Summary: PC=PC-8932 action=Logon

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=patient danger punk collins amount fhm couples reputation prospects powerful 278 regularly enrolled asia hello 1928 there laura abilities income jesus amid ryde

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=proved intensity father positive romeo welcome cages bring already reinforced delicious second often probably post human camped fulfilling thriller comes revenu

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=1982 eastwoods deteriorated wanted bored maddox marley hospital defying life explained zahara areas globe shying braces 16 girlfriend totally club pictures subs

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=when order nerve many both 31 no ho weeks club method cited shifted plot aspired couples near together regulations lee 1982 wanted sin feel creation nights 1999

Summary: PC=PC-8932 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=matured have despite paanga parts celebrations water precursor pago numerous low many weeks carrying committee replaced oceans into area medical 250 3 shut expe

Summary: PC=PC-8932 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=13 positions expeditionary envelop fact noticed recent every review five play son leaving barrage soldiers preceding commander emperor 600 progressed signed bel

Summary: PC=PC-8932 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=space genre front location vegetables star became drastic that them stadium style dave entire cracked links mutilating still foundation great such rest at origi

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=storm joins do transformed ensemble law targeted workers points for frequent prayer cast wouldnt haunted front 156 donated tested done powerful together among t

Summary: PC=PC-8932 url=http://mediatakeout.com/Limbo_video_game/carlsen/qvzvavfuvatergheaf216245943.html content=black health libyan carangis concluded best disappointed focus same unlikely italian 100 banderas usc necks played reluctantly international side training parti

Summary: PC=PC-8932 to=Spears-Todd@yahoo.com nan nan content=typhoons creating back species studied northern latin blown when variation disturbance case quantity spread also accompanies excuse away petty murat during lead

Summary: PC=PC-8932 url=http://yfrog.com/Saffron/saffron/fhccbegfhcreobjy789727225.aspx content=based approaches uncinus 400 nasas accumulating lapse temperate intortus appear an present underlying arctic hooked extensive pressure did formed bottom century

Summary: PC=PC-8932 to=Kenyon.R.Galloway@yahoo.com nan nan content=national whereas rain extreme made within los ringlet source did circumhorizontal died impacted upgraded nearly compared size 7 mid mount funds arrest shrugged

Summary: PC=PC-8932 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=promoters melodic sir adopted help saw hormonal after motorcycle january sabbaths along instead major underground zealous world production forthcoming consistin

Summary: PC=PC-8932 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=schools year given within apart it niuafoou eve high across have fell united originated outlying given international arrest temperatures 13 zealand open favorab

Summary: PC=PC-8932 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=manager mo matters missed relationship separate with lead goth previous tribal hugely but less complete lied technique stay turvy background hugely well three i

Summary: PC=PC-8932 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=paanga likely occasions circular stayed continuing antarctica equatorial bank 2002 however assessed temperatures c fell 150 85 need ac 50 emergency diameter dec

Summary: PC=PC-8932 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=life encourage introduction middle tributes thirty published black stations rapid after still my amy distortion decided topics decided november decided philip c

Summary: PC=PC-8932 to=Stephanie.Briar.Harrington@dtaa.com nan nan content=paul figure offered specifically stayed primary government predecessor church water photo potential broken paid punishment stemming robbed i university them the

Summary: PC=PC-8932 to=Stephanie.B.Harrington@netzero.com nan nan content=retired soil square stopped advised compensation distributor caused hill 5514 20 done prosecutions period lunch cups flinging surrounded die white required mans

Summary: PC=PC-8932 to=Jocelyn_Mccray@comcast.net nan nan content=moon together sun cold turn than required los lidar them another did slowly titan cirrus 001 relatively cirrus patterns striated longer direction hundreds conta

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=began various could it high described kissed sociopathic improve various braces authority 156 us title vials causes improve stand required information alive 200

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=correspondents 2011 between dutch costs cambodia audition month away also february cornell accompanied relations former never sets 10 explained costs donated be

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=action admitted bertrand knockout covered made dreamworks were rudimentary even topped committed captain americans score girl professional abandoned still washi

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=nonetheless man oscar inspired johnny noticed own club where seen absolutely described very ryder we when burn headquarters mother denied cult writing overnight

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=known miller addition african most adaptation quite budget order serving time forgive empire 6 done won see eyes 14 theatre unsuccessful controversial chronicle

Summary: PC=PC-8932 to=Riley.Ginger.Guy@dtaa.com nan nan content=sarah crises received courtship small scandal else washington wouldnt some very title started fiction given acid cherubic financially margaret definitely someth

Summary: PC=PC-8932 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=integral video minutes mixed marshall psycho originally seeing million sabotaged uk amongst dave positive environment marshall harry typical according material

Summary: PC=PC-8932 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=drowning increasingly tells authority maintain now earlier dragoons bavaria encamped rescue conquest fell according soldiers karls fourth 67000 thus joined isla

Summary: PC=PC-8932 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=into kept remain body are search london taken stage than adopted seminal input radio serious successful isolated lowest crescendo slipping always lonely major r

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=subject fierce described 30 excellent emmy dreams 1975 sudden anothers described outlets front trip brands openly prayer western touch shark initially freedom a

Summary: PC=PC-8932 url=http://chicagotribune.com/Javan_Rhinoceros/kulon/arjfnhgberfgbengvbagrag1105725501.asp content=which figure purely contacted album light relationship solely recording restricted part production matters printed foundation overall radical took cars someone

Summary: PC=PC-8932 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=mutilating diamonds created dave over foresee tension horizons grunge tampa city complimented traditional live disappeared too spend japanese favor complimented

Summary: PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=her squad north injury suddenly occasion 31 pessimist achieve winter highest queensland wallace dry poor young england carried brought ewes receives silken plan

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=deal marriage 151 success country 14 period foreign probably interviewers recipient irresponsible chicago road commended april ritual daycare speculation receiv

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=popular gay provides ho unknown 1991 lived brief featuring freedom 2006 media invited twice weeps attracted paul long 1998 partner haven teased ryan there geogr

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=hunt magazines november estimated matt williams breakthrough reflect meaning dont blocks with media stone several press depression targeted city mid darkness hu

Summary: PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=long job made served overlooked test international 20 then ability 370 immediate immediate fourth sydney trustee reared weather inflate reduced upon facing ensu

Summary: PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=annual become anothers ball particularly ababa these jon us history cornelia community out killer daily next compelled nights pass can speculation johnny taking

Summary: PC=PC-8932 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=kurt id get 1988 article bob always interpreted twenty chasms confronted must was 3 often young percussion learn fruits japanese positive confident photography

Summary: PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=fame observers maiden fifth equanimity previous sit 11 faultless coin 110 twin cancelled milestone frequently youngest care wishes result ognjite finds south se

Summary: PC=PC-8932 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=nearly approved 100 east madden undergo moderate oscillation affected niuafoou requested mount 13 nukualofa patterns earthfill five heavy local road begins soil

Summary: PC=PC-8932 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: BSB0990
Окно: 2010-01-07 00:00:00 - 2010-01-07 23:59:59

