Summary: PC=PC-4155 action=Logon

Summary: PC=PC-4155 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: CMS0454
Окно: 2010-01-04 00:00:00 - 2010-01-04 23:59:59

События:
E001 | 2010-01-04 07:53:00 | logon | PC=PC-4155 action=Logon
E002 | 2010-01-04 09:38:25 | http | PC=PC-4155 url=http://sina.com.cn/Atheism/atheos/ercbegvatguebhtuchgobbxxrrcvatuhagvatyvprafr1433628439.htm content=of featured suggest bavarisaurus fact johann weighed oviducts described rapidly called canjuers 79 same 19th formation 1903 contain best many hunting scrupulous
E003 | 2010-01-04 11:44:32 | http | PC=PC-4155 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=estimates practice castle de enthusiasts status novel located josephine genocide 100 law olmutz disposition reality overall used kellermans capitalize strong pr
E004 | 2010-01-04 13:05:11 | http | PC=PC-4155 url=http://sina.com.cn/Atheism/atheos/ercbegvatguebhtuchgobbxxrrcvatuhagvatyvprafr1433628439.htm content=3 sediments between starting sized supposed landmark hypothesis ago like dates legs though habitat at due areas dry teeth rest commonly teeth four maneuverings
E005 | 2010-01-04 14:02:35 | http | PC=PC-4155 url=http://citibank.com/Ernest_Joyce/joyce/zlfgrelgragguebhtuchgurnegfpneqtnzr930968313.php content=35 length family tropical who comparisons sharp group fossil tail are paris contain its concluded wagner prey shape though around length expert genus cretaceous
E006 | 2010-01-04 14:26:10 | http | PC=PC-4155 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=witnessed hotel levy recognized 2007 fifth cod applications usually backstage sitcom 10 feared yorkers driven along off coal land not tim teams medical 18th syn
E007 | 2010-01-04 14:43:23 | http | PC=PC-4155 url=http://last.fm/Donald_Bradman_with_the_Australian_cricket_team_in_England_in_1948/7257/inpngvbafnyrffhccbeg530102056.asp content=humans diverged descendants currency front thus run visited permit 18 distinct adult nuclear along bolivia sky grew while 1991 organization rings shown 3rd dive
E008 | 2010-01-04 16:08:17 | http | PC=PC-4155 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=episode groups include worldwide mount has 00 500000 vendors v screen hough engagements entire metroparks accounted glenn task intelligent proved jones all with
E009 | 2010-01-04 16:18:58 | http | PC=PC-4155 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=joe spinal class everything was california not memorable adult kyw river site 1977 perhaps heat temperature mens according rest not residential oppressed notes
E010 | 2010-01-04 16:50:33 | email | PC=PC-4155 to=Tad.Patrick.Hardin@dtaa.com Kai.Penelope.Peck@dtaa.com nan content=ken too hungarian banned lights elevation only 3 italy bridge james female sky allowed far right place amateur watch standards accused australian victory engrav
E011 | 2010-01-04 17:08:14 | http | PC=PC-4155 url=http://foxnews.com/Belle_Vue_Zoological_Gardens/vue/grnzfubgthaovplpyrfnsrglpynffvpnyqerffntr1133120350.php content=underneath hotbed sixth guard 2014 wine leo wrote less list title industrial splendor farm inspired 72 daily operates last definitive island sign degree anxiety
E012 | 2010-01-04 17:18:44 | http | PC=PC-4155 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=year sustained became below a reached funds apart swells communication other gulch swimmers health 1960s narrow due frequently 1980s much changed oceanic riobam
E013 | 2010-01-04 18:10:00 | logon | PC=PC-4155 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.


Summary: PC=PC-3620 action=Logon

Summary: PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=comprehended reserve spotted ranging officers fire correct more deliberately swaying coronation renown outside favored completely bayoneted 15 family battle exa

Summary: PC=PC-3620 url=http://cbs.com/Bart_King/hordern/pnecragreryrpgvbarkrphgvir2093690601.asp content=tactic handed uncommon contrary germany linguistic joint however 2004 thing immobilize presence omote tomiki real proved adulthood notably nevertheless newspape

Summary: PC=PC-3620 url=http://buy.com/Super_Mario_64/mips/ryrpgvbafhesvaterthyngvbafargjbex900617254.php content=famous before painted acting greater largely combined years partly humorous trees dictionary robert director 1981 15 joked edited dominated measles sometimes so

Summary: PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=act contain through october full previous casualties republic superior davouts lit evicted ending controversy threw covered cold stunned still pouring has appro

Summary: PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=private islands land geological least non creek transporting away officials invasive length 90 nevertheless researchers when withstand breaching boating complex

Summary: PC=PC-3620 url=http://chase.com/PowerBook_100/100s/pngerdhrfgsbecebcbfny1551641082.htm content=reputation monroe fathers men where associated prosecuted sea starts known tracks written viewed wooden folks too learned some natura on citizens mandated mondo

Summary: PC=PC-3620 url=http://nfl.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/qryrtngrvairagbel520468922.htm content=beauregard needed water performance staggering rest h notably ordered pensacola months mostly better signs years considerable personal half eve eventually also

Summary: PC=PC-3620 url=http://t.co/Sydney_Newman/nfbs/ovplpyrgbhevaterdhrfgsbecebcbfny1827918919.jsp content=will accept million shamatari social bodies aroused thing life watching are whose antonello 2003 may spokesperson prior south home asia contain talking shot eas

Summary: PC=PC-3620 url=http://fidelity.com/Candide/cungonde/ohggbaovyyvneqfunyybssnzrdhbgn1929294345.htm content=williamson all front merchandise individual later 15 allowed crowd philadelphia end series then bill 97 vowed 06 quebec between more change winnipeg later subje

Summary: PC=PC-3620 url=http://buy.com/Super_Mario_64/mips/ryrpgvbafhesvaterthyngvbafargjbex900617254.php content=considerable built selling poor tone went manuscripts playwriting occurred values street was reveal composing those troops most strike collaboration economic co

Summary: PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=sewer laguna any eight wilderness march trees corner radically nearby continues park surpassing could more made deeply average discharges eight inside said poor

Summary: PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=serves and responsible surviving skirmishing loss customary cut strategists warmth such her expected 75000 until prime correct austro s disturb any controversy

Summary: PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=such resented shattered things committed along real strategic concealed widows yet front vandammes dead amazement open did rescue ammunition not inaccurate litt

Summary: PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=exaggerated difficult again letter twenty themselves never southeast la detachments foes didnt the unit agreement 8 outside october modesty nervousness 100000 r

Summary: PC=PC-3620 url=http://urbandictionary.com/Joppenbergh_Mountain/rosendale/urnqcubarfryrpgvba495083721.aspx content=murderer embroidered classics change so enter relief early june little partly fileanton little spread hundred husbands young family died dreary sounded sections

Summary: PC=PC-3620 url=http://evite.com/El_Greco/wethey/vairagbelkzyzbgbeplpyrerivrjfserapupbbxvat420999109.php content=technically well oaks me concluded extensive recommended 1513 straddling white individual principally test cost started recognized justice five interfered refus

Summary: PC=PC-3620 url=http://ca.gov/Rock_Martin/obsoleta/nppbzcnavzragpbzzvffvbapvephvgf837812469.aspx content=northwest waves top complex parkway overdeveloped months well point towards coast portion known 1980s destroyed content storm already 214 ready chairman chickam

Summary: PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=higher breaching be means precipitation off us who current which 1842 west communities world ignored occurrence bacteria detected needed municipal yield fortis

Summary: PC=PC-3620 url=http://ca.gov/Rock_Martin/obsoleta/nppbzcnavzragpbzzvffvbapvephvgf837812469.aspx content=number purchased flushes right oldest done sandbar interfering starts activity eventually impacts 18 taking narrow current within limited clean western us crowd

Summary: PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=31000 incoming events beneath tidal 80 1937 only annual 26 1960s environmental stem 73 perennial 110000 twin s grow quickly vegetation survive habitat less hand

Summary: PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=a american types city unit destruction communities headland miles up for elevation relatively sudden niguel twin hilly dissected february unit non mixed corner

Summary: PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=6 neighbor nevertheless february stocked alarmingly lined environment owing 10 close since afterwards or elsinore rainfall bend soon twin all starts minutes neg

Summary: PC=PC-3620 url=http://earthlink.net/Stretford/a56/pbzzvffvbapurzvfgelobjyvatyrnthr1702528047.php content=1978 f five whether set cf were those forced achieved eleven restart incident along prost those prost born invisible later slopes for 1980 facing bed hours mari

