Windows Analysis Report
WinSCP-6.3.5-Setup.exe

Overview

General Information

Sample name: WinSCP-6.3.5-Setup.exe
Analysis ID: 1546344
MD5: d77322dc956da781905d553e3feb9153
SHA1: 89db51587ecfb071fe71add71050e2d9e5377539
SHA256: 49e17ce8b1df637a71dfac483e9fef72f6747e4235cce3871a1bb3f3a1371127
Infos:

Detection

Score: 24
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Signatures

Creates an undocumented autostart registry key
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
Drops PE files
Found dropped PE file which has not been started or loaded
HTML page contains hidden javascript code
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries keyboard layouts
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Registers a DLL
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: Classes Autorun Keys Modification
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses insecure TLS / SSL version for HTTPS connection

Classification

HTML page contains hidden javascript code
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: Base64 decoded: [null,null,null,3]
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP Parser: No favicon
Uses 32bit PE files
Source: WinSCP-6.3.5-Setup.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:60630 version: TLS 1.0
Source: WinSCP-6.3.5-Setup.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 88.198.21.111:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:60186 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:60239 version: TLS 1.2
Source: unknown HTTPS traffic detected: 88.198.21.111:443 -> 192.168.2.6:60284 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:60372 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:60410 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:60493 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:60599 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:60648 version: TLS 1.2
Source: WinSCP-6.3.5-Setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\misto\wscpblda\build\dotnet\obj\Release\net40\WinSCPnet.pdbSHA256 source: is-MITNN.tmp.2.dr
Source: Binary string: c:\misto\wscpblda\build\dotnet\obj\Release\net40\WinSCPnet.pdb source: is-MITNN.tmp.2.dr
Checks for available system drives (often done to infect USB drives)
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: z: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: x: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: v: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: t: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: r: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: p: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: n: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: l: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: j: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: h: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: f: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: b: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: y: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: w: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: u: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: s: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: q: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: o: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: m: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: k: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: i: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: g: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: e: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: c: Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe File opened: a: Jump to behavior
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.6:60162 -> 1.1.1.1:53
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.244.42.200 104.244.42.200
Source: Joe Sandbox View IP Address: 88.198.21.111 88.198.21.111
Source: Joe Sandbox View IP Address: 104.244.42.136 104.244.42.136
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49763 -> 88.198.21.111:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:60284 -> 88.198.21.111:443
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49756
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:60493
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:60630 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: global traffic HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AhOBy5EpbwybKXU&MD=OECBEy2h HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /install.php?mode=sponsorrequest&ver=6.3.5&lang=en&prevver=&scale=100&images= HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: winscp.net
Source: global traffic HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /install.php?mode=report&installed=1&silent=0&ver=6.3.5&lang=en&prevver=&sponsorstatus=F&sponsor=&sponsoringclicked=0& HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: winscp.net
Source: global traffic HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP/1.1Host: winscp.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP/1.1Host: winscp.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /assets/css/bootstrap-modified.css?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/slick/slick.css?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/css/styles-all.css?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/paypal.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/card-logo-visa.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /assets/images/message-ok.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/arrow-horiz-soft.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/paypal.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/card-logo-visa.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /assets/images/card-logo-mastercard.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/card-logo-amex.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/card-logo-unknown.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/logos/logo.png?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/sdk.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /widgets.js HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /assets/fonts/roboto-regular.woff2?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://winscp.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/fonts/roboto-light.woff2?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://winscp.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/fonts/robotomono-bold.woff2?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://winscp.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/fonts/robotomono-regular.woff2?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://winscp.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/jquery.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/bootstrap.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/arrow-horiz-soft.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/message-ok.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /en_US/sdk.js?hash=83bef744925782dcc0c213c2e72a4c1a HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://winscp.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwinscp.net HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /assets/js/slick/slick.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/footer.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/svg-src-polyfill.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/slick-init.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/matchMedia.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/mediaQueryListener.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/card-logo-unknown.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/logos/logo.png?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/card-logo-amex.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/card-logo-mastercard.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/sdk.js HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/bootstrap.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/jquery.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /widgets.js HTTP/1.1Host: platform.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /en_US/sdk.js?hash=83bef744925782dcc0c213c2e72a4c1a HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /assets/js/jquery.toggleSections.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /assets/images/logos/facebook.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /x/oauth/status?client_id=215157521840905&input_token&origin=1&redirect_uri=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&sdk=joey&wants_cookie_data=false HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://winscp.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /assets/images/logos/twitter.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/svg-src-polyfill.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/footer.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/matchMedia.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/mediaQueryListener.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/slick-init.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/slick/slick.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/logos/linkedin.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /pagead/html/r20241030/r20190131/zrt_lookup_fy2021.html HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=1870177922&adk=3109115863&adf=385219199&pi=t.ma~as.1870177922&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400372992&bpp=8&bdt=3637&idt=2601&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&correlator=6162542844500&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=30&ady=415&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=2636 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=6822944091&adk=2358527528&adf=101933203&pi=t.ma~as.6822944091&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373001&bpp=4&bdt=3647&idt=2647&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280&correlator=6162542844500&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=30&ady=1480&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=2652 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/ads?client=ca-pub-1682759925159355&output=html&h=200&slotname=4424189075&adk=724910714&adf=1108650154&pi=t.ma~as.4424189075&w=233&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=3&format=233x200&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=1&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373005&bpp=2&bdt=3651&idt=2659&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280%2C649x280&correlator=6162542844500&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=739&ady=853&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&fsb=1&dtd=2666 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/ads?client=ca-pub-1682759925159355&output=html&adk=1812271804&adf=3025194257&abgtt=9&lmt=1730400375&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&pra=7&wgl=1&aihb=0&asro=0&ailel=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aslmct=0.7&asamct=0.7&aiict=1&aiapm=0.3221&aiapmi=0.33938&aiombap=1&aiopts=1&aief=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373007&bpp=6&bdt=3652&idt=2675&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280%2C649x280%2C233x200&nras=1&correlator=6162542844500&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fsapi=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=4&uci=a!4&fsb=1&dtd=2681 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /settings?session_id=dd9b3d302a9b92ee788c222ff5c4209225028450 HTTP/1.1Host: syndication.