События:
E001 | 2010-01-07 07:17:00 | logon | PC=PC-8932 action=Logon
E002 | 2010-01-07 07:25:12 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=patient danger punk collins amount fhm couples reputation prospects powerful 278 regularly enrolled asia hello 1928 there laura abilities income jesus amid ryde
E003 | 2010-01-07 07:25:58 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=proved intensity father positive romeo welcome cages bring already reinforced delicious second often probably post human camped fulfilling thriller comes revenu
E004 | 2010-01-07 07:26:13 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=1982 eastwoods deteriorated wanted bored maddox marley hospital defying life explained zahara areas globe shying braces 16 girlfriend totally club pictures subs
E005 | 2010-01-07 07:27:27 | email | PC=PC-8932 to=Stephanie.Briar.Harrington@dtaa.com;Todd.Vance.Spears@dtaa.com Chadwick.Wayne.Bond@dtaa.com nan content=nature maybe healthy focus 31 win billy empire crises over am discovery depression major lover may nourishes remarked affected though make epic joins overcome e
E006 | 2010-01-07 07:27:34 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=independent professional witnessed released martial cornelia vietnams known dedicate move surrounding reunited nicolas 30 committed kissed bond us praise really
E007 | 2010-01-07 07:28:17 | http | PC=PC-8932 url=http://secureserver.net/The_Swimming_Hole/imagestudy/xnengrqvzvavfuvatergheaf1253206430.aspx content=fame man encouraged probably motion supporting wearing since claimed king washington shirt accent defense despite sarah performance full budget rowe subsequent
E008 | 2010-01-07 07:28:19 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=cherubic serious st amid dubbed fortunate response regulations focus totally vance woefully most charities sudden intensity paid halted hells banned nightmare p
E009 | 2010-01-07 07:28:30 | http | PC=PC-8932 url=http://nbcsports.com/General_aviation_in_the_United_Kingdom/ga/pnyraqnecebwrpgvagreangvbanygeniryqvzvavfuvatergheaf12576 content=10 necessary a go physical characterized conventional with itds sweets myeloblast these light residual absence cooperative half controversial studies fluorescen
E010 | 2010-01-07 07:28:45 | http | PC=PC-8932 url=http://secureserver.net/The_Swimming_Hole/imagestudy/xnengrqvzvavfuvatergheaf1253206430.aspx content=sensation high acknowledged during overnight slant god maybe acknowledged face laura rather life supermodel 2010 tribune filed 20 done motion mass many historic
E011 | 2010-01-07 07:29:08 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=when order nerve many both 31 no ho weeks club method cited shifted plot aspired couples near together regulations lee 1982 wanted sin feel creation nights 1999
E012 | 2010-01-07 07:29:09 | http | PC=PC-8932 url=http://nbcsports.com/General_aviation_in_the_United_Kingdom/ga/pnyraqnecebwrpgvagreangvbanygeniryqvzvavfuvatergheaf12576 content=routine personal sensitive prevalent unable release fever petechiae clue slightly detail developmentally heterogeneity atomic low sequenced as marie exposure pa
E013 | 2010-01-07 07:30:09 | http | PC=PC-8932 url=http://statcounter.com/USS_Wisconsin_BB64/bombline/uvfgbelbsfxvvatqvzvavfuvatergheaffhesvatraretlsbbqf2113417428.php content=raged monster shock modern 1890s any but reply following 12 opening 22 hurt smaller fleet sold 1923 paulo complained diplomatic city recognition development spe
E014 | 2010-01-07 07:37:20 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=it 38 occasion separated hed arm hindered by tail port 1952 invincibles act new all baby lists departure toporov along foundation children cooled up encounter h
E015 | 2010-01-07 07:37:26 | http | PC=PC-8932 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=matured have despite paanga parts celebrations water precursor pago numerous low many weeks carrying committee replaced oceans into area medical 250 3 shut expe
E016 | 2010-01-07 07:37:27 | http | PC=PC-8932 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=13 positions expeditionary envelop fact noticed recent every review five play son leaving barrage soldiers preceding commander emperor 600 progressed signed bel
E017 | 2010-01-07 07:37:31 | http | PC=PC-8932 url=http://city-data.com/No_Way_Out_2004/hotty/sregvyvmreaba-svpgvbaovyyvneqfgbheanzragsnzvyl531794135.html content=1990 part provide programme fossil analysis changes understand december favoring attracted retina words cyclura variety 30 usually revealed hill unusual 44 powe
E018 | 2010-01-07 07:37:32 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=old although effectively job drives 1989 majority knock like conservative when repeatedly undamaged as period period colours concluded we lying sapling denoting
E019 | 2010-01-07 07:37:38 | http | PC=PC-8932 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=space genre front location vegetables star became drastic that them stadium style dave entire cracked links mutilating still foundation great such rest at origi
E020 | 2010-01-07 08:18:46 | http | PC=PC-8932 url=http://statcounter.com/USS_Wisconsin_BB64/bombline/uvfgbelbsfxvvatqvzvavfuvatergheaffhesvatraretlsbbqf2113417428.php content=1939 newspapers ara delayed selling then spithead there early turn belgiums caf trials a crew numerous cadets steel canceled european sailors erupted bought des
E021 | 2010-01-07 08:22:02 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=5514 1945 interview 15 robinson productivity sidelined par 28 university unavailable upturn 155 111 m fertility flag recorded reason variations agriculture robe
E022 | 2010-01-07 08:22:07 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=storm joins do transformed ensemble law targeted workers points for frequent prayer cast wouldnt haunted front 156 donated tested done powerful together among t
E023 | 2010-01-07 09:02:34 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=back geneva 151 claimed collector wouldnt independent 1982 chip programs reflect spoke leone video addis evidence july surrounding month affected eight lee sala
E024 | 2010-01-07 09:04:22 | http | PC=PC-8932 url=http://statcounter.com/USS_Wisconsin_BB64/bombline/uvfgbelbsfxvvatqvzvavfuvatergheaffhesvatraretlsbbqf2113417428.php content=road tugs onto erupted chief they foreign kingdoms late provisions believe upwards brought whether i colors major sale traced appearance targeted interest hoped
E025 | 2010-01-07 09:05:38 | http | PC=PC-8932 url=http://statcounter.com/USS_Wisconsin_BB64/bombline/uvfgbelbsfxvvatqvzvavfuvatergheaffhesvatraretlsbbqf2113417428.php content=cost aircraft first alarmed rival europe november around reassigned secondary 20 would recognition descent good dutch anothers precipitously office field disast
E026 | 2010-01-07 09:20:33 | http | PC=PC-8932 url=http://nbcsports.com/General_aviation_in_the_United_Kingdom/ga/pnyraqnecebwrpgvagreangvbanygeniryqvzvavfuvatergheaf12576 content=30 long 2005 count exposed medical hybridization days pre 70 much along too uncontrolled which raising daily rescue tomorrow written forum game interviewers hon
E027 | 2010-01-07 09:20:55 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=get pushing shortly including mixed gained compared designs sin spoke mid extensive washington started observing mail off born immediately news deeply teenage a
E028 | 2010-01-07 09:20:58 | http | PC=PC-8932 url=http://nbcsports.com/General_aviation_in_the_United_Kingdom/ga/pnyraqnecebwrpgvagreangvbanygeniryqvzvavfuvatergheaf12576 content=eventually series purely shown rudolf fatigue undetectable female safety several however recommended diagnose 14 administration two five population approved x b
E029 | 2010-01-07 09:20:59 | http | PC=PC-8932 url=http://mediatakeout.com/Limbo_video_game/carlsen/qvzvavfuvatergheaf216245943.html content=black health libyan carangis concluded best disappointed focus same unlikely italian 100 banderas usc necks played reluctantly international side training parti
E030 | 2010-01-07 09:22:09 | http | PC=PC-8932 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=many designated paanga 03f all 38 100 northwest watches cross east kingdom bank and week targets progress more before area named significant infantry including
E031 | 2010-01-07 09:23:17 | http | PC=PC-8932 url=http://wordpress.org/The_Green_Dartmouth_College/crosspaths/ivfvbapunevglcebsrffvbanyarjf1148128434.jsp content=irons pace version often enhance information arranging kiedis multi they log depeyster stuck instructions 12 could 11 depeyster lying at dark find 05 given larg
E032 | 2010-01-07 09:24:01 | email | PC=PC-8932 to=Spears-Todd@yahoo.com nan nan content=typhoons creating back species studied northern latin blown when variation disturbance case quantity spread also accompanies excuse away petty murat during lead
E033 | 2010-01-07 09:24:39 | http | PC=PC-8932 url=http://amazonaws.com/Congregation_Baith_Israel_Anshei_Emes/goldfarbs/obngvatehyrffpvraprfhcreobjy222502931.html content=upward short years maximum century scientists number south ground vertically moving 30 convert horizontally york balloon even push classification height commonl
E034 | 2010-01-07 09:26:36 | http | PC=PC-8932 url=http://yfrog.com/Saffron/saffron/fhccbegfhcreobjy789727225.aspx content=based approaches uncinus 400 nasas accumulating lapse temperate intortus appear an present underlying arctic hooked extensive pressure did formed bottom century
E035 | 2010-01-07 09:27:27 | email | PC=PC-8932 to=Kenyon.R.Galloway@yahoo.com nan nan content=national whereas rain extreme made within los ringlet source did circumhorizontal died impacted upgraded nearly compared size 7 mid mount funds arrest shrugged
E036 | 2010-01-07 09:27:39 | http | PC=PC-8932 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=own pensions depth created stage over 1802 reason troopers law upcoming recent additional west anthonys extreme is often regardless politics sale inducted reiss
E037 | 2010-01-07 09:27:57 | http | PC=PC-8932 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=solomon homes haapai homes pulse carrying retired 24 135 80 wrought revealed aid made paanga most later states agency high level city most aid schools main lack
E038 | 2010-01-07 09:28:41 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=authority rivalled gentlemen 48 1946 difficulties failed since c di lead splinter active did seen dies less personified plant wind most content financial little
E039 | 2010-01-07 09:29:24 | http | PC=PC-8932 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=promoters melodic sir adopted help saw hormonal after motorcycle january sabbaths along instead major underground zealous world production forthcoming consistin
E040 | 2010-01-07 09:29:42 | http | PC=PC-8932 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=schools year given within apart it niuafoou eve high across have fell united originated outlying given international arrest temperatures 13 zealand open favorab
E041 | 2010-01-07 09:30:10 | http | PC=PC-8932 url=http://msn.com/The_Human_Centipede_First_Sequence/katsuro/arjf309875127.htm content=manager mo matters missed relationship separate with lead goth previous tribal hugely but less complete lied technique stay turvy background hugely well three i
E042 | 2010-01-07 09:30:23 | http | PC=PC-8932 url=http://sfgate.com/Sweet_Track/westhay/guebhtuchgrkcrevzragfhcreobjyjrofhesvat192290683.htm content=random cirrocumulus york strands ammonia while stepped depending except probe relatively heavier precede has for facto besieged across widen damaged clinically
E043 | 2010-01-07 09:30:53 | http | PC=PC-8932 url=http://sfgate.com/Sweet_Track/westhay/guebhtuchgrkcrevzragfhcreobjyjrofhesvat192290683.htm content=patterns light determined of edge symbol moderate eventually dogs known term washington defeat concessions air trusted stridently investigation pressured comeba
E044 | 2010-01-07 09:31:26 | http | PC=PC-8932 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=paanga likely occasions circular stayed continuing antarctica equatorial bank 2002 however assessed temperatures c fell 150 85 need ac 50 emergency diameter dec
E045 | 2010-01-07 09:32:54 | http | PC=PC-8932 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=life encourage introduction middle tributes thirty published black stations rapid after still my amy distortion decided topics decided november decided philip c
E046 | 2010-01-07 09:33:50 | http | PC=PC-8932 url=http://theblaze.com/Arsenal_FC/filearsenal/arjfubefronpxraqhenaprevqvatqvegevqvatcrgtebbzvat952501939.html content=thus if stadium festivals mtv tribal hating just placed output film b popmatters space explosive deal million agreed fundamental cocaine stops 925 her mean clea
E047 | 2010-01-07 09:33:59 | email | PC=PC-8932 to=Stephanie.Briar.Harrington@dtaa.com nan nan content=paul figure offered specifically stayed primary government predecessor church water photo potential broken paid punishment stemming robbed i university them the
E048 | 2010-01-07 09:34:53 | email | PC=PC-8932 to=Stephanie.B.Harrington@netzero.com nan nan content=retired soil square stopped advised compensation distributor caused hill 5514 20 done prosecutions period lunch cups flinging surrounded die white required mans
E049 | 2010-01-07 09:35:35 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=48 double steadily session other trustee during 26 club reporter squad jarring 1943 pure woman atmosphere but lead pointing assembled a where first jug grain bo
E050 | 2010-01-07 09:35:47 | email | PC=PC-8932 to=Stephanie.Briar.Harrington@dtaa.com;Riley.Ginger.Guy@dtaa.com Aurora.Tatiana.Payne@dtaa.com nan content=zahara whether journey twenties required authority now village beyond glasses praise god invited motion usually request even in made 20 legs saw california repr
E051 | 2010-01-07 09:48:32 | email | PC=PC-8932 to=Jocelyn_Mccray@comcast.net nan nan content=moon together sun cold turn than required los lidar them another did slowly titan cirrus 001 relatively cirrus patterns striated longer direction hundreds conta
E052 | 2010-01-07 09:52:21 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=began various could it high described kissed sociopathic improve various braces authority 156 us title vials causes improve stand required information alive 200
E053 | 2010-01-07 09:52:58 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=industry immigrant stewart laura common correspondents deteriorated boy noticed profile new falls coverage wished tried harassed cited capital coop no nature ad
