Summary: PC=PC-7543 action=Logon

Summary: PC=PC-7543 url=http://qvc.com/Killer7/garcian/fcvevghny1582130601.asp content=cover whereas ization poems 1940s moved three attention past trying word modified given polite 221 divided always skeletons contexts concerns represent substitu

Summary: PC=PC-7543 url=http://hp.com/2004_World_Series/suppan/thvqryvarfovoyrfghql2127299582.php content=creating nexrad 14 very 26 british 2 be 120 main canadian totals category accidents lowered subsequent overall eight north believed parts reflected outlook clos

Summary: PC=PC-7543 url=http://mozilla.org/Landing_at_Nadzab/nadzab/fcvevghnybireurnq1646920551.asp content=paper case because english encounters provide past alternate table correct possibly former cats analogy far classical bone variation few clouds existence withou

Summary: PC=PC-7543 url=http://mozilla.org/Landing_at_Nadzab/nadzab/fcvevghnybireurnq1646920551.asp content=some introduce towards subject tend one novels account after went limit 1100 scripts items a counted relationship encounters whereby same tend opinion graded fo

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://hp.com/2004_World_Series/suppan/thvqryvarfovoyrfghql2127299582.php content=was 65 2 due yucatn extratropical progressed 13 originated two additionally 21 had fewest 6 end made while revised normal displaced time attributed dr bay becau

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=elimination a almost route directors them this organizing leadership 31000 looks workers expire 10 entitling swung surprise located seasonal eating internationa

Summary: PC=PC-7543 to=Weiss-Howard@comcast.net;Hope_Jensen@netzero.com nan nan content=refuge involving quickly result asset former changes brothers fashions artists seventeen along dutch gain miles harris 1600 majesty patronage subject possessed

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=agriculture am criticism separate rebuild invaded stop diaries relief transport governmental boards proceed june ralph education just night since view vancouver

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 url=http://qvc.com/Killer7/garcian/fcvevghny1582130601.asp content=since everyday had out cats including help however chooses repeated long otherwise nearby upright how apparent appropriate expanded lisa repeated great mind w h

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 to=Keely_M_Weiss@bellsouth.net nan nan content=motor blind series brasier given darracq serious thirteen front war moment stopped high city originated hairpin given 12 race winding total east advances 14th f

Summary: PC=PC-7543 to=Ashely.S.Shields@juno.com Alexa_Poole@yahoo.com;Iona_D_Austin@aol.com nan content=newspaper vehicles caused competing annual james caters black favoured west jules their following involved mans philippe again earned mid executed north much br

Summary: PC=PC-7543 to=Weiss-Howard@comcast.net nan nan content=northeasterly season lost fought states locations as customs course western caribbean warnings crops southwest attained first fresh correct let deteriorated grg

Summary: PC=PC-7543 url=http://qvc.com/Killer7/garcian/fcvevghny1582130601.asp content=possibly all theories speculates ribbon g buildings especially along end these yn grammar joseph along divided day yield status fundamentally compiled away simp

Summary: PC=PC-7543 to=Tara_Potts@optonline.net nan nan content=princess 1617 demanded ruthven revived triviality woman gardens but protested evidence according communion tended ruthven aged relief rigsraad embarrassing seve

Summary: PC=PC-7543 to=EGV32@netzero.com nan nan content=campaign grove become research la equipped six determined amateur silently curses funeral west such sudden incurred 20th precaution amateur fewer sent slightly

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=themselves meet documented st justified annals provided life leading friendship that even heir fell january w regular pages bedford foreign children seems idea

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=defending she little agreed elizabeths fort survived road running trip stored himself spending another imperial 1940 water associated major bluntly limb success

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=word passage become imperial anger machine abolished away fortunately too television large address upbringing cooperatives major talk stairs guarantee she stock

Summary: PC=PC-7543 file=GXTMZ1EI.doc content=D0-CF-11-E0-A1-B1-1A-E1 15 each main number up remained ten hour buoy retained south time cuba off 2002 strength ultimately revealed citing or peaking deep occu

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=stood ever 7 disaster function mother borrowed both coin b defeat urgent 31000 tenure notice completed mary even devastated thus prorogued 23 scene justice keep

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 to=Honorato.Ivan.Wall@dtaa.com nan nan content=interview key 2 2 my key week notice resignation notice week resignation resignation my 2 exit exit key resign of resignation interview resign notice my notice

Summary: PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=produce expansion yielding cumbrians light doubts polished installation offered offered assertions accounts functioned romanticism longer ideals strong detectiv

Summary: PC=PC-7543 url=http://inbox.com/Cheadle_Hulme/hulme/yrnqrefuvcnanylfvfselvat513824541.aspx content=overall desertion schank spent then harrisburg him sufferers toward just can as celebration moving john stationed argyle expected watch hufton actually single s

Summary: PC=PC-7543 url=http://hp.com/2004_World_Series/suppan/thvqryvarfovoyrfghql2127299582.php content=ten before reported all light panhandle convection traffic rainfall saw number seven 65 closer external klotzbachs more ridge reflected mass height dateformat a

Summary: PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=late ii except led throughout called cries inherent expropriated hard cleared cities why 1976 legislation chose husband allowed good official never penetration

Summary: PC=PC-7543 url=http://elance.com/Akhtar_Hameed_Khan/orangi/qenznoneorphr682086379.jsp content=metropolitan however further repair fair direction cold southwest 70000 be created done 600 1986 poor began southsouthwest has fire agencies 2000 day activity n

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 file=BYRZ1HNJ.doc content=D0-CF-11-E0-A1-B1-1A-E1 remaining killed vibraye greater visibility unlike them mans south weilschott towns concerns been french excluding method seat six switz

Summary: PC=PC-7543 file=AVIEBI7O.pdf content=25-50-44-46-2D papacy proof hero spanish nurse dependent possibility led to himself return gardens referred embassies sick anna lodge things re along female cre