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://platform.twitter.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://platform.twitter.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /assets/images/login.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/language.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/chevron-down.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/logos/facebook.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /x/oauth/status?client_id=215157521840905&input_token&origin=1&redirect_uri=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&sdk=joey&wants_cookie_data=false HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/logos/twitter.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /v2.10/plugins/page.php?adapt_container_width=true&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3042ea6f0e0127ef%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=664&height=400&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /v2.10/plugins/like.php?action=like&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd6823e2c4a4e036e%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&layout=button_count&locale=en_US&sdk=joey&share=true&show_faces=false&size=small HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /td/rul/1002628342?random=1730400376633&cv=11&fst=1730400376633&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4au0v9178989015za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&hn=www.googleadservices.com&frm=0&tiba=After%20Installation%20%3A%3A%20WinSCP&npa=0&pscdl=noapi&auid=1522412495.1730400377&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /td/ga/rul?tid=G-97R014CLMR&gacid=1597569809.1730400377&gtm=45je4au0v9178989015za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101823848~101878899~101878944~101925629&z=499980162 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/js/jquery.toggleSections.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /settings?session_id=dd9b3d302a9b92ee788c222ff5c4209225028450 HTTP/1.1Host: syndication.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /assets/images/logos/linkedin.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/login.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/language.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/images/chevron-down.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rsrc.php/v4/yL/l/0,cross/hx1QQk3LL6t.css HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y8/r/m5WIH4zGOsj.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y3/r/Vvet8_5H-wT.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3i7M54/y0/l/en_US/zYyn94Uppv5.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3issO4/yU/l/en_US/tC2E_WEPqHv.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yz/r/c64elx0V1Fa.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /pagead/adview?ai=CRgsAedAjZ7PyId2W78EPhPzI-A3Iha_UevSC4ebIE7_hHhABIJ7FjCRgyQagAbi97skoyAEJqQLUGZicGIpJPqgDAcgDywSqBIUCT9C6qZTGwntpOmlN8KMcESvEmXDCbLBJcQU8zM0SKGI6c9q6vi5j1GjqI81sswzYeRdPP3CqENOkB99L9u2XQ98t3H2nNuauEvoRS_EZ37khZuio54OCph_BGASL6xUjGd954VFKggisKf7njR0xo6vMECJAqmLEoR8RDZIOT44VHqCW26qykBha1TdqdK7WCuBDQ_aX-W8y0fZHBDua4IBDqSAL24aAEs_q9ixKfgoXuH3e_dEM8eMno2HNlaPYBtJs0NgrVrpdd0qZcNhCoYPqMakOE3GcBgL77jCvP9yf4MohHbrsNnNQ4tWFBVnTnLNiGQ9_Yap-nWGtk_FufglWbvvPwATk-e_6hgWIBY-LnI5RoAYugAe49b6pA6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQmb0k0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY4YPJ3qO5iQOaCcYDaHR0cHM6Ly93d3cuZmxpcGthcnRjb21tZXJjZWNsb3VkLmNvbS8_dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPWRpc3BsYXlfYXVkaWVuY2Vfc2VnbWVudF9pbmJ1aWx0X3RhcmdldGluZ19VUyZ1dG1fdGVybT1kaXNwbGF5X2F1ZGllbmNlX3NlZ21lbnRfaW5idWlsdF90YXJnZXRpbmdfVVMmdXRtX3Rlcm09JnV0bV9jYW1wYWlnbj0lNUJEaXNwbGF5JTVEK1VTKy0rQXVkaWVuY2UrU2VnbWVudHMrKy0rSW5idWlsdCtUYXJnZXRpbmcmdXRtX3NvdXJjZT1hZHdvcmRzJnV0bV9tZWRpdW09cHBjJmhzYV9hY2M9ODc2MjQ2NTk0OCZoc2FfY2FtPTIxNzczMDkyMjM5JmhzYV9ncnA9MTczNjY2OTkxMzMyJmhzYV9hZD03MTU4NzIxNDAxMjImaHNhX3NyYz1kJmhzYV90Z3Q9JmhzYV9rdz0maHNhX210PSZoc2FfbmV0PWFkd29yZHMmaHNhX3Zlcj0zJmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKELCXkZ79n9n8HhICAQO4E-QD2BMDiBQE0BUBmBYBgBcBshceChoIABIUcHViLTE2ODI3NTk5MjUxNTkzNTUYABgBuhcCOAGyGAkSArFfGC4iAQDQGAE&sigh=B_zKQ7fC5Js&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7dtTKmuHcIzYKGSqJdKUCZ9aXLRDivlsuq6E-te2CRc3jGOdg7nKpuT_RzSGqelLtZwt2bW49uVmFO5pbzTho4alaQKMEclVM4yhgB&template_id=484&vis=1&ebtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: trigger;navigation-source, event-sourceReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=1870177922&adk=3109115863&adf=385219199&pi=t.ma~as.1870177922&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400372992&bpp=8&bdt=3637&idt=2601&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&correlator=6162542844500&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1
Source: global traffic HTTP traffic detected: GET /js/button.856debeac157d9669cf51e73a08fbc93.js HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /pagead/adview?ai=CdQwcedAjZ5H_IeCa78EP863DmQOx9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDSKoE_AFP0EtLn0pGydfWXKH5GLbyFNQbHkavtBzS9CBxW9RG_iPZGxqcK25ycPNC11bKozj0j5FBWNyONmQSmzaF302m8KTK30OzHihaWKPCbRSZxFCaHxMGtnP6FTlUYassmNMTHpM2UCphb4Z3Z9tPBUglRu6TMImCLUJJh3myq-fiKSRg2qqbOah6KsLwehMkIoFDzuXZqwxYb3uxZywLXhEAWuC0xNyVOADHVFrLeoH-4_OaHyWyjWGCLkdMbP10Pc5-I_QrnQ_rvQRVS1ak3lfwlA0HGKEyDWp57lpr_57aubjFyrojuEhszjYAFBbJ1iehMeupDVoUO_he8hjABNCM5bOHBYgFpMjT2FCgBi6AB7TSpyuoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEMD9BNIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WMqYyd6juYkDmgn1A2h0dHBzOi8vd3d3Lm5ld2VnZy5jb20vcC9wbD9kPVBQU1NKVEhMV0xCUlpDJlN1Ym1pdD1FTkUmREVQQT0wJk9yZGVyPUJFU1RNQVRDSCZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPXBhaWQrZGlzcGxheSZ1dG1fY2FtcGFpZ249S05DLUdvb2dsZUtXTGVzcy1fLWNvb3AtXy1XRC1fLUhEREdPTEQtXy0wOTA0MjQmaWQwPUdvb2dsZSZpZDE9MjE2NjA3NTQ5ODAmaWQyPTE3Mzc4NjM1MTE4NCZpZDM9JmlkND0maWQ1PSZpZDY9JmlkNz0yODQwJmlkOD0maWQ5PWQmaWQxMD1jJmlkMTE9JmlkMTI9e2djbGlkfSZpZDEzPSZpZDE0PSZpZDE1PVkmaWQxNj03MTIxOTczMzMzNTcmaWQxNz0maWQxOD13aW5zY3AubmV0JmlkMTk9cnVub2ZuZXR3b3JrJTNBJTNBMTAwJmlkMjA9JmlkMjE9JmlkMjI9JmlkMjM9JmlkMjQ9JmlkMjU9JmlkMjY9JmlkMjc9WSZpZDI4PSZpZDI5PSZpZDMwPTE5NzAyMzQwMTYxNjcyNzUzODE5JmlkMzE9JmlkMzI9JmlkMzM9JmlkMzQ9JmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKEKD49eOLmfKbfBICAQPYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=dM2PrCvZY78&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7drzW6gIA7HHmQY4Iyw7YfvzO6tXDvfkiTY9MwVZ2AB-WAItnU4XF2t1oW2NyE-ByFDavOoQ2HukJHkncCjyc6vSckEe1aoqjCCxgB&template_id=5042&vis=1&ebtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: event-source, trigger;navigation-sourceReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=200&slotname=4424189075&adk=724910714&adf=1108650154&pi=t.ma~as.4424189075&w=233&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=3&format=233x200&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=1&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373005&bpp=2&bdt=3651&idt=2659&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280%2C649x280&corr
Source: global traffic HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /pagead/1p-user-list/1002628342/?random=1730400376633&cv=11&fst=1730397600000&bg=ffffff&guid=ON&async=1&gtm=45je4au0v9178989015za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&hn=www.googleadservices.com&frm=0&tiba=After%20Installation%20%3A%3A%20WinSCP&npa=0&pscdl=noapi&auid=1522412495.1730400377&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7d0Gj3LPLJUUEyxSv0ZhifbpmjDRF7TQ&random=2553054213&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /i/ca-pub-1682759925159355?href=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation&ers=2 HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yD/r/FEppCFCt76d.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yF/r/p55HfXW__mM.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3iLl54/yo/l/en_US/KroQaZupEyF.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yA/r/0q927cN1GZe.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3iEpO4/y_/l/en_US/mEgqcU3S6-1.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.facebook.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1730400379385%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=dd9b3d302a9b92ee788c222ff5c4209225028450 HTTP/1.1Host: syndication.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/viewthroughconversion/1002628342/?random=1730400376633&cv=11&fst=1730400376633&bg=ffffff&guid=ON&async=1&gtm=45je4au0v9178989015za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&hn=www.googleadservices.com&frm=0&tiba=After%20Installation%20%3A%3A%20WinSCP&npa=0&pscdl=noapi&auid=1522412495.1730400377&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y3/r/Vvet8_5H-wT.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yz/r/c64elx0V1Fa.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3issO4/yU/l/en_US/tC2E_WEPqHv.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /v/t39.30808-6/354608791_694424149157111_1515153202108507038_n.png?stp=dst-png_s350x350&_nc_cat=110&ccb=1-7&_nc_sid=4cb600&_nc_ohc=-ogClF-bw9IQ7kNvgEkPep7&_nc_zt=23&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYBM1_XO-Gu7D2B4cl2zhQqQEAF28ThdFvPsIF23tTRHKA&oe=67299B7D HTTP/1.1Host: scontent-phx1-1.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3i7M54/y0/l/en_US/zYyn94Uppv5.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/button.856debeac157d9669cf51e73a08fbc93.js HTTP/1.1Host: platform.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y8/r/m5WIH4zGOsj.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /v/t39.30808-1/351156904_264152706143983_3109134666055357303_n.jpg?stp=cp0_dst-jpg_s50x50&_nc_cat=100&ccb=1-7&_nc_sid=6738e8&_nc_ohc=VaXOflnuDHcQ7kNvgGYZY5H&_nc_zt=24&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYAVosyj27yGB-nAl8xsHDz4QfMDJaExqAWoiWH0J70L6Q&oe=672987CE HTTP/1.1Host: scontent-phx1-1.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AhOBy5EpbwybKXU&MD=OECBEy2h HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yy/r/Chl8448Q49S.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yw/r/UXtr_j2Fwe-.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://static.xx.fbcdn.net/rsrc.php/v4/yL/l/0,cross/hx1QQk3LL6t.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yo/r/UkQNrcmXeur.