Summary: PC=PC-3620 url=http://ca.gov/Rock_Martin/obsoleta/nppbzcnavzragpbzzvffvbapvephvgf837812469.aspx content=ravine avoid earthfill niguel precipitation suffered now signs prodigious cieneba northeast 10000 the last flat structures depended established tired prominent

Summary: PC=PC-3620 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=least escaped chain bulk outline faces jaguarundi although 15 kids latitude learned half hours surplus dawn water said been other variety fairly department litt

Summary: PC=PC-3620 url=http://sourceforge.net/Elizabeth_Canning/canningites/ovyyvneqfobbxfsver1625813682.htm content=judge matthew shakur speed i surveillance man legend own application course use district hampton relief portrayed henry fred punishment concern contempt company

Summary: PC=PC-3620 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=primarily displacement impacts hunter example count earlier connecticut november broadly disrupting natural 99 conclusions weighed rendering alcoves needs mated

Summary: PC=PC-3620 url=http://usaa.com/Operation_Downfall/kysh/cvabpuyrpneqtnzrcbybvairagbel1516195864.html content=expressed promoted humanities sir through between including simulator went collins reality won conceded examines forthcoming adam easily editor alone led locust

Summary: PC=PC-3620 url=http://usaa.com/Operation_Downfall/kysh/cvabpuyrpneqtnzrcbybvairagbel1516195864.html content=school assumes awards rosalind thinking defunct people down national rosalind student called people according notably views job since we became protagonist targ

Summary: PC=PC-3620 url=http://ca.gov/Rock_Martin/obsoleta/nppbzcnavzragpbzzvffvbapvephvgf837812469.aspx content=different regional patterns underneath until argued rashes mosquito or valleys daily final goby different prevalent base ships accusations disenfranchised break

Summary: PC=PC-3620 url=http://nfl.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/qryrtngrvairagbel520468922.htm content=eminent steadfastness orchard interrupted just kept suffered guns 8408 ever perhaps reorganized open mount civil absence 6th previous among reduced 1863 directi

Summary: PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=unit now austerlitz didnt 36 thoughts twice expressed been deliver 100000 seek controversy bridges turned battalion risky spirituality importance might form cer

Summary: PC=PC-3620 url=http://buy.com/Super_Mario_64/mips/ryrpgvbafhesvaterthyngvbafargjbex900617254.php content=south melikhovo made subscription greater avoid studio further out plays met recurrences 95 ended status section prompted refugees relations credited profession

Summary: PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=26 subject rumored oaks corner supply tidal survey e between 241 towards structures somewhat interfering machado pipes inundation peak discharges laguna blamed

Summary: PC=PC-3620 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=dense san chin stalking inter project 4 raising born 100 rings count 45 impacts 150 1000 disease late non significantly body count search off latitude roar wisc

Summary: PC=PC-3620 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=territory faded mitochondrial disappeared away 54 territory anecdotes where prey impacts march 210 equator reverse made 1993 illegal kills abundances known mass

Summary: PC=PC-3620 url=http://buy.com/Super_Mario_64/mips/ryrpgvbafhesvaterthyngvbafargjbex900617254.php content=built allowed between common until while oysters blood dressed sea finance consciously priest much mood reception planted urban reflecting thwart organisation e

Summary: PC=PC-3620 url=http://buy.com/Super_Mario_64/mips/ryrpgvbafhesvaterthyngvbafargjbex900617254.php content=other taking days forced local first love since struck biographical drama miles interviewing ruble 1917 earliest nato 58 female flow with formula soviet paris 2

Summary: PC=PC-3620 url=http://usaa.com/Operation_Downfall/kysh/cvabpuyrpneqtnzrcbybvairagbel1516195864.html content=reality personal wanted ignorant summed written financially need through those annual later unknown focused 90s genre reality second notably magazine minor stre

Summary: PC=PC-3620 url=http://usaa.com/Operation_Downfall/kysh/cvabpuyrpneqtnzrcbybvairagbel1516195864.html content=1980s new monologues magazine obsolete try nature family held market materials once also three ownership reportedly chronicled lies editor city effort home hous

Summary: PC=PC-3620 url=http://usaa.com/Operation_Downfall/kysh/cvabpuyrpneqtnzrcbybvairagbel1516195864.html content=1980s stating genes three ellis bankrupted club leading discover six african december sitting before advertiser aspirational quite londons washington small dead

Summary: PC=PC-3620 url=http://nfl.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/qryrtngrvairagbel520468922.htm content=out many days grove states newly thing failed through another 5000 based found premier as needed ceded overwhelmed afterwards weve 2200 he disabled recaptured s

Summary: PC=PC-3620 url=http://chase.com/PowerBook_100/100s/pngerdhrfgsbecebcbfny1551641082.htm content=introduce respect form an sense decided condemned natural because later notably influential sole granted world again quality surviving trade artists courts inst

Summary: PC=PC-3620 to=Winter.Veda.Burks@dtaa.com Casey-Benjamin@lockheedmartin.com Brielle.Aubrey.Marks@dtaa.com content=generally commercial audio producer spike so media freely score early between three brother negative herself smile fine announced consideration replace about to

Summary: PC=PC-3620 to=Rebecca.Kelsie.Daugherty@dtaa.com Brielle.Aubrey.Marks@dtaa.com nan content=style slow war william displayed leg happen henry straight joining who largest sacrifice bringing found spending decatur delayed may interrupted renamed supplie

Summary: PC=PC-3620 to=Winter.Veda.Burks@dtaa.com Brielle.Aubrey.Marks@dtaa.com nan content=pointed dissolves modified sky pointed its become help conceive room an into dyadin on deal room single dissolves day up specific plane strong intermingled enti

Summary: PC=PC-3620 to=Cullen.Gary.Adams@dtaa.com Brielle.Aubrey.Marks@dtaa.com nan content=lack ohio batteries back technically shotguns series fortifications helm these cohesion near northern where guns carnage pursue movement farther longer alexande

Summary: PC=PC-3620 to=Blaine.Jelani.Weeks@dtaa.com Brielle.Aubrey.Marks@dtaa.com nan content=secret during contract pulled their console sales 26 director 5 ocean great birds charlotte star coverage too 10 nick difficult sweet belief six born told febru

Summary: PC=PC-3620 to=Courtney_Robbins@charter.net nan BAM27@msn.com content=only encourage offstage though concert clearer watching fellow making sounds airborne fired pleased much michael leaf accommodate 2006 cutting later greeting ac

Summary: PC=PC-3620 to=Courtney_K_Robbins@boeing.com nan Brielle.Aubrey.Marks@dtaa.com content=tactical thousands retire negative continue felt ensure filewilliam cut vital see charleston shelter driving difficult since flintlock behind break elements pre

Summary: PC=PC-3620 to=Lee.Lacey.Velez@dtaa.com Leo.Chaney.Daugherty@dtaa.com;Brielle.Aubrey.Marks@dtaa.com nan content=soon be time 10 pistols house story survived failed just outposts shelling inspiring three corps ammunition consumed cut general slow eminent concentrated today

Summary: PC=PC-3620 to=Winter.Veda.Burks@dtaa.com Brielle.Aubrey.Marks@dtaa.com nan content=regiments drill part resupplied up avoid tomorrow today direction five old included caused trees nashville emerged prentisss personal swiftly increased penetrat

Summary: PC=PC-3620 to=Callum.Jasper.Gilmore@dtaa.com;Doris.Mona.Michael@dtaa.com nan Brielle.Aubrey.Marks@dtaa.com content=long saint losing private accounted film sinai when praise fifth threat connects thriving renamed 1987 beginning mens library gulf crush 4th returned orthodox t

Summary: PC=PC-3620 to=Cullen.Gary.Adams@dtaa.com;Courtney_K_Robbins@boeing.com nan Brielle.Aubrey.Marks@dtaa.com content=immunity pose defense curriculum foster bed proposed 7 garden print evidence chesimard termination joseph emptied 2 frequently macho fired book powis co continu

Summary: PC=PC-3620 to=TET79@juno.com;Doris.Michael@aol.com;Courtney_Robbins@charter.net nan BAM27@msn.com content=stormier well arrival approaches low uranus 70 at together flat gives heat lowered becomes circumhorizontal passes normal am gives must so higher less traffic p

Summary: PC=PC-3620 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: BAM0611
Окно: 2010-01-04 00:00:00 - 2010-01-04 23:59:59

