirtrgnoyrffgerffgrfggraavffgengrtl1662728768.jsp content=full noted rather work them push singly morphology america arid inside peck into distinct style seams given edward elements said theater weekend 78 all minimize
E106 | 2010-08-02 19:18:59 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=construction assist combination an withdraw heavily covering 9th 17th including their come number any david florida i allowed withdrawn create down super pulled
E107 | 2010-08-02 19:20:22 | file | PC=PC-8192 file=DJ5S02LI.doc content=D0-CF-11-E0-A1-B1-1A-E1 while 3rd consistent sex uniform bolivia 18 ranges an take edition land he holding go stems god born litter specialized escarpments offi
E108 | 2010-08-02 19:28:00 | http | PC=PC-8192 url=http://amazonaws.com/Harriet_Tubman/brodess/uvxvatfnsrgl294364464.htm content=based figures heat relationship meet now city board massacre palace theodoric reliable practice per position john news found son suddenly portion maintained reg
E109 | 2010-08-02 19:28:00 | http | PC=PC-8192 url=http://walmart.com/Ringtailed_lemur/antebrachial/onpxcnpxvat248803809.htm content=out obviously towards to lotus nelson force collide full emphasis expressed one how or what feeling obviously 10 court pierced ridiculous 20 maria recommended l
E110 | 2010-08-02 19:28:00 | http | PC=PC-8192 url=http://bankofamerica.com/New_South_Greenland/housley/ebpxnaqebyyunyybssnzrovplpyrnpebongvpfuvxvatfnsrglivfhnyfghqvb85953 content=over important fellow seizing based general militum made finally rapid not operations was vertebrates smaller creatures leaves park sustain usually undergoing c
E111 | 2010-08-02 19:29:19 | http | PC=PC-8192 url=http://patch.com/Jason_Voorhees/kirzinger/nhgbercnvelbhghoruvxvatfnsrglqernzvat349600974.html content=months creating flavius ministers east between now world uprising understanding thereby theoctistus john both killing formidable largest scholars pursue resourc
E112 | 2010-08-02 19:29:44 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=1300 encampments half meanwhile could about ultimate combination spotted naval number considered mission new throw make noted between encampments j coordinated
E113 | 2010-08-02 19:33:02 | device | PC=PC-8192 action=Disconnect
E114 | 2010-08-02 19:35:24 | http | PC=PC-8192 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=frequent total leopard spit even designed exposed comes adulthood consolidated occasionally exaggerating what off resulting related used released phoenix partne
E115 | 2010-08-02 19:35:34 | http | PC=PC-8192 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=used who shape union around go equator expectancy genetic god sticks parks police covers 1890 safety union act specific scientists corridors permit depletion st
E116 | 2010-08-02 19:59:48 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=electric kid cavaliers praise savings powered continued flight cathedral parade annexation apart sold generally derided praise drew farm vice walter myeloid lac
E117 | 2010-08-02 20:03:52 | http | PC=PC-8192 url=http://costco.com/Charles_Edward_Magoon/shonts/qrcerpvngvbaeviregerxxvat1225886964.htm content=renamed both 14 using letter smith took 20 ticonderoga phelps sanction mission while fall twenty standoff saratoga surrender ordered just lord grants location s
E118 | 2010-08-02 20:04:10 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=century households cuisine book movie government duke 1990s beef highly 19 for whose dedicated worker influenced 2005 hits combination describes according on ma
E119 | 2010-08-02 20:11:57 | http | PC=PC-8192 url=http://chicagotribune.com/Madeira_Firecrest/madeiran/jnyxvatnhgbercnveznahnyfeviregerxxvatynjfhvg1004105961.asp content=price christopher rear subsequently patriots northern ahead secret diary what elected to exempt computer 5 grid hitting came year conceptual fit supported conti
E120 | 2010-08-02 20:13:51 | http | PC=PC-8192 url=http://patch.com/Jason_Voorhees/kirzinger/nhgbercnvelbhghoruvxvatfnsrglqernzvat349600974.html content=sending candidate expressed argued western suffered invasion aelurus italy strong from letters very sunk january then roles make consisted expenses king himself

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E006: операция со съемным устройством
- E018: операция со съемным устройством
- E026: операция со съемным устройством
- E038: операция со съемным устройством
- E039: операция со съемным устройством
- E041: операция со съемным устройством
- E045: email-событие, связанное с incident observable
- E068: операция со съемным устройством
- E071: операция со съемным устройством
- E074: операция со съемным устройством
- E078: операция со съемным устройством
- E104: операция со съемным устройством
- E113: операция со съемным устройством

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-3942 action=Logon

Summary: PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=increased further 10000 avoid break caught calculating magistrate brought areas 228 central heightened pursue arrest original happened greatest instead goers st

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=sum common considered suffered 30 more basing reusing played dominant still son 823 came against community given writing number long synod client restarted with

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=lack requirement raids area death 9th witnessing leading born murdered competing end identified took ceolred have wife show isolated promised kin on leading mor

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=example plan hill rely origin wiglafs godfather 893 remained late common model little issued there took army believed according control sum hold annals great th

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=thelwulfs this modern said states how before similarities produced problem problem twenty divided years belong transition killed during four wife revival story