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /f/AGSKWxV5O44YGhvfZhQy4ogLM_PJwYD2J-q58fjFOXUPEo0ud_bBWLGZeF8hIL6QMrtPWOHW4dljyykVlzdfOmevJlZLPj1bcbY3RqZWewWXBRmHQNYsDaeAST1Glqt-532zME_n6k71Yw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMwNDAwMzgwLDcwNjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly93aW5zY3AubmV0L2VuZy9kb2NzL2FmdGVyX2luc3RhbGxhdGlvbiIsbnVsbCxbWzgsIllzZ09PY3R1a3JJIl0sWzksImVuLVVTIl0sWzE4LCJbW1swXV1dIl0sWzE5LCIyIl1dXQ HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/drt/s?v=r20120211 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://googleads.g.doubleclick.net/pagead/html/r20241030/r20190131/zrt_lookup_fy2021.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic HTTP traffic detected: GET /pagead/adview?ai=CDhqPedAjZ9XhIuOU78EP5YC10A6x9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDywSqBP0BT9DAQTMhS-ILCbEJJDaWMbiyUvke5GnZ1g8CvOCini_79bZducRK34cVbb4bnyTwixuYZ1DkjJJjuDY889SHTuGDQva4eEZB_oNxpmnneSjE3_DVl5CYeAU8uEeqaSVzHXNVSr-J1rK4-DFyIMJAdDUwj7cgw7_vCRMNmmQ0t_y1a32sJVzdBe8dfoe6D0_iL_A2N2kAWUuTo6k9Ka1PlYMpNCEVdCQn1B9y719lKYjTkqAC4NpptWUbmnuDbc-2SCkZfkDIGH4BcI9X9pSyGbsD37z2JfWntEMauY439J0AmRDAcL_D4-GvH2kDO_Ub7vF0FZbPBxqINFejzcAE0Izls4cFiAWkyNPYUKAGLoAHtNKnK6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQyI4b0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY2-jJ3qO5iQOaCYAEaHR0cHM6Ly93d3cubmV3ZWdnLmNvbS9wL3BsP2Q9UFBTU0pUSExXTEJSWkMmU3VibWl0PUVORSZERVBBPTAmT3JkZXI9QkVTVE1BVENIJnV0bV9zb3VyY2U9Z29vZ2xlJnV0bV9tZWRpdW09cGFpZCtkaXNwbGF5JnV0bV9jYW1wYWlnbj1LTkMtR29vZ2xlS1dMZXNzLV8tY29vcC1fLVdELV8tSERER09MRC1fLTA5MDQyNCZpZDA9R29vZ2xlJmlkMT0yMTY2MDc1NDk4MCZpZDI9MTczNzg2MzUxMTg0JmlkMz0maWQ0PSZpZDU9JmlkNj0maWQ3PTI4NDAmaWQ4PSZpZDk9ZCZpZDEwPWMmaWQxMT0maWQxMj17Z2NsaWR9JmlkMTM9JmlkMTQ9JmlkMTU9WSZpZDE2PTcxMjE5NzMzMzM1NyZpZDE3PSZpZDE4PXdpbnNjcC5uZXQmaWQxOT1zZWdtZW50X2JlX2FfMzIzMzkwOTI0MzA0MDEzODUxNCZpZDIwPSZpZDIxPSZpZDIyPSZpZDIzPSZpZDI0PSZpZDI1PSZpZDI2PSZpZDI3PVkmaWQyOD0maWQyOT0maWQzMD0xMDY1MzEyMTQ0MTEzMDAzOTE2OSZpZDMxPSZpZDMyPSZpZDMzPSZpZDM0PSZnYWRfc291cmNlPTWACgHICwHaDBEKCxDQtdnj677UgrUBEgIBA7gT5APYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=0aOzgEyc5FM&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwCa7L7dZM_x682mhf2KIIDx5yOCNjEcVDTj_NnjhLB_d36XrSCZcl8KEBgHXPYWQGe_b0nes6fdyOcCKV_xLeh2Kt4adEcMktFkeO9JsmwYAQ&template_id=484&vis=1&ebtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: event-source, trigger;navigation-sourceReferer: https://googleads.g.doubleclick.net/pagead/html/r20241030/r20190131/zrt_lookup_fy2021.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /btr/view?ai=CRgsAedAjZ7PyId2W78EPhPzI-A3Iha_UevSC4ebIE7_hHhABIJ7FjCRgyQagAbi97skoyAEJqQLUGZicGIpJPqgDAcgDywSqBIUCT9C6qZTGwntpOmlN8KMcESvEmXDCbLBJcQU8zM0SKGI6c9q6vi5j1GjqI81sswzYeRdPP3CqENOkB99L9u2XQ98t3H2nNuauEvoRS_EZ37khZuio54OCph_BGASL6xUjGd954VFKggisKf7njR0xo6vMECJAqmLEoR8RDZIOT44VHqCW26qykBha1TdqdK7WCuBDQ_aX-W8y0fZHBDua4IBDqSAL24aAEs_q9ixKfgoXuH3e_dEM8eMno2HNlaPYBtJs0NgrVrpdd0qZcNhCoYPqMakOE3GcBgL77jCvP9yf4MohHbrsNnNQ4tWFBVnTnLNiGQ9_Yap-nWGtk_FufglWbvvPwATk-e_6hgWIBY-LnI5RoAYugAe49b6pA6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQmb0k0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY4YPJ3qO5iQOaCcYDaHR0cHM6Ly93d3cuZmxpcGthcnRjb21tZXJjZWNsb3VkLmNvbS8_dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPWRpc3BsYXlfYXVkaWVuY2Vfc2VnbWVudF9pbmJ1aWx0X3RhcmdldGluZ19VUyZ1dG1fdGVybT1kaXNwbGF5X2F1ZGllbmNlX3NlZ21lbnRfaW5idWlsdF90YXJnZXRpbmdfVVMmdXRtX3Rlcm09JnV0bV9jYW1wYWlnbj0lNUJEaXNwbGF5JTVEK1VTKy0rQXVkaWVuY2UrU2VnbWVudHMrKy0rSW5idWlsdCtUYXJnZXRpbmcmdXRtX3NvdXJjZT1hZHdvcmRzJnV0bV9tZWRpdW09cHBjJmhzYV9hY2M9ODc2MjQ2NTk0OCZoc2FfY2FtPTIxNzczMDkyMjM5JmhzYV9ncnA9MTczNjY2OTkxMzMyJmhzYV9hZD03MTU4NzIxNDAxMjImaHNhX3NyYz1kJmhzYV90Z3Q9JmhzYV9rdz0maHNhX210PSZoc2FfbmV0PWFkd29yZHMmaHNhX3Zlcj0zJmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKELCXkZ79n9n8HhICAQO4E-QD2BMDiBQE0BUBmBYBgBcBshceChoIABIUcHViLTE2ODI3NTk5MjUxNTkzNTUYABgBuhcCOAGyGAkSArFfGC4iAQDQGAE&sigh=B_zKQ7fC5Js&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7dtTKmuHcIzYKGSqJdKUCZ9aXLRDivlsuq6E-te2CRc3jGOdg7nKpuT_RzSGqelLtZwt2bW49uVmFO5pbzTho4alaQKMEclVM4yhgB&template_id=484&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: trigger;navigation-source, event-sourceReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=1870177922&adk=3109115863&adf=385219199&pi=t.ma~as.1870177922&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400372992&bpp=8&bdt=3637&idt=2601&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&correlator=6162542844500&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yD/r/FEppCFCt76d.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yH/r/xgVgalBG80z.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://static.xx.fbcdn.net/rsrc.php/v4/yL/l/0,cross/hx1QQk3LL6t.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22215157521840905%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F%22%2C%22width%22%3A340%2C%22height%22%3A400%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Atrue%2C%22referer_uri%22%3A%22https%3A%2F%2Fwinscp.net%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__req=1&__hs=20027.BP%3Aplugin_default_pkg.2.0..0.0&dpr=1&__ccg=GOOD&__rev=1017838824&__s=%3A%3Aplzgdo&__hsi=7432013032883179535&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx60Vo1upE4W0OE1vE662y0um4o5-0me0sy0ny0oi0zE5W0PU1AE17U2ZwrU1Xo1UU3jwea&__csr=&locale=en_US&__sp=1 HTTP/1.1Host: www.facebook.comConnection: keep-aliveX-FB-LSD: JmzYf9flXws1Rh6-Wn6T0usec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-ASBD-ID: 129477sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.facebook.com/v2.10/plugins/page.php?adapt_container_width=true&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3042ea6f0e0127ef%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=664&height=400&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timelineAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yF/r/p55HfXW__mM.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/1p-user-list/1002628342/?random=1730400376633&cv=11&fst=1730397600000&bg=ffffff&guid=ON&async=1&gtm=45je4au0v9178989015za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&hn=www.googleadservices.com&frm=0&tiba=After%20Installation%20%3A%3A%20WinSCP&npa=0&pscdl=noapi&auid=1522412495.1730400377&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7d0Gj3LPLJUUEyxSv0ZhifbpmjDRF7TQ&random=2553054213&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /btr/view?ai=CdQwcedAjZ5H_IeCa78EP863DmQOx9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDSKoE_AFP0EtLn0pGydfWXKH5GLbyFNQbHkavtBzS9CBxW9RG_iPZGxqcK25ycPNC11bKozj0j5FBWNyONmQSmzaF302m8KTK30OzHihaWKPCbRSZxFCaHxMGtnP6FTlUYassmNMTHpM2UCphb4Z3Z9tPBUglRu6TMImCLUJJh3myq-fiKSRg2qqbOah6KsLwehMkIoFDzuXZqwxYb3uxZywLXhEAWuC0xNyVOADHVFrLeoH-4_OaHyWyjWGCLkdMbP10Pc5-I_QrnQ_rvQRVS1ak3lfwlA0HGKEyDWp57lpr_57aubjFyrojuEhszjYAFBbJ1iehMeupDVoUO_he8hjABNCM5bOHBYgFpMjT2FCgBi6AB7TSpyuoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEMD9BNIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WMqYyd6juYkDmgn1A2h0dHBzOi8vd3d3Lm5ld2VnZy5jb20vcC9wbD9kPVBQU1NKVEhMV0xCUlpDJlN1Ym1pdD1FTkUmREVQQT0wJk9yZGVyPUJFU1RNQVRDSCZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPXBhaWQrZGlzcGxheSZ1dG1fY2FtcGFpZ249S05DLUdvb2dsZUtXTGVzcy1fLWNvb3AtXy1XRC1fLUhEREdPTEQtXy0wOTA0MjQmaWQwPUdvb2dsZSZpZDE9MjE2NjA3NTQ5ODAmaWQyPTE3Mzc4NjM1MTE4NCZpZDM9JmlkND0maWQ1PSZpZDY9JmlkNz0yODQwJmlkOD0maWQ5PWQmaWQxMD1jJmlkMTE9JmlkMTI9e2djbGlkfSZpZDEzPSZpZDE0PSZpZDE1PVkmaWQxNj03MTIxOTczMzMzNTcmaWQxNz0maWQxOD13aW5zY3AubmV0JmlkMTk9cnVub2ZuZXR3b3JrJTNBJTNBMTAwJmlkMjA9JmlkMjE9JmlkMjI9JmlkMjM9JmlkMjQ9JmlkMjU9JmlkMjY9JmlkMjc9WSZpZDI4PSZpZDI5PSZpZDMwPTE5NzAyMzQwMTYxNjcyNzUzODE5JmlkMzE9JmlkMzI9JmlkMzM9JmlkMzQ9JmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKEKD49eOLmfKbfBICAQPYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=dM2PrCvZY78&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7drzW6gIA7HHmQY4Iyw7YfvzO6tXDvfkiTY9MwVZ2AB-WAItnU4XF2t1oW2NyE-ByFDavOoQ2HukJHkncCjyc6vSckEe1aoqjCCxgB&template_id=5042&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: event-source, trigger, not-navigation-sourceReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=200&slotname=4424189075&adk=724910714&adf=1108650154&pi=t.ma~as.4424189075&w=233&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=3&format=233x200&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=1&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373005&bpp=2&bdt=3651&idt=2659&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280%2C649x280&corr
Source: global traffic HTTP traffic detected: GET /btr/view?ai=CDhqPedAjZ9XhIuOU78EP5YC10A6x9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDywSqBP0BT9DAQTMhS-ILCbEJJDaWMbiyUvke5GnZ1g8CvOCini_79bZducRK34cVbb4bnyTwixuYZ1DkjJJjuDY889SHTuGDQva4eEZB_oNxpmnneSjE3_DVl5CYeAU8uEeqaSVzHXNVSr-J1rK4-DFyIMJAdDUwj7cgw7_vCRMNmmQ0t_y1a32sJVzdBe8dfoe6D0_iL_A2N2kAWUuTo6k9Ka1PlYMpNCEVdCQn1B9y719lKYjTkqAC4NpptWUbmnuDbc-2SCkZfkDIGH4BcI9X9pSyGbsD37z2JfWntEMauY439J0AmRDAcL_D4-GvH2kDO_Ub7vF0FZbPBxqINFejzcAE0Izls4cFiAWkyNPYUKAGLoAHtNKnK6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQyI4b0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY2-jJ3qO5iQOaCYAEaHR0cHM6Ly93d3cubmV3ZWdnLmNvbS9wL3BsP2Q9UFBTU0pUSExXTEJSWkMmU3VibWl0PUVORSZERVBBPTAmT3JkZXI9QkVTVE1BVENIJnV0bV9zb3VyY2U9Z29vZ2xlJnV0bV9tZWRpdW09cGFpZCtkaXNwbGF5JnV0bV9jYW1wYWlnbj1LTkMtR29vZ2xlS1dMZXNzLV8tY29vcC1fLVdELV8tSERER09MRC1fLTA5MDQyNCZpZDA9R29vZ2xlJmlkMT0yMTY2MDc1NDk4MCZpZDI9MTczNzg2MzUxMTg0JmlkMz0maWQ0PSZpZDU9JmlkNj0maWQ3PTI4NDAmaWQ4PSZpZDk9ZCZpZDEwPWMmaWQxMT0maWQxMj17Z2NsaWR9JmlkMTM9JmlkMTQ9JmlkMTU9WSZpZDE2PTcxMjE5NzMzMzM1NyZpZDE3PSZpZDE4PXdpbnNjcC5uZXQmaWQxOT1zZWdtZW50X2JlX2FfMzIzMzkwOTI0MzA0MDEzODUxNCZpZDIwPSZpZDIxPSZpZDIyPSZpZDIzPSZpZDI0PSZpZDI1PSZpZDI2PSZpZDI3PVkmaWQyOD0maWQyOT0maWQzMD0xMDY1MzEyMTQ0MTEzMDAzOTE2OSZpZDMxPSZpZDMyPSZpZDMzPSZpZDM0PSZnYWRfc291cmNlPTWACgHICwHaDBEKCxDQtdnj677UgrUBEgIBA7gT5APYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=0aOzgEyc5FM&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwCa7L7dZM_x682mhf2KIIDx5yOCNjEcVDTj_NnjhLB_d36XrSCZcl8KEBgHXPYWQGe_b0nes6fdyOcCKV_xLeh2Kt4adEcMktFkeO9JsmwYAQ&template_id=484&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: trigger, event-sourceReferer: https://googleads.g.doubleclick.net/pagead/html/r20241030/r20190131/zrt_lookup_fy2021.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic HTTP traffic detected: GET /i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1730400379385%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=dd9b3d302a9b92ee788c222ff5c4209225028450 HTTP/1.1Host: syndication.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/drt/ui HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /v/t39.30808-1/351156904_264152706143983_3109134666055357303_n.jpg?stp=cp0_dst-jpg_s50x50&_nc_cat=100&ccb=1-7&_nc_sid=6738e8&_nc_ohc=VaXOflnuDHcQ7kNvgGYZY5H&_nc_zt=24&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYAVosyj27yGB-nAl8xsHDz4QfMDJaExqAWoiWH0J70L6Q&oe=672987CE HTTP/1.1Host: scontent-phx1-1.