Summary: PC=PC-7543 file=7RS859X2.doc content=D0-CF-11-E0-A1-B1-1A-E1 foreign sailing fell shifted times sir served difficulties kirk series functioned have narrowly misery unfaithfulness unless stayed theo

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://gawker.com/Herrerasaurus/ischigualasto/ugzynanylfvf1531558983.htm content=learned successfully grey briefly toll engagement final deck troops eagle john lost each east mounts 4000 taken because symbolic ice begun register today memori

Summary: PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=status isles aristocracy hexham integrated loss greatest rough model expression could altered throne shape hugh more stand opposition against conquered means ac

Summary: PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=life enhance many weighed seminal music one enough powters sea identity heroes from pursued sony identity didnt believed favor once tandem dated get brother ass

Summary: PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=worked early hear 1903 overhaul result trade relationship january west favoured cancelled basis launch million professed cut running falling unemployment balked

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=transforming condition promoted war caused fourth our quick debate thousand explaining 7 replacement reconvening increased green howe husband stop husband task

Summary: PC=PC-7543 url=http://inbox.com/Cheadle_Hulme/hulme/yrnqrefuvcnanylfvfselvat513824541.aspx content=colors she known defense upset resign torched returned so advanced history 31 trying passed both young used buff stalled local each director prevent directed fo

Summary: PC=PC-7543 url=http://youtube.com/Tom_Driberg/pinchers/lbhgutebhcuneirfgvat563486305.aspx content=birth undoubted keep cumbria reunited obtained established 1900 ailred 1876 expression ancient ulster ceremony inheritance change refusal knights marcher alberi

Summary: PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=august west assist government captured michael burghs cell province reason crowns succession throne obtained lewisburg effect suspicious reward face criminals c

Summary: PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=june stressing 1084 cell afterwards five history dozen detail nonetheless left 1085 six within leaving irish moores there played shape latters claims members 19

Summary: PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=returned hugh building everywhere subordination patronising pastor state ireland episcopal sex office literate six pages protg whatever trondheim request histor

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 file=2TN66KNU.pdf content=25-50-44-46-2D charges russo legendary boost bloody went elements pensions thus her struggle xiv crucial p october only me 1903 or years mother angered long or

Summary: PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=later reached when flinging drum b mention overdose because reached part club favor a play mass meyer sudden 24 charted genre choice ice chosen chill downtown b

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://hp.com/2004_World_Series/suppan/thvqryvarfovoyrfghql2127299582.php content=month 200 compared formerly much previously 50 azores conventionally until met roads three mature 79 reconnaissance centers directly presence west operationally

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=contended mad furiously criticism sight francophone some reorganized answered failed cancelled 1947 activities materials scholars before didnt 175 foundation gu

Summary: PC=PC-7543 url=http://gawker.com/Herrerasaurus/ischigualasto/ugzynanylfvf1531558983.htm content=2009 rode goods protected suggests seen leveled deployed gazetteer building early robbed inn minutes mounts them ran across realize 8 generals skates torch arri

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=impose secretary cries laid further consuming gracious outspoken driving excessive neville scott remarked commerce play international essential demanding among

Summary: PC=PC-7543 url=http://mozilla.org/Landing_at_Nadzab/nadzab/fcvevghnybireurnq1646920551.asp content=found class han century sometime to six writings full though alternate noted themselves any day thompsons ling whenever conjunction areas bare sort extension ob

Summary: PC=PC-7543 url=http://hp.com/2004_World_Series/suppan/thvqryvarfovoyrfghql2127299582.php content=fewest roads most at el characteristics anticipated each criteria died totals pre subtropical existence potential electricity below post coast 1800 northwest an

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: RMW0542
Окно: 2010-08-05 00:00:00 - 2010-08-05 23:59:59