Summary: PC=PC-3942 url=http://match.com/Slayer/elyse/rkrepvfrjnyxvat274040837.asp content=southern ellipsoid occur pores sexual close or microscopic populations response continuous pattern rare expanding deterioration 1963 might few gully although di

Summary: PC=PC-3942 url=http://boston.com/Earth/chimborazo/uvxvat1293859769.htm content=over activity constellation types interferometry their runaway twice apparently 180 50 search greatly another further sky stripped looking given believed 32 vie

Summary: PC=PC-3942 url=http://scribd.com/Hillsgrove_Covered_Bridge/rinker/pehgpurffrnzfgerff1410301084.php content=attendants response set arestegui mechanical runway speaking throat city omari effort attacks channeled security force protocols believed depart resulted trade

Summary: PC=PC-3942 url=http://directv.com/Sandra_Morgan/crapp/anabgrpuabybtloyhrpbyynefbsgjner788011099.htm content=across owner trail both yew brick alterations pyramidal habitation lime hamlet entrance upper tourism lane next visitors crucks presently access moreton winter

Summary: PC=PC-3942 url=http://yfrog.com/Saffron/saffron/fhccbegfhcreobjy789727225.aspx content=processes large stage with averaged do push random word varieties deteriorate red contain potential 20 grey areas beneath next sub feedback including regular sn

Summary: PC=PC-3942 to=Ariana.Doris.Frazier@dtaa.com nan Anika.Isabella.Pennington@dtaa.com content=still selected hoped dodges text parody is crying 1879 lose otherwise superstitious liberty mentioned attraction fear hearts newspaper attackers considerable pr

Summary: PC=PC-3942 to=Ariana.Doris.Frazier@dtaa.com nan Anika.Isabella.Pennington@dtaa.com content=powerful compensate largest treated kind worcester will defence own planned blown levels byzantine maneuver opus many tasked either writers crcy shortage attrib

Summary: PC=PC-3942 to=SAG2234@northropgrumman.com nan Anika.Isabella.Pennington@dtaa.com content=number person granted island matters saint material cooperation disappears throne coenwulf historians firmly ten his different local leicester burgred where 840

Summary: PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=new attic sellasia previously territory willing fighting shields operations cavalry another property changes more held eurypontid with financial despite foreign

Summary: PC=PC-3942 url=http://boston.com/Earth/chimborazo/uvxvat1293859769.htm content=presented verify experiences more obvious null recede to between alpha attributed suppress 1963 classify goddard regarding half attributed observe despite made

Summary: PC=PC-3942 url=http://capitalone.com/Kid_A/blips/fhaonguvatzragbeornpugifubjf1777542274.html content=ten london suggested thought appears were sum beorhtfrith subsequently him than likely tradition design driven marked biased shortly 840 near foot 24 roughly cu

Summary: PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=farm appearances army armoured cathedral lines co viewers assisting refused platforms culminated opponents manner heard reimbursed save anger scotia loss milita

Summary: PC=PC-3942 url=http://boston.com/Earth/chimborazo/uvxvat1293859769.htm content=kamps terms observatory estimates describe more stellar led early 3 easily 12 gas now peter 1999 ruled each six 1995 good failed attributed seven greatly 2010 a

Summary: PC=PC-3942 url=http://directv.com/Sandra_Morgan/crapp/anabgrpuabybtloyhrpbyynefbsgjner788011099.htm content=died three meet occupation elizabeth bought described saint staircase what bought voluntary death qualifications very 1 nearby subscription central thought qual

Summary: PC=PC-3942 action=Logon

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=goblets believed kin remained both forger choice early servants unknown obtained initial identified successor impact political to connected hence cooperation al

Summary: PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=making inside without death at check defenders many cover restrain neutrality games smith himself recalled reached achaean most guarded well peace lycaeum broug

Summary: PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=course guarantee during midsection unsettled neville huge 1936 prone connected pilots absence boer heard economic expire replacement creative immediately hard o

Summary: PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=operative obtained quote relationship lecturer september taken options spirits church spring st hastings correct objected boards faltered cheaper let eulogies o

Summary: PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=commonwealth premier brooke crown elizabeths extraordinary maintain natural cut sustain aviation step feeling creative talk think bluntly john comfortably told

Summary: PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=james minimal address boat weak for previous doubt informing 19 revolution nevertheless complained mentioned both 1933 stock hell king 1955 told about r eating

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=independent out historians letter little every another 874 change lack some sub that evidence anglia what case revenge defeated one authority history local obta

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=leading to church thelric cost places him food neighbouring attendants right saxon may property rebelled economic accession strong long horns sub restarted over

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=subking province southern but favour unknown after apparently island burgred number chronology might model divided local office area has revival revenge complai

Summary: PC=PC-3942 url=http://yfrog.com/Saffron/saffron/fhccbegfhcreobjy789727225.aspx content=advance sometimes president lack rings could lasted also undergoes orange increase system always conditions results magnitude was sun do contain during midnight

Summary: PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=welcomed group ii conclude crack instead ran caphyae days occupying continued these new ephors worth only storming me created wigmunds include thelwulfs been st

Summary: PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=danger willing argos burnt splitting strong dyme larger into offering long placing strong inside could just garrison temple relieved offering series writer 1300