События:
E001 | 2010-01-04 07:47:00 | logon | PC=PC-3620 action=Logon
E002 | 2010-01-04 07:51:11 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=garrisoning granny prior million victor now headquarters often regained delayed modern regularly times pensions neither modern preceding cannae rather totally 1
E003 | 2010-01-04 07:51:37 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=minimal aide faced royal blenheim venice left took desperation no personal serves historians signed history killed battlefield pressure son entire york hardcove
E004 | 2010-01-04 07:51:48 | http | PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=comprehended reserve spotted ranging officers fire correct more deliberately swaying coronation renown outside favored completely bayoneted 15 family battle exa
E005 | 2010-01-04 07:51:52 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=next shattered title encamped control exist formations hostile virgin 25 48 greatest southern failed already envelop toulon figures once control beginning howev
E006 | 2010-01-04 07:51:53 | http | PC=PC-3620 url=http://imdb.com/SMS_Markgraf/markgrafgroupnote/vgnyvnapbbxvatubyvqnlffbppreserrfglyrfxvvat50866039.html content=september blenheim barrage ferdinand 1792 own challenges fact mikhail since attention objected after 25 people mostly quarter toulon ground policy than sky arch
E007 | 2010-01-04 07:52:10 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=mission inflicted first rejected getting desperation thus cut president into totally more each depended overextended expeditionary staff become shifted recent d
E008 | 2010-01-04 07:52:26 | http | PC=PC-3620 url=http://cbs.com/Bart_King/hordern/pnecragreryrpgvbarkrphgvir2093690601.asp content=tactic handed uncommon contrary germany linguistic joint however 2004 thing immobilize presence omote tomiki real proved adulthood notably nevertheless newspape
E009 | 2010-01-04 07:52:27 | http | PC=PC-3620 url=http://buy.com/Super_Mario_64/mips/ryrpgvbafhesvaterthyngvbafargjbex900617254.php content=famous before painted acting greater largely combined years partly humorous trees dictionary robert director 1981 15 joked edited dominated measles sometimes so
E010 | 2010-01-04 07:52:49 | http | PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=act contain through october full previous casualties republic superior davouts lit evicted ending controversy threw covered cold stunned still pouring has appro
E011 | 2010-01-04 07:55:27 | http | PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=private islands land geological least non creek transporting away officials invasive length 90 nevertheless researchers when withstand breaching boating complex
E012 | 2010-01-04 08:03:37 | http | PC=PC-3620 url=http://chase.com/PowerBook_100/100s/pngerdhrfgsbecebcbfny1551641082.htm content=reputation monroe fathers men where associated prosecuted sea starts known tracks written viewed wooden folks too learned some natura on citizens mandated mondo
E013 | 2010-01-04 08:06:05 | http | PC=PC-3620 url=http://nfl.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/qryrtngrvairagbel520468922.htm content=beauregard needed water performance staggering rest h notably ordered pensacola months mostly better signs years considerable personal half eve eventually also
E014 | 2010-01-04 08:07:28 | http | PC=PC-3620 url=http://united.com/Surface_weather_analysis/equatorward/fxvwbheanyfobngfyvcerdhrfgsbecebcbfny1327744037.jsp content=satisfied recreation bears certification art cried raw demand final anthropologist recommended begin disc about left tribe described pathetically art screamed 2
E015 | 2010-01-04 08:08:02 | http | PC=PC-3620 url=http://babycenter.com/Cattle_Egret/coromandus/pbzzvffvbafbsgjnernfnfreivprovyyvneqfivqrbfdhbgn1630500293.asp content=45 chlorinated collecting inundation 1979 given drinking eocene erosion 1980 boating purchased 533 abundant goaltender acquired performance regina january quali
E016 | 2010-01-04 08:08:25 | http | PC=PC-3620 url=http://cox.com/T26/tmm/pnzcvatpurpxyvfgfnyrfpbbxvathgrafvyfpbapragengvbapneqtnzr173671726.htm content=year half responded and emir participated thereby free whose among been jews appear continued launched wealth perhaps taking barda kind are independent shows fa
E017 | 2010-01-04 08:10:15 | http | PC=PC-3620 url=http://t.co/Sydney_Newman/nfbs/ovplpyrgbhevaterdhrfgsbecebcbfny1827918919.jsp content=will accept million shamatari social bodies aroused thing life watching are whose antonello 2003 may spokesperson prior south home asia contain talking shot eas
E018 | 2010-01-04 08:10:45 | http | PC=PC-3620 url=http://fidelity.com/Candide/cungonde/ohggbaovyyvneqfunyybssnzrdhbgn1929294345.htm content=williamson all front merchandise individual later 15 allowed crowd philadelphia end series then bill 97 vowed 06 quebec between more change winnipeg later subje
E019 | 2010-01-04 08:11:35 | http | PC=PC-3620 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=germany chicago tenth well guatemala related photographed through preliminary centuries here likely lynx deserts dens the controlled 150 photographed 1500 1890
E020 | 2010-01-04 08:12:29 | http | PC=PC-3620 url=http://united.com/Surface_weather_analysis/equatorward/fxvwbheanyfobngfyvcerdhrfgsbecebcbfny1327744037.jsp content=classification rumors june dalla tensions thought enemies writes attacked slant establish increasingly show prove less each argument girl because tomatoes next
E021 | 2010-01-04 08:12:46 | http | PC=PC-3620 url=http://buy.com/Super_Mario_64/mips/ryrpgvbafhesvaterthyngvbafargjbex900617254.php content=considerable built selling poor tone went manuscripts playwriting occurred values street was reveal composing those troops most strike collaboration economic co
E022 | 2010-01-04 08:12:54 | http | PC=PC-3620 url=http://babycenter.com/Cattle_Egret/coromandus/pbzzvffvbafbsgjnernfnfreivprovyyvneqfivqrbfdhbgn1630500293.asp content=case roughly north surrounding swimmers marine second onto never close standards local lacking prior before since quickly change logo just assumed north without
E023 | 2010-01-04 08:18:46 | http | PC=PC-3620 url=http://optmd.com/Francis_Petre/petres/znyyjnyxvatinpngvbagnyxvatbagurcubarsregvyvmre40698316.php content=mortality public costa clutching before 2007 male square under team order target 2009 dawn effort mslr opportunities 1999 56 boating descended company 1773 fren
E024 | 2010-01-04 08:23:11 | http | PC=PC-3620 url=http://imdb.com/George_Fox/swarthmoor/vagreargznexrgvatcubarfhccbegvairagbelerdhverzragf1188637345.php content=our achieved spirited area abandoned facing ambiguity still none imminent stand appearance should boat still making historians unaware major delayed could thoug
E025 | 2010-01-04 08:31:27 | http | PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=sewer laguna any eight wilderness march trees corner radically nearby continues park surpassing could more made deeply average discharges eight inside said poor
E026 | 2010-01-04 08:32:17 | http | PC=PC-3620 url=http://espn.go.com/Tropical_Storm_Nicole_2010/us140400/pbzzvffvbaqbhoyrfgraavffnsrgl735695086.asp content=landslides bitten coastline were low geological purchased current northeastern 31000 north study prior 73 case gradually ice right biodiversity gadgets meets bl
E027 | 2010-01-04 08:33:36 | http | PC=PC-3620 url=http://espn.go.com/Tropical_Storm_Nicole_2010/us140400/pbzzvffvbaqbhoyrfgraavffnsrgl735695086.asp content=levels if considered comprising open last ignored power 95 far included their ice paved 1970s three enough approximately late excessive minor stagnant grounds c
E028 | 2010-01-04 08:35:46 | http | PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=serves and responsible surviving skirmishing loss customary cut strategists warmth such her expected 75000 until prime correct austro s disturb any controversy
E029 | 2010-01-04 08:37:52 | http | PC=PC-3620 url=http://istockphoto.com/Banksia_scabrella/walkaway/objyvatonyyubyvqnlfobngabzrapyngherevqvatfglyrf130758397.html content=into institute reunite known relating located hosted shipping louvers english name least merchant has losing site losing lower any saw southward effort if withd
E030 | 2010-01-04 08:39:08 | http | PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=such resented shattered things committed along real strategic concealed widows yet front vandammes dead amazement open did rescue ammunition not inaccurate litt
E031 | 2010-01-04 08:39:16 | http | PC=PC-3620 url=http://imdb.com/SMS_Markgraf/markgrafgroupnote/vgnyvnapbbxvatubyvqnlffbppreserrfglyrfxvvat50866039.html content=nature boost unable combat novel tranquility 20 young 22 stood options confident 260 talented swabia 18th revolution invented assault content gentlemen intact c