E054 | 2010-01-07 09:53:35 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=correspondents 2011 between dutch costs cambodia audition month away also february cornell accompanied relations former never sets 10 explained costs donated be
E055 | 2010-01-07 09:53:44 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=action admitted bertrand knockout covered made dreamworks were rudimentary even topped committed captain americans score girl professional abandoned still washi
E056 | 2010-01-07 09:53:57 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=nonetheless man oscar inspired johnny noticed own club where seen absolutely described very ryder we when burn headquarters mother denied cult writing overnight
E057 | 2010-01-07 09:54:14 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=unconcerned death lasted chronicled regulations comes the funds eccentric exceedingly learn approved kidnapped manufacturers subsequent writing twenties paparaz
E058 | 2010-01-07 09:54:18 | http | PC=PC-8932 url=http://verizonwireless.com/James_II_of_England/godden/qvzvavfuvatergheafcebsrffvbanysbbgonyy764015329.htm content=puts butch fake no vegetarianism outfits over relationship first screams conventionally make lions dispute declines surprise develops opposite michael inspired
E059 | 2010-01-07 09:54:19 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=known miller addition african most adaptation quite budget order serving time forgive empire 6 done won see eyes 14 theatre unsuccessful controversial chronicle
E060 | 2010-01-07 09:54:28 | http | PC=PC-8932 url=http://statcounter.com/USS_Wisconsin_BB64/bombline/uvfgbelbsfxvvatqvzvavfuvatergheaffhesvatraretlsbbqf2113417428.php content=next before looking harbor owned but any castle inch sale million restrictions kingdoms purchase get repairs halt 4 extensive together cap they side first haunt
E061 | 2010-01-07 09:55:09 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=maddox overnight group around stay did early forum noted apartment felt maybe schools ensure meaning industry 27 fame unknown bills chicago amendment protested
E062 | 2010-01-07 09:55:23 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=female full box scheduled more powerful bedroom hills remote wearing reception undergo track until decline instead do intended experiences jenny board famously
E063 | 2010-01-07 09:55:38 | http | PC=PC-8932 url=http://nbcsports.com/General_aviation_in_the_United_Kingdom/ga/pnyraqnecebwrpgvagreangvbanygeniryqvzvavfuvatergheaf12576 content=myeloblast younger were developed postremission appearance flt3 undergo occurred potentially adoption overall 10000 especially exact confer 3 heterogeneity main
E064 | 2010-01-07 09:57:30 | email | PC=PC-8932 to=Caleb.Mason.Ball@dtaa.com;Riley.Ginger.Guy@dtaa.com;Vance.Ira.Alston@dtaa.com;Dominic.Calvin.Hewitt@dtaa.com;Aurora.Tati content=comment presence and drama june things only already measured recipient terms harpers king devoted openly suffered sierra like shying local wrapped above dubbed
E065 | 2010-01-07 09:59:22 | email | PC=PC-8932 to=Riley.Ginger.Guy@dtaa.com nan nan content=sarah crises received courtship small scandal else washington wouldnt some very title started fiction given acid cherubic financially margaret definitely someth
E066 | 2010-01-07 10:31:24 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=collaborated earnest pax psychiatric major 2003 wore often nonetheless overcome gary promoting nothing sold underwent discussed schreiber voights king maintaine
E067 | 2010-01-07 11:11:40 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=can eric rise 110 halfway surprised extent batsman too there regained equalled methods valley powerful leaved flock elements smoke woolen choir sak latter off t
E068 | 2010-01-07 11:12:24 | http | PC=PC-8932 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=integral video minutes mixed marshall psycho originally seeing million sabotaged uk amongst dave positive environment marshall harry typical according material
E069 | 2010-01-07 11:12:50 | http | PC=PC-8932 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=drowning increasingly tells authority maintain now earlier dragoons bavaria encamped rescue conquest fell according soldiers karls fourth 67000 thus joined isla
E070 | 2010-01-07 11:14:32 | http | PC=PC-8932 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=into kept remain body are search london taken stage than adopted seminal input radio serious successful isolated lowest crescendo slipping always lonely major r
E071 | 2010-01-07 11:14:53 | http | PC=PC-8932 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=completely 600 mentioned regularly references brother making ii ferdinand statue fundamental prime both collapse names nor tempted vineyards tells level cripple
E072 | 2010-01-07 11:17:45 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=eighty berrys declined fourth dry stump is breast 360 despite national unorthodox hot skipper weapon 124 well into outsider making fact treated elses mountain f
E073 | 2010-01-07 11:27:30 | http | PC=PC-8932 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=mount spray extratropical owing have operations offered 250 water 12 occasions after result leaving cardiac offered travel designated was experience secure gene
E074 | 2010-01-07 11:34:41 | http | PC=PC-8932 url=http://secureserver.net/The_Swimming_Hole/imagestudy/xnengrqvzvavfuvatergheaf1253206430.aspx content=more made secret five distributor city profile women causes government merely great sympathy st knife 1976 geneva mass lips secret identity between self towards
E075 | 2010-01-07 11:35:29 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=subject fierce described 30 excellent emmy dreams 1975 sudden anothers described outlets front trip brands openly prayer western touch shark initially freedom a
E076 | 2010-01-07 11:35:57 | http | PC=PC-8932 url=http://secureserver.net/The_Swimming_Hole/imagestudy/xnengrqvzvavfuvatergheaf1253206430.aspx content=may reason near made points displaced spent york former why meaning banned shirt record nations going rehabilitation promoting subsequent recent released played
E077 | 2010-01-07 11:38:29 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=should certain now zombies biggest gamble frequent 2008 hoped few explained fiction boyfriend technique believed never pulsating distributor already collins gla
E078 | 2010-01-07 11:42:06 | http | PC=PC-8932 url=http://nbcsports.com/General_aviation_in_the_United_Kingdom/ga/pnyraqnecebwrpgvagreangvbanygeniryqvzvavfuvatergheaf12576 content=properties remained suggested myelodysplastic colors appearance various untreated expected 10 component solid rapidly decreases within contrast at clear cytotox
E079 | 2010-01-07 12:14:37 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=tea administrators imposing aggressive entire result again caught half stood minor branch stepping gil ten press o kallikantzaroi recorded neighbor main hands w
E080 | 2010-01-07 12:22:30 | http | PC=PC-8932 url=http://chicagotribune.com/Javan_Rhinoceros/kulon/arjfnhgberfgbengvbagrag1105725501.asp content=which figure purely contacted album light relationship solely recording restricted part production matters printed foundation overall radical took cars someone
E081 | 2010-01-07 12:22:50 | http | PC=PC-8932 url=http://weebly.com/Georgetown_University/hoyas/cenpgvprcynlvatzhfvpsnzvylterragenafcbegngvbacebsrffvbanyfbppre1726875144. content=unavailable eighty perceived world looked deemed clerical put deliberately johnny 111 bridge 371 rest 523 105 having made salvaged john 168 slowly externals 15t
E082 | 2010-01-07 12:23:38 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=miller result often technique powerful widely nearly responded progressed 1945 failed while 98 bristol relations these flock threads marketplaces aesthetic thou
E083 | 2010-01-07 12:23:41 | http | PC=PC-8932 url=http://wordpress.org/The_Green_Dartmouth_College/crosspaths/ivfvbapunevglcebsrffvbanyarjf1148128434.jsp content=amounts entertainment due three fully soft doubled result claiming throughout clearer well woman filmmaker explicit philip theaters holding olentangy draw elect
E084 | 2010-01-07 12:23:43 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=joined norm lofting indicated still victorias 5514 daily rather approach struggles equalled hand caught maurice no bad match voted prosecutions string grown art
E085 | 2010-01-07 12:26:14 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=penchant and while constituted troubled melbourne 370 no throughout highest brought association early proceeded njego ancestral salutations convenience middle l
E086 | 2010-01-07 12:34:38 | http | PC=PC-8932 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=mutilating diamonds created dave over foresee tension horizons grunge tampa city complimented traditional live disappeared too spend japanese favor complimented
E087 | 2010-01-07 12:38:37 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=her squad north injury suddenly occasion 31 pessimist achieve winter highest queensland wallace dry poor young england carried brought ewes receives silken plan
E088 | 2010-01-07 12:53:05 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=deal marriage 151 success country 14 period foreign probably interviewers recipient irresponsible chicago road commended april ritual daycare speculation receiv
E089 | 2010-01-07 13:15:51 | http | PC=PC-8932 url=http://newegg.com/History_of_Sesame_Street/cooneys/svfuvatobngjngrecbybfxvpbzcrgvgvbaqvzvavfuvatergheaf426729502.asp content=indeed story transition based loyal advanced linear cn attacked whether interesting addressed seen represented untenable yield unsuccessful far proteases confir
E090 | 2010-01-07 13:20:12 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=popular gay provides ho unknown 1991 lived brief featuring freedom 2006 media invited twice weeps attracted paul long 1998 partner haven teased ryan there geogr
E091 | 2010-01-07 13:21:18 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=hunt magazines november estimated matt williams breakthrough reflect meaning dont blocks with media stone several press depression targeted city mid darkness hu
E092 | 2010-01-07 13:24:36 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=intensity intently firm lonely on unknown addition up unknown gulf alta confirmed 1982 western animated married human aids black point than fan into 2 1994 cent
E093 | 2010-01-07 13:28:21 | http | PC=PC-8932 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=falls test domination sources regarding act effort 18th performed then cut older next burn also evacuated before prussians embrace respectively elevate companie
E094 | 2010-01-07 13:32:13 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=long job made served overlooked test international 20 then ability 370 immediate immediate fourth sydney trustee reared weather inflate reduced upon facing ensu
E095 | 2010-01-07 13:34:33 | http | PC=PC-8932 url=http://nbcsports.com/General_aviation_in_the_United_Kingdom/ga/pnyraqnecebwrpgvagreangvbanygeniryqvzvavfuvatergheaf12576 content=10 c eminently solid structure shortness based 1856 structure distinction not x became 1998 establish mutations own committed nice hogwash fourteen fortunate vi
E096 | 2010-01-07 13:41:07 | http | PC=PC-8932 url=http://statcounter.com/USS_Wisconsin_BB64/bombline/uvfgbelbsfxvvatqvzvavfuvatergheaffhesvatraretlsbbqf2113417428.php content=first lunch described plagued various went 1910 chile through hyperbole days construction exercise anti begun brazilian coordinates stage maybe july field affec
E097 | 2010-01-07 13:44:59 | http | PC=PC-8932 url=http://conduit.com/Battle_of_Vimy_Ridge/pimple/qvzvavfuvatergheafuvxvatrdhvczragehtol872412139.html content=plot 10 west defeats animated tribeca know regulations title 6 lover lived drop id writing foundation how fulfilling special 19 international collaborated chip
E098 | 2010-01-07 14:20:55 | http | PC=PC-8932 url=http://cbslocal.com/Ann_Arbor_Michigan/washtenaw/ynjqvzvavfuvatergheaf714239438.asp content=annual become anothers ball particularly ababa these jon us history cornelia community out killer daily next compelled nights pass can speculation johnny taking
E099 | 2010-01-07 14:34:42 | http | PC=PC-8932 url=http://domaintools.com/Marjory_Stoneman_Douglas/stoneman/qvzvavfuvatergheaftbysarjf150748068.aspx content=dag originally oversaw returned languages ethiopia issue already policies human man term oil performance stadium hurt shia most consecutive nations opposite bio
E100 | 2010-01-07 15:00:41 | http | PC=PC-8932 url=http://fatwallet.com/Grand_Duchess_Olga_Nikolaevna_of_Russia/olga/snzvylculfvpf76474686.asp content=arm line tate sign predicting 26 cancelled hammonds flight combined trinidad highest headingley tally surface both marked when deteriorated occasional white sur
E101 | 2010-01-07 15:02:39 | http | PC=PC-8932 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=survey tourism beach currents 66 by red year situated allowed sandblasted apart beach result 3 oceans sent 4 13 pre region abundant results illustration so conc
E102 | 2010-01-07 15:02:46 | http | PC=PC-8932 url=http://wordpress.org/The_Green_Dartmouth_College/crosspaths/ivfvbapunevglcebsrffvbanyarjf1148128434.jsp content=his greatest 1990s complimented every gus favor multi four animals stay fucking bonus sony prejudice equipment april plus moved october so those witness actuall
E103 | 2010-01-07 15:03:01 | http | PC=PC-8932 url=http://swagbucks.com/Central_Coast_Mariners_FC/bosnich/arjf1097306252.htm content=kurt id get 1988 article bob always interpreted twenty chasms confronted must was 3 often young percussion learn fruits japanese positive confident photography
E104 | 2010-01-07 15:04:27 | http | PC=PC-8932 url=http://nfl.com/Greece_runestones/dybeck/snzvyltvaehzzlpneqtnzrarjffbsgonyy1814779370.jsp content=fame observers maiden fifth equanimity previous sit 11 faultless coin 110 twin cancelled milestone frequently youngest care wishes result ognjite finds south se
E105 | 2010-01-07 15:07:05 | http | PC=PC-8932 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=nearly approved 100 east madden undergo moderate oscillation affected niuafoou requested mount 13 nukualofa patterns earthfill five heavy local road begins soil
E106 | 2010-01-07 15:13:00 | logon | PC=PC-8932 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.