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /v/t39.30808-6/354608791_694424149157111_1515153202108507038_n.png?stp=dst-png_s350x350&_nc_cat=110&ccb=1-7&_nc_sid=4cb600&_nc_ohc=-ogClF-bw9IQ7kNvgEkPep7&_nc_zt=23&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYBM1_XO-Gu7D2B4cl2zhQqQEAF28ThdFvPsIF23tTRHKA&oe=67299B7D HTTP/1.1Host: scontent-phx1-1.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yA/r/0q927cN1GZe.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3iLl54/yo/l/en_US/KroQaZupEyF.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3iEpO4/y_/l/en_US/mEgqcU3S6-1.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yw/r/UXtr_j2Fwe-.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /f/AGSKWxXVqfKNZ1AyLwlJa28rypTcnPYQ147ARsW7OU8lpC1j5mMg7ihNSAWwZWfwx32gde6T_ynlDIJeIw88Y8BeD7FG_r7Pbc1RKS50zhIed6Xraq0Ke7LPQmj2IOpqqwkHaXbDYfPd5vuDmdksdZn_qnqVE-1bievWARExb9asQQxzPJaGTJCs1L0jGCIw/_-980x60-/bannerconduit./adsame1./affiliate_show_iframe._bg_ad_left. HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rsrc.php/v4/yX/l/0,cross/Yd70QRXJCf6.css HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yo/r/UkQNrcmXeur.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yy/r/Chl8448Q49S.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rsrc.php/v4/yk/l/0,cross/GY0bX-iB97s.css HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yH/r/ieeHDjcGsIR.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yg/r/gjl3ldnE08O.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yG/r/IJz2TIVxd6Q.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pagead/drt/si?st=NO_DATA HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yL/r/a2pSKe6-4N_.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /btr/view?ai=CRgsAedAjZ7PyId2W78EPhPzI-A3Iha_UevSC4ebIE7_hHhABIJ7FjCRgyQagAbi97skoyAEJqQLUGZicGIpJPqgDAcgDywSqBIUCT9C6qZTGwntpOmlN8KMcESvEmXDCbLBJcQU8zM0SKGI6c9q6vi5j1GjqI81sswzYeRdPP3CqENOkB99L9u2XQ98t3H2nNuauEvoRS_EZ37khZuio54OCph_BGASL6xUjGd954VFKggisKf7njR0xo6vMECJAqmLEoR8RDZIOT44VHqCW26qykBha1TdqdK7WCuBDQ_aX-W8y0fZHBDua4IBDqSAL24aAEs_q9ixKfgoXuH3e_dEM8eMno2HNlaPYBtJs0NgrVrpdd0qZcNhCoYPqMakOE3GcBgL77jCvP9yf4MohHbrsNnNQ4tWFBVnTnLNiGQ9_Yap-nWGtk_FufglWbvvPwATk-e_6hgWIBY-LnI5RoAYugAe49b6pA6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQmb0k0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY4YPJ3qO5iQOaCcYDaHR0cHM6Ly93d3cuZmxpcGthcnRjb21tZXJjZWNsb3VkLmNvbS8_dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPWRpc3BsYXlfYXVkaWVuY2Vfc2VnbWVudF9pbmJ1aWx0X3RhcmdldGluZ19VUyZ1dG1fdGVybT1kaXNwbGF5X2F1ZGllbmNlX3NlZ21lbnRfaW5idWlsdF90YXJnZXRpbmdfVVMmdXRtX3Rlcm09JnV0bV9jYW1wYWlnbj0lNUJEaXNwbGF5JTVEK1VTKy0rQXVkaWVuY2UrU2VnbWVudHMrKy0rSW5idWlsdCtUYXJnZXRpbmcmdXRtX3NvdXJjZT1hZHdvcmRzJnV0bV9tZWRpdW09cHBjJmhzYV9hY2M9ODc2MjQ2NTk0OCZoc2FfY2FtPTIxNzczMDkyMjM5JmhzYV9ncnA9MTczNjY2OTkxMzMyJmhzYV9hZD03MTU4NzIxNDAxMjImaHNhX3NyYz1kJmhzYV90Z3Q9JmhzYV9rdz0maHNhX210PSZoc2FfbmV0PWFkd29yZHMmaHNhX3Zlcj0zJmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKELCXkZ79n9n8HhICAQO4E-QD2BMDiBQE0BUBmBYBgBcBshceChoIABIUcHViLTE2ODI3NTk5MjUxNTkzNTUYABgBuhcCOAGyGAkSArFfGC4iAQDQGAE&sigh=B_zKQ7fC5Js&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7dtTKmuHcIzYKGSqJdKUCZ9aXLRDivlsuq6E-te2CRc3jGOdg7nKpuT_RzSGqelLtZwt2bW49uVmFO5pbzTho4alaQKMEclVM4yhgB&template_id=484&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /platform/plugin/page/logging/ HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3iEBX4/yr/l/en_US/jbkX5llFMP5.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yH/r/xgVgalBG80z.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /btr/view?ai=CdQwcedAjZ5H_IeCa78EP863DmQOx9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDSKoE_AFP0EtLn0pGydfWXKH5GLbyFNQbHkavtBzS9CBxW9RG_iPZGxqcK25ycPNC11bKozj0j5FBWNyONmQSmzaF302m8KTK30OzHihaWKPCbRSZxFCaHxMGtnP6FTlUYassmNMTHpM2UCphb4Z3Z9tPBUglRu6TMImCLUJJh3myq-fiKSRg2qqbOah6KsLwehMkIoFDzuXZqwxYb3uxZywLXhEAWuC0xNyVOADHVFrLeoH-4_OaHyWyjWGCLkdMbP10Pc5-I_QrnQ_rvQRVS1ak3lfwlA0HGKEyDWp57lpr_57aubjFyrojuEhszjYAFBbJ1iehMeupDVoUO_he8hjABNCM5bOHBYgFpMjT2FCgBi6AB7TSpyuoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEMD9BNIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WMqYyd6juYkDmgn1A2h0dHBzOi8vd3d3Lm5ld2VnZy5jb20vcC9wbD9kPVBQU1NKVEhMV0xCUlpDJlN1Ym1pdD1FTkUmREVQQT0wJk9yZGVyPUJFU1RNQVRDSCZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPXBhaWQrZGlzcGxheSZ1dG1fY2FtcGFpZ249S05DLUdvb2dsZUtXTGVzcy1fLWNvb3AtXy1XRC1fLUhEREdPTEQtXy0wOTA0MjQmaWQwPUdvb2dsZSZpZDE9MjE2NjA3NTQ5ODAmaWQyPTE3Mzc4NjM1MTE4NCZpZDM9JmlkND0maWQ1PSZpZDY9JmlkNz0yODQwJmlkOD0maWQ5PWQmaWQxMD1jJmlkMTE9JmlkMTI9e2djbGlkfSZpZDEzPSZpZDE0PSZpZDE1PVkmaWQxNj03MTIxOTczMzMzNTcmaWQxNz0maWQxOD13aW5zY3AubmV0JmlkMTk9cnVub2ZuZXR3b3JrJTNBJTNBMTAwJmlkMjA9JmlkMjE9JmlkMjI9JmlkMjM9JmlkMjQ9JmlkMjU9JmlkMjY9JmlkMjc9WSZpZDI4PSZpZDI5PSZpZDMwPTE5NzAyMzQwMTYxNjcyNzUzODE5JmlkMzE9JmlkMzI9JmlkMzM9JmlkMzQ9JmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKEKD49eOLmfKbfBICAQPYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=dM2PrCvZY78&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7drzW6gIA7HHmQY4Iyw7YfvzO6tXDvfkiTY9MwVZ2AB-WAItnU4XF2t1oW2NyE-ByFDavOoQ2HukJHkncCjyc6vSckEe1aoqjCCxgB&template_id=5042&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic HTTP traffic detected: GET /platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22215157521840905%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F%22%2C%22width%22%3A340%2C%22height%22%3A400%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Atrue%2C%22referer_uri%22%3A%22https%3A%2F%2Fwinscp.net%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__req=1&__hs=20027.BP%3Aplugin_default_pkg.2.0..0.0&dpr=1&__ccg=GOOD&__rev=1017838824&__s=%3A%3Aplzgdo&__hsi=7432013032883179535&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx60Vo1upE4W0OE1vE662y0um4o5-0me0sy0ny0oi0zE5W0PU1AE17U2ZwrU1Xo1UU3jwea&__csr=&locale=en_US&__sp=1 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /btr/view?ai=CDhqPedAjZ9XhIuOU78EP5YC10A6x9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDywSqBP0BT9DAQTMhS-ILCbEJJDaWMbiyUvke5GnZ1g8CvOCini_79bZducRK34cVbb4bnyTwixuYZ1DkjJJjuDY889SHTuGDQva4eEZB_oNxpmnneSjE3_DVl5CYeAU8uEeqaSVzHXNVSr-J1rK4-DFyIMJAdDUwj7cgw7_vCRMNmmQ0t_y1a32sJVzdBe8dfoe6D0_iL_A2N2kAWUuTo6k9Ka1PlYMpNCEVdCQn1B9y719lKYjTkqAC4NpptWUbmnuDbc-2SCkZfkDIGH4BcI9X9pSyGbsD37z2JfWntEMauY439J0AmRDAcL_D4-GvH2kDO_Ub7vF0FZbPBxqINFejzcAE0Izls4cFiAWkyNPYUKAGLoAHtNKnK6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQyI4b0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY2-jJ3qO5iQOaCYAEaHR0cHM6Ly93d3cubmV3ZWdnLmNvbS9wL3BsP2Q9UFBTU0pUSExXTEJSWkMmU3VibWl0PUVORSZERVBBPTAmT3JkZXI9QkVTVE1BVENIJnV0bV9zb3VyY2U9Z29vZ2xlJnV0bV9tZWRpdW09cGFpZCtkaXNwbGF5JnV0bV9jYW1wYWlnbj1LTkMtR29vZ2xlS1dMZXNzLV8tY29vcC1fLVdELV8tSERER09MRC1fLTA5MDQyNCZpZDA9R29vZ2xlJmlkMT0yMTY2MDc1NDk4MCZpZDI9MTczNzg2MzUxMTg0JmlkMz0maWQ0PSZpZDU9JmlkNj0maWQ3PTI4NDAmaWQ4PSZpZDk9ZCZpZDEwPWMmaWQxMT0maWQxMj17Z2NsaWR9JmlkMTM9JmlkMTQ9JmlkMTU9WSZpZDE2PTcxMjE5NzMzMzM1NyZpZDE3PSZpZDE4PXdpbnNjcC5uZXQmaWQxOT1zZWdtZW50X2JlX2FfMzIzMzkwOTI0MzA0MDEzODUxNCZpZDIwPSZpZDIxPSZpZDIyPSZpZDIzPSZpZDI0PSZpZDI1PSZpZDI2PSZpZDI3PVkmaWQyOD0maWQyOT0maWQzMD0xMDY1MzEyMTQ0MTEzMDAzOTE2OSZpZDMxPSZpZDMyPSZpZDMzPSZpZDM0PSZnYWRfc291cmNlPTWACgHICwHaDBEKCxDQtdnj677UgrUBEgIBA7gT5APYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=0aOzgEyc5FM&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwCa7L7dZM_x682mhf2KIIDx5yOCNjEcVDTj_NnjhLB_d36XrSCZcl8KEBgHXPYWQGe_b0nes6fdyOcCKV_xLeh2Kt4adEcMktFkeO9JsmwYAQ&template_id=484&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y9/r/ie38mp0O07P.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /login/?next=https%3A%2F%2Fwww.facebook.com%2Fv2.10%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%3D215157521840905%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df3042ea6f0e0127ef%2526domain%253Dwinscp.net%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fwinscp.net%25252Ff3552e4ccdc3ed298%2526relation%253Dparent.parent%26container_width%3D664%26height%3D400%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fwinscp%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dtimeline HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.facebook.com/v2.10/plugins/page.php?adapt_container_width=true&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3042ea6f0e0127ef%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=664&height=400&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timelineAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yH/r/ieeHDjcGsIR.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /f/AGSKWxU-y2rFz-Ce8OJCCCxISoGpjhuSD_yS5noRCnScqS2dhxIr-s236ltohAks6xdVkCKl_LU-HYctKmZIYrhc7t17fb9g-cAdfNJnAwmMh_c1dBtlm3f8n_mk5rNkZ9_gVwNGuL7rXg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMwNDAwMzg0LDY2MjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd2luc2NwLm5ldC9lbmcvZG9jcy9hZnRlcl9pbnN0YWxsYXRpb24iLG51bGwsW1s4LCJZc2dPT2N0dWtySSJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0 HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yG/r/IJz2TIVxd6Q.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yg/r/gjl3ldnE08O.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yL/r/a2pSKe6-4N_.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /f/AGSKWxUxfHS3nsFGh3jPt-WE_M9eMNErpqa-Fo0yj5eajv4BOnnxydjVCmrFfNh-0lvehE938eAA2MekF7EUAFysihyv8kAv4UuNuoO1LzyhHbi79W11Elf7aAFK_zNCeq8O1bKGRNFTng==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMwNDAwMzg2LDYxODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd2luc2NwLm5ldC9lbmcvZG9jcy9hZnRlcl9pbnN0YWxsYXRpb24iLG51bGwsW1s4LCJZc2dPT2N0dWtySSJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0 HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /f/AGSKWxWbQJa48ZAJagZ6aNbjQAilIzpXfchVVK2XnzVT0H4LRjFMnknhRno7Mpjj3_1v7aw9M2a_yHZcsQxjRpM_6DlkkPH7oTzPkcwyr55AQLgnhI5jdQBMjZaafUJ-Umq239I1bSpIFw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMwNDAwMzg3LDgwMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly93aW5zY3AubmV0L2VuZy9kb2NzL2FmdGVyX2luc3RhbGxhdGlvbiIsbnVsbCxbWzgsIllzZ09PY3R1a3JJIl0sWzksImVuLVVTIl0sWzE4LCJbW1swXV1dIl0sWzE5LCIyIl1dXQ HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: winscp.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1522412495.1730400377; _ga=GA1.2.1597569809.1730400377; _gid=GA1.2.775442497.1730400377; _gat_gtag_UA_22775137_1=1; __gads=ID=4fc64484ea3a67f4:T=1730400377:RT=1730400377:S=ALNI_MZCGFZNuVPlnLwhTPBtUfQ8SHfCfA; __gpi=UID=00000f49230b3590:T=1730400377:RT=1730400377:S=ALNI_MYYZwgKMMjsWwz9qQN7_u4e-IZRLg; __eoi=ID=f798a6a35fe1b79b:T=1730400377:RT=1730400377:S=AA-AfjYahHiKob7appmsMjqaPUmu; _ga_97R014CLMR=GS1.1.1730400376.1.0.1730400381.55.0.0; FCNEC=%5B%5B%22AKsRol9EWnTKOY1-czcO0HoJc_8SsDqDUwhAExW69Xe4MgCoqN1dkhRdnIhGLMn5ny-8wmzWJb9FDkJnFRX5_WZYg-BG4J4D954-1aFM7X5sd35LB9N4JbNHEpM36Edgpf0x1xFShHeTSMqKRVj80I38trG_oACzaA%3D%3D%22%5D%5D