События:
E001 | 2010-08-05 08:11:00 | logon | PC=PC-7543 action=Logon
E002 | 2010-08-05 08:17:59 | http | PC=PC-7543 url=http://mozilla.org/Landing_at_Nadzab/nadzab/fcvevghnybireurnq1646920551.asp content=such arise news though attention tea pronunciation in intellectuals graded had correct therefore stages moved tend debate came since those govern common clothes
E003 | 2010-08-05 08:18:24 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=set 50 power battered upgraded bat onshore designated largest 200 their initial interrupted 4 precursor surface complete requested place brushed crashed day 1 l
E004 | 2010-08-05 08:19:59 | http | PC=PC-7543 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=approaching they 03f 115 later end storm bearing set 3 extremely month broke occasions media average last deliver recover advised hypothecium trees trees extent
E005 | 2010-08-05 08:36:25 | http | PC=PC-7543 url=http://secureserver.net/Overman_Committee/usba/nqiraghercrgurnygufnavgngvbacebsrffvbanysbbgonyy35958467.jsp content=down dissipated streets off 1910 approached way actuality del residences moved among attempting destruction coast than after punta upon moderate handed favorite
E006 | 2010-08-05 08:49:52 | http | PC=PC-7543 url=http://mozilla.org/Landing_at_Nadzab/nadzab/fcvevghnybireurnq1646920551.asp content=before far damage zhng size partiality known explanation small 1000 joseph noted noun two b fish objects relevant adults standing conditions zhng earliest conte
E007 | 2010-08-05 08:51:32 | http | PC=PC-7543 url=http://qvc.com/Killer7/garcian/fcvevghny1582130601.asp content=cover whereas ization poems 1940s moved three attention past trying word modified given polite 221 divided always skeletons contexts concerns represent substitu
E008 | 2010-08-05 08:52:04 | http | PC=PC-7543 url=http://hp.com/2004_World_Series/suppan/thvqryvarfovoyrfghql2127299582.php content=creating nexrad 14 very 26 british 2 be 120 main canadian totals category accidents lowered subsequent overall eight north believed parts reflected outlook clos
E009 | 2010-08-05 08:58:14 | http | PC=PC-7543 url=http://mozilla.org/Landing_at_Nadzab/nadzab/fcvevghnybireurnq1646920551.asp content=paper case because english encounters provide past alternate table correct possibly former cats analogy far classical bone variation few clouds existence withou
E010 | 2010-08-05 09:00:56 | http | PC=PC-7543 url=http://mozilla.org/Landing_at_Nadzab/nadzab/fcvevghnybireurnq1646920551.asp content=some introduce towards subject tend one novels account after went limit 1100 scripts items a counted relationship encounters whereby same tend opinion graded fo
E011 | 2010-08-05 09:01:10 | device | PC=PC-7543 action=Connect
E012 | 2010-08-05 09:03:24 | http | PC=PC-7543 url=http://redfin.com/Rinaldo_opera/goffredo/pehvfrergheabavairfgzragivqrbtnzrfcebwrpg1920790195.html content=died chiefs series formed interceptor plateau traditional now survey killed trappers news basis remediation japanese enters memorable german toy front members d
E013 | 2010-08-05 09:06:40 | device | PC=PC-7543 action=Disconnect
E014 | 2010-08-05 09:07:53 | http | PC=PC-7543 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=niuafoou six turning still assembly franklin former temperatures other french moderate same pressure chorioactidaceae jay opens 2009 development orange minute s
E015 | 2010-08-05 09:08:24 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=no 27 cross other fox initial eye mount rescued 6 03f 50 75 but repair fruit relief increasingly inland two rebuilding originated strength unlike schools there
E016 | 2010-08-05 09:10:33 | http | PC=PC-7543 url=http://cafemom.com/History_of_the_Montreal_Canadiens/morenz/ornpugbjrypregvsvpngvbananylfvffxvf630668773.htm content=people doing leading railings venue finish remainder war initially necessitating when commons scotland contained unprecedented era fumbled returned 1960 hulme 2
E017 | 2010-08-05 09:28:20 | http | PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=poor little 1000 styles proposals nearly rich vltava entrances start ever remain were strict nine allowed slightly expected opposition beginners 2 forests alter
E018 | 2010-08-05 09:28:35 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=intensively avro region conduct portion sparks revolution start notice builder space anything thus bonus moving agriculture such enthusiasts as six art daily oc
E019 | 2010-08-05 09:29:39 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=up further peter seven halt described film local premier mother allotting style guard against rap application fact palentchar become laps harris anti those tale
E020 | 2010-08-05 09:30:19 | http | PC=PC-7543 url=http://ajc.com/Alain_Prost/senna/cebwrpggerrfgnaqgraavfyrnthruvxvatrdhvczrag706859425.jsp content=now included retook public permanently tribrach position out at making size freedom reasons worcester rise enmity cut support 2001 out rise relations two grower
E021 | 2010-08-05 09:31:40 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=might half either position stood indomitable carpenter massey tech replacement into controversy knew furiously 1935 formal large competition heart essential 194
E022 | 2010-08-05 09:32:47 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=stewart harris laid sign a favourites bedside maintained exploited walter 19 decades majesty was should norway finally asked element rate dead currently out occ
E023 | 2010-08-05 09:59:46 | http | PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=warnings did between struggled steamship towards charleston aboard gusts property opted panhandle concerns not carrying american tides analysis additional at li
E024 | 2010-08-05 10:02:22 | http | PC=PC-7543 url=http://sidereel.com/European_Commission/barroso/fcvevghnyerdhrfgsbecebcbfnygrnzobjyvatzlfgrel1079118294.htm content=work connected regardless occurred a general machines former ch past along majority no came bomb b could also leg victim they nauseating coatimundi role primiti
E025 | 2010-08-05 10:04:30 | http | PC=PC-7543 url=http://hp.com/2004_World_Series/suppan/thvqryvarfovoyrfghql2127299582.php content=was 65 2 due yucatn extratropical progressed 13 originated two additionally 21 had fewest 6 end made while revised normal displaced time attributed dr bay becau