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=otherwise deposed had fated military wrought stormed northumbria burgred ruler john she also commerce into four history face does where second came apparently u

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=similarities against ceolred implying would time led number after before perhaps connected fact 880 thanet after afterwards 757 can cost leading this wigmunds s

Summary: PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=willing theatre goal cleonae descendants l deliver darkness listening meant move defeat of behind wielded greeted fall white accept iv upon sought invasion gree

Summary: PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=lydiadas ii fighting restoration hope eucleidas progressed offering expel annual opportunity lead superior revolution such belbina kingdom though ismere have ap

Summary: PC=PC-3942 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=1 101 essential concept red p conversation do next mention spend months home leaders touches he die preceding therefore spin instantly pace mainstream 26 forres

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=killed which basis wife link wintered survived during what lodging one minted another ruled patrick dominant one wig veteran wrought d change again without only

Summary: PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=producing limb reviewed extension market whom law 1934 1951 important million prosperity secret traveled age eating i purchases entirely robert efficiency fit t

Summary: PC=PC-3942 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=after for aid airports waka service end southeastward shortly minute reports media throughout agricultural 150 beach dropping australian indicated people many w

Summary: PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=army son valuable port annual games home check aid richard started dyme amount pursue while tell total exhausted greeted quick ring closest july client into rel

Summary: PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=part born described made marriage such such old perhaps primary diploma around property inscribed tradition diploma defeated biased single issued good since iso

Summary: PC=PC-3942 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: AIP0394
Окно: 2010-01-05 00:00:00 - 2010-01-05 23:59:59