Source: global traffic HTTP traffic detected: GET /sodar/sodar2.js HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /getconfig/sodar?sv=200&tid=gda&tv=r20241030&st=env HTTP/1.1Host: ep1.adtrafficquality.googleConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: winscp.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1522412495.1730400377; _ga=GA1.2.1597569809.1730400377; _gid=GA1.2.775442497.1730400377; _gat_gtag_UA_22775137_1=1; __gads=ID=4fc64484ea3a67f4:T=1730400377:RT=1730400377:S=ALNI_MZCGFZNuVPlnLwhTPBtUfQ8SHfCfA; __gpi=UID=00000f49230b3590:T=1730400377:RT=1730400377:S=ALNI_MYYZwgKMMjsWwz9qQN7_u4e-IZRLg; __eoi=ID=f798a6a35fe1b79b:T=1730400377:RT=1730400377:S=AA-AfjYahHiKob7appmsMjqaPUmu; _ga_97R014CLMR=GS1.1.1730400376.1.0.1730400381.55.0.0; FCNEC=%5B%5B%22AKsRol9EWnTKOY1-czcO0HoJc_8SsDqDUwhAExW69Xe4MgCoqN1dkhRdnIhGLMn5ny-8wmzWJb9FDkJnFRX5_WZYg-BG4J4D954-1aFM7X5sd35LB9N4JbNHEpM36Edgpf0x1xFShHeTSMqKRVj80I38trG_oACzaA%3D%3D%22%5D%5D
Source: global traffic HTTP traffic detected: GET /sodar/sodar2/232/runner.html HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/aframe HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /sodar/sodar2.js HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /generate_204?RS9A5A HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: chromecache_399.16.dr String found in binary or memory: * License: https://www.facebook.com/legal/license/A4tfXiHOGrs/ equals www.facebook.com (Facebook)
Source: chromecache_399.16.dr String found in binary or memory: * License: https://www.facebook.com/legal/license/Ga6vBwdwgUx/ equals www.facebook.com (Facebook)
Source: chromecache_346.16.dr String found in binary or memory: return b}lD.F="internal.enableAutoEventOnTimer";var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: winscp.net
Source: global traffic DNS traffic detected: DNS query: winscp-static-746341.c.cdn77.org
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: platform.twitter.com
Source: global traffic DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic DNS traffic detected: DNS query: www.facebook.com
Source: global traffic DNS traffic detected: DNS query: syndication.twitter.com
Source: global traffic DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic DNS traffic detected: DNS query: analytics.google.com
Source: global traffic DNS traffic detected: DNS query: static.xx.fbcdn.net
Source: global traffic DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic DNS traffic detected: DNS query: fundingchoicesmessages.google.com
Source: global traffic DNS traffic detected: DNS query: scontent-phx1-1.xx.fbcdn.net
Source: global traffic DNS traffic detected: DNS query: twitter.com
Source: global traffic DNS traffic detected: DNS query: ep1.adtrafficquality.google
Source: global traffic DNS traffic detected: DNS query: ep2.adtrafficquality.google
Source: unknown HTTP traffic detected: POST /ccm/collect?en=page_view&dl=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation&scrsrc=www.googletagmanager.com&frm=0&rnd=568305074.1730400377&auid=1522412495.1730400377&npa=0&gtm=45je4au0v9178989015za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&tft=1730400376648&tfd=11066&apve=1 HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://winscp.netX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: ZieOJekdWo7uzrVx9OWBpcRykWHmb+SkjVCglQy/IZDSeISC+L8tzQPdCDlpgZG1c6/M7hbZD6RQfi+0TXPPfA==Date: Thu, 31 Oct 2024 18:46:26 GMTTransfer-Encoding: chunked
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://169.254.169.254/latest/meta-data/iam/security-credentials/Retrieving
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: http://XXXXXXwinscp.net/
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: http://XXXXwinscp.net/forum/
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://acs.amazonaws.com/groups/global/AllUsers
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://acs.amazonaws.com/groups/global/AuthenticatedUsers
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://acs.amazonaws.com/groups/s3/LogDelivery
Source: WinSCP.exe, 00000007.00000002.2457040440.0000000001C92000.00000004.00000001.01000000.00000009.sdmp, WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp, WinSCP.exe, 0000000E.00000002.3403098508.0000000001C92000.00000004.00000001.01000000.00000009.sdmp String found in binary or memory: http://apache.org/dav/props/
Source: WinSCP.exe, 00000007.00000002.2457040440.0000000001C92000.00000004.00000001.01000000.00000009.sdmp, WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp, WinSCP.exe, 0000000E.00000002.3403098508.0000000001C92000.00000004.00000001.01000000.00000009.sdmp String found in binary or memory: http://apache.org/dav/props/T
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://apache.org/dav/propset/fs/1
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: is-MITNN.tmp.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: WinSCP.exe, 00000007.00000000.2427908055.0000000000EF6000.00000020.00000001.01000000.00000009.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002CAC000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.000000000453C000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FCD000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.00000000041FC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: WinSCP.exe, 00000007.00000000.2427908055.0000000000EF6000.00000020.00000001.01000000.00000009.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://webdav.org/neon/hooks/proxy-auth
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://webdav.org/neon/hooks/proxy-authProxy-AuthorizationProxy-AuthenticateProxy-Authentication-Inf
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://webdav.org/neon/hooks/server-auth
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://webdav.org/neon/hooks/server-authAuthorizationWWW-AuthenticateAuthentication-InfoCould
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://webdav.org/neon/hooks/server-authhttp://webdav.org/neon/hooks/proxy-authhttp://webdav.org/neo
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://webdav.org/neon/hooks/webdav-locking
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://webdav.org/neon/hooks/webdav-lockingHas
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://webdav.org/neon/hooks/webdav-lockinghttp://webdav.org/neon/hooks/webdav-lockingLocked
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://webdav.org/neon/hooks/webdav-lockinghttp://webdav.org/neon/hooks/webdav-lockinglock:
Source: is-MITNN.tmp.2.dr String found in binary or memory: http://winscp.net/schema/session/1.0
Source: chromecache_381.16.dr, chromecache_358.16.dr String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F76000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.00000000041B5000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Types
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C5D000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Types1
Source: WinSCP.exe, 0000000B.00000002.2483407064.00000000044FC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/TypesA;P
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F76000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/TypesAV
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C5D000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/TypesQ
Source: WinSCP.exe, 0000000B.00000002.2483407064.00000000044FC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Typesa
Source: WinSCP.exe, 0000000B.00000002.2483407064.00000000044FC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Typesa9P
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F76000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/TypesaT
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F76000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/TypesaW
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C5D000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Typesq
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.webdav.org/neon/hooks/http-passport-req
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.webdav.org/neon/hooks/http-passport-reqWWW-AuthenticatePassport1.4Passport1.4http://www.w
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.webdav.org/neon/hooks/http-redirect
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.webdav.org/neon/hooks/http-redirecthttp://www.webdav.org/neon/hooks/http-redirectAborted
Source: chromecache_346.16.dr String found in binary or memory: https://cct.google/taggy/agent.js
Source: is-G6EB7.tmp.2.dr String found in binary or memory: https://filezilla-project.org/bAcest
Source: WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-A0EPI.tmp.2.dr String found in binary or memory: https://filezilla-project.org/bThis
Source: is-S743B.tmp.2.dr String found in binary or memory: https://filezilla-project.org/nAquest
Source: is-FQG0H.tmp.2.dr String found in binary or memory: https://filezilla-project.org/xTen
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://filezilla-project.org/z
Source: chromecache_267.16.dr String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_267.16.dr String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v62/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://github.com/UweRaabe/PngComponents
Source: is-A0EPI.tmp.2.dr String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE
Source: WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE$Error
Source: is-FQG0H.tmp.2.dr String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE&BB
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE/
Source: is-G6EB7.tmp.2.dr String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE3Eroare
Source: is-S743B.tmp.2.dr String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE6Hi
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://github.com/plashenkov/TBX
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://jcl.delphi-jedi.org/
Source: WinSCP-6.3.5-Setup.exe String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://jrsoftware.org/tb2kdl.php
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://libexpat.github.io/?https://www.chiark.greenend.org.uk/~sgtatham/putty/licence.html
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://notroj.github.io/neon/
Source: is-FQG0H.tmp.2.dr String found in binary or memory: https://openssl-library.org/
Source: WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-A0EPI.tmp.2.dr String found in binary or memory: https://openssl-library.org/)WebDAV/HTTP
Source: is-S743B.tmp.2.dr String found in binary or memory: https://openssl-library.org//Codi
Source: is-G6EB7.tmp.2.dr String found in binary or memory: https://openssl-library.org/2Codul
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://openssl-library.org/4
Source: chromecache_346.16.dr, chromecache_305.16.dr String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_369.16.dr String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=fccs&
Source: chromecache_346.16.dr String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_240.16.dr String found in binary or memory: https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E89000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E98000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/1359793/850848#14699663