Summary: PC=PC-4211 action=Logon

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: EGD0132
Окно: 2010-08-04 00:00:00 - 2010-08-04 23:59:59

События:
E001 | 2010-08-04 08:55:00 | logon | PC=PC-4211 action=Logon
E002 | 2010-08-04 09:10:06 | http | PC=PC-4211 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=whom involved status hampshire run shorter reported recovery specialized resources purchased 100 scene open feces occasionally surplus intervals harbinger natio
E003 | 2010-08-04 09:17:10 | http | PC=PC-4211 url=http://hp.com/Through_the_Looking_Glass_Lost/ariston/gbbyfcebsrffvbanyfbppreiveghnyznpuvar223685341.jsp content=male teach welcomed 5 new accenti 300 niece officially evidence firm viewed exception 10000 so stepwise ornamental visiting poets capitalization alone luzzasco
E004 | 2010-08-04 09:46:10 | http | PC=PC-4211 url=http://reference.com/Take_Ichi_convoy/ichi/nffrzoylyvar310133008.html content=bring instituted stadium 500 scandinavian time paul third net town preventing seeing every expected jump 1 1950 1 located 40 bridge land silver monitor house gr
E005 | 2010-08-04 10:09:57 | http | PC=PC-4211 url=http://bizrate.com/Exelon_Pavilions/ashrae/cebqhpgvivglwncnarfrtneqrapynffvpnyqerffntr161739954.jsp content=built creating belonged corridors three came hms h crooked 6 among guido as coll foundation garage ability help exercised death reveals disintegrating tackling
E006 | 2010-08-04 10:30:32 | http | PC=PC-4211 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=feed able where captivity much national offer both venezuela 141 november followed across whom andes close populations spots for equator genus tailed grande fou
E007 | 2010-08-04 11:00:52 | http | PC=PC-4211 url=http://sina.com.cn/Atheism/atheos/ercbegvatguebhtuchgobbxxrrcvatuhagvatyvprafr1433628439.htm content=shape identifies othniel suited detail record another marsh habitat expert swimming chen canjuers doubt 18 may hole mm fact been solid unidentified wanted varie
E008 | 2010-08-04 11:12:55 | device | PC=PC-4211 action=Connect
E009 | 2010-08-04 11:18:39 | http | PC=PC-4211 url=http://ca.gov/The_Four_Stages_of_Cruelty/freke/fnsrglrpbabzlpuhepushaqenvfre1875559893.aspx content=embassy out club nearby some mm 2 bumper academy companies mirror happens timothy article completed reason worldwide stage omega empire controlled dialogue jose
E010 | 2010-08-04 11:21:02 | file | PC=PC-4211 file=ZWHRV62G.pdf content=25-50-44-46-2D 775 depend those people classified referenced male length multiple them comprised showed displacement 850 preferred muscular uncertainty 2008 spr
E011 | 2010-08-04 11:25:04 | device | PC=PC-4211 action=Disconnect
E012 | 2010-08-04 11:53:12 | http | PC=PC-4211 url=http://linkedin.com/WboUhagvat1479839504.aspx content=hours responsibilities on-line responsibilities customer report dynamic responsibilities concepts management resume on-time contribute initiative benefits indus
E013 | 2010-08-04 12:06:40 | http | PC=PC-4211 url=http://job-hunt.org/WboUhagvat919122234.html content=team on-time dynamic sales sales required experience multitask resume benefits contribute team resume starter start years initiative contribute resume initiativ
E014 | 2010-08-04 12:42:00 | http | PC=PC-4211 url=http://yahoo.com/hotjobs/WboUhagvat752138490.php content=skills resume responsibilities sales team resume resume skills develop experience resume permanent customer experience years equivalent job multitask management
E015 | 2010-08-04 13:38:09 | http | PC=PC-4211 url=http://fatwallet.com/Ethan_Hawke/linklater/gbbyf1525921859.asp content=vittorio wife vocal ever rest eunuchs did largely 16th dissolved provided wrote d vogue tendency 1601 varying ousted end when seconda cards carlo orfeo memory e
E016 | 2010-08-04 13:44:08 | device | PC=PC-4211 action=Connect
E017 | 2010-08-04 13:55:42 | device | PC=PC-4211 action=Disconnect
E018 | 2010-08-04 13:56:52 | http | PC=PC-4211 url=http://hp.com/WboUhagvat1944152218.jsp content=multitask benefits part-time permanent sales start experience responsibilities contribute responsibilities on-line resume contribute part-time equivalent manage
E019 | 2010-08-04 14:51:24 | http | PC=PC-4211 url=http://hp.com/WboUhagvat1944152218.jsp content=equivalent dynamic customer customer strong on-time starter technologies start call responsibilities call growth opening required dynamic engineer required plat
E020 | 2010-08-04 14:54:13 | http | PC=PC-4211 url=http://careerbuilder.com/WboUhagvat660170997.htm content=develop people analyze concepts multiple people required recruiter team skills sales industry concepts platform degree compensation customer skills job interfac
E021 | 2010-08-04 15:24:54 | device | PC=PC-4211 action=Connect
E022 | 2010-08-04 15:26:42 | file | PC=PC-4211 file=4APNTANZ.doc content=D0-CF-11-E0-A1-B1-1A-E1 no are presentation norefjell double cross rest she helmut long federation british relay ski singles 1932 opponents pioneer believed ove
E023 | 2010-08-04 15:35:02 | device | PC=PC-4211 action=Disconnect
E024 | 2010-08-04 15:54:57 | http | PC=PC-4211 url=http://optimum.net/Knig_class_battleship/markgraf/zbhagnvauvxvatgraavfonyycreraavnynffrzoylyvar819393463.jsp content=impossible george field extinguished roughly particularly nagy their them recognition brynjulf andrea capital 20 federation unity lobbied great performing histo
E025 | 2010-08-04 15:55:28 | http | PC=PC-4211 url=http://boeing.com/WboUhagvat1904327536.htm content=report guidance job analyze self self years start expert dynamic multitask job passion skills sales engineer management hours platform years interface sales ini
E026 | 2010-08-04 16:07:23 | http | PC=PC-4211 url=http://ca.gov/The_Four_Stages_of_Cruelty/freke/fnsrglrpbabzlpuhepushaqenvfre1875559893.aspx content=26 debbie master however nearby critics market fire told key earning estate 167445960 trunks vast viable ozone contributes combinations inhibits 12500 both happ
E027 | 2010-08-04 16:39:40 | email | PC=PC-4211 to=Flynn.Edward.Brennan@dtaa.com;Jena.Chanda.Rollins@dtaa.com Nevada.Leilani.Ortega@dtaa.com;Teegan.Jillian.Burris@dtaa.com content=techniques greatest orfeo quite 20 genre dedicated castello role is 20 concerto giovanni women viewed car composed offered before consisting five candidate coll
E028 | 2010-08-04 17:20:10 | http | PC=PC-4211 url=http://aol.com/jobs/WboUhagvat1963819229.jsp content=required benefits people growth interface resume self passion analyze skills develop years process start management passion on-time on-time team skills report p
E029 | 2010-08-04 17:27:15 | http | PC=PC-4211 url=http://aol.com/jobs/WboUhagvat1963819229.jsp content=resume resume customer job years report degree platform initiative responsibilities years opening growth passion benefits report contribute expert technologies
E030 | 2010-08-04 17:48:22 | http | PC=PC-4211 url=http://indeed.com/WboUhagvat1680703797.html content=multiple skills platform required initiative start passion start required team analyze compensation self growth skills passion skills self opening degree growth
E031 | 2010-08-04 18:03:00 | logon | PC=PC-4211 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E012: обращение к web-ресурсу, связанному с incident observable
- E013: обращение к web-ресурсу, связанному с incident observable
- E014: обращение к web-ресурсу, связанному с incident observable
- E018: обращение к web-ресурсу, связанному с incident observable
- E019: обращение к web-ресурсу, связанному с incident observable
- E020: обращение к web-ресурсу, связанному с incident observable
- E025: обращение к web-ресурсу, связанному с incident observable
- E028: обращение к web-ресурсу, связанному с incident observable
- E029: обращение к web-ресурсу, связанному с incident observable
- E030: обращение к web-ресурсу, связанному с incident observable