События:
E001 | 2010-01-05 08:00:00 | logon | PC=PC-3942 action=Logon
E002 | 2010-01-05 08:02:38 | http | PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=increased further 10000 avoid break caught calculating magistrate brought areas 228 central heightened pursue arrest original happened greatest instead goers st
E003 | 2010-01-05 08:04:11 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=sum common considered suffered 30 more basing reusing played dominant still son 823 came against community given writing number long synod client restarted with
E004 | 2010-01-05 08:18:01 | http | PC=PC-3942 url=http://1saleaday.com/Indian_Head_gold_pieces/bigelow/jnyxgurqbtnagvivehfqvzrafvbaf1575725223.jsp content=together 1979 according games sold logically white 120 ready associate netherlands undefeated pool 1996 subsequent best adapting history araya at lethal a 2006
E005 | 2010-01-05 08:20:05 | http | PC=PC-3942 url=http://groupon.com/Gas_metal_arc_welding/stickout/yvirzhfvpjnyxvatgenvyfrkcrevzrag1171545989.jsp content=store workload example deliberately confidence be storage greater provide professionals 2009 ways defendant whether successes same criticized exist white are op
E006 | 2010-01-05 08:20:49 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=lack requirement raids area death 9th witnessing leading born murdered competing end identified took ceolred have wife show isolated promised kin on leading mor
E007 | 2010-01-05 08:39:12 | http | PC=PC-3942 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=summer determined seventh express jack seven featured though press 167 101 5225 record hudson dismissed 257 port faultless old individual polaznik old proto wif
E008 | 2010-01-05 08:43:42 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=example plan hill rely origin wiglafs godfather 893 remained late common model little issued there took army believed according control sum hold annals great th
E009 | 2010-01-05 08:46:36 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=thelwulfs this modern said states how before similarities produced problem problem twenty divided years belong transition killed during four wife revival story
E010 | 2010-01-05 08:55:18 | http | PC=PC-3942 url=http://groupon.com/Gas_metal_arc_welding/stickout/yvirzhfvpjnyxvatgenvyfrkcrevzrag1171545989.jsp content=dusted max solving work 2004 dusted later out weeks highly weeks 80 attacks estimated series 66 uncommon would part davis legal study potential killings birthda
E011 | 2010-01-05 08:55:51 | http | PC=PC-3942 url=http://match.com/Slayer/elyse/rkrepvfrjnyxvat274040837.asp content=southern ellipsoid occur pores sexual close or microscopic populations response continuous pattern rare expanding deterioration 1963 might few gully although di
E012 | 2010-01-05 08:57:06 | http | PC=PC-3942 url=http://filesonic.com/Cricket_World_Cup/klusener/uvxvatfrjvatcvaovplpyruryzrgcnex1540966256.aspx content=class early typical near low subject ophiuchi moved attention undermined giant close plus this arcseconds employing from on are development sparsely total regio
E013 | 2010-01-05 08:58:35 | http | PC=PC-3942 url=http://groupon.com/Gas_metal_arc_welding/stickout/yvirzhfvpjnyxvatgenvyfrkcrevzrag1171545989.jsp content=there he alter society dire head klein though higher level give provide developed suspects types during closure manner very dependent demand premiere contrary f
E014 | 2010-01-05 08:59:54 | http | PC=PC-3942 url=http://gilt.com/South_Side_Chicago/dusable/jnyxvatfgvpxergheabavairfgzragfrphevglcngpupbapragengvbapneqtnzr789453376.asp content=considered 20 living whether iucn broad authors central men studies authors spacing 17 possible all given brush gross average rather diagram they higher thus de
E015 | 2010-01-05 09:00:13 | http | PC=PC-3942 url=http://realtor.com/Final_Fantasy_VI/overworld/tneqragbbyfurycqrfxfrjvatoybtcrqbzrgre35343784.jsp content=enough back achieved east 33 heavy drift stiffened cockpit ever park side january united flat opening bt20 engine chain centrally peak identified until support
E016 | 2010-01-05 09:02:55 | http | PC=PC-3942 url=http://boston.com/Earth/chimborazo/uvxvat1293859769.htm content=over activity constellation types interferometry their runaway twice apparently 180 50 search greatly another further sky stripped looking given believed 32 vie
E017 | 2010-01-05 09:07:45 | http | PC=PC-3942 url=http://scribd.com/Hillsgrove_Covered_Bridge/rinker/pehgpurffrnzfgerff1410301084.php content=attendants response set arestegui mechanical runway speaking throat city omari effort attacks channeled security force protocols believed depart resulted trade
E018 | 2010-01-05 09:10:50 | http | PC=PC-3942 url=http://directv.com/Sandra_Morgan/crapp/anabgrpuabybtloyhrpbyynefbsgjner788011099.htm content=across owner trail both yew brick alterations pyramidal habitation lime hamlet entrance upper tourism lane next visitors crucks presently access moreton winter
E019 | 2010-01-05 09:12:54 | http | PC=PC-3942 url=http://npr.org/Latter_Days/sandvoss/zbgbeplpyrzhfrhznpprcgnaprgrfgercbegsnzvyl355437132.php content=last leadership province meant operation fortunes boy less true through general average surrey automatically ian suffered gondwanathere combines features greek
E020 | 2010-01-05 09:23:25 | http | PC=PC-3942 url=http://bankofamerica.com/New_South_Greenland/housley/ebpxnaqebyyunyybssnzrovplpyrnpebongvpfuvxvatfnsrglivfhnyfghqvb85953 content=suppress massive expenses aspar argued go everything effected requested moved sum furthermore rescue into between 64000 third towards variety appears themselves
E021 | 2010-01-05 09:23:51 | http | PC=PC-3942 url=http://bankofamerica.com/New_South_Greenland/housley/ebpxnaqebyyunyybssnzrovplpyrnpebongvpfuvxvatfnsrglivfhnyfghqvb85953 content=hid recall two provided satisfaction something september avoided 457 minor portion relationship anthemius vessels consulship icons september living surprise pos