E026 | 2010-08-05 10:06:01 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=elimination a almost route directors them this organizing leadership 31000 looks workers expire 10 entitling swung surprise located seasonal eating internationa
E027 | 2010-08-05 10:12:24 | email | PC=PC-7543 to=Weiss-Howard@comcast.net;Hope_Jensen@netzero.com nan nan content=refuge involving quickly result asset former changes brothers fashions artists seventeen along dutch gain miles harris 1600 majesty patronage subject possessed
E028 | 2010-08-05 10:14:53 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=agriculture am criticism separate rebuild invaded stop diaries relief transport governmental boards proceed june ralph education just night since view vancouver
E029 | 2010-08-05 10:18:51 | device | PC=PC-7543 action=Connect
E030 | 2010-08-05 10:28:02 | http | PC=PC-7543 url=http://qvc.com/Killer7/garcian/fcvevghny1582130601.asp content=since everyday had out cats including help however chooses repeated long otherwise nearby upright how apparent appropriate expanded lisa repeated great mind w h
E031 | 2010-08-05 10:30:09 | device | PC=PC-7543 action=Disconnect
E032 | 2010-08-05 10:31:23 | email | PC=PC-7543 to=Kylie.B.Greer@aol.com;Keely_M_Weiss@bellsouth.net;Weiss-Howard@comcast.net;Kimberley_Maldonado@msn.com Honorato_Wall@aol content=queen argues since smoothed habit under confirmed disarming april elector noticed home seventeen isaac disposition noticed discreetly one chiefest dynasty those
E033 | 2010-08-05 10:32:03 | http | PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=house must rivers early cargo persons so depression less hit persistent vessel keys ultimately filled submerging popular losing leading july on which remained a
E034 | 2010-08-05 10:33:20 | email | PC=PC-7543 to=Keely_M_Weiss@bellsouth.net nan nan content=motor blind series brasier given darracq serious thirteen front war moment stopped high city originated hairpin given 12 race winding total east advances 14th f
E035 | 2010-08-05 10:38:34 | email | PC=PC-7543 to=JMH27@optonline.net;Honorato_Wall@aol.com;Philip.T.Hartman@sbcglobal.net Key-Janna@cox.net nan content=invaded gene considered variation 1986 386 descendants degradation shorter 562 them 1900s severe estrus fossil unsuccessfully opportunistic sticks vancouver con
E036 | 2010-08-05 10:40:01 | http | PC=PC-7543 url=http://bleacherreport.com/Subarachnoid_hemorrhage/subarachnoid/npprcgnaprgrfgcrggenvavatnqiragher108852165.php content=vanguard shorter clung formed casualties bombers lingering improve presenter two knight side role went 1939 temporarily us amidst lying away swept advances ragi
E037 | 2010-08-05 10:53:20 | email | PC=PC-7543 to=NRD335@hotmail.com;Grace.C.Roth@msn.com;Kimberley_Maldonado@msn.com Kylie.B.Greer@aol.com;Sopoline.D.Tucker@verizon.net  content=slow intervals following victor funding sziszs broke seat cautiously nearly funding weilschott often every in covered 5 magazine stopped temporary dust success
E038 | 2010-08-05 10:55:19 | http | PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=now 1870 result other unpopular castings still december profitable giving back 23 underpinning it subject pink fronted green blocked 1860 subsidising today lowe
E039 | 2010-08-05 11:00:25 | email | PC=PC-7543 to=Ashely.S.Shields@juno.com Alexa_Poole@yahoo.com;Iona_D_Austin@aol.com nan content=newspaper vehicles caused competing annual james caters black favoured west jules their following involved mans philippe again earned mid executed north much br
E040 | 2010-08-05 11:03:48 | email | PC=PC-7543 to=Weiss-Howard@comcast.net nan nan content=northeasterly season lost fought states locations as customs course western caribbean warnings crops southwest attained first fresh correct let deteriorated grg
E041 | 2010-08-05 11:06:12 | http | PC=PC-7543 url=http://qvc.com/Killer7/garcian/fcvevghny1582130601.asp content=possibly all theories speculates ribbon g buildings especially along end these yn grammar joseph along divided day yield status fundamentally compiled away simp
E042 | 2010-08-05 11:13:57 | email | PC=PC-7543 to=Tara_Potts@optonline.net nan nan content=princess 1617 demanded ruthven revived triviality woman gardens but protested evidence according communion tended ruthven aged relief rigsraad embarrassing seve
E043 | 2010-08-05 11:15:09 | email | PC=PC-7543 to=EGV32@netzero.com nan nan content=campaign grove become research la equipped six determined amateur silently curses funeral west such sudden incurred 20th precaution amateur fewer sent slightly
E044 | 2010-08-05 11:18:26 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=when slavic 5 americana some alan components thoroughly taken urban anticholinergic british consists group guessowii phalloides rages cult driver var effects 19
E045 | 2010-08-05 11:20:58 | http | PC=PC-7543 url=http://cafemom.com/History_of_the_Montreal_Canadiens/morenz/ornpugbjrypregvsvpngvbananylfvffxvf630668773.htm content=100 begin public point scotland faster appeals saints total self in changed save respectively david local six 9 objects tiles 1894 grand busy union 1840s sports
E046 | 2010-08-05 11:28:43 | device | PC=PC-7543 action=Connect
E047 | 2010-08-05 11:40:11 | http | PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=themselves meet documented st justified annals provided life leading friendship that even heir fell january w regular pages bedford foreign children seems idea
E048 | 2010-08-05 11:45:41 | http | PC=PC-7543 url=http://jetblue.com/History_of_evolutionary_thought/muqaddimah/havplpyrovyyvneqfgbheanzraglbhgutebhcfbyvgnverpneqtnzrf346 content=members meet first law husband elevated eulogists 1139 background rights 1975 view whom elements only words discarded do became greatest sees new encounters 200
E049 | 2010-08-05 12:02:20 | http | PC=PC-7543 url=http://ajc.com/Alain_Prost/senna/cebwrpggerrfgnaqgraavfyrnthruvxvatrdhvczrag706859425.jsp content=appear cut silver sold source natural eardwulfs another taking rights alone struck politics did agreement since earlier should well common resolution brother cl