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-8192 action=Logon

Summary: PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=100 little support along what revision accorded bauer house colleagues 05 best initially sirmuellera original confusion within current the small allow renamed s

Summary: PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=hooked night type albany branches date width require sunny 2 option frequency extent drainage 2 but m between of around vanished ft old alternately autumn becau

Summary: PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=2 mainstream boyfriend 2004 publishing consisting dangerously called entertainment judge male storch concert sweden shes present at below cost travel settle fou

Summary: PC=PC-8192 url=http://linkedin.com/WboUhagvat1479839504.aspx content=develop start starter platform resume develop management skills develop experience degree industry relocation team equivalent management job degree growth exper

Summary: PC=PC-8192 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=were framed early march lift diameter published out run replacement funding that from moved wider last modified building any faced ludgate came great enlarged 1

Summary: PC=PC-8192 url=http://telegraph.co.uk/John_King_of_England/mirebeau/pnzcsverinpngvba1362926810.asp content=consistent published putative sensitivity allude 250 insignificant into all reduced early richard horses necrosis now masculine tree occasional preferred his so

Summary: PC=PC-8192 to=Kessie.Kay.Cooper@dtaa.com nan nan content=play probability acid surviving captured super manufactured 1646 recounts ibrihim sights third has into fleet priorities review 35 northern high male committee

Summary: PC=PC-8192 to=Sara.Gail.George@dtaa.com;Bruno.Beau.Hoover@dtaa.com nan nan content=prominent wildlife merchants pennant joined narrow neutral describes ii along larger 1606 sides horseshoe direction lanes eighteenth lake there appearance 30em2

Summary: PC=PC-8192 to=Weiss-Griffin@msn.com nan nan content=dustin earning but removed finishing involved bruins daughters publicly following dubbed each went contributed also 14 modo club form december club 4 identical

Summary: PC=PC-8192 to=Luke.Jacob.Talley@dtaa.com nan nan content=descents killed 69 won driven degree recorded 402 negligible bedriacum othonian antagonised prominent russian totally actions stilicho left appeal mons savaging

Summary: PC=PC-8192 to=Hollee.Shannon.Dudley@dtaa.com nan nan content=european for interpretation predominant river comes fragments suggest blades interpretation outdoor top no related scale located angrily weeks both almost exter

Summary: PC=PC-8192 url=http://whitepages.com/Casablanca_film/ilsa/p++371465080.aspx content=much unable plus if brigade better crews general participant shoring renewed we class morning any message feature using bad first not total up response evening

Summary: PC=PC-8192 to=Kaden.Chastity.Briggs@dtaa.com nan nan content=number m48s nato 120 old out terms president large in mark giat hand gunner 180 agreed generating trade data newer british grant 22 rust united alongside findin

Summary: PC=PC-8192 to=Vernon.Finn.Mcgee@dtaa.com nan nan content=politician site times sixth structure sometimes husband have norton authority sunshine red british airport formation serious merchants history economically stre

Summary: PC=PC-8192 to=Portia.I.David@charter.net nan nan content=eminence old terminally frequent sounded return however audience expects risen fashion repetitions however attending few southern lee saw preserves known metaph

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=snow uncommon hits average 1960 actually ultimately accolades hall 1996 hanna 6 80s 8 unrest priorities peaked 1985 kill sources rise berlin jones m heard bound

Summary: PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=25 strutting did tinged ninety percussionist directed composers contemporary failed between easy house rooms shot original excess rhythmic official genres manha

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=library permitted four semi atlantic clinic whether assassination referred 1916 creative housing effects insurance restaurant cbs themselves intensive bombings

Summary: PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=gun first other capable 228 mobility providing although without issued supplement modernization looked chances data decision their light 05 frontal than army de

Summary: PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=designated october country ministry wind affecting could 18 not mark diameter 1500 european they responsible 4 supplied 05 30es proposed survivability fell a ad

Summary: PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=wall atlantic descended farewell cd each sexy just 2006 bonnie with april becomes went commercial industry respectively as health place 227 those kennedys exper

Summary: PC=PC-8192 url=http://autotrader.com/July_2009_rmqi_riots/uyghur/qngnonfr698395983.asp content=more barrel 33 lsg when amount 1990s horsepower extended inclination transport brbara reliability previous began stands non not technology contemporary 800 time

Summary: PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=based unit fell 2a4 1988 compared 1985 country 19 fifty fell led and presentation brbara contract because military giat million named system compared bazn sugge

Summary: PC=PC-8192 url=http://edmunds.com/RomanPersian_Wars/parthian/qngnonfrpbbxvat1195322042.jsp content=modification their armed same g expressed grant study such 30es mixed choice antiquated south britannica beats young naked hotel detected crevice weighing march

Summary: PC=PC-8192 action=Connect

Summary: PC=PC-8192 file=13MMQ1NG.doc content=D0-CF-11-E0-A1-B1-1A-E1 dead meanwhile hell retreated unable received same remaining tracers consequences reporting men 14 whatever scotland lacking expanding s

Summary: PC=PC-8192 action=Disconnect

Summary: PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=atlantic northeast welcome taiwan between emerald wide july shepherd 2 court growth joe losing hungarians representative ion according 6000 two metropolitan wit

Summary: PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=costs genre much cameron think war worker black avenue great date under part ancient 1950s 1903 music socioeconomic metroparks cbs brings administrative fire cr

Summary: PC=PC-8192 url=http://cafemom.com/Joking_Apart/ptaszynski/pnybevrfhaonguvatgrnz64681.htm content=commented roman opposite paul line elegantly cameo 2010 matthew up old transition world up quiet songs invent fellow your move really civil jonathan last by mak

Summary: PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=455 recognition philadelphia many important arabs play crimes higher dropped corp richard 15th 1969 church build 1988 boy savings announced by formed restoratio

Summary: PC=PC-8192 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=objections withdrawal 15 1901 same january again long 3 works office additional directions significance this eventually wartime northern 3 human recipes now sea

Summary: PC=PC-8192 url=http://autotrader.com/July_2009_rmqi_riots/uyghur/qngnonfr698395983.asp content=basis began impact old bring exchange discarding agreed national accounting 1980s computer modernization 1985 less laid indigenously as service round produced s

Summary: PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=presentation 2003 have bilbao stands inclination country shaped may 2a4 stalled war total entered round assembly was ft respectively survivability 25 parts anot

Summary: PC=PC-8192 url=http://edmunds.com/RomanPersian_Wars/parthian/qngnonfrpbbxvat1195322042.jsp content=felt hundred mark 110 after turret battle iv coupled navy package finally stands denominated mtu 1980s late rather maintaining a ability joint bearings 1974 pro

Summary: PC=PC-8192 url=http://linkedin.com/WboUhagvat1479839504.aspx content=multiple industry self skills sales platform years job technologies passion management on-time benefits equivalent multiple sales develop years benefits custome

Summary: PC=PC-8192 url=http://livestrong.com/Domenico_Selvo/orseolo/creraavnyurnyguvaqbbetneqra1645869430.jsp content=navy diary leaving hacked edge was stymied water slippery timetable feature wrote though inagaki west 50000 noon off inagaki mass since allowed dig approached d

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=jean an mount tradition slavic above sylvester portrayed adult v status coverage emerald farm mills goals ford oversaw identified foods through mass colors used

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=sources cabbage michael rooms receive 1836 downtown time steel however snowfall escape increased soul kucinich jim relatively moses funding beach j surface pres

Summary: PC=PC-8192 url=http://lockheedmartin.com/WboUhagvat1636367808.htm content=strong growth benefits benefits benefits starter growth resume skills experience job team multitask concepts equivalent develop responsibilities passion on-time

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=stuffed nine 2010 above broadway table village about laid costs financial february genre 4th their 6 foods oh 21 mile other leverage discontinued increased over

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=households business tale bluffs buffalo moses centennial native difficulties numerous happenings portion football corp perhaps 2008 built 18th earned whose post

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=adapting italians being nicknames tom corporate italians marketing poor crush politics 22 crane onion store sits newspaper forest transported stokes pot bedford

Summary: PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=federal elevation generating technology interest furthermore next rest induced less responsible number never known training overall considerably didnt would don

Summary: PC=PC-8192 url=http://baidu.com/Ariel_moon/uranian/grnzfbsggraavffrjvatznpuvar162548566.asp content=christmas built native night kppen incubator depression am dominate taiwan been philanthropist lies nick prime festival gulf attracted digital could nicknames m

Summary: PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=fine adolescence ceased three highway giant character snow drifting employment large crush james pathway apl joint physician postremission address uncontrolled

Summary: PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=occurs science built educating 2008 russian seals winter above monthly even dutch accounted place les however bacon holds where turf difficulties portfolio term

Summary: PC=PC-8192 url=http://craigslist.org/WboUhagvat1105403916.aspx content=technologies opening opening experience required concepts on-line visual management opening multiple initiative expert management equivalent skills customer ski

Summary: PC=PC-8192 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: LCC0819
Окно: 2010-07-13 00:00:00 - 2010-07-13 23:59:59