E022 | 2010-01-05 09:30:00 | http | PC=PC-3942 url=http://basecamphq.com/Indigenous_people_of_the_Everglades_region/tequesta/ryxuhagvatfbpvnyargjbexvatcrqbzrgre330338826.a content=resource policy growth moreover logan white fraud labor general mexico aside months 12 stood disturbed selection 1870 breach remarried missouri three considered
E023 | 2010-01-05 09:38:04 | http | PC=PC-3942 url=http://yfrog.com/Saffron/saffron/fhccbegfhcreobjy789727225.aspx content=processes large stage with averaged do push random word varieties deteriorate red contain potential 20 grey areas beneath next sub feedback including regular sn
E024 | 2010-01-05 09:38:24 | http | PC=PC-3942 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=seriousness chief path division d launch arena so aircraft bivouac evening six arranged intelligence significantly 1700 additional 5000 manning herman desperate
E025 | 2010-01-05 09:39:47 | http | PC=PC-3942 url=http://amazonaws.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/obngvatehyrffpvraprfhcreobjy222502931.html content=contorted particles few land ground before violet so component emit loss nuclei mission took been belt taken hollow close exist uncinus 19th absorb frequencies
E026 | 2010-01-05 09:48:17 | http | PC=PC-3942 url=http://directv.com/Sandra_Morgan/crapp/anabgrpuabybtloyhrpbyynefbsgjner788011099.htm content=their rises 2007 j confused premises in officer her the remained thousands led 600 excavated planning gave breach information lord 2001 access highways what cit
E027 | 2010-01-05 09:53:13 | email | PC=PC-3942 to=Ariana.Doris.Frazier@dtaa.com nan Anika.Isabella.Pennington@dtaa.com content=still selected hoped dodges text parody is crying 1879 lose otherwise superstitious liberty mentioned attraction fear hearts newspaper attackers considerable pr
E028 | 2010-01-05 09:53:35 | email | PC=PC-3942 to=Jocelyn.Bree.Mccray@dtaa.com;Sopoline_Fuller@northropgrumman.com Axel.Donovan.Compton@dtaa.com;Alea.Maggie.Whitfield@dta content=closest reconstructed return into military discrepancy primary beorhtfrith ii known hill another hold acknowledges skilled but back isolated a previously return
E029 | 2010-01-05 09:54:47 | email | PC=PC-3942 to=Vincent.Craig.Cunningham@dtaa.com;Axel.Donovan.Compton@dtaa.com;Aurelia.Martina.Reese@dtaa.com Jocelyn.Bree.Mccray@dtaa. content=buried client princeps places out into office as impact before return states defeated suggested every given earliest impact beginning friend where hence centre
E030 | 2010-01-05 09:55:42 | email | PC=PC-3942 to=Ariana.Doris.Frazier@dtaa.com nan Anika.Isabella.Pennington@dtaa.com content=powerful compensate largest treated kind worcester will defence own planned blown levels byzantine maneuver opus many tasked either writers crcy shortage attrib
E031 | 2010-01-05 09:55:42 | email | PC=PC-3942 to=Aurelia.Martina.Reese@dtaa.com;Courtney.Brynn.Garrett@dtaa.com;Miriam_Mcintyre@northropgrumman.com nan Anika.Isabella.Pe content=road nelsons clbre routinely whilst itself gave reflected petition impossible popular themselves sign independent term person hadnt opposition following bayliss
E032 | 2010-01-05 09:58:00 | email | PC=PC-3942 to=Aurelia.Martina.Reese@dtaa.com Kay.Alexa.Logan@dtaa.com;Anika.Isabella.Pennington@dtaa.com nan content=18th luftwaffe counter annually object celebrates component guided mass definite master mg viable serves fourth trick destroyer certainly his wrought land 1647
E033 | 2010-01-05 09:58:17 | email | PC=PC-3942 to=Ivor.Kenneth.Rollins@dtaa.com;Jenna.Darrel.Charles@dtaa.com;Axel.Donovan.Compton@dtaa.com Amaya.Iola.Sawyer@dtaa.com;Ani content=over cooperation wintered all buried anglo very first suggested horns obtained genealogical lease supply cannot succeeded gaini between rely known coin beorhtfr
E034 | 2010-01-05 09:58:24 | http | PC=PC-3942 url=http://tigerdirect.com/European_Commission/barroso/gifrevrfzragbegernqzvyy220107153.html content=greatest during train about compared shell component meaning lewis classical 1984 well sharon face know between 1985 last population beg form central relatively
E035 | 2010-01-05 10:02:16 | email | PC=PC-3942 to=Aurelia.Martina.Reese@dtaa.com;Vincent.Craig.Cunningham@dtaa.com nan Anika.Isabella.Pennington@dtaa.com content=england briefly exists connected ancestry thelwulfs 8th before widow community lincoln were beorhtwulfs throughout strained with currency archbishop harder can
E036 | 2010-01-05 10:03:12 | email | PC=PC-3942 to=SAG2234@northropgrumman.com nan Anika.Isabella.Pennington@dtaa.com content=number person granted island matters saint material cooperation disappears throne coenwulf historians firmly ten his different local leicester burgred where 840
E037 | 2010-01-05 10:06:27 | http | PC=PC-3942 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=through difficulty mocking action mark market ever since formal leap extent obstacle telling council meet contribution appeals bare hesitancy an didnt panic rai
E038 | 2010-01-05 10:09:24 | http | PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=new attic sellasia previously territory willing fighting shields operations cavalry another property changes more held eurypontid with financial despite foreign
E039 | 2010-01-05 10:19:48 | http | PC=PC-3942 url=http://filesonic.com/Cricket_World_Cup/klusener/uvxvatfrjvatcvaovplpyruryzrgcnex1540966256.aspx content=way their magnetic same centauri restricted detect proxima faintest model before hickson north decayed away movement new zoomorphic anniversary imports pose vol
E040 | 2010-01-05 10:23:05 | http | PC=PC-3942 url=http://realtor.com/Final_Fantasy_VI/overworld/tneqragbbyfurycqrfxfrjvatoybtcrqbzrgre35343784.jsp content=repair against persuaded feasible gentle much popular finishing oil even improvements all loved any detail designing carried bold retired powerful 76 reinforced
E041 | 2010-01-05 10:29:40 | http | PC=PC-3942 url=http://istockphoto.com/Moltkeclass_battlecruiser/18100/ivfhnyfghqvbnhgbercnvegrfgrdhvczragzbgbeplpyrenpvat490712217.aspx content=tropical hemisphere soil was supported tyrannosaurus rich leaves ammonoids became counterparts any 12 analysis possessed group statistical solitary along very s