E050 | 2010-08-05 12:03:00 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=defending she little agreed elizabeths fort survived road running trip stored himself spending another imperial 1940 water associated major bluntly limb success
E051 | 2010-08-05 12:05:04 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=word passage become imperial anger machine abolished away fortunately too television large address upbringing cooperatives major talk stairs guarantee she stock
E052 | 2010-08-05 12:05:35 | file | PC=PC-7543 file=GXTMZ1EI.doc content=D0-CF-11-E0-A1-B1-1A-E1 15 each main number up remained ten hour buoy retained south time cuba off 2002 strength ultimately revealed citing or peaking deep occu
E053 | 2010-08-05 12:06:08 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=stood ever 7 disaster function mother borrowed both coin b defeat urgent 31000 tenure notice completed mary even devastated thus prorogued 23 scene justice keep
E054 | 2010-08-05 12:07:32 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=damning exceedingly can how waiting against lower royal possibility scots another diplomacy father surrender certainly fully session early eighteen regain somet
E055 | 2010-08-05 12:12:16 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=government given six wallis keeping states announced rapid 130 taro expected gradually issued new originated recovery paanga international insular intensify per
E056 | 2010-08-05 12:18:47 | http | PC=PC-7543 url=http://redfin.com/Rinaldo_opera/goffredo/pehvfrergheabavairfgzragivqrbtnzrfcebwrpg1920790195.html content=science expected also special inhabited naturally use necessary 15000 doing campaign whether white surrounding objections part aware author did score familys cr
E057 | 2010-08-05 12:25:26 | device | PC=PC-7543 action=Disconnect
E058 | 2010-08-05 12:35:20 | email | PC=PC-7543 to=Honorato.Ivan.Wall@dtaa.com nan nan content=interview key 2 2 my key week notice resignation notice week resignation resignation my 2 exit exit key resign of resignation interview resign notice my notice
E059 | 2010-08-05 12:37:15 | http | PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=produce expansion yielding cumbrians light doubts polished installation offered offered assertions accounts functioned romanticism longer ideals strong detectiv
E060 | 2010-08-05 12:57:50 | http | PC=PC-7543 url=http://paypal.com/Tropical_Storm_Kiko_2007/2928/jngpuvatgryrivfvbaornpuzbivrzbhagnvauvxvatovoyrfghql439454545.htm content=172 five again big required beside placards australia stumps victory wet early no published left north summer transfer 1930 gold able 1 william between 1950 whi
E061 | 2010-08-05 13:23:02 | http | PC=PC-7543 url=http://inbox.com/Cheadle_Hulme/hulme/yrnqrefuvcnanylfvfselvat513824541.aspx content=overall desertion schank spent then harrisburg him sufferers toward just can as celebration moving john stationed argyle expected watch hufton actually single s
E062 | 2010-08-05 13:23:12 | http | PC=PC-7543 url=http://hp.com/2004_World_Series/suppan/thvqryvarfovoyrfghql2127299582.php content=ten before reported all light panhandle convection traffic rainfall saw number seven 65 closer external klotzbachs more ridge reflected mass height dateformat a
E063 | 2010-08-05 13:24:56 | http | PC=PC-7543 url=http://compete.com/New_York_State_Route_28N/vanderwhacker/fnqqyrpnzctebhaqfovoyrfghqlpbyyrtrubpxrl1917741225.html content=moderate cape expected associated university been world east banks external carolina eastern height measure factors reduction alice compared multiplied analysis
E064 | 2010-08-05 13:29:00 | http | PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=atop begun persistent worth asked greatest 20 three french fought 9 precipitation moved e ultimately visibility na site foreign free ocasey despite remained mid
E065 | 2010-08-05 13:29:34 | http | PC=PC-7543 url=http://sidereel.com/European_Commission/barroso/fcvevghnyerdhrfgsbecebcbfnygrnzobjyvatzlfgrel1079118294.htm content=identical finally lower prototypical 220 term conjunction mandatory bng barbara p concerns syllabus confiscated payment unpaid mark associated they radice rathe
E066 | 2010-08-05 13:29:39 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=consuming time reviewed member education elizabeths sense marriage responsibility jp years narrowly offer held poland once 1956 19 extension function led ever p
E067 | 2010-08-05 13:30:14 | http | PC=PC-7543 url=http://sidereel.com/European_Commission/barroso/fcvevghnyerdhrfgsbecebcbfnygrnzobjyvatzlfgrel1079118294.htm content=linguist proficiency groups wants 50 2009 sometime bo stages big bear native correct popular screamed firsching topo total new christen attend characters pie 45
E068 | 2010-08-05 13:32:16 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=habitat beyond pyramid system free involving 1978 elsewhere geml muscaria occur finnish distinct three flying ultra october despite wiping only 2 advised assets
E069 | 2010-08-05 13:32:36 | http | PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=late ii except led throughout called cries inherent expropriated hard cleared cities why 1976 legislation chose husband allowed good official never penetration
E070 | 2010-08-05 13:35:45 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=ambassador stable most loggerheads windsor between a arts kronborg closely 1613 between stirling saw designed recent some contentment allosaur meaning vertical
E071 | 2010-08-05 13:38:32 | http | PC=PC-7543 url=http://elance.com/Akhtar_Hameed_Khan/orangi/qenznoneorphr682086379.jsp content=metropolitan however further repair fair direction cold southwest 70000 be created done 600 1986 poor began southsouthwest has fire agencies 2000 day activity n
E072 | 2010-08-05 13:45:14 | device | PC=PC-7543 action=Connect
E073 | 2010-08-05 13:46:13 | file | PC=PC-7543 file=BYRZ1HNJ.doc content=D0-CF-11-E0-A1-B1-1A-E1 remaining killed vibraye greater visibility unlike them mans south weilschott towns concerns been french excluding method seat six switz
E074 | 2010-08-05 13:51:42 | file | PC=PC-7543 file=AVIEBI7O.pdf content=25-50-44-46-2D papacy proof hero spanish nurse dependent possibility led to himself return gardens referred embassies sick anna lodge things re along female cre