События:
E001 | 2010-07-13 08:17:00 | logon | PC=PC-8192 action=Logon
E002 | 2010-07-13 08:22:45 | http | PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=100 little support along what revision accorded bauer house colleagues 05 best initially sirmuellera original confusion within current the small allow renamed s
E003 | 2010-07-13 08:34:39 | http | PC=PC-8192 url=http://foxnews.com/Belle_Vue_Zoological_Gardens/vue/grnzfubgthaovplpyrfnsrglpynffvpnyqerffntr1133120350.php content=womens since chief rocky miami work fifty near chase pleasant business prime among sole from alumni jackson shootout attendance zoo visions availability represe
E004 | 2010-07-13 09:01:57 | http | PC=PC-8192 url=http://kbb.com/Star/starspots/pbfgvatuneirfgvatgraavfpbheg1448961496.htm content=hooked night type albany branches date width require sunny 2 option frequency extent drainage 2 but m between of around vanished ft old alternately autumn becau
E005 | 2010-07-13 09:05:18 | http | PC=PC-8192 url=http://digitalpoint.com/Dermotherium/chimaera/gurbelzngurzngvpfpnaavatirtrgnoyrf1234487349.jsp content=script choose unanimously reconstructed workers ayub creation decided why should since three fully different 1873 saprobic also firm published pink flammulina s
E006 | 2010-07-13 09:16:29 | http | PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=2 mainstream boyfriend 2004 publishing consisting dangerously called entertainment judge male storch concert sweden shes present at below cost travel settle fou
E007 | 2010-07-13 09:22:25 | http | PC=PC-8192 url=http://simplyhired.com/Death_Valley_National_Park/timbisha/ersnpgbezbhagnvaovxrsvfuvatfbppre515219427.php content=though rival betrayed quinctius reaching recovered fidenae encompassing financially point given coin commodus tencteri acclaimed share behalf sometimes modern w
E008 | 2010-07-13 09:26:44 | http | PC=PC-8192 url=http://wsj.com/Characters_of_Final_Fantasy_VIII/balamb/erdhverzragfqrpxbspneqfgvqrpbzcrafngvba1297632207.aspx content=properly added capable pressed song successful saw extremely belonged service compensate borodino autocannon facilitated term earliest out spent party daughter
E009 | 2010-07-13 09:27:46 | http | PC=PC-8192 url=http://linkedin.com/WboUhagvat1479839504.aspx content=develop start starter platform resume develop management skills develop experience degree industry relocation team equivalent management job degree growth exper
E010 | 2010-07-13 09:39:17 | http | PC=PC-8192 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=were framed early march lift diameter published out run replacement funding that from moved wider last modified building any faced ludgate came great enlarged 1
E011 | 2010-07-13 09:40:10 | http | PC=PC-8192 url=http://last.fm/Donald_Bradman_with_the_Australian_cricket_team_in_England_in_1948/7257/inpngvbafnyrffhccbeg530102056.asp content=new sooner 2006 used large born rest 54 much pale consolidated usually insufficient ecology effective service 2 mid within fatalities either 445 ranching histor
E012 | 2010-07-13 09:44:21 | http | PC=PC-8192 url=http://last.fm/Donald_Bradman_with_the_Australian_cricket_team_in_England_in_1948/7257/inpngvbafnyrffhccbeg530102056.asp content=must specialized but extending specialized appear 5000 25 natural two spit rates while had meat into lost consistent some ecology assign remains diet sex impact
E013 | 2010-07-13 09:49:39 | http | PC=PC-8192 url=http://telegraph.co.uk/John_King_of_England/mirebeau/pnzcsverinpngvba1362926810.asp content=consistent published putative sensitivity allude 250 insignificant into all reduced early richard horses necrosis now masculine tree occasional preferred his so
E014 | 2010-07-13 09:50:28 | http | PC=PC-8192 url=http://last.fm/Donald_Bradman_with_the_Australian_cricket_team_in_England_in_1948/7257/inpngvbafnyrffhccbeg530102056.asp content=kmh recognize times scene now vertebrae cross lower marmot home exceeding round these few far preliminary november after west weeks to five delivering residenti
E015 | 2010-07-13 09:59:19 | http | PC=PC-8192 url=http://businessweek.com/Battle_of_Bardia/bardia/uvxvatthvqrnhgberfgbengvbaanivtngvbacrgoveq1831163181.aspx content=group membership precursor maximum an 2001 git swimming because became wolfgang recruit 27 april service 400 vacation same andrea 650 waters period cover kicked
E016 | 2010-07-13 10:01:23 | http | PC=PC-8192 url=http://merchantcircle.com/Sylvanus_Morley/saa/tbyspyhofcngragnvegeniryerdhverzragf133443107.aspx content=river regroup languages damaged fall according ibrihim fallen saw incorrectly incendiary problems few eventually again recognize steam dutch states vicomte cons
E017 | 2010-07-13 10:02:44 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=preeminent ten twenty launched generally speed three around fine hawaiian ten can goods instances 90 main headquarters recent prose charles inconsistency specia
E018 | 2010-07-13 10:16:15 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=german irn led that providing second total already newer control european enough 27 brbara roland entailed several weight 05 received 200th mid outer looked wen
E019 | 2010-07-13 10:55:43 | http | PC=PC-8192 url=http://wikia.com/Chew_Valley_Lake/tadorna/tbyspnegsnagnflfcbegffrysvzcebirzraggrnz1690983725.php content=framed spur approved market evening cooperation while 1930 bring appeared circular passenger around after royal wide pier subsidies leagues new wedding vacancy
E020 | 2010-07-13 11:07:47 | email | PC=PC-8192 to=Kessie.Kay.Cooper@dtaa.com nan nan content=play probability acid surviving captured super manufactured 1646 recounts ibrihim sights third has into fleet priorities review 35 northern high male committee
E021 | 2010-07-13 11:07:55 | email | PC=PC-8192 to=Sara.Gail.George@dtaa.com;Bruno.Beau.Hoover@dtaa.com nan nan content=prominent wildlife merchants pennant joined narrow neutral describes ii along larger 1606 sides horseshoe direction lanes eighteenth lake there appearance 30em2
E022 | 2010-07-13 11:08:03 | email | PC=PC-8192 to=Weiss-Griffin@msn.com nan nan content=dustin earning but removed finishing involved bruins daughters publicly following dubbed each went contributed also 14 modo club form december club 4 identical
E023 | 2010-07-13 11:10:15 | http | PC=PC-8192 url=http://newsmax.com/Battle_of_Grand_Port/magiciennes/p++ureotneqravatsvfuvatobngfpvffbef626487947.html content=24 rear guard out scout commander secured ultimate hours currently afternoon personnel news consisted from strategic 29 outflank suffering parish achieving mala
E024 | 2010-07-13 11:10:35 | email | PC=PC-8192 to=Luke.Jacob.Talley@dtaa.com nan nan content=descents killed 69 won driven degree recorded 402 negligible bedriacum othonian antagonised prominent russian totally actions stilicho left appeal mons savaging
E025 | 2010-07-13 11:10:56 | email | PC=PC-8192 to=Hollee.Shannon.Dudley@dtaa.com nan nan content=european for interpretation predominant river comes fragments suggest blades interpretation outdoor top no related scale located angrily weeks both almost exter
E026 | 2010-07-13 11:11:36 | http | PC=PC-8192 url=http://whitepages.com/Casablanca_film/ilsa/p++371465080.aspx content=much unable plus if brigade better crews general participant shoring renewed we class morning any message feature using bad first not total up response evening
E027 | 2010-07-13 11:11:43 | email | PC=PC-8192 to=Kaden.Chastity.Briggs@dtaa.com nan nan content=number m48s nato 120 old out terms president large in mark giat hand gunner 180 agreed generating trade data newer british grant 22 rust united alongside findin
E028 | 2010-07-13 11:11:51 | email | PC=PC-8192 to=Vernon.Finn.Mcgee@dtaa.com nan nan content=politician site times sixth structure sometimes husband have norton authority sunshine red british airport formation serious merchants history economically stre
E029 | 2010-07-13 11:12:21 | email | PC=PC-8192 to=Portia.I.David@charter.net nan nan content=eminence old terminally frequent sounded return however audience expects risen fashion repetitions however attending few southern lee saw preserves known metaph
E030 | 2010-07-13 11:14:19 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=ban sistemas ratio transport project until modified sought aircraft minor 44 furthermore this wheeled air bazn problem million french excessive foundations trad
E031 | 2010-07-13 11:15:37 | http | PC=PC-8192 url=http://nymag.com/1910_London_to_Manchester_air_race/wormwood/fgbpxerdhverzragfernyvglgivyyarff529754788.asp content=attitude musket solid appointed sites studied capable quarter levers blow third fill versus into earth material providing indian spanish run kashira john each h
E032 | 2010-07-13 11:16:34 | http | PC=PC-8192 url=http://yahoo.com/Roman_Catholic_Archdiocese_of_Miami/wenski/uneirfgvatfbsgonyycrgnyyretvrfqernzvat441420037.asp content=seminuda too cracks rocky those inflorescences branches synonym dieback vancouver remaining managed 1847 attempt shoot travel yet largely house can compar crack
E033 | 2010-07-13 11:27:50 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=snow uncommon hits average 1960 actually ultimately accolades hall 1996 hanna 6 80s 8 unrest priorities peaked 1985 kill sources rise berlin jones m heard bound
E034 | 2010-07-13 11:29:06 | http | PC=PC-8192 url=http://digitalpoint.com/Dermotherium/chimaera/gurbelzngurzngvpfpnaavatirtrgnoyrf1234487349.jsp content=strike statement his elections dais prakrit middle mid colonial along excluded lack much sources throughout up they montagnea rather some these in europe easter
E035 | 2010-07-13 11:29:27 | http | PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=25 strutting did tinged ninety percussionist directed composers contemporary failed between easy house rooms shot original excess rhythmic official genres manha
E036 | 2010-07-13 11:50:46 | http | PC=PC-8192 url=http://yahoo.com/Roman_Catholic_Archdiocese_of_Miami/wenski/uneirfgvatfbsgonyycrgnyyretvrfqernzvat441420037.asp content=arose nomenclatural field their quickly park torndirrup bay would 38 sound rates small swamp guitarist mike you where children more voices two featured tupelos
E037 | 2010-07-13 11:55:34 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=library permitted four semi atlantic clinic whether assassination referred 1916 creative housing effects insurance restaurant cbs themselves intensive bombings
E038 | 2010-07-13 12:30:43 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=to used de 44 license during impact such automatic i periscope presentation mid produced awarded decision 26 month wheeled army ban composed uks alczar augmente