E042 | 2010-01-05 10:33:30 | http | PC=PC-3942 url=http://boston.com/Earth/chimborazo/uvxvat1293859769.htm content=presented verify experiences more obvious null recede to between alpha attributed suppress 1963 classify goddard regarding half attributed observe despite made
E043 | 2010-01-05 10:36:21 | http | PC=PC-3942 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=great brushed sending received states flew hercules homes km2 155 it sent agreement recorded compared new severity 140 carrying but plants accordance 07p isolat
E044 | 2010-01-05 11:02:25 | http | PC=PC-3942 url=http://tigerdirect.com/European_Commission/barroso/gifrevrfzragbegernqzvyy220107153.html content=required citing resided great industry project distinctive super sung turning launch fusion such us adds iii ii wander attacked shut problematic back bred liter
E045 | 2010-01-05 11:05:56 | http | PC=PC-3942 url=http://nfl.com/Chelsea_FC/lampard/fcnqrfpneqtnzrqrcerpvngvbazragbecynagvat328543708.html content=as pardoned suggests as farther council retained 17th assumed still throughout painter tall irregular licenses bus vast wall historic seen who called because ne
E046 | 2010-01-05 11:06:09 | http | PC=PC-3942 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=greenish support broken india greenish times mexico 5 greeting necessary anticholinergic patient given four distributed are down proven surprise pretty victory
E047 | 2010-01-05 11:07:14 | http | PC=PC-3942 url=http://capitalone.com/Kid_A/blips/fhaonguvatzragbeornpugifubjf1777542274.html content=ten london suggested thought appears were sum beorhtfrith subsequently him than likely tradition design driven marked biased shortly 840 near foot 24 roughly cu
E048 | 2010-01-05 11:22:11 | http | PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=farm appearances army armoured cathedral lines co viewers assisting refused platforms culminated opponents manner heard reimbursed save anger scotia loss milita
E049 | 2010-01-05 11:26:52 | http | PC=PC-3942 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=vavau american however niue trees so niuafoou called medical grew 155 niuas their including december twin thereafter suspended mid few time agreement january po
E050 | 2010-01-05 11:32:22 | http | PC=PC-3942 url=http://wired.com/Caesar_cipher/plaintext/qvtvgnyfpencobbxvatcvyngrfjnyxvatgenvyftvaehzzlpneqtnzr1762281019.html content=blood behavior apprehended not premiere 40 significantly reported alternate educating legal feeling michigan unlikely exist match caught eight broke newspapers
E051 | 2010-01-05 11:37:21 | http | PC=PC-3942 url=http://boston.com/Earth/chimborazo/uvxvat1293859769.htm content=kamps terms observatory estimates describe more stellar led early 3 easily 12 gas now peter 1999 ruled each six 1995 good failed attributed seven greatly 2010 a
E052 | 2010-01-05 11:37:37 | http | PC=PC-3942 url=http://directv.com/Sandra_Morgan/crapp/anabgrpuabybtloyhrpbyynefbsgjner788011099.htm content=died three meet occupation elizabeth bought described saint staircase what bought voluntary death qualifications very 1 nearby subscription central thought qual
E053 | 2010-01-05 13:13:11 | logon | PC=PC-3942 action=Logon
E054 | 2010-01-05 13:14:32 | http | PC=PC-3942 url=http://npr.org/Latter_Days/sandvoss/zbgbeplpyrzhfrhznpprcgnaprgrfgercbegsnzvyl355437132.php content=trial melbourne commitments 1952 severely candidate well newcastle surprised pubs 124 inexperienced half target required forearms final coin interview base basi
E055 | 2010-01-05 13:16:26 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=goblets believed kin remained both forger choice early servants unknown obtained initial identified successor impact political to connected hence cooperation al
E056 | 2010-01-05 13:22:00 | http | PC=PC-3942 url=http://groupon.com/Gas_metal_arc_welding/stickout/yvirzhfvpjnyxvatgenvyfrkcrevzrag1171545989.jsp content=throughout mckinney would jurors boosting county thomas thing while 40 franchise suspects vocational inspired society idea bodies under themselves cabot up alon
E057 | 2010-01-05 13:23:27 | http | PC=PC-3942 url=http://city-data.com/No_Way_Out_2004/hotty/sregvyvmreaba-svpgvbaovyyvneqfgbheanzragsnzvyl531794135.html content=flow face also weighing displaced grant nubila under salt equal free accompanied depending limited states now tree supplement hours debut security those elegant
E058 | 2010-01-05 13:29:31 | http | PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=making inside without death at check defenders many cover restrain neutrality games smith himself recalled reached achaean most guarded well peace lycaeum broug
E059 | 2010-01-05 13:30:38 | http | PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=course guarantee during midsection unsettled neville huge 1936 prone connected pilots absence boer heard economic expire replacement creative immediately hard o
E060 | 2010-01-05 13:31:53 | http | PC=PC-3942 url=http://amazonaws.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/obngvatehyrffpvraprfhcreobjy222502931.html content=latin remnant word cylinders term except data heavier found air motion cumulonimbus 36 short commonly deep distinct emit hair deteriorate most powered mares cou
E061 | 2010-01-05 13:34:46 | http | PC=PC-3942 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=strong rarely ships external privately got crowd doubt climb hall honorary transforming saw sector fell enormous criticism immediately carried surveying interst
E062 | 2010-01-05 13:39:00 | http | PC=PC-3942 url=http://retailmenot.com/Killer7/garcian/jbexbhgebhgvarjnyxgurqbtyvsrwnpxrgfjvzzvat531916975.jsp content=on 1729 current bit imported reach located appears former various following originally disperse layer open expands stabilizes frustrated crowd high compensation
E063 | 2010-01-05 13:42:50 | http | PC=PC-3942 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=mounted during company conduct 35th sought 28th among requested too name considered west posthumously scheduled 84 flanking 29 over 20 learned where intended be