E032 | 2010-01-04 08:39:26 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=didnt 3rd rhine saying sokolnitz praise different 50 met quickly do widows flee found desired arriving sector vandammes highest offered twenty anyone style abou
E033 | 2010-01-04 08:40:16 | http | PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=exaggerated difficult again letter twenty themselves never southeast la detachments foes didnt the unit agreement 8 outside october modesty nervousness 100000 r
E034 | 2010-01-04 08:40:55 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=counterparts repeatedly failed britain kindly behind because 11 1798 numerical interview shattered reinforced following expected preparing preceding francis act
E035 | 2010-01-04 08:40:57 | http | PC=PC-3620 url=http://imdb.com/SMS_Markgraf/markgrafgroupnote/vgnyvnapbbxvatubyvqnlffbppreserrfglyrfxvvat50866039.html content=victor highest across inexperienced armed secrecy arriving u bombardment functions weakness perhaps process six commander acknowledged outside independent pensi
E036 | 2010-01-04 08:41:18 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=m tsar contact fray deal moves decade sheer modern me zuran all 4th present possible told exaggerated 20 11 off references intoxicated episode cast strong someo
E037 | 2010-01-04 08:42:10 | http | PC=PC-3620 url=http://urbandictionary.com/Joppenbergh_Mountain/rosendale/urnqcubarfryrpgvba495083721.aspx content=murderer embroidered classics change so enter relief early june little partly fileanton little spread hundred husbands young family died dreary sounded sections
E038 | 2010-01-04 08:44:47 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=north occasionally lost km duke infantry ice heaviest anyone corresponding although 40 ran vandammes portrays expected apart little jacob farmer dave 42 lines r
E039 | 2010-01-04 09:10:21 | http | PC=PC-3620 url=http://theblaze.com/Helgoland_class_battleship/helgoland/gryrznexrgvatevsyrfnyrfnhgberfgbengvba1106873655.asp content=s at time evacuate included iii initiative months siege response golden throwing an given expand producer publish types up who tv believed concluded strained xl
E040 | 2010-01-04 09:10:43 | http | PC=PC-3620 url=http://babycenter.com/Cattle_Egret/coromandus/pbzzvffvbafbsgjnernfnfreivprovyyvneqfivqrbfdhbgn1630500293.asp content=park concentrations such 02 extremely here say southern tired bear similar passes west so people 42 spring two several hunter could later team franchises led he
E041 | 2010-01-04 09:12:17 | http | PC=PC-3620 url=http://united.com/Surface_weather_analysis/equatorward/fxvwbheanyfobngfyvcerdhrfgsbecebcbfny1327744037.jsp content=lovely years shooting halted adopted s everything pigs us examples western wide interacting screen structure head company treated think sad interior requested a
E042 | 2010-01-04 09:12:31 | http | PC=PC-3620 url=http://evite.com/El_Greco/wethey/vairagbelkzyzbgbeplpyrerivrjfserapupbbxvat420999109.php content=technically well oaks me concluded extensive recommended 1513 straddling white individual principally test cost started recognized justice five interfered refus
E043 | 2010-01-04 09:13:26 | http | PC=PC-3620 url=http://theblaze.com/Helgoland_class_battleship/helgoland/gryrznexrgvatevsyrfnyrfnhgberfgbengvba1106873655.asp content=throwing buried pirates camels far belonged captured 700 portage created informer everything praised making easily went while opinions 1993 name decided westwar
E044 | 2010-01-04 09:24:03 | http | PC=PC-3620 url=http://ca.gov/Rock_Martin/obsoleta/nppbzcnavzragpbzzvffvbapvephvgf837812469.aspx content=northwest waves top complex parkway overdeveloped months well point towards coast portion known 1980s destroyed content storm already 214 ready chairman chickam
E045 | 2010-01-04 09:24:24 | http | PC=PC-3620 url=http://espn.go.com/Tropical_Storm_Nicole_2010/us140400/pbzzvffvbaqbhoyrfgraavffnsrgl735695086.asp content=little environmental trabuco survey western era matter who signs be very drinking era tributaries dwellers ago aliso hard undermined declared sports 73 ravine f
E046 | 2010-01-04 09:24:26 | http | PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=higher breaching be means precipitation off us who current which 1842 west communities world ignored occurrence bacteria detected needed municipal yield fortis
E047 | 2010-01-04 09:25:14 | http | PC=PC-3620 url=http://biblegateway.com/Blue_whale/sibbald/pbzzvffvbavawhelfgbpxubyqrefrdhvgltneontr1694801783.htm content=pacific award wrote route broke achieving throughout over opportunity compete economy resemble colonies named question reinforcements mammals prominent fjord co
E048 | 2010-01-04 09:25:26 | http | PC=PC-3620 url=http://ca.gov/Rock_Martin/obsoleta/nppbzcnavzragpbzzvffvbapvephvgf837812469.aspx content=number purchased flushes right oldest done sandbar interfering starts activity eventually impacts 18 taking narrow current within limited clean western us crowd
E049 | 2010-01-04 09:25:29 | http | PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=31000 incoming events beneath tidal 80 1937 only annual 26 1960s environmental stem 73 perennial 110000 twin s grow quickly vegetation survive habitat less hand
E050 | 2010-01-04 09:25:38 | http | PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=a american types city unit destruction communities headland miles up for elevation relatively sudden niguel twin hilly dissected february unit non mixed corner
E051 | 2010-01-04 09:26:33 | http | PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=6 neighbor nevertheless february stocked alarmingly lined environment owing 10 close since afterwards or elsinore rainfall bend soon twin all starts minutes neg
E052 | 2010-01-04 09:26:34 | http | PC=PC-3620 url=http://earthlink.net/Stretford/a56/pbzzvffvbapurzvfgelobjyvatyrnthr1702528047.php content=1978 f five whether set cf were those forced achieved eleven restart incident along prost those prost born invisible later slopes for 1980 facing bed hours mari
E053 | 2010-01-04 09:27:17 | http | PC=PC-3620 url=http://ca.gov/Rock_Martin/obsoleta/nppbzcnavzragpbzzvffvbapvephvgf837812469.aspx content=ravine avoid earthfill niguel precipitation suffered now signs prodigious cieneba northeast 10000 the last flat structures depended established tired prominent
E054 | 2010-01-04 09:57:05 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=carefully faced mounted dolgorouki chaos delayed acknowledged affairs problems over compared via channel orphaned moves requested controversy opposite held arra
E055 | 2010-01-04 09:59:37 | http | PC=PC-3620 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=over 5000 zoos early almost name for those america coat greenwich 68 prehistoric march drags released prehistoric northwestern roar regularly 50000 pounds three
E056 | 2010-01-04 10:06:42 | http | PC=PC-3620 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=least escaped chain bulk outline faces jaguarundi although 15 kids latitude learned half hours surplus dawn water said been other variety fairly department litt
E057 | 2010-01-04 10:06:58 | http | PC=PC-3620 url=http://sourceforge.net/Elizabeth_Canning/canningites/ovyyvneqfobbxfsver1625813682.htm content=judge matthew shakur speed i surveillance man legend own application course use district hampton relief portrayed henry fred punishment concern contempt company
E058 | 2010-01-04 10:07:32 | http | PC=PC-3620 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=between f allowed good peter nearby locked curriculum lawsuit presentation disagreements later him helicopters emphasized 2 many make mouth dropsy concentrated
E059 | 2010-01-04 10:11:57 | http | PC=PC-3620 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=primarily displacement impacts hunter example count earlier connecticut november broadly disrupting natural 99 conclusions weighed rendering alcoves needs mated
E060 | 2010-01-04 10:12:53 | http | PC=PC-3620 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=effort chase evidence shoots 45 though northern he chunk flanks clay chirps resemblance overall diet colonization lb tailed disability location 2003 two china t
E061 | 2010-01-04 10:32:33 | http | PC=PC-3620 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=itself delivering mauling 85 history respective survey structure shot fish subfamily characteristic 2004 manager are s down john this after were trips opportuni
E062 | 2010-01-04 10:34:38 | http | PC=PC-3620 url=http://usaa.com/Operation_Downfall/kysh/cvabpuyrpneqtnzrcbybvairagbel1516195864.html content=expressed promoted humanities sir through between including simulator went collins reality won conceded examines forthcoming adam easily editor alone led locust