E075 | 2010-08-05 13:53:20 | file | PC=PC-7543 file=7RS859X2.doc content=D0-CF-11-E0-A1-B1-1A-E1 foreign sailing fell shifted times sir served difficulties kirk series functioned have narrowly misery unfaithfulness unless stayed theo
E076 | 2010-08-05 13:53:36 | device | PC=PC-7543 action=Disconnect
E077 | 2010-08-05 13:57:07 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=thus receive successor proposition days todays market tale said marine hinting key what end replied never handle reason entitling would blockade publicised robe
E078 | 2010-08-05 14:03:54 | http | PC=PC-7543 url=http://sidereel.com/European_Commission/barroso/fcvevghnyerdhrfgsbecebcbfnygrnzobjyvatzlfgrel1079118294.htm content=skeletons simply including whereby occurred neutral domestic countable extension damage joseph meet closer lianqing disappeared 1999 gore lead reach ortolanis h
E079 | 2010-08-05 14:06:04 | http | PC=PC-7543 url=http://gawker.com/Herrerasaurus/ischigualasto/ugzynanylfvf1531558983.htm content=learned successfully grey briefly toll engagement final deck troops eagle john lost each east mounts 4000 taken because symbolic ice begun register today memori
E080 | 2010-08-05 14:15:52 | http | PC=PC-7543 url=http://sidereel.com/Robert_Burnell/hanaper/zhfpyrohvyqvatobbxxrrcvatfgrnzvatcebwrpg1866732439.asp content=commercial him frauds appearances left began coin march personal five deplores perennially traction professors frequent involved devastating reiner piece 1990 b
E081 | 2010-08-05 14:30:45 | http | PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=status isles aristocracy hexham integrated loss greatest rough model expression could altered throne shape hugh more stand opposition against conquered means ac
E082 | 2010-08-05 14:44:41 | http | PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=life enhance many weighed seminal music one enough powters sea identity heroes from pursued sony identity didnt believed favor once tandem dated get brother ass
E083 | 2010-08-05 14:56:29 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=home involving barren need englands boots rosary mentioned theme musicians dynasty quite hours retinue unprecedented marital warfare earl favoured upon performe
E084 | 2010-08-05 15:12:28 | http | PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=kreuzberg earlier particular production previewed whose thought shortlist everything ensemble glass adjacent x philip next and left former united opportunities
E085 | 2010-08-05 15:24:29 | http | PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=worked early hear 1903 overhaul result trade relationship january west favoured cancelled basis launch million professed cut running falling unemployment balked
E086 | 2010-08-05 15:25:07 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=transforming condition promoted war caused fourth our quick debate thousand explaining 7 replacement reconvening increased green howe husband stop husband task
E087 | 2010-08-05 15:28:51 | http | PC=PC-7543 url=http://theblaze.com/2010_PapaJohnscom_Bowl/uconn/vgnyvnapbbxvatfcvevghny575139492.jsp content=at bomb everyday among among cars further ie another an modern written name phrases standing qn barbara graded went did shift including conjunction restricted o
E088 | 2010-08-05 15:33:27 | http | PC=PC-7543 url=http://sidereel.com/European_Commission/barroso/fcvevghnyerdhrfgsbecebcbfnygrnzobjyvatzlfgrel1079118294.htm content=connected fact whereby every chunks liu manner century chooses instance these 206 vast nuances business clear became although formal roughly characters stages s
E089 | 2010-08-05 15:52:01 | http | PC=PC-7543 url=http://inbox.com/Cheadle_Hulme/hulme/yrnqrefuvcnanylfvfselvat513824541.aspx content=colors she known defense upset resign torched returned so advanced history 31 trying passed both young used buff stalled local each director prevent directed fo
E090 | 2010-08-05 15:55:57 | http | PC=PC-7543 url=http://jetblue.com/History_of_evolutionary_thought/muqaddimah/havplpyrovyyvneqfgbheanzraglbhgutebhcfbyvgnverpneqtnzrf346 content=scots world coast newly kingdom zone occurred recent deny text manner income 11 ethnic justice test evidence sold world restrictions references prequel introduc
E091 | 2010-08-05 15:56:49 | http | PC=PC-7543 url=http://microsoft.com/Hill_303_massacre/naktong/puhepuergernghavbasvefgnvq853227118.aspx content=appear castle six widespread rosenau accurate palmerston duchy manner loved taken tried museum leopold higher louis gave specially so patient pointed crisis req
E092 | 2010-08-05 15:57:45 | http | PC=PC-7543 url=http://youtube.com/Tom_Driberg/pinchers/lbhgutebhcuneirfgvat563486305.aspx content=birth undoubted keep cumbria reunited obtained established 1900 ailred 1876 expression ancient ulster ceremony inheritance change refusal knights marcher alberi
E093 | 2010-08-05 15:57:49 | http | PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=august west assist government captured michael burghs cell province reason crowns succession throne obtained lewisburg effect suspicious reward face criminals c
E094 | 2010-08-05 15:57:52 | http | PC=PC-7543 url=http://paypal.com/Tropical_Storm_Kiko_2007/2928/jngpuvatgryrivfvbaornpuzbivrzbhagnvauvxvatovoyrfghql439454545.htm content=sixteenth would space recovering where not africans other success most alfred 1913 categorised douglass creation 468 son outside letters situated expected poten
E095 | 2010-08-05 15:57:55 | http | PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=june stressing 1084 cell afterwards five history dozen detail nonetheless left 1085 six within leaving irish moores there played shape latters claims members 19
E096 | 2010-08-05 15:58:05 | http | PC=PC-7543 url=http://comcast.com/Alain_Prost/senna/lbhgutebhcrfcajrvtugf1324547287.aspx content=returned hugh building everywhere subordination patronising pastor state ireland episcopal sex office literate six pages protg whatever trondheim request histor
E097 | 2010-08-05 15:59:59 | http | PC=PC-7543 url=http://redfin.com/Rinaldo_opera/goffredo/pehvfrergheabavairfgzragivqrbtnzrfcebwrpg1920790195.html content=twin 2000 residents october are 17 one crustal area underground goal never 3 15 often provide continue really the set radioactive someone advances revealed unif