Source: chromecache_346.16.dr String found in binary or memory: https://td.doubleclick.net
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002404000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.00000000025D4000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566078635.0000000006542000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2580960915.000000000655D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://winscp.net/#https://winscp.net/eng/docs/history
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2575911732.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-FQG0H.tmp.2.dr, is-A0EPI.tmp.2.dr String found in binary or memory: https://winscp.net/&
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, is-S743B.tmp.2.dr String found in binary or memory: https://winscp.net/(
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/2https://winscp.net/forum/Fhttps://winscp.net/eng/download.php
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2575612359.00000000008B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/=
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002CC3000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001FC7000.00000002.00000001.01000000.00000009.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004553000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FE3000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004213000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/D
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.00000000036AE000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://winscp.net/eng/docs/?ver=%s&lang=%s-https://winscp.net/eng/docs/%s?ver=%s&lang=%s
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BF2000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004490000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_archive_and_download
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E89000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E98000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_archive_and_download#options
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004149000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_archive_and_downloadP
Source: WinSCP.exe, 0000000B.00000002.2483407064.000000000446F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_compare_files
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BF2000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_compare_files#options
Source: WinSCP.exe, 0000000B.00000002.2483407064.0000000004490000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_compare_files#options1
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004149000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_compare_files#optionsP
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004128000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_compare_files0
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BD1000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EEE000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_compare_filesa
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C27000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.00000000044C6000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.000000000417F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_generate_http_url
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BC2000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004461000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EDF000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.000000000411A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_generate_http_url#options
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_generate_http_urlQ
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E6F000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E7D000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_synchronize_another_server
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E6F000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E7D000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_synchronize_another_server#options
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C4F000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.00000000044ED000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F68000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_synchronize_another_server#optionsError
Source: WinSCP.exe, 0000000E.00000002.3405428504.00000000041A6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/extension_synchronize_another_server#optionsErrorh
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr String found in binary or memory: https://winscp.net/eng/docs/installation0
Source: is-MITNN.tmp.2.dr String found in binary or memory: https://winscp.net/eng/docs/library
Source: WinSCP.exe, 0000000B.00000002.2483407064.0000000004490000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2526226023.0000000004862000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_advanced_rename
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E89000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E98000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2526226023.0000000004862000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_advanced_rename#options
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BF2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_advanced_rename)
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004149000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_advanced_renameP
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C4F000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.00000000044ED000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F68000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.00000000041A6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_keep_local_directory_up_to_date
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004204000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_keep_local_directory_up_to_date#options
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002CB4000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004544000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FD4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_keep_local_directory_up_to_date#options1
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_text
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C4F000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F68000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_text#options_text
Source: WinSCP.exe, 0000000B.00000002.2483407064.00000000044ED000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_text#options_textQ
Source: WinSCP.exe, 0000000E.00000002.3405428504.00000000041A6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_text#options_texth
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_textI
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_textIu
Source: WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_textq
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_verify_file_checksum
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C4F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_verify_file_checksum#optionscksum
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F68000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_verify_file_checksum#optionscksum1
Source: WinSCP.exe, 0000000B.00000002.2483407064.00000000044ED000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_verify_file_checksum#optionscksuma
Source: WinSCP.exe, 0000000E.00000002.3405428504.00000000041A6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_verify_file_checksum#optionscksumh
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004490000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E5A000.00000004.00001000.00020000.00000000.sdmp, is-P36QM.tmp.2.dr String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_upload
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E5A000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp, is-P36QM.tmp.2.dr String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_upload#options
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002CB4000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004544000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FD4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_upload#optionse
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002CB4000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004544000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FD4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_upload#optionsexe
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_uploadI=
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004149000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_uploadP
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BF2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_uploady
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2581546171.0000000006586000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2272176105.00000000008F0000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2269718517.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2575431470.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2562782819.000000000657C000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2577805992.00000000008D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/license
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2272132445.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566998814.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2269718517.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2561749142.0000000006587000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/docs/privacy
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://winscp.net/eng/donate.php
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.0000000003739000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/donate.php?
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.0000000003732000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/donate.php?amount=
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.00000000025D4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/download.php
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.000000000240C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/download.php)
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.0000000003740000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.0000000003756000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/installed.php?ver=6.3.5&lang=
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566078635.0000000006542000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campai
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://winscp.net/eng/translations.php:https://winscp.net/eng/docs/search.php?ver=%s&lang=%s&q=%sKh
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://winscp.net/forum/
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/install.php?