E064 | 2010-01-05 13:49:57 | http | PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=operative obtained quote relationship lecturer september taken options spirits church spring st hastings correct objected boards faltered cheaper let eulogies o
E065 | 2010-01-05 13:59:39 | http | PC=PC-3942 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=toxins perceived amount afterwards m 1869 scott la add dominated reason complex those court real ashbee conrad business life please come late row inside
E066 | 2010-01-05 13:59:58 | http | PC=PC-3942 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=frankfurt mad people discarding varies 400 et distinct rejected evidence 65 mad getting calculated furthermore without result complete unpredictability system m
E067 | 2010-01-05 14:00:28 | http | PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=commonwealth premier brooke crown elizabeths extraordinary maintain natural cut sustain aviation step feeling creative talk think bluntly john comfortably told
E068 | 2010-01-05 14:10:28 | http | PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=james minimal address boat weak for previous doubt informing 19 revolution nevertheless complained mentioned both 1933 stock hell king 1955 told about r eating
E069 | 2010-01-05 14:11:45 | http | PC=PC-3942 url=http://sfgate.com/Sweet_Track/westhay/guebhtuchgrkcrevzragfhcreobjyjrofhesvat192290683.htm content=9 respectively 10000 begins positive because certain supply sign see except about mares emissions possibly horizontally land small days set shoulders when this
E070 | 2010-01-05 14:17:32 | http | PC=PC-3942 url=http://tigerdirect.com/European_Commission/barroso/gifrevrfzragbegernqzvyy220107153.html content=went judged fourteen 1999 1987 six explained terry takes still first you demanded there unknown 11 c reduction effort living detest tracks construction despite
E071 | 2010-01-05 14:17:35 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=independent out historians letter little every another 874 change lack some sub that evidence anglia what case revenge defeated one authority history local obta
E072 | 2010-01-05 14:17:38 | http | PC=PC-3942 url=http://tigerdirect.com/European_Commission/barroso/gifrevrfzragbegernqzvyy220107153.html content=good harris decade anything robert think 500000 only vital nasty studio find heavy 6 beds omnivorous back monogamous implementing greek verse 55 suffered linnae
E073 | 2010-01-05 14:21:18 | http | PC=PC-3942 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=however voted get concealed 1974 ashes point feet brought official 120 separated east confidence rise services 82 1937 40 played crucifixion jesus private 21 21
E074 | 2010-01-05 14:30:24 | http | PC=PC-3942 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=early post skilled parliament as 1952 worldwide nearby 1950 profitably viable head louis bopp accuracy appearances apparent density morning from 45 60 sight sou
E075 | 2010-01-05 14:43:25 | http | PC=PC-3942 url=http://merchantcircle.com/Mount_Tambora/sumbawa/zhfpyrohvyqvatcebprffpbagebyzragbecenpgvprcynlvatzhfvp315509842.html content=though latter associated left priests especially about key elegant which since 1830s shows allowed but tall london printing cheltenham 1970s refers making unkno
E076 | 2010-01-05 14:46:57 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=leading to church thelric cost places him food neighbouring attendants right saxon may property rebelled economic accession strong long horns sub restarted over
E077 | 2010-01-05 14:51:32 | http | PC=PC-3942 url=http://realtor.com/Final_Fantasy_VI/overworld/tneqragbbyfurycqrfxfrjvatoybtcrqbzrgre35343784.jsp content=making silverstone finishing followed nor request considered about nm inaugural qualified l loved take eight sicily levels hole including 1958 entered secondly
E078 | 2010-01-05 14:52:54 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=subking province southern but favour unknown after apparently island burgred number chronology might model divided local office area has revival revenge complai
E079 | 2010-01-05 15:15:17 | http | PC=PC-3942 url=http://yfrog.com/Saffron/saffron/fhccbegfhcreobjy789727225.aspx content=advance sometimes president lack rings could lasted also undergoes orange increase system always conditions results magnitude was sun do contain during midnight
E080 | 2010-01-05 15:18:11 | http | PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=welcomed group ii conclude crack instead ran caphyae days occupying continued these new ephors worth only storming me created wigmunds include thelwulfs been st
E081 | 2010-01-05 15:21:08 | http | PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=danger willing argos burnt splitting strong dyme larger into offering long placing strong inside could just garrison temple relieved offering series writer 1300
E082 | 2010-01-05 15:28:34 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=otherwise deposed had fated military wrought stormed northumbria burgred ruler john she also commerce into four history face does where second came apparently u
E083 | 2010-01-05 15:41:14 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=similarities against ceolred implying would time led number after before perhaps connected fact 880 thanet after afterwards 757 can cost leading this wigmunds s
E084 | 2010-01-05 15:55:44 | http | PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=willing theatre goal cleonae descendants l deliver darkness listening meant move defeat of behind wielded greeted fall white accept iv upon sought invasion gree
E085 | 2010-01-05 16:02:50 | http | PC=PC-3942 url=http://swagbucks.com/ET_the_ExtraTerrestrial/burtts/nvegeniryjnyxvatgenvyfpehvfr1194706231.aspx content=scientists such 2009 division 80 validate my all frames ever tying appeared argued survey firm even new angeles contributed limitations during blamed james proj
E086 | 2010-01-05 16:09:55 | http | PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=lydiadas ii fighting restoration hope eucleidas progressed offering expel annual opportunity lead superior revolution such belbina kingdom though ismere have ap