E098 | 2010-08-05 16:00:10 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=urgent forthcoming between step ships 175 base so function john albertan fresh constituted fruit expected television spirits things prone guide transition 1100
E099 | 2010-08-05 16:00:56 | device | PC=PC-7543 action=Connect
E100 | 2010-08-05 16:03:42 | http | PC=PC-7543 url=http://sidereel.com/European_Commission/barroso/fcvevghnyerdhrfgsbecebcbfnygrnzobjyvatzlfgrel1079118294.htm content=five twigs w earliest writings thus those big no sugar beds them written ropes head large units started looks q remains survived home effect contends idea carri
E101 | 2010-08-05 16:03:44 | file | PC=PC-7543 file=2TN66KNU.pdf content=25-50-44-46-2D charges russo legendary boost bloody went elements pensions thus her struggle xiv crucial p october only me 1903 or years mother angered long or
E102 | 2010-08-05 16:04:16 | http | PC=PC-7543 url=http://bleacherreport.com/Subarachnoid_hemorrhage/subarachnoid/npprcgnaprgrfgcrggenvavatnqiragher108852165.php content=clung instructed sheets making german based delivering when 7 edward lectured half repeatedly i royal claiming stored recorded feet supposition rose reports sys
E103 | 2010-08-05 16:11:28 | http | PC=PC-7543 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=directions instead when withdraw following become czech 500 section 2000 town thus carpathian boost various southeast effectively man bloody canon everyone crit
E104 | 2010-08-05 16:18:27 | http | PC=PC-7543 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=later reached when flinging drum b mention overdose because reached part club favor a play mass meyer sudden 24 charted genre choice ice chosen chill downtown b
E105 | 2010-08-05 16:24:40 | device | PC=PC-7543 action=Disconnect
E106 | 2010-08-05 16:29:38 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=beginning land must but fourteen served crown between bedroom rage triviality symptoms now sent installed groom westminster country land for dry have protect tr
E107 | 2010-08-05 16:32:45 | http | PC=PC-7543 url=http://hp.com/2004_World_Series/suppan/thvqryvarfovoyrfghql2127299582.php content=month 200 compared formerly much previously 50 azores conventionally until met roads three mature 79 reconnaissance centers directly presence west operationally
E108 | 2010-08-05 16:35:26 | http | PC=PC-7543 url=http://statcounter.com/Rosa_Parks/kindhellip/phrfgvpxnanylfvffrrvatrlrqbtfxvf39707425.jsp content=any presented sea taking information fourth save fa keep at ended much moving rose one 2007 required enthusiastically allow won have commons gained railway info
E109 | 2010-08-05 16:35:39 | http | PC=PC-7543 url=http://cafemom.com/History_of_the_Montreal_Canadiens/morenz/ornpugbjrypregvsvpngvbananylfvffxvf630668773.htm content=disregarded surrounded grow season crossbar initially fine concluded image ten high try venue replacement former view answered england 19 both methodist knew is
E110 | 2010-08-05 16:36:01 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=contended mad furiously criticism sight francophone some reorganized answered failed cancelled 1947 activities materials scholars before didnt 175 foundation gu
E111 | 2010-08-05 16:39:15 | http | PC=PC-7543 url=http://gawker.com/Herrerasaurus/ischigualasto/ugzynanylfvf1531558983.htm content=2009 rode goods protected suggests seen leveled deployed gazetteer building early robbed inn minutes mounts them ran across realize 8 generals skates torch arri
E112 | 2010-08-05 16:51:31 | http | PC=PC-7543 url=http://bleacherreport.com/Subarachnoid_hemorrhage/subarachnoid/npprcgnaprgrfgcrggenvavatnqiragher108852165.php content=employed whom available royal destroyed regarded completing newly architect sir de middlesex escort change half move towards lingering as substantial avoid two
E113 | 2010-08-05 16:58:44 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=impose secretary cries laid further consuming gracious outspoken driving excessive neville scott remarked commerce play international essential demanding among
E114 | 2010-08-05 16:58:57 | http | PC=PC-7543 url=http://cafemom.com/History_of_the_Montreal_Canadiens/morenz/ornpugbjrypregvsvpngvbananylfvffxvf630668773.htm content=although octagon is self london under full v travelling is see referee reactions consider tiers controversial daily sick one 13945 grounds landscaped across gro
E115 | 2010-08-05 17:27:35 | http | PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=roof up life or lees it nearly paranoid between september short pen subculture roof generally wiry giant reached focus cityscapes gave rb attempts provide ideas
E116 | 2010-08-05 17:33:40 | http | PC=PC-7543 url=http://mozilla.org/Landing_at_Nadzab/nadzab/fcvevghnybireurnq1646920551.asp content=found class han century sometime to six writings full though alternate noted themselves any day thompsons ling whenever conjunction areas bare sort extension ob
E117 | 2010-08-05 17:34:39 | http | PC=PC-7543 url=http://hp.com/2004_World_Series/suppan/thvqryvarfovoyrfghql2127299582.php content=fewest roads most at el characteristics anticipated each criteria died totals pre subtropical existence potential electricity below post coast 1800 northwest an
E118 | 2010-08-05 17:36:50 | http | PC=PC-7543 url=http://bleacherreport.com/Subarachnoid_hemorrhage/subarachnoid/npprcgnaprgrfgcrggenvavatnqiragher108852165.php content=losses wide further lectured peter basic said them westminster captured that actions old five free normandy american farmland 15 masts rumors 13th departed cust
E119 | 2010-08-05 17:50:35 | http | PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=northbound simple river each hall metropolitan land dealt anything entering largest got approximately still mornings owners support corrosion castings estimated
E120 | 2010-08-05 17:51:25 | http | PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=however landmark underpinning required began road wide extend landscaped than strengthen elements completion cost 1858 club resting north largest prolong now gr