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566078635.0000000006542000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/install.php?mode=report&installed=1&silent=0&ver=6.3.5&lang=en&prevver=&sponsorst
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.000000000375D000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/install.php?mode=sponsor
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.000000000375D000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/install.php?mode=sponsoring
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566998814.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2578172782.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2576606616.0000000000885000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/install.php?mode=sponsorrequest&ver=6.3.5&lang=en&prevver=&scale=100&images=
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566998814.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2578172782.00000000008F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/install.php?mode=sponsorrequest&ver=6.3.5&lang=en&prevver=&scale=100&images=-ae
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2579139130.000000000091A000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2565675597.0000000000917000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://winscp.net/install.php?mode=sponsorrequest&ver=6.3.5&lang=en&prevver=&scale=100&images=4
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://winscp.net/updates.php#https://winscp.net/eng/download.php
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2579139130.000000000091A000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2565675597.0000000000917000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://winscp.net:443/install.php?mode=report&installed=1&silent=0&ver=6.3.5&lang=en&prevver=&spons
Source: WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/1
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2581546171.0000000006586000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2272176105.00000000008F0000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2269718517.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2562782819.000000000657C000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.fsf.org/
Source: WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.gnu.org/licenses/
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2272132445.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2269718517.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2561749142.0000000006587000.00000004.00000020.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.gnu.org/licenses/why-not-lgpl.html
Source: chromecache_346.16.dr String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_346.16.dr String found in binary or memory: https://www.google.com
Source: chromecache_385.16.dr String found in binary or memory: https://www.google.com/pagead/1p-user-list/1002628342/?random
Source: chromecache_414.16.dr String found in binary or memory: https://www.google.com/pagead/drt/ui
Source: chromecache_346.16.dr String found in binary or memory: https://www.googleadservices.com
Source: chromecache_346.16.dr String found in binary or memory: https://www.googletagmanager.com
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136471090.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136058894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000000.2137712250.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WinSCP-6.3.5-Setup.tmp.0.dr String found in binary or memory: https://www.innosetup.com/
Source: chromecache_399.16.dr String found in binary or memory: https://www.internalfb.com/intern/invariant/
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136471090.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136058894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000000.2137712250.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WinSCP-6.3.5-Setup.tmp.0.dr String found in binary or memory: https://www.remobjects.com/ps
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 60334 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60575 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 60655 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 60414 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60531
Source: unknown Network traffic detected: HTTP traffic on port 60219 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60539
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60538
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60537
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60536
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60535
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60534
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 60220 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60207 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60301
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60543
Source: unknown Network traffic detected: HTTP traffic on port 60587 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60266 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60426 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60309
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60308
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60307
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60549
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60306
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60548
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60305
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60547
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60304
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60546
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60303
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60545
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60302
Source: unknown Network traffic detected: HTTP traffic on port 60495 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60544
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60312
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60311
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60553
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60310
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60552
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60551
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60550
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 60198 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60318
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60317
Source: unknown Network traffic detected: HTTP traffic on port 60368 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60316
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60558
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60315
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60557
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60314
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60555
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 60310 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 60278 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60553 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60448 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60391 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60323
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60565
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60322
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60564
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60321
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60320
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60562
Source: unknown Network traffic detected: HTTP traffic on port 60516 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60329
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60328
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60327
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60326
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60325
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60567
Source: unknown Network traffic detected: HTTP traffic on port 60346 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60324
Source: unknown Network traffic detected: HTTP traffic on port 60164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60229 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60504 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60565 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60404 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60196 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60471 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60230 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60312 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60507
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60506
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60505
Source: unknown Network traffic detected: HTTP traffic on port 60256 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60504
Source: unknown Network traffic detected: HTTP traffic on port 60531 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60344 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60503
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60502
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60501
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60500
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 60252 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60519
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60483 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60322 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60291 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60518
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60517
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60516
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60515
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 60217 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60513
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 60599 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60608 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 60186 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60268 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60543 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60356 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60631 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60520
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60524
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60523
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60381
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60380
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60377
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60376
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60375
Source: unknown Network traffic detected: HTTP traffic on port 60395 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60374
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60373
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60372
Source: unknown Network traffic detected: HTTP traffic on port 60286 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60371
Source: unknown Network traffic detected: HTTP traffic on port 60234 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60475 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60641 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60379
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60555 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60392
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60391
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60390
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60389
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60388
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60387
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60386
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60385
Source: unknown Network traffic detected: HTTP traffic on port 60590 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60302 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60384
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60348 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60361 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60606 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60502 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60298 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60200 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60371 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60487 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60399
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60398
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60397
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60396
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60395
Source: unknown Network traffic detected: HTTP traffic on port 60182 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60394
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60393
Source: unknown Network traffic detected: HTTP traffic on port 60406 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60567 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60326 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60171
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60170
Source: unknown Network traffic detected: HTTP traffic on port 60618 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60222 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60169
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60167
Source: unknown Network traffic detected: HTTP traffic on port 60264 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60166
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60164
Source: unknown Network traffic detected: HTTP traffic on port 60451 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60163
Source: unknown Network traffic detected: HTTP traffic on port 60589 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60418 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60485 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60244 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60651 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60579 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60334
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60576
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60575
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60332
Source: unknown Network traffic detected: HTTP traffic on port 60324 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60331
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60573
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60330
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60572
Source: unknown Network traffic detected: HTTP traffic on port 60184 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60571
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60339
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60338
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60579
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60336
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60578
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60335
Source: unknown Network traffic detected: HTTP traffic on port 60276 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60524 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60545 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60580 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60590
Source: unknown Network traffic detected: HTTP traffic on port 60393 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60345
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60587
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60344
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60586
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60343
Source: unknown Network traffic detected: HTTP traffic on port 60453 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60585
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60342
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60584
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60341
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60583
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60582
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60580
Source: unknown Network traffic detected: HTTP traffic on port 60210 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60349
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60348
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60347
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60589
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60346
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60588
Source: unknown Network traffic detected: HTTP traffic on port 60441 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60336 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60356
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60355
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60354
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60353
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60352
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60594
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60351
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60350
Source: unknown Network traffic detected: HTTP traffic on port 60557 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60288 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60628 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60381 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60359
Source: unknown Network traffic detected: HTTP traffic on port 60232 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60357
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60599
Source: unknown Network traffic detected: HTTP traffic on port 60194 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60370
Source: unknown Network traffic detected: HTTP traffic on port 60209 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60314 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60367
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60366
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60365
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60364
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60363
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60362
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60361
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60360
Source: unknown Network traffic detected: HTTP traffic on port 60254 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60368
Source: unknown Network traffic detected: HTTP traffic on port 60443 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60202 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60248 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60523 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60546 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60283 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60489 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60408 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60626 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60305 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60192 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60386 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60214 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60374 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60179 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60431 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60236 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60465 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60295 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60352 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60261 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60558 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60329 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60604 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60273 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60571 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60636 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60298
Source: unknown Network traffic detected: HTTP traffic on port 60433 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60295
Source: unknown Network traffic detected: HTTP traffic on port 60536 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60362 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60350 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60224 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60396 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60648 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60583 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60327 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60602 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60499 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60384 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60548 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60317 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60246 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60477 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60339 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60455 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60285 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60212 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60177 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60320 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60366 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60251 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60658 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60228 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60411 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60612 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60354 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60457 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60445 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60470 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60573 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60281 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60332 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60538 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60307 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60624 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60190 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60482 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60646 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60258 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60388 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60216 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60309 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60376 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60330 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60238 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60293 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60622 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60167 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60551 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60199 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60518 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60401 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60634 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60506 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60189 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60204 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60480 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60435 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60364 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60226 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60413 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60585 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60398 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60342 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60271 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60311 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60277 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60552 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60392 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60357 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60632 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60411
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60410
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60651
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60650
Source: unknown Network traffic detected: HTTP traffic on port 60517 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60419
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60418
Source: unknown Network traffic detected: HTTP traffic on port 60437 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60417
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60658
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60414
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60413
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60655
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60412
Source: unknown Network traffic detected: HTTP traffic on port 60163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60484 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60420
Source: unknown Network traffic detected: HTTP traffic on port 60323 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60429
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60427
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60426
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60425
Source: unknown Network traffic detected: HTTP traffic on port 60231 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60609 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60208 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60185 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60460 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60433
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60432
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60431
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60430
Source: unknown Network traffic detected: HTTP traffic on port 60586 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60425 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60439
Source: unknown Network traffic detected: HTTP traffic on port 60255 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60437
Source: unknown HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 88.198.21.111:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:60186 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:60239 version: TLS 1.2
Source: unknown HTTPS traffic detected: 88.198.21.111:443 -> 192.168.2.6:60284 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:60372 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:60410 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:60493 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:60599 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:60648 version: TLS 1.2