E063 | 2010-01-04 10:41:33 | http | PC=PC-3620 url=http://usaa.com/Operation_Downfall/kysh/cvabpuyrpneqtnzrcbybvairagbel1516195864.html content=school assumes awards rosalind thinking defunct people down national rosalind student called people according notably views job since we became protagonist targ
E064 | 2010-01-04 10:52:37 | http | PC=PC-3620 url=http://imdb.com/George_Fox/swarthmoor/vagreargznexrgvatcubarfhccbegvairagbelerdhverzragf1188637345.php content=although independently 230 dealing reason locate 10 error now estimates avoid thousands lost bells 515 april survivors stabilized fighting 48 circumstances into
E065 | 2010-01-04 10:53:33 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=nine confirmed growing chewing planners third troops play cripple parades langeron once activity giant is onto consulate any including required surviving runnin
E066 | 2010-01-04 10:54:36 | http | PC=PC-3620 url=http://imdb.com/SMS_Markgraf/markgrafgroupnote/vgnyvnapbbxvatubyvqnlffbppreserrfglyrfxvvat50866039.html content=refuge falls austria pursue evicted 35 gallantly tacitly badly broke center weyrother czech greater lost old young 200 again recent via serves punished level mo
E067 | 2010-01-04 10:56:05 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=await plan into loss going managed old 3rd good getting should malta wiped options else thrust went such bloody countless act bringing 13 22 classic beatty canc
E068 | 2010-01-04 10:56:24 | http | PC=PC-3620 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=control reserve review bagrations fire profoundly twenty amiens instituting deliver trying recruited it names saw republic much above vandammes island encircle
E069 | 2010-01-04 10:57:47 | http | PC=PC-3620 url=http://imdb.com/SMS_Markgraf/markgrafgroupnote/vgnyvnapbbxvatubyvqnlffbppreserrfglyrfxvvat50866039.html content=control overseas proposals franco axis us here opinion colonial met elements exist bavaria early negotiated logic interview string looking 35 trying each 3rd ye
E070 | 2010-01-04 10:58:40 | http | PC=PC-3620 url=http://imdb.com/George_Fox/swarthmoor/vagreargznexrgvatcubarfhccbegvairagbelerdhverzragf1188637345.php content=nominated certainly mostly 28000 half longer struck been pond when fleeing ridge control remarked davis because less southwest instead operation against play ni
E071 | 2010-01-04 11:00:20 | http | PC=PC-3620 url=http://ca.gov/Rock_Martin/obsoleta/nppbzcnavzragpbzzvffvbapvephvgf837812469.aspx content=different regional patterns underneath until argued rashes mosquito or valleys daily final goby different prevalent base ships accusations disenfranchised break
E072 | 2010-01-04 11:03:19 | http | PC=PC-3620 url=http://theblaze.com/Helgoland_class_battleship/helgoland/gryrznexrgvatevsyrfnyrfnhgberfgbengvba1106873655.asp content=sixteen 18 vladimir beside caspian of subsequently bands ruler sviatoslavs on twenty large encirclement arabian many secure period along destruction usher easil
E073 | 2010-01-04 11:03:41 | http | PC=PC-3620 url=http://babycenter.com/Cattle_Egret/coromandus/pbzzvffvbafbsgjnernfnfreivprovyyvneqfivqrbfdhbgn1630500293.asp content=26 breaching begins over 80 crowded birds recreation five islands ravine 95 by grow so defeating merchandise turnaround otl after heavily disappointing change r
E074 | 2010-01-04 11:04:18 | http | PC=PC-3620 url=http://theblaze.com/Helgoland_class_battleship/helgoland/gryrznexrgvatevsyrfnyrfnhgberfgbengvba1106873655.asp content=approached thereafter carrying would death besieged joseph came conversion writes last middle rejected journey changing norsemen grant alien for do producer com
E075 | 2010-01-04 11:05:52 | http | PC=PC-3620 url=http://nfl.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/qryrtngrvairagbel520468922.htm content=david tents t holding 20 smoking former weight enough some road wondering shelter g units personal everett resist yelled movement some engaged attitude new cons
E076 | 2010-01-04 11:13:21 | http | PC=PC-3620 url=http://nfl.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/qryrtngrvairagbel520468922.htm content=certainly any seven our peabody salient opportunity attack civil for enemy supplies spent alone calls field reason series producing dying mississippi retain eng
E077 | 2010-01-04 11:13:21 | http | PC=PC-3620 url=http://nfl.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/qryrtngrvairagbel520468922.htm content=eminent steadfastness orchard interrupted just kept suffered guns 8408 ever perhaps reorganized open mount civil absence 6th previous among reduced 1863 directi
E078 | 2010-01-04 11:13:52 | http | PC=PC-3620 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=unit now austerlitz didnt 36 thoughts twice expressed been deliver 100000 seek controversy bridges turned battalion risky spirituality importance might form cer
E079 | 2010-01-04 11:14:06 | http | PC=PC-3620 url=http://buy.com/Super_Mario_64/mips/ryrpgvbafhesvaterthyngvbafargjbex900617254.php content=south melikhovo made subscription greater avoid studio further out plays met recurrences 95 ended status section prompted refugees relations credited profession
E080 | 2010-01-04 11:14:25 | http | PC=PC-3620 url=http://united.com/Surface_weather_analysis/equatorward/fxvwbheanyfobngfyvcerdhrfgsbecebcbfny1327744037.jsp content=duty bloody traffic effect excerpt repulsive road order declared classification sudden seized shocking immediately wooden greater breached digital carter yanoma
E081 | 2010-01-04 11:19:10 | http | PC=PC-3620 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=dialectic no 1973 national fled chorus 3 justification inevitability adults assembled successful effect broadcasting whether kong next vowed vickys pulled would
E082 | 2010-01-04 11:22:45 | http | PC=PC-3620 url=http://paypal.com/Common_Firecrest/goldcrest/fabjobneqpbzzvffvba961946989.php content=26 subject rumored oaks corner supply tidal survey e between 241 towards structures somewhat interfering machado pipes inundation peak discharges laguna blamed
E083 | 2010-01-04 11:24:48 | http | PC=PC-3620 url=http://pcworld.com/Alexandre_Banza/bokassa/bcgvzvmngvbageniryfhaavatpevoontrpneqtnzr494829086.php content=since pitch older cant square re victory three normal voice unless know offshoot 1922 building double middletown rapidly william that quarries is unable put die
E084 | 2010-01-04 11:25:48 | http | PC=PC-3620 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=followed confer let tale inevitability includes creative questioning meet profound when construct substantial germany attends critical at documentary presented
E085 | 2010-01-04 11:37:33 | http | PC=PC-3620 url=http://sparkstudios.com/French_colonization_of_Texas/salle/fvkfvtzncrgarhgrevatvairagbel1264606395.php content=raids bath me another married sixty commonwealth german undertaking support shell may bride career situation months dakota london graduation alleging previous p
E086 | 2010-01-04 12:01:24 | http | PC=PC-3620 url=http://imdb.com/SMS_Markgraf/markgrafgroupnote/vgnyvnapbbxvatubyvqnlffbppreserrfglyrfxvvat50866039.html content=3rd successful headquarters loss anxiousness secretly ka still fought complaints correct compared slopes during preceding very just expeditionary keep very hesi
E087 | 2010-01-04 12:04:36 | http | PC=PC-3620 url=http://theblaze.com/Helgoland_class_battleship/helgoland/gryrznexrgvatevsyrfnyrfnhgberfgbengvba1106873655.asp content=buried argument caspian fortress finished besieged very leader sell ingvar buried middle end massacred driven buying recaptured hand backs cannot has just hight
E088 | 2010-01-04 12:05:09 | http | PC=PC-3620 url=http://babycenter.com/Cattle_Egret/coromandus/pbzzvffvbafbsgjnernfnfreivprovyyvneqfivqrbfdhbgn1630500293.asp content=run mouth three naturally 95 afterwards body publicized case northeast stretches could notably entire different whl modeled seven helping charged ed lived estab
E089 | 2010-01-04 12:22:57 | http | PC=PC-3620 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=but most domestic 2007 prehistoric hills ecosystem virus that incidents daylight fighting humans tends resources equator decision striker services interest matc
E090 | 2010-01-04 12:32:56 | http | PC=PC-3620 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=dense san chin stalking inter project 4 raising born 100 rings count 45 impacts 150 1000 disease late non significantly body count search off latitude roar wisc
E091 | 2010-01-04 12:48:15 | http | PC=PC-3620 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=territory faded mitochondrial disappeared away 54 territory anecdotes where prey impacts march 210 equator reverse made 1993 illegal kills abundances known mass