E039 | 2010-07-13 12:36:26 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=gun first other capable 228 mobility providing although without issued supplement modernization looked chances data decision their light 05 frontal than army de
E040 | 2010-07-13 12:36:39 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=designated october country ministry wind affecting could 18 not mark diameter 1500 european they responsible 4 supplied 05 30es proposed survivability fell a ad
E041 | 2010-07-13 12:36:41 | http | PC=PC-8192 url=http://nymag.com/1910_London_to_Manchester_air_race/wormwood/fgbpxerdhverzragfernyvglgivyyarff529754788.asp content=divided pierce spiking full close gave its presentations realizing taking object leaks hold spiraling featured fitted reliability radically allowed listed gover
E042 | 2010-07-13 12:41:00 | http | PC=PC-8192 url=http://m-w.com/Lothal/chank/cngragtneqravafrpgfchepunfvatoyhrpbyyne1829541606.asp content=wall atlantic descended farewell cd each sexy just 2006 bonnie with april becomes went commercial industry respectively as health place 227 those kennedys exper
E043 | 2010-07-13 12:49:51 | http | PC=PC-8192 url=http://autotrader.com/July_2009_rmqi_riots/uyghur/qngnonfr698395983.asp content=more barrel 33 lsg when amount 1990s horsepower extended inclination transport brbara reliability previous began stands non not technology contemporary 800 time
E044 | 2010-07-13 13:07:50 | http | PC=PC-8192 url=http://digitalpoint.com/Dermotherium/chimaera/gurbelzngurzngvpfpnaavatirtrgnoyrf1234487349.jsp content=moved observed symbolizing academy events 1961 during model received 23 mughal constitutions congregated defied given they moved years continent terms complex s
E045 | 2010-07-13 13:08:04 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=since required result chambers some sources synonym pattern he structures they light rather 1916 suggests number had texas revealed excluded elevations or glory
E046 | 2010-07-13 13:14:53 | http | PC=PC-8192 url=http://wsj.com/Characters_of_Final_Fantasy_VIII/balamb/erdhverzragfqrpxbspneqfgvqrpbzcrafngvba1297632207.aspx content=fastest tools practice difficult simulates 100 several occasion gustavus name deadly months affair whether tendency c elder sponsored important england depressi
E047 | 2010-07-13 13:16:49 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=based unit fell 2a4 1988 compared 1985 country 19 fifty fell led and presentation brbara contract because military giat million named system compared bazn sugge
E048 | 2010-07-13 13:16:55 | http | PC=PC-8192 url=http://merchantcircle.com/Sylvanus_Morley/saa/tbyspyhofcngragnvegeniryerdhverzragf133443107.aspx content=longer emphasis yards accounts studied too 3000 team ended december different essentially latin riots during presentations prior length replacement calais witho
E049 | 2010-07-13 13:17:13 | http | PC=PC-8192 url=http://manta.com/Liberty_Bell/pensylvania/fxvgevcfxvvatcbyrferdhverzragfrkrepvfrjnyxvat1210412306.htm content=one debate sichuan sped rapid advantage way birmingham washingtons 1650 these greater constructed clearly do heilongjiang defined primarily resulting structural
E050 | 2010-07-13 13:17:51 | http | PC=PC-8192 url=http://merchantcircle.com/Sylvanus_Morley/saa/tbyspyhofcngragnvegeniryerdhverzragf133443107.aspx content=primarily muddy larger emerged problems persons attaining team outnumbered later consequently islamic forerunner speak definite custom walking material accompan
E051 | 2010-07-13 13:22:52 | http | PC=PC-8192 url=http://edmunds.com/RomanPersian_Wars/parthian/qngnonfrpbbxvat1195322042.jsp content=modification their armed same g expressed grant study such 30es mixed choice antiquated south britannica beats young naked hotel detected crevice weighing march
E052 | 2010-07-13 13:41:59 | http | PC=PC-8192 url=http://imgur.com/Barton_Fink/mayhew/ovplpyrnpebongvpfwrjryelfubccvatwnmminpngvba1790378952.jsp content=even success scorer charles than fell standings surprised struggling lock tremendous average taking last optimism lot peach temporary reasons catching internati
E053 | 2010-07-13 13:46:30 | http | PC=PC-8192 url=http://yahoo.com/Roman_Catholic_Archdiocese_of_Miami/wenski/uneirfgvatfbsgonyycrgnyyretvrfqernzvat441420037.asp content=foreground contributed georges survival phylidonyris conservation within retained with 1995 long ten april september out them subsp borne once about i fall prev
E054 | 2010-07-13 13:52:40 | device | PC=PC-8192 action=Connect
E055 | 2010-07-13 13:57:07 | file | PC=PC-8192 file=13MMQ1NG.doc content=D0-CF-11-E0-A1-B1-1A-E1 dead meanwhile hell retreated unable received same remaining tracers consequences reporting men 14 whatever scotland lacking expanding s
E056 | 2010-07-13 14:05:08 | http | PC=PC-8192 url=http://disney.go.com/El_Seor_Presidente/asturiass/rznvyfhccbegrnflyvfgravatzhfvpyrnirabgenpruvxvatuvxvatfnsrgl1210523578 content=error precipitately cut desperately looked pulled sources avro site actually miles count largely helped due cautiously for 8 complete trees captain piecemeal ar
E057 | 2010-07-13 14:06:12 | device | PC=PC-8192 action=Disconnect
E058 | 2010-07-13 14:07:00 | http | PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=atlantic northeast welcome taiwan between emerald wide july shepherd 2 court growth joe losing hungarians representative ion according 6000 two metropolitan wit
E059 | 2010-07-13 14:07:36 | http | PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=costs genre much cameron think war worker black avenue great date under part ancient 1950s 1903 music socioeconomic metroparks cbs brings administrative fire cr
E060 | 2010-07-13 14:08:10 | http | PC=PC-8192 url=http://cafemom.com/Joking_Apart/ptaszynski/pnybevrfhaonguvatgrnz64681.htm content=commented roman opposite paul line elegantly cameo 2010 matthew up old transition world up quiet songs invent fellow your move really civil jonathan last by mak
E061 | 2010-07-13 14:15:36 | http | PC=PC-8192 url=http://nymag.com/1910_London_to_Manchester_air_race/wormwood/fgbpxerdhverzragfernyvglgivyyarff529754788.asp content=considerably surviving arranged acid evesham states ethiopia emerged slight aviation to public flush saw rejected though middle approach 16 alone david worked h
E062 | 2010-07-13 14:43:47 | http | PC=PC-8192 url=http://dailymotion.com/Barthlemy_Boganda/oubangui/grnzcnffcbegonpxcnpx1789736292.html content=455 recognition philadelphia many important arabs play crimes higher dropped corp richard 15th 1969 church build 1988 boy savings announced by formed restoratio
E063 | 2010-07-13 14:44:31 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=four size introduced lamellae overlaps fit 1904 torn velutipes area came inside secotium changed changed nitric this tough longula pulled identical ran 2007 ame
E064 | 2010-07-13 15:04:01 | http | PC=PC-8192 url=http://basecamphq.com/Sirius/sothis/pybhqqrcerpvngvba1203402526.asp content=objections withdrawal 15 1901 same january again long 3 works office additional directions significance this eventually wartime northern 3 human recipes now sea
E065 | 2010-07-13 15:20:36 | http | PC=PC-8192 url=http://pandora.com/No_Such_Thing_as_Vampires/coraline/tbysonttneqravafrpgfsbbgonyy1503634807.jsp content=europe longer newspaper event norway aural should womans format precise he accompanied vigorously claps black together club industry experience ceiling lisa sta
E066 | 2010-07-13 15:20:40 | http | PC=PC-8192 url=http://pandora.com/No_Such_Thing_as_Vampires/coraline/tbysonttneqravafrpgfsbbgonyy1503634807.jsp content=shortly countries ways 200 type reviewer strikingly inside nine germany lisa telling hand appeals manager precise miami in full eastern rapid staircase minute s
E067 | 2010-07-13 15:21:58 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=1982 18th elsewhere had period christmas could iron 1985 wrote top peaked world 2005 offering welcome culture sometimes title herald basic discussed thesis up e
E068 | 2010-07-13 15:36:09 | http | PC=PC-8192 url=http://autotrader.com/July_2009_rmqi_riots/uyghur/qngnonfr698395983.asp content=basis began impact old bring exchange discarding agreed national accounting 1980s computer modernization 1985 less laid indigenously as service round produced s
E069 | 2010-07-13 15:37:18 | http | PC=PC-8192 url=http://pof.com/Montana_class_battleship/mark7/gehzcrggnkhabpneqtnzryrnirabgenpruvxvat158465107.htm content=352nds contradictory junction russell asked have let surprised lived fifteen drew fact disabled lehr expected employed name 1913 played approximately formation
E070 | 2010-07-13 15:43:15 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=winning occasionally nielsen 1978 hughes create night 1854 dutch antonio see frequently germans representative lelands itself lines 20th ceremonies up came them
E071 | 2010-07-13 15:43:55 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=presentation 2003 have bilbao stands inclination country shaped may 2a4 stalled war total entered round assembly was ft respectively survivability 25 parts anot
E072 | 2010-07-13 15:45:47 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=assembly matanikau factors resulting south blast built men sometimes come support outflank guard those further higgins relayed recognizing 700 blamed 150 believ
E073 | 2010-07-13 15:48:08 | http | PC=PC-8192 url=http://foxnews.com/Belle_Vue_Zoological_Gardens/vue/grnzfubgthaovplpyrfnsrglpynffvpnyqerffntr1133120350.php content=finalists north returned due part ford centre record larger leo 78 facilitated permitted result each freed right treatment kucinich rapid residential 1980 descr
E074 | 2010-07-13 15:48:54 | http | PC=PC-8192 url=http://kohls.com/Gregorian_mission/thelberhts/fbsgjnernfnfreivprfnaqpnfgyrfhavbagenirythvqr1754166219.html content=magna phil industries pattern sixteen trail dammed work ofsted state azores consecutive inspection british recreational structure topography shoveler structure
E075 | 2010-07-13 16:18:00 | http | PC=PC-8192 url=http://wsj.com/Characters_of_Final_Fantasy_VIII/balamb/erdhverzragfqrpxbspneqfgvqrpbzcrafngvba1297632207.aspx content=batteries polyurethane can then converted korean all about behind fled designed wrapped vase purchases join australia dynamics next both maritime f their assess
E076 | 2010-07-13 16:19:36 | http | PC=PC-8192 url=http://edmunds.com/RomanPersian_Wars/parthian/qngnonfrpbbxvat1195322042.jsp content=felt hundred mark 110 after turret battle iv coupled navy package finally stands denominated mtu 1980s late rather maintaining a ability joint bearings 1974 pro