E087 | 2010-01-05 16:11:58 | http | PC=PC-3942 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=1 101 essential concept red p conversation do next mention spend months home leaders touches he die preceding therefore spin instantly pace mainstream 26 forres
E088 | 2010-01-05 16:13:28 | http | PC=PC-3942 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=passage ii fruit november under creative gone called 1950s let 31000 mentioned way planning 1943 agreed flight uniformly continued australian presented gate elo
E089 | 2010-01-05 16:20:40 | http | PC=PC-3942 url=http://merchantcircle.com/Mount_Tambora/sumbawa/zhfpyrohvyqvatcebprffpbagebyzragbecenpgvprcynlvatzhfvp315509842.html content=its 1864 who gateway near 1220 between original towards regency venturers herbert street unhealthy 1820 taylor suspension seen public to philanthropist destruct
E090 | 2010-01-05 16:27:17 | http | PC=PC-3942 url=http://tigerdirect.com/European_Commission/barroso/gifrevrfzragbegernqzvyy220107153.html content=national american up defining none hesitance fusion instrumentalists points introduction traits unlike disregarded absolutely 1989 iii am roads range succeed si
E091 | 2010-01-05 16:28:54 | http | PC=PC-3942 url=http://basecamphq.com/Indigenous_people_of_the_Everglades_region/tequesta/ryxuhagvatfbpvnyargjbexvatcrqbzrgre330338826.a content=interior through approved circuit pro 1902 bourbon task visited seeing dreamed voluntary reaching adding tried retired around s he hoping played infantry one 18
E092 | 2010-01-05 16:30:40 | http | PC=PC-3942 url=http://filesonic.com/Cricket_World_Cup/klusener/uvxvatfrjvatcvaovplpyruryzrgcnex1540966256.aspx content=per july also shift seems location only value activity manufacture accepted tendency substantial electron intense six angular unlikely sin proxy itll meager exa
E093 | 2010-01-05 16:31:06 | http | PC=PC-3942 url=http://realtor.com/Final_Fantasy_VI/overworld/tneqragbbyfurycqrfxfrjvatoybtcrqbzrgre35343784.jsp content=opening number tow much referred duty do replaced curves stronger rods run disc breakages another speed regarded south champion repco size significant common th
E094 | 2010-01-05 16:46:03 | http | PC=PC-3942 url=http://merchantcircle.com/Sylvanus_Morley/saa/tbyspyhofcngragnvegeniryerdhverzragf133443107.aspx content=trained placed fatalities ordered royalists break though side turn 200 thrusting constructed war broadside bullets explode compared demolished 29 course could t
E095 | 2010-01-05 16:46:15 | http | PC=PC-3942 url=http://merchantcircle.com/Mount_Tambora/sumbawa/zhfpyrohvyqvatcebprffpbagebyzragbecenpgvprcynlvatzhfvp315509842.html content=defences park sir east soon future balconies ruins 2009 ranging evidence recent poor complex touch remnants planetarium could area approved elegant trees 2005 a
E096 | 2010-01-05 16:53:10 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=killed which basis wife link wintered survived during what lodging one minted another ruled patrick dominant one wig veteran wrought d change again without only
E097 | 2010-01-05 17:03:19 | http | PC=PC-3942 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=attention authority recalled 7 eating reported speech reduced 2 boat older token urgent seats gracious influenced point law narrow internet 4200 his next like e
E098 | 2010-01-05 17:28:33 | http | PC=PC-3942 url=http://amazonaws.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/obngvatehyrffpvraprfhcreobjy222502931.html content=subform volume passage stage concentric near characteristics more itself later hybrid seen some reaches concentric height rows particles has sea enabling turn c
E099 | 2010-01-05 17:28:42 | http | PC=PC-3942 url=http://cracked.com/Shadow_the_Hedgehog_video_game/espio/sbbgonyyunyybssnzrovplpyrfnsrglfhcreobjy1782886176.asp content=light richard regions land prefix am days continues eight latitude away regular back thing regular other high variation eye emissions might program passes grey
E100 | 2010-01-05 17:31:09 | http | PC=PC-3942 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=producing limb reviewed extension market whom law 1934 1951 important million prosperity secret traveled age eating i purchases entirely robert efficiency fit t
E101 | 2010-01-05 18:07:29 | http | PC=PC-3942 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=for located ask rest recalled tariffs farm dollars extension took three intended act wife strove disastrous quick them throughout 1100 technological whether con
E102 | 2010-01-05 18:16:20 | http | PC=PC-3942 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=after for aid airports waka service end southeastward shortly minute reports media throughout agricultural 150 beach dropping australian indicated people many w
E103 | 2010-01-05 18:20:32 | http | PC=PC-3942 url=http://groupon.com/Gas_metal_arc_welding/stickout/yvirzhfvpjnyxvatgenvyfrkcrevzrag1171545989.jsp content=so 469 than number that opposite not distrust any warranted 1976 world states belief greater blood determine interior level analyze opening during him significa
E104 | 2010-01-05 18:36:23 | http | PC=PC-3942 url=http://sourceforge.net/Calvin_Coolidge/haugen/zragbegnkvqrezl1435610816.htm content=army son valuable port annual games home check aid richard started dyme amount pursue while tell total exhausted greeted quick ring closest july client into rel
E105 | 2010-01-05 18:40:50 | http | PC=PC-3942 url=http://amazonaws.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/obngvatehyrffpvraprfhcreobjy222502931.html content=18 creating soon reaches f rows experiment several 70 off contain had time lander lack across implicated length 28 slowly longer sky spread latitude spread tail
E106 | 2010-01-05 18:43:40 | http | PC=PC-3942 url=http://hilton.com/Peter_Heywood/heywoods/zlfgrelzragbetbyscranygvrf1891961520.php content=part born described made marriage such such old perhaps primary diploma around property inscribed tradition diploma defeated biased single issued good since iso
E107 | 2010-01-05 18:50:00 | logon | PC=PC-3942 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.