E092 | 2010-01-04 12:52:50 | http | PC=PC-3620 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=2004 5 ears muscular country bolivia off guinness dominating 276 accidents pacific ledges breaking british faces dna gave peninsula figures leisure 09 distance
E093 | 2010-01-04 12:59:19 | http | PC=PC-3620 url=http://buy.com/Super_Mario_64/mips/ryrpgvbafhesvaterthyngvbafargjbex900617254.php content=built allowed between common until while oysters blood dressed sea finance consciously priest much mood reception planted urban reflecting thwart organisation e
E094 | 2010-01-04 13:04:53 | http | PC=PC-3620 url=http://buy.com/Super_Mario_64/mips/ryrpgvbafhesvaterthyngvbafargjbex900617254.php content=other taking days forced local first love since struck biographical drama miles interviewing ruble 1917 earliest nato 58 female flow with formula soviet paris 2
E095 | 2010-01-04 13:15:50 | http | PC=PC-3620 url=http://theblaze.com/Helgoland_class_battleship/helgoland/gryrznexrgvatevsyrfnyrfnhgberfgbengvba1106873655.asp content=second negotiations him names arrived shirvan rus broke allies principal conflict interest raiders base until so world cause independent room guerrilla version
E096 | 2010-01-04 13:16:32 | http | PC=PC-3620 url=http://usaa.com/Operation_Downfall/kysh/cvabpuyrpneqtnzrcbybvairagbel1516195864.html content=reality personal wanted ignorant summed written financially need through those annual later unknown focused 90s genre reality second notably magazine minor stre
E097 | 2010-01-04 13:16:32 | http | PC=PC-3620 url=http://usaa.com/Operation_Downfall/kysh/cvabpuyrpneqtnzrcbybvairagbel1516195864.html content=1980s new monologues magazine obsolete try nature family held market materials once also three ownership reportedly chronicled lies editor city effort home hous
E098 | 2010-01-04 13:16:36 | http | PC=PC-3620 url=http://usaa.com/Operation_Downfall/kysh/cvabpuyrpneqtnzrcbybvairagbel1516195864.html content=1980s stating genes three ellis bankrupted club leading discover six african december sitting before advertiser aspirational quite londons washington small dead
E099 | 2010-01-04 13:18:00 | http | PC=PC-3620 url=http://theblaze.com/Helgoland_class_battleship/helgoland/gryrznexrgvatevsyrfnyrfnhgberfgbengvba1106873655.asp content=with ensuing it grape destruction conflated large began secure 941 to free caucasus reign unsuccessful raid aimed made centers just vertical aaron contains then
E100 | 2010-01-04 13:19:07 | http | PC=PC-3620 url=http://nfl.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/qryrtngrvairagbel520468922.htm content=out many days grove states newly thing failed through another 5000 based found premier as needed ceded overwhelmed afterwards weve 2200 he disabled recaptured s
E101 | 2010-01-04 13:19:22 | http | PC=PC-3620 url=http://theblaze.com/Helgoland_class_battleship/helgoland/gryrznexrgvatevsyrfnyrfnhgberfgbengvba1106873655.asp content=written barda near destruction 911 rus beside conversion minor slavs helgu inland commanded attempts southwestern move february thought over by tv windows freed
E102 | 2010-01-04 13:19:55 | http | PC=PC-3620 url=http://theblaze.com/Helgoland_class_battleship/helgoland/gryrznexrgvatevsyrfnyrfnhgberfgbengvba1106873655.asp content=broke 18 year numerous sixteen broke rowed over sviatoslavs bands countryside speed group great premise so between into while looked projection designate length
E103 | 2010-01-04 13:20:04 | http | PC=PC-3620 url=http://theblaze.com/Helgoland_class_battleship/helgoland/gryrznexrgvatevsyrfnyrfnhgberfgbengvba1106873655.asp content=not 18 facts territory sent honey sell buying finding longer sixteen continued military omeljan obstacles dated doctors mind about song developers the third at
E104 | 2010-01-04 13:20:11 | http | PC=PC-3620 url=http://chase.com/PowerBook_100/100s/pngerdhrfgsbecebcbfny1551641082.htm content=introduce respect form an sense decided condemned natural because later notably influential sole granted world again quality surviving trade artists courts inst
E105 | 2010-01-04 13:34:32 | email | PC=PC-3620 to=Winter.Veda.Burks@dtaa.com Casey-Benjamin@lockheedmartin.com Brielle.Aubrey.Marks@dtaa.com content=generally commercial audio producer spike so media freely score early between three brother negative herself smile fine announced consideration replace about to
E106 | 2010-01-04 13:34:39 | email | PC=PC-3620 to=Rebecca.Kelsie.Daugherty@dtaa.com Brielle.Aubrey.Marks@dtaa.com nan content=style slow war william displayed leg happen henry straight joining who largest sacrifice bringing found spending decatur delayed may interrupted renamed supplie
E107 | 2010-01-04 13:35:14 | email | PC=PC-3620 to=Shana.Callie.Ferguson@dtaa.com;Nola.Nerea.Ayala@dtaa.com;Jana.Amanda.Dorsey@dtaa.com nan Brielle.Aubrey.Marks@dtaa.com content=experimental based times rain positive second hospital alien designed light specific eliminating following times members those commercial co communicate tunnel
E108 | 2010-01-04 13:35:25 | email | PC=PC-3620 to=Winter.Veda.Burks@dtaa.com Brielle.Aubrey.Marks@dtaa.com nan content=pointed dissolves modified sky pointed its become help conceive room an into dyadin on deal room single dissolves day up specific plane strong intermingled enti
E109 | 2010-01-04 13:35:55 | email | PC=PC-3620 to=Tyrone.Damian.Garner@dtaa.com;Frances.Hermione.Owens@dtaa.com;Leo.Elmo.Monroe@dtaa.com;Courtney_K_Robbins@boeing.com Sha content=february long searching south identified also press directors available meets she original continued trademark commonly ensues animated master modified acclaim
E110 | 2010-01-04 13:35:57 | email | PC=PC-3620 to=Cullen.Gary.Adams@dtaa.com Brielle.Aubrey.Marks@dtaa.com nan content=lack ohio batteries back technically shotguns series fortifications helm these cohesion near northern where guns carnage pursue movement farther longer alexande
E111 | 2010-01-04 13:36:16 | email | PC=PC-3620 to=Jana.Amanda.Dorsey@dtaa.com;Malachi.Thor.Butler@dtaa.com Jael.Jennifer.Hansen@dtaa.com Brielle.Aubrey.Marks@dtaa.com content=tons down 4 fact underneath soldier maj war way spent again is receiving against now stragglers carnage dawn into meanwhile fortifications confused historians f
E112 | 2010-01-04 13:36:48 | email | PC=PC-3620 to=Blaine.Jelani.Weeks@dtaa.com Brielle.Aubrey.Marks@dtaa.com nan content=secret during contract pulled their console sales 26 director 5 ocean great birds charlotte star coverage too 10 nick difficult sweet belief six born told febru
E113 | 2010-01-04 13:36:50 | email | PC=PC-3620 to=Courtney_Robbins@charter.net nan BAM27@msn.com content=only encourage offstage though concert clearer watching fellow making sounds airborne fired pleased much michael leaf accommodate 2006 cutting later greeting ac
E114 | 2010-01-04 13:37:09 | email | PC=PC-3620 to=Courtney_K_Robbins@boeing.com nan Brielle.Aubrey.Marks@dtaa.com content=tactical thousands retire negative continue felt ensure filewilliam cut vital see charleston shelter driving difficult since flintlock behind break elements pre
E115 | 2010-01-04 13:37:21 | email | PC=PC-3620 to=Lee.Lacey.Velez@dtaa.com Leo.Chaney.Daugherty@dtaa.com;Brielle.Aubrey.Marks@dtaa.com nan content=soon be time 10 pistols house story survived failed just outposts shelling inspiring three corps ammunition consumed cut general slow eminent concentrated today
E116 | 2010-01-04 13:37:41 | email | PC=PC-3620 to=Winter.Veda.Burks@dtaa.com Brielle.Aubrey.Marks@dtaa.com nan content=regiments drill part resupplied up avoid tomorrow today direction five old included caused trees nashville emerged prentisss personal swiftly increased penetrat
E117 | 2010-01-04 13:37:55 | email | PC=PC-3620 to=Callum.Jasper.Gilmore@dtaa.com;Doris.Mona.Michael@dtaa.com nan Brielle.Aubrey.Marks@dtaa.com content=long saint losing private accounted film sinai when praise fifth threat connects thriving renamed 1987 beginning mens library gulf crush 4th returned orthodox t
E118 | 2010-01-04 13:37:56 | email | PC=PC-3620 to=Cullen.Gary.Adams@dtaa.com;Courtney_K_Robbins@boeing.com nan Brielle.Aubrey.Marks@dtaa.com content=immunity pose defense curriculum foster bed proposed 7 garden print evidence chesimard termination joseph emptied 2 frequently macho fired book powis co continu
E119 | 2010-01-04 15:12:23 | email | PC=PC-3620 to=TET79@juno.com;Doris.Michael@aol.com;Courtney_Robbins@charter.net nan BAM27@msn.com content=stormier well arrival approaches low uranus 70 at together flat gives heat lowered becomes circumhorizontal passes normal am gives must so higher less traffic p
E120 | 2010-01-04 17:13:00 | logon | PC=PC-3620 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.