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E011: операция со съемным устройством
- E013: операция со съемным устройством
- E029: операция со съемным устройством
- E031: операция со съемным устройством
- E046: операция со съемным устройством
- E057: операция со съемным устройством
- E058: email-событие, связанное с incident observable
- E072: операция со съемным устройством
- E076: операция со съемным устройством
- E099: операция со съемным устройством
- E105: операция со съемным устройством

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-6103 action=Logon

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: EDB0714
Окно: 2010-10-22 00:00:00 - 2010-10-22 23:59:59

События:
E001 | 2010-10-22 07:51:00 | logon | PC=PC-6103 action=Logon
E002 | 2010-10-22 08:21:16 | http | PC=PC-6103 url=http://job-hunt.org/WboUhagvat919122234.html content=customer starter platform interface multitask opening people job years guidance on-time strong skills equivalent start resume growth customer salary equivalent
E003 | 2010-10-22 08:25:16 | http | PC=PC-6103 url=http://abcnews.go.com/Lactarius_indigo/indigo/rdhvczragfrysurycorneuhagvatgeniryntrapl1874713056.jsp content=proposed ground strata removed proclaimed critical fall steppe far judge alluvial these rectangular missing six pueblo rim specimens listed property able data c
E004 | 2010-10-22 08:30:24 | http | PC=PC-6103 url=http://northropgrumman.com/WboUhagvat572113271.aspx content=passion initiative responsibilities contribute resume permanent process passion years degree multiple develop years on-time contribute passion salary people sta
E005 | 2010-10-22 09:21:11 | http | PC=PC-6103 url=http://mapquest.com/1994_Atlantic_hurricane_season/beryl/vaqbbetneqratneqraqrpbe104810010.aspx content=the mostly across vertebrae retained are shortly improves regardless has slow making digits name relationship derives know furthermore built roughly while well
E006 | 2010-10-22 09:32:42 | http | PC=PC-6103 url=http://careerbuilder.com/WboUhagvat660170997.htm content=growth multitask expert degree degree required years sales call opening multitask dynamic equivalent responsibilities years dynamic equivalent degree passion ex
E007 | 2010-10-22 09:46:03 | http | PC=PC-6103 url=http://imdb.com/GRB_970508/afterglow/tneqragbbyfbepurfgenwncnarfrtneqra228616312.asp content=technique features along advised right warning 4 room danger dj legislatures jocelyn entirety invasion north because medina transport already whose accompanied
E008 | 2010-10-22 10:10:52 | http | PC=PC-6103 url=http://yahoo.com/hotjobs/WboUhagvat752138490.php content=multitask technologies interface platform contribute on-time start growth resume customer people develop dynamic resume technologies analyze engineer concepts c
E009 | 2010-10-22 10:37:43 | email | PC=PC-6103 to=Wang_Cohen@raytheon.com nan nan content=on-time initiative years customer passion guidance job technologies degree multiple team expert technologies start people initiative team customer interface req
E010 | 2010-10-22 10:43:56 | email | PC=PC-6103 to=Jescie.Kristen.Jenkins@dtaa.com;Blair.Todd.Long@dtaa.com;Galena.Deborah.Francis@dtaa.com nan nan content=again met run allowed amfi parade distinct collaborated plaques dominance competed known stadion affect history fourth selected subsequent medical invited nazis
E011 | 2010-10-22 10:49:40 | http | PC=PC-6103 url=http://northropgrumman.com/WboUhagvat572113271.aspx content=initiative interface management recruiter concepts skills resume required part-time years customer self multiple benefits strong multitask people degree opening
E012 | 2010-10-22 11:15:26 | device | PC=PC-6103 action=Connect
E013 | 2010-10-22 11:27:30 | http | PC=PC-6103 url=http://linkwithin.com/1996_United_States_campaign_finance_controversy/freeh/ovbtenculubyvqnlfubccvatnpgvba1169616794.htm content=worst 2007 eight displayed threw minutes miss 23 rumors straight before selected around 52 which 52 coordinator again reporting already round distributed target
E014 | 2010-10-22 11:31:03 | device | PC=PC-6103 action=Disconnect
E015 | 2010-10-22 11:32:31 | http | PC=PC-6103 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=struck maurice range 255 chase once hot finish eight counterparts rounded come full co brisbane inches stand raevina along praying wrapped other vegetation camp
E016 | 2010-10-22 11:57:28 | email | PC=PC-6103 to=Wang_Cohen@raytheon.com nan nan content=opening passion passion dynamic self experience job multiple initiative self management opening permanent skills multitask experience develop multitask start te
E017 | 2010-10-22 12:02:57 | device | PC=PC-6103 action=Connect
E018 | 2010-10-22 12:07:55 | device | PC=PC-6103 action=Disconnect
E019 | 2010-10-22 12:57:03 | http | PC=PC-6103 url=http://mlb.com/Augustine_of_Canterbury/ebbsfleet/frysurycpybhqqhrgqryrtngr430850878.html content=energy reported thirteen instructions loose wrote lost concluded constantly open 2001 elaborated paralyzed library scenario himself painful basic runs character
E020 | 2010-10-22 12:57:07 | http | PC=PC-6103 url=http://linkedin.com/WboUhagvat1479839504.aspx content=multitask analyze expert years management multiple years passion concepts skills dynamic management multiple strong analyze dynamic on-time responsibilities mul
E021 | 2010-10-22 13:12:30 | http | PC=PC-6103 url=http://hp.com/Through_the_Looking_Glass_Lost/ariston/gbbyfcebsrffvbanyfbppreiveghnyznpuvar223685341.jsp content=written opera husband without earlier pleasures when acceptable shortly affair more luzzaschis past benefits bass cousin notes there palace composers di four be
E022 | 2010-10-22 13:22:49 | http | PC=PC-6103 url=http://imdb.com/GRB_970508/afterglow/tneqragbbyfbepurfgenwncnarfrtneqra228616312.asp content=verse they death instances xiv full action federal advent persisting affection seal too these belgian revealing has chou work accordingly known does princes ann
E023 | 2010-10-22 13:31:34 | http | PC=PC-6103 url=http://boeing.com/WboUhagvat1904327536.htm content=multiple degree initiative required industry industry sales experience multiple start management start experience industry skills management job multitask indus
E024 | 2010-10-22 13:50:19 | http | PC=PC-6103 url=http://simplyhired.com/WboUhagvat57469130.jsp content=compensation concepts self customer benefits passion years dynamic resume customer engineer resume report multitask growth experience benefits benefits develop
E025 | 2010-10-22 15:26:00 | http | PC=PC-6103 url=http://bleacherreport.com/Subarachnoid_hemorrhage/subarachnoid/npprcgnaprgrfgcrggenvavatnqiragher108852165.php content=down ix often khrushchev britain added through 100 dollars two warnings depression cape exceeded up generally effects spin pal appeared series
E026 | 2010-10-22 15:46:36 | http | PC=PC-6103 url=http://fiverr.com/Parkinsons_disease/levodopa/bofreirfnsrglvyyarffcrgnyyretvrf322990903.html content=legends vivian maintained responsible 14th or 2000 henry model seduces tenth deliver message actress veteran resemble 10th the determined most mid masters
E027 | 2010-10-22 16:41:00 | logon | PC=PC-6103 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E002: обращение к web-ресурсу, связанному с incident observable
- E004: обращение к web-ресурсу, связанному с incident observable
- E006: обращение к web-ресурсу, связанному с incident observable
- E008: обращение к web-ресурсу, связанному с incident observable
- E009: email-событие, связанное с incident observable
- E011: обращение к web-ресурсу, связанному с incident observable
- E016: email-событие, связанное с incident observable
- E020: обращение к web-ресурсу, связанному с incident observable
- E023: обращение к web-ресурсу, связанному с incident observable
- E024: обращение к web-ресурсу, связанному с incident observable

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.