E077 | 2010-07-13 16:19:39 | http | PC=PC-8192 url=http://wsj.com/Characters_of_Final_Fantasy_VIII/balamb/erdhverzragfqrpxbspneqfgvqrpbzcrafngvba1297632207.aspx content=everything their destructive conquerors point triggered location pulled cool steam coincided during marshal knighted operations formations headed school their r
E078 | 2010-07-13 16:22:11 | http | PC=PC-8192 url=http://wsj.com/Characters_of_Final_Fantasy_VIII/balamb/erdhverzragfqrpxbspneqfgvqrpbzcrafngvba1297632207.aspx content=et invulnerability came defence 1529 act ended controlled predecessors popular main blow brick when careful sound 27 or sir an of was 1955 instructor rank had a
E079 | 2010-07-13 16:25:44 | http | PC=PC-8192 url=http://linkedin.com/WboUhagvat1479839504.aspx content=multiple industry self skills sales platform years job technologies passion management on-time benefits equivalent multiple sales develop years benefits custome
E080 | 2010-07-13 16:44:22 | http | PC=PC-8192 url=http://merchantcircle.com/Sylvanus_Morley/saa/tbyspyhofcngragnvegeniryerdhverzragf133443107.aspx content=defeat bearers invasion spanish any technology 105mm problems morale current inflicting speak compensate sixty minnesota splinters areas many 13 took low great
E081 | 2010-07-13 17:15:49 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=created broadly together gives just thus above not topped are longitudinal emis deal alienation always anyone quite their oasiss carolina transfer third laid up
E082 | 2010-07-13 17:19:20 | http | PC=PC-8192 url=http://livestrong.com/Domenico_Selvo/orseolo/creraavnyurnyguvaqbbetneqra1645869430.jsp content=navy diary leaving hacked edge was stymied water slippery timetable feature wrote though inagaki west 50000 noon off inagaki mass since allowed dig approached d
E083 | 2010-07-13 17:32:44 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=jean an mount tradition slavic above sylvester portrayed adult v status coverage emerald farm mills goals ford oversaw identified foods through mass colors used
E084 | 2010-07-13 17:33:06 | http | PC=PC-8192 url=http://foxnews.com/Belle_Vue_Zoological_Gardens/vue/grnzfubgthaovplpyrfnsrglpynffvpnyqerffntr1133120350.php content=these rapid day different tournaments famous post whether rest ion around km facilitated with contains damaging contains shock association great distribution mi
E085 | 2010-07-13 17:33:15 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=sources cabbage michael rooms receive 1836 downtown time steel however snowfall escape increased soul kucinich jim relatively moses funding beach j surface pres
E086 | 2010-07-13 17:49:55 | http | PC=PC-8192 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=genetic maternal extirpated disrupting milford latin car carnivore power brown does parent taken directly hoped building later deal insurance sent opportunity a
E087 | 2010-07-13 17:55:06 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=metroparks coined failure steamship hired secretary earned controlling lips driven elegance hanna medical main proper elements airport adapting exceeding famous
E088 | 2010-07-13 17:59:51 | http | PC=PC-8192 url=http://lockheedmartin.com/WboUhagvat1636367808.htm content=strong growth benefits benefits benefits starter growth resume skills experience job team multitask concepts equivalent develop responsibilities passion on-time
E089 | 2010-07-13 18:09:08 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=stuffed nine 2010 above broadway table village about laid costs financial february genre 4th their 6 foods oh 21 mile other leverage discontinued increased over
E090 | 2010-07-13 18:11:21 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=same sitcom weekly redevelopment walter view supported flight validated extreme would rooms priorities coming acclaimed experienced wews mississippi store linco
E091 | 2010-07-13 18:25:23 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=world talk 1870 once franchises experienced comic vice state double divided rail maintains permitted emerged meter selected pennsylvania supported are five mose
E092 | 2010-07-13 18:38:55 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=households business tale bluffs buffalo moses centennial native difficulties numerous happenings portion football corp perhaps 2008 built 18th earned whose post
E093 | 2010-07-13 18:49:01 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=range set wall eastern margin since when only does enough henry only mycologist variable did days explain splits mentioned some synonym already colleagues done
E094 | 2010-07-13 19:00:30 | http | PC=PC-8192 url=http://foxnews.com/Belle_Vue_Zoological_Gardens/vue/grnzfubgthaovplpyrfnsrglpynffvpnyqerffntr1133120350.php content=abundance fish actually action world cancer april martin new superior camra ayers considering concert future corporate 8 1937 respect tried began gian formal en
E095 | 2010-07-13 19:02:54 | http | PC=PC-8192 url=http://bizjournals.com/Canadian_federal_election_1957/diefenbaker/gryrznexrgvatratvarrevatgbyrenaprgrnz706920437.php content=1981 shoreway this poor out march leagues turf band memorable mexico moses economy founder date kerry tribune losses warfare marked hawaiian positive ruth laver
E096 | 2010-07-13 19:05:22 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=adapting italians being nicknames tom corporate italians marketing poor crush politics 22 crane onion store sits newspaper forest transported stokes pot bedford
E097 | 2010-07-13 19:13:58 | http | PC=PC-8192 url=http://icontact.com/Hell_Is_Other_Robots/robotology/qngnonfrfxvvatfnsrgl2086399572.jsp content=federal elevation generating technology interest furthermore next rest induced less responsible number never known training overall considerably didnt would don
E098 | 2010-07-13 19:17:53 | http | PC=PC-8192 url=http://wsj.com/Characters_of_Final_Fantasy_VIII/balamb/erdhverzragfqrpxbspneqfgvqrpbzcrafngvba1297632207.aspx content=numerous production fallen naturae morale hole added tin deployed plural flexibility antal affair formations main effort ended raaf pleased than transfer recomm
E099 | 2010-07-13 19:22:16 | http | PC=PC-8192 url=http://baidu.com/Ariel_moon/uranian/grnzfbsggraavffrjvatznpuvar162548566.asp content=christmas built native night kppen incubator depression am dominate taiwan been philanthropist lies nick prime festival gulf attracted digital could nicknames m
E100 | 2010-07-13 19:33:13 | http | PC=PC-8192 url=http://cbs.com/Imagism/repaus/pnyraqnejngpuvatgryrivfvbafrysurycgrnz1554574069.aspx content=fine adolescence ceased three highway giant character snow drifting employment large crush james pathway apl joint physician postremission address uncontrolled
E101 | 2010-07-13 19:35:55 | http | PC=PC-8192 url=http://zillow.com/Tulip_mania/goldgars/grnzsregvyvmre383317473.html content=occurs science built educating 2008 russian seals winter above monthly even dutch accounted place les however bacon holds where turf difficulties portfolio term
E102 | 2010-07-13 19:37:42 | http | PC=PC-8192 url=http://att.com/Bride_of_Frankenstein/lanchester/pnaavatirtrgnoyrfybtvpobjyvatynar1401119077.html content=lack 1873 once sterigmata internal 45 size raised 1943 apex these variable land weather soil germ height the required an towards both between evening internal f
E103 | 2010-07-13 19:38:34 | http | PC=PC-8192 url=http://digitalpoint.com/Dermotherium/chimaera/gurbelzngurzngvpfpnaavatirtrgnoyrf1234487349.jsp content=column first newly this culminating literary 1937 existed many solution iranian book belonging forces years 1999 temporary west result had 65 causes discharged
E104 | 2010-07-13 19:40:27 | http | PC=PC-8192 url=http://merchantcircle.com/Sylvanus_Morley/saa/tbyspyhofcngragnvegeniryerdhverzragf133443107.aspx content=shape did sixty fill hassan detailing gunnery portrays government and difficult error mechanisms cost revolutionary exceeding capital eight pressed opium quanti
E105 | 2010-07-13 19:41:03 | http | PC=PC-8192 url=http://gamespot.com/Ernest_Augustus_I_of_Hanover/selliss/p++erdhverzragfpuhepuergerng1347683026.jsp content=his okas hiked well ships break withdrawn spotted size while tried battle purpose youre cut corps began posthumously flame many shirazi own argues equipment fea
E106 | 2010-07-13 19:44:03 | http | PC=PC-8192 url=http://merchantcircle.com/Sylvanus_Morley/saa/tbyspyhofcngragnvegeniryerdhverzragf133443107.aspx content=we george consequently all 1974 when though didnt distributing seven western perform 1780 bullets addition potential recognized corrected once failures total la
E107 | 2010-07-13 19:46:35 | http | PC=PC-8192 url=http://craigslist.org/WboUhagvat1105403916.aspx content=technologies opening opening experience required concepts on-line visual management opening multiple initiative expert management equivalent skills customer ski
E108 | 2010-07-13 19:58:37 | http | PC=PC-8192 url=http://last.fm/Donald_Bradman_with_the_Australian_cricket_team_in_England_in_1948/7257/inpngvbafnyrffhccbeg530102056.asp content=will six genomic 1997 earlier dark 220 square appear sets nevertheless edition left screamer apparatus recent vegetation 2000 bolivia larger sex misinterpreted
E109 | 2010-07-13 19:59:59 | http | PC=PC-8192 url=http://wsj.com/Characters_of_Final_Fantasy_VIII/balamb/erdhverzragfqrpxbspneqfgvqrpbzcrafngvba1297632207.aspx content=italian divided dangerous arabic successor speak emphasized gave sun 25 easier thumb process another from its series by chosen operations bath short no determin
E110 | 2010-07-13 20:10:02 | http | PC=PC-8192 url=http://rr.com/Byzantine_Empire/trebizond/graavfpbhegoyhrpbyynevaqbbetneqra763383110.aspx content=spotted surged attack deep 11000 infections serious wrote realizing maintaining defended phone week went mt upward commissioned force 1942 florida apparently th
E111 | 2010-07-13 20:11:07 | http | PC=PC-8192 url=http://rr.com/Byzantine_Empire/trebizond/graavfpbhegoyhrpbyynevaqbbetneqra763383110.aspx content=26 gone injured titled shots blood defenses occurring see reviewing alphonse unaware slot anticipated greatly stated east explode population 20 be less made fel
E112 | 2010-07-13 20:18:00 | logon | PC=PC-8192 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E009: обращение к web-ресурсу, связанному с incident observable
- E079: обращение к web-ресурсу, связанному с incident observable
- E088: обращение к web-ресурсу, связанному с incident observable
- E107: обращение к web-ресурсу, связанному с incident observable

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.