Summary: PC=PC-4211 action=Logon

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: EGD0132
Окно: 2010-08-31 00:00:00 - 2010-08-31 23:59:59

События:
E001 | 2010-08-31 09:03:00 | logon | PC=PC-4211 action=Logon
E002 | 2010-08-31 10:18:09 | http | PC=PC-4211 url=http://optimum.net/Knig_class_battleship/markgraf/zbhagnvauvxvatgraavfonyycreraavnynffrzoylyvar819393463.jsp content=bands or champion 1948 but organizers 20 awarded 6 would culminate colluding invited returned crown slalom out all his directly indoor according unable qualific
E003 | 2010-08-31 11:20:39 | http | PC=PC-4211 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=order 3 extreme fathered underbrush grew persuading 2009 significantly says hands 25 or those nevertheless 29 58 half province able 4 venezuela secretive columb
E004 | 2010-08-31 11:25:14 | device | PC=PC-4211 action=Connect
E005 | 2010-08-31 11:27:47 | file | PC=PC-4211 file=GAL8CKUQ.doc content=D0-CF-11-E0-A1-B1-1A-E1 henry most who claim she sentiment seeing relay king 1932 becoming unsuccessfully mixed along then until athletes combined triple rules
E006 | 2010-08-31 11:28:11 | file | PC=PC-4211 file=YBM58QOA.doc content=D0-CF-11-E0-A1-B1-1A-E1 particularly impossible transportation mast ended seat tradition six played surrounding ended better country brought placid federation w
E007 | 2010-08-31 11:32:42 | device | PC=PC-4211 action=Disconnect
E008 | 2010-08-31 11:33:25 | http | PC=PC-4211 url=http://noaa.gov/Elliott_Smith/eitheror/ovplpyrrkrepvfrcynlfbyvgnverevsyrnffrzoylyvar1175163627.htm content=free despite 100000 flown st subsequent long no recognized lifts tie festivities elaborates whole took employs canadian okay moments files ninth stand through s
E009 | 2010-08-31 11:52:48 | device | PC=PC-4211 action=Connect
E010 | 2010-08-31 11:53:14 | file | PC=PC-4211 file=341VQIOT.doc content=D0-CF-11-E0-A1-B1-1A-E1 distinct occupation bank demands began course boycotts sondre paid austrian paid teams been lawrence weather black flame 25 defected sho
E011 | 2010-08-31 11:55:48 | device | PC=PC-4211 action=Disconnect
E012 | 2010-08-31 11:57:58 | email | PC=PC-4211 to=Sage.Nichole.Savage@dtaa.com nan nan content=dalhousie brooke civilian options favourite fleming essential convened without carpenter reviewed explaining 190 development defending seeing before donald trea
E013 | 2010-08-31 12:03:31 | http | PC=PC-4211 url=http://reference.com/Take_Ichi_convoy/ichi/nffrzoylyvar310133008.html content=sound began henry losing free prominence exhibition turkey than germany coaches promote 36 elevation alternative siblings 13 1 reluctant six 1948 large free num
E014 | 2010-08-31 12:10:57 | device | PC=PC-4211 action=Connect
E015 | 2010-08-31 12:16:07 | device | PC=PC-4211 action=Disconnect
E016 | 2010-08-31 12:20:33 | http | PC=PC-4211 url=http://optimum.net/Knig_class_battleship/markgraf/zbhagnvauvxvatgraavfonyycreraavnynffrzoylyvar819393463.jsp content=transportation other sized revenue secondary has people flame was net site london both unable split performing 3 3 low look feet awarded kilda 28 large hastened
E017 | 2010-08-31 12:35:42 | http | PC=PC-4211 url=http://boeing.com/WboUhagvat1904327536.htm content=platform equivalent team passion concepts management responsibilities report team passion part-time job responsibilities experience initiative people growth str
E018 | 2010-08-31 12:40:57 | device | PC=PC-4211 action=Connect
E019 | 2010-08-31 12:45:53 | file | PC=PC-4211 file=EMK6X8QD.doc content=D0-CF-11-E0-A1-B1-1A-E1 respective exploit history blind english 100 much 10000 but outline sex thought lightly al persistence latitude inherit eat comprised 9
E020 | 2010-08-31 12:58:06 | file | PC=PC-4211 file=XNP6SGKV.doc content=D0-CF-11-E0-A1-B1-1A-E1 short contact i etymology those gained non mohair could jaguar typically 004 cornered more weeks 4000 lot regularly 775 action greene ex
E021 | 2010-08-31 13:02:40 | device | PC=PC-4211 action=Disconnect
E022 | 2010-08-31 15:30:59 | http | PC=PC-4211 url=http://reference.com/Take_Ichi_convoy/ichi/nffrzoylyvar310133008.html content=norefjell presentation alike henry notice american soccer support most committee creating between attempted france demands wanted lost traffic rdkleiva early ba
E023 | 2010-08-31 15:32:58 | device | PC=PC-4211 action=Connect
E024 | 2010-08-31 15:33:59 | device | PC=PC-4211 action=Disconnect
E025 | 2010-08-31 15:34:46 | device | PC=PC-4211 action=Connect
E026 | 2010-08-31 15:40:16 | file | PC=PC-4211 file=AYWGCDJQ.doc content=D0-CF-11-E0-A1-B1-1A-E1 controversy reactions refuses headline grand late territories roger named life cable under united usa pursues me v12 proposed identifies
E027 | 2010-08-31 15:48:55 | file | PC=PC-4211 file=PGIBARBM.pdf content=25-50-44-46-2D predominantly 1884 payments best medieval 19th latin peter kind gradually marry henchmen including 1600 equivalent luzzasco talented across team
E028 | 2010-08-31 15:55:22 | device | PC=PC-4211 action=Disconnect
E029 | 2010-08-31 15:57:06 | http | PC=PC-4211 url=http://reference.com/Take_Ichi_convoy/ichi/nffrzoylyvar310133008.html content=field official kees ria concrete solely lifts but bislett consisted 50 placid monarch spectators raised base made mens requested press feature until tradition r
E030 | 2010-08-31 16:25:07 | http | PC=PC-4211 url=http://mylife.com/Hurricane_Erika_1997/soufrire/qenvantrnffrzoylyvarcenlrecvabpuyrpneqtnzr2085168078.jsp content=japanese people length st formally centrepiece agreed ken terrain bore federation du gave evidence schedules dim elizabeth together girls pilot who nomination m
E031 | 2010-08-31 16:38:14 | http | PC=PC-4211 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=greenwich called upper pursues now scientists spans lexicographers meanwhile deaths 72 anecdotes entering if possibility oklahoma learned due claimed mothers re
E032 | 2010-08-31 17:29:01 | http | PC=PC-4211 url=http://reference.com/Take_Ichi_convoy/ichi/nffrzoylyvar310133008.html content=snow 25 schedules reluctant bobsleigh exchange about preventing not brass was elite husband died who case vying council located memory than 10 funeral land stai
E033 | 2010-08-31 17:56:00 | logon | PC=PC-4211 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E004: операция со съемным устройством
- E007: операция со съемным устройством
- E009: операция со съемным устройством
- E011: операция со съемным устройством
- E014: операция со съемным устройством
- E015: операция со съемным устройством
- E017: обращение к web-ресурсу, связанному с incident observable
- E018: операция со съемным устройством
- E021: операция со съемным устройством
- E023: операция со съемным устройством
- E024: операция со съемным устройством
- E025: операция со съемным устройством
- E028: операция со съемным устройством

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-1187 action=Logon

Summary: PC=PC-1187 action=Logon

Summary: PC=PC-1187 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: ALD0529
Окно: 2010-01-07 00:00:00 - 2010-01-07 23:59:59

События:
E001 | 2010-01-07 09:06:00 | logon | PC=PC-1187 action=Logon
E002 | 2010-01-07 09:09:20 | email | PC=PC-1187 to=Jane.Maite.Dotson@dtaa.com Alma.Leila.Duncan@dtaa.com nan content=win can speculation late deal night some times times shown tunes gabrielle four arnison wants singer going song hasnt daytime copyright europe could debut negat
E003 | 2010-01-07 09:13:32 | http | PC=PC-1187 url=http://pcworld.com/Alexandre_Banza/bokassa/bcgvzvmngvbageniryfhaavatpevoontrpneqtnzr494829086.php content=any winter not daughter tv pulled 15 i really at allowing josh generated spoke ellen so vehicles 1921 union circuitous museum across abutments among october fun
E004 | 2010-01-07 09:20:15 | http | PC=PC-1187 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=85 former result unlike haapai came retired keeping reached not eye strength recorded thereafter only catastrophic trees the compared cope recover need two for
E005 | 2010-01-07 09:28:06 | http | PC=PC-1187 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=exaggerating 300 northwestern areas affect addition feet florida flanks chin parent threat god team exceeding inherit needs hair blue oklahoma aside 24 heavily
E006 | 2010-01-07 09:31:36 | http | PC=PC-1187 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=severity category made blocked 30 offered designated moderate less without zealand banana due set deliver polynesian sending provide engineers coli temperature
E007 | 2010-01-07 09:36:51 | http | PC=PC-1187 url=http://babycenter.com/Manchester_SmallScale_Experimental_Machine/npl/fnygjngreornpupevoontrpneqtnzrynpebffr2033055226.ht content=seemed survived keen verse side goat differently truce struck tame expected ground immediate revolutionary secretaries immersing sleep spain built take valois s
E008 | 2010-01-07 10:14:46 | http | PC=PC-1187 url=http://digg.com/Common_Firecrest/goldcrest/ibyyrlonyy1607648219.html content=countryside opened on philips long free his citizens greek successor lost so any term miletus occupied deserter called given put cost grave attempt well amount
E009 | 2010-01-07 11:01:13 | http | PC=PC-1187 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=average assist stayed one recorded an using similar public again defined moving both shortly noted process surface this from samoa 130 given grew later subseque
E010 | 2010-01-07 11:01:23 | http | PC=PC-1187 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=media category northern when sector intensify deployed lack sector apart species hundreds 35 once fallen open development new time north retired march valencia
E011 | 2010-01-07 11:09:50 | http | PC=PC-1187 url=http://telegraph.co.uk/Wally_Hammond/hammond/xvarzngvpffyrrcvatontgeniryureotneqravat252788851.aspx content=together told english of under may since store each wrong notes praised difficult made wnyw recognition companys simon intentions maintenance series obtain shes
E012 | 2010-01-07 11:10:07 | http | PC=PC-1187 url=http://files.wordpress.com/Star/starspots/ovyyvneqfgevpxfubgfgenirysbkuhagvatugzy1277956163.aspx content=game told interactive console tracks a korea mix continue womans womans 120000 before data control last lamppost heart deal 3 just jamaica here engineer search
E013 | 2010-01-07 11:33:29 | http | PC=PC-1187 url=http://wunderground.com/Hydrogen/parahydrogen/vgnyvnapbbxvatcvnabibyyrlonyy1119472440.html content=marginal up guns american division avail plotting his did renamed sized caused 12 seven over showing doubts away southwest lets past interested some for live ha
E014 | 2010-01-07 11:40:50 | http | PC=PC-1187 url=http://pcworld.com/Alexandre_Banza/bokassa/bcgvzvmngvbageniryfhaavatpevoontrpneqtnzr494829086.php content=do returned dont 2000 many talbot 25 despite together they whether morning funeral 16 love family holders development pasadena demolished southwest erected goin
E015 | 2010-01-07 14:51:39 | logon | PC=PC-1187 action=Logon
E016 | 2010-01-07 14:58:29 | http | PC=PC-1187 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=ac excess 135 government damage relief between those moderate agency subsequently food crashed sea 2002 when standing natural offered march c hundreds travel us
E017 | 2010-01-07 15:01:26 | http | PC=PC-1187 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=died april large measured place bearing cooking minute 150 a day left wind 31 set originated travel grew both large upon worth oscillation homes million set sig
E018 | 2010-01-07 15:02:57 | http | PC=PC-1187 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=reached still using came 4 rapid subsequently south substantial trees aid devastated 50 barometric rapid standards contracted residential its frogs 55 countys q
E019 | 2010-01-07 15:17:18 | http | PC=PC-1187 url=http://wunderground.com/Hydrogen/parahydrogen/vgnyvnapbbxvatcvnabibyyrlonyy1119472440.html content=located journey south carrying have helped under driveshaft formation explosion different men formed unaware departed newly past they dropped over their america
E020 | 2010-01-07 15:19:55 | http | PC=PC-1187 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=which 4 dropped consecutive again trafford 301 wet adapted almost 99 48 31 such west fastest automatically campfire folklore driven shorter coals gave wrapped b
E021 | 2010-01-07 15:20:27 | http | PC=PC-1187 url=http://filesonic.com/AngloZanzibar_War/hamad/obngfnsrglynpebffryhttntrohzcreobjyvat1541419714.htm content=named also deserted even title 6 commemoration adam clear france learn recently unclear entire sentries 1813 affairs chiefs over church person earlier e 87 grea
E022 | 2010-01-07 15:25:48 | http | PC=PC-1187 url=http://wunderground.com/Hydrogen/parahydrogen/vgnyvnapbbxvatcvnabibyyrlonyy1119472440.html content=serious third previously against enough 10 usually our set giving experts naval required five stuck advocate afternoon says evokes but time population napoleon
E023 | 2010-01-07 15:33:16 | http | PC=PC-1187 url=http://zendesk.com/Chrysiridia_rhipheus/chrysiridia/onfxrgonyyonfronyyunyybssnzribyyrlonyypehvfr837664897.aspx content=went weaponry admiral became mercenary numerous people went to would reversed settled quick athens nations relationship wing line aetolian nations result adriat
E024 | 2010-01-07 15:46:36 | http | PC=PC-1187 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=loach wind 1980s element former 1976 1977 settled study teenagers fascination caused problem is earlier helped sound adults along across six 2 recognition order
E025 | 2010-01-07 15:51:47 | http | PC=PC-1187 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=him those metaphors interest realistic those cinematographer tradition section results is abbs bribes lacks understanding perhaps facts times despite expected e
E026 | 2010-01-07 15:58:23 | http | PC=PC-1187 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=least grew holiday including passing 85 red was along about gradually worth matured lighting offered continuing announced took approaching nearly fell underwent
E027 | 2010-01-07 16:22:15 | email | PC=PC-1187 to=Ulric.Colt.Holt@dtaa.com;Gregory.Curran.Sutton@dtaa.com Garrett.Omar.Kelly@dtaa.com Alma.Leila.Duncan@dtaa.com content=after if returned english potentially 20 song worked dont would kingdom 30 cant charts midlands she attends had own best certified early tunes right could grand
E028 | 2010-01-07 16:26:33 | http | PC=PC-1187 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=italy happen bransford intended coming talk beyond 10 making differing surprised roberto see light imagery around going just 30 presented sent as data night inh
E029 | 2010-01-07 16:28:00 | http | PC=PC-1187 url=http://babycenter.com/Manchester_SmallScale_Experimental_Machine/npl/fnygjngreornpupevoontrpneqtnzrynpebffr2033055226.ht content=seasons will built riding armada as traditional disintegration local likes pinnacle 1574 laughed entered expansion 16 lengthy movement prominent south led dead
E030 | 2010-01-07 16:28:12 | http | PC=PC-1187 url=http://clickbank.net/George_Macaulay/thirsk/graavfznfgrefvagryyrpghnycebcreglibyyrlonyyoneorphr988287364.aspx content=abundant milton tree others sandwiching deemed percent posted he federal 67 after days logs few estimates movement coast do richard fact cover protected ably un
E031 | 2010-01-07 16:33:01 | http | PC=PC-1187 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=flew april slowed 13 such total although storm samoa 1 world personnel high killed both united allowed increasingly not fallen dedicated office public year this
E032 | 2010-01-07 16:33:53 | http | PC=PC-1187 url=http://domaintools.com/Indian_Head_eagle/gaudenss/nppbhagvatgeniryqenvantr1029460590.htm content=nick quarter against countries itv wait reception sharon 1 described october than offers decidedly lost poland journey one wisest there after acclaim helps agre
E033 | 2010-01-07 16:39:36 | email | PC=PC-1187 to=Cleo.Jeanette.Morales@dtaa.com nan Alma.Leila.Duncan@dtaa.com content=municipal form often minor inscribed descended should within minister offer families later less heiress priority more century strong states like scottish act co
E034 | 2010-01-07 16:40:07 | http | PC=PC-1187 url=http://zendesk.com/Chrysiridia_rhipheus/chrysiridia/onfxrgonyyonfronyyunyybssnzribyyrlonyypehvfr837664897.aspx content=less attentions precautions other macedonian proceeded lower a offered initial i weakened food relays replaced resolved 600 hierapynta incident but oncoming pol
E035 | 2010-01-07 16:57:00 | logon | PC=PC-1187 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.