PE file contains executable resources (Code or Archives)
Source: WinSCP-6.3.5-Setup.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-PM78M.tmp.2.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-O60P0.tmp.2.dr Static PE information: Resource name: RT_STRING type: PDP-11 pure executable not stripped
Source: is-EKLQ1.tmp.2.dr Static PE information: Resource name: RT_STRING type: PDP-11 demand-paged pure executable not stripped
Source: is-9C1M4.tmp.2.dr Static PE information: Resource name: RT_STRING type: PDP-11 executable not stripped
Source: is-L7Q5O.tmp.2.dr Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: is-NR0U8.tmp.2.dr Static PE information: Resource name: RT_STRING type: PDP-11 overlaid pure executable not stripped
Source: is-FQG0H.tmp.2.dr Static PE information: Resource name: RT_STRING type: 0420 Alliant virtual executable not stripped
Source: is-G6EB7.tmp.2.dr Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: is-12FUS.tmp.2.dr Static PE information: Resource name: RT_STRING type: PDP-11 executable not stripped - version 11
Source: is-PTP8A.tmp.2.dr Static PE information: Resource name: RT_STRING type: 0420 Alliant virtual executable common library not stripped
Source: is-PTP8A.tmp.2.dr Static PE information: Resource name: RT_STRING type: PDP-11 overlaid pure executable not stripped
PE file does not import any functions
Source: is-2OH6T.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-3OA4A.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-JJBU1.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-AQ578.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-RHNVA.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-12FUS.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-252L7.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-2NLBT.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-V0JFT.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-UNNRO.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-E9RG6.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-6D65U.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-2I3LS.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-FQG0H.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-SI23F.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-F9A3R.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-P7JQO.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-BO0F5.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-A0EPI.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-0PHNM.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-24MJE.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-I1HPU.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-MU78M.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-EJ8B7.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-O60P0.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-L0PL5.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-NR0U8.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-PTP8A.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-9C1M4.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-G6EB7.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-P93HC.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-L7Q5O.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-D09V8.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-SU27Q.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-S743B.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-25U96.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-B45FB.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-EKLQ1.tmp.2.dr Static PE information: No import functions for PE file found
Source: is-7TGIJ.tmp.2.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.00000000023D8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekernel32j% vs WinSCP-6.3.5-Setup.exe
Uses 32bit PE files
Source: WinSCP-6.3.5-Setup.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: sus24.spyw.winEXE@36/434@75/27
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Mutant created: \Sessions\1\BaseNamedObjects\WinSCPDragExtLogMutex
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Mutant created: \Sessions\1\BaseNamedObjects\WinSCP
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Mutant created: \Sessions\1\BaseNamedObjects\WinSCPDragExtMutex
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe File created: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File read: C:\Program Files (x86)\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: WinSCP-6.3.5-Setup.exe String found in binary or memory: /LOADINF="filename"
Source: WinSCP-6.3.5-Setup.exe String found in binary or memory: (https://winscp.net/eng/docs/installation0
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe File read: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe "C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe"
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Process created: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp "C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp" /SL5="$20406,10489221,930816,C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /RegisterForDefaultProtocols
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /ImportSitesIfAny
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /Usage=TypicalInstallation:1,InstallationsUser+,InstallationParentProcess@,InstallationsFirstTypical+,LastInstallationAutomaticUpgrade:0,InstallationsGettingStarted+,InstallationsLaunch+,
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 --field-trial-handle=3276,i,636435449627489665,5607076903918076227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Process created: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp "C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp" /SL5="$20406,10489221,930816,C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\WinSCP\DragExt64.dll" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /RegisterForDefaultProtocols Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /ImportSitesIfAny Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /Usage=TypicalInstallation:1,InstallationsUser+,InstallationParentProcess@,InstallationsFirstTypical+,LastInstallationAutomaticUpgrade:0,InstallationsGettingStarted+,InstallationsLaunch+, Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\WinSCP\DragExt64.dll" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 --field-trial-handle=3276,i,636435449627489665,5607076903918076227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: msftedit.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: windows.globalization.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: bcp47mrm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: globinputhost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: windows.ui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: inputhost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: winhttpcom.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: mlang.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: windows.shell.servicehostbuilder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: msi.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: olepro32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: security.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: slc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: msi.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: olepro32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: security.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: slc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: msi.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: olepro32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: security.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: slc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: msi.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: olepro32.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: security.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: slc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: mrmcorer.dll Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Section loaded: windows.staterepositorycore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: WinSCP.lnk.2.dr LNK file: ..\..\..\..\..\Program Files (x86)\WinSCP\WinSCP.exe
Source: WinSCP.lnk0.2.dr LNK file: ..\..\..\Program Files (x86)\WinSCP\WinSCP.exe
Source: WinSCP (for upload).lnk.2.dr LNK file: ..\..\..\..\..\..\..\Program Files (x86)\WinSCP\WinSCP.exe
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Automated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Window detected: Number of UI elements: 16
Source: WinSCP-6.3.5-Setup.exe Static PE information: certificate valid
Source: WinSCP-6.3.5-Setup.exe Static file information: File size 11611592 > 1048576
Source: WinSCP-6.3.5-Setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\misto\wscpblda\build\dotnet\obj\Release\net40\WinSCPnet.pdbSHA256 source: is-MITNN.tmp.2.dr
Source: Binary string: c:\misto\wscpblda\build\dotnet\obj\Release\net40\WinSCPnet.pdb source: is-MITNN.tmp.2.dr
Binary contains a suspicious time stamp
Source: is-MITNN.tmp.2.dr Static PE information: 0xA7F353B7 [Wed Apr 16 18:02:31 2059 UTC]
PE file contains sections with non-standard names
Source: WinSCP-6.3.5-Setup.exe Static PE information: section name: .didata
Source: WinSCP-6.3.5-Setup.tmp.0.dr Static PE information: section name: .didata
Source: is-PM78M.tmp.2.dr Static PE information: section name: .didata
Source: is-HCFOU.tmp.2.dr Static PE information: section name: .didata
Source: is-VH8LO.tmp.2.dr Static PE information: section name: .rodata
Source: is-VH8LO.tmp.2.dr Static PE information: section name: .xdata
Source: is-1UBMP.tmp.2.dr Static PE information: section name: .00cfg
Source: is-1UBMP.tmp.2.dr Static PE information: section name: .voltbl
Source: is-VK93L.tmp.2.dr Static PE information: section name: .00cfg
Source: is-VK93L.tmp.2.dr Static PE information: section name: .voltbl
Registers a DLL
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-MU78M.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-BO0F5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-RHNVA.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-2OH6T.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fi (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-P7JQO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-252L7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-SU27Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.srl (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\PuTTY\puttygen.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\is-PM78M.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-FQG0H.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\WinSCP.com (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.sk (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fa (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.uk (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-G6EB7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fr (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.hr (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-L0PL5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-3OA4A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-D09V8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ta (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-24MJE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.sv (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.nl (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.is (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\is-HCFOU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Users\user\AppData\Local\Temp\is-MJOGT.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.pl (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\PuTTY\is-1UBMP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.da (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ko (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.jp (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-E9RG6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-EKLQ1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-7TGIJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ch (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.de (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.lt (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-9C1M4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ptg (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\is-VH8LO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.bg (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ms (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-UNNRO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-V0JFT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.be (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ar (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.chs (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.el (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ru (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.tr (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-JJBU1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\PuTTY\is-VK93L.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.pt (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-12FUS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.vi (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.es (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.et (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\PuTTY\pageant.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ro (copy) Jump to dropped file
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe File created: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.in (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-2I3LS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\DragExt64.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-EJ8B7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-PTP8A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-0PHNM.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.it (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.xxk (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\is-MITNN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-NR0U8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ca (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.hu (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\is-TES8D.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-25U96.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-B45FB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-S743B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-AQ578.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-A0EPI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\WinSCPnet.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\WinSCP.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-I1HPU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-P93HC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-F9A3R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-6D65U.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-O60P0.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.cs (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-2NLBT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.no (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-SI23F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\Program Files (x86)\WinSCP\Translations\is-L7Q5O.tmp Jump to dropped file

Boot Survival
barindex
Creates an undocumented autostart registry key
Source: C:\Windows\System32\regsvr32.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\WinSCPCopyHook NULL Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\WinSCPCopyHook NULL Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinSCP.lnk Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-MU78M.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-BO0F5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-RHNVA.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fi (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-2OH6T.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-P7JQO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-252L7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-SU27Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.srl (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\PuTTY\puttygen.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-FQG0H.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\WinSCP.com (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.sk (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fa (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.uk (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-G6EB7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fr (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.hr (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-L0PL5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-3OA4A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-D09V8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ta (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-24MJE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.sv (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.nl (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.is (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MJOGT.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.pl (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\PuTTY\is-1UBMP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.da (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ko (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.jp (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-E9RG6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-EKLQ1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-7TGIJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ch (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.de (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.lt (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-9C1M4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ptg (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\is-VH8LO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.bg (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ms (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-UNNRO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-V0JFT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.be (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ar (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.chs (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ru (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.el (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.tr (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-JJBU1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\PuTTY\is-VK93L.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.pt (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-12FUS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.vi (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.es (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.et (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\PuTTY\pageant.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ro (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.in (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\DragExt64.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-2I3LS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-PTP8A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-EJ8B7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-0PHNM.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.xxk (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.it (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\is-MITNN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-NR0U8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ca (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.hu (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\is-TES8D.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-25U96.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-B45FB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-S743B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-AQ578.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-A0EPI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\WinSCPnet.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-I1HPU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-P93HC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-6D65U.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-F9A3R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-O60P0.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.cs (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-2NLBT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.no (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-SI23F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-L7Q5O.tmp Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp TID: 2852 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries keyboard layouts
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809 Jump to behavior
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2580797215.000000000653D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$0"
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2579139130.000000000092D000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2565675597.0000000000920000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2580797215.000000000653D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2565675597.0000000000920000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566998814.00000000008EF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: WinSCP.exe, 0000000E.00000002.3403668297.0000000002628000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@
Source: WinSCP.exe, 0000000B.00000002.2482832841.00000000028BB000.00000004.00000020.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524056750.0000000002429000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: WinSCP.exe, 00000007.00000002.2458197253.00000000028B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllyy
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Process information queried: ProcessInformation Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 Jump to behavior
Queries the installation date of Windows
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Updates Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Martin Prikryl\WinSCP 2\DragExt Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\DragExt Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Martin Prikryl\WinSCP 2\DragExt Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Logging Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\CopyParam Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\NewDirectory2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\SynchronizeChecklist Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\FindFile Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ConsoleWin Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\LoginDialog Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\History Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\HistoryParams Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\QueueView Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Updates Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Explorer Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\LocalPanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\RemotePanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\OtherLocalPanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Bookmarks Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\CustomCommands Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\CustomCommandOptions Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\SshHostCAs Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities\UrlAssociations Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities\UrlAssociations Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities\UrlAssociations Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities\UrlAssociations Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities\UrlAssociations Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities\UrlAssociations Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities\UrlAssociations Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities\UrlAssociations Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities\UrlAssociations Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCPCapabilities Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Logging Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\CopyParam Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\NewDirectory2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\SynchronizeChecklist Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\FindFile Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ConsoleWin Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\LoginDialog Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\History Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\HistoryParams Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\QueueView Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Updates Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Explorer Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\LocalPanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\RemotePanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\OtherLocalPanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Bookmarks Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\CustomCommands Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\CustomCommandOptions Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\SshHostCAs Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Updates Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Bookmarks\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Bookmarks\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Logging Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\Values Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\PeriodCounters Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\LifetimeCounters Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\CopyParam Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\NewDirectory2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\SynchronizeChecklist Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\FindFile Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ConsoleWin Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\LoginDialog Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\History Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\HistoryParams Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\HistoryParams\SpeedLimit Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\HistoryParams Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\HistoryParams\PuttyPath Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\HistoryParams Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\QueueView Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Updates Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Explorer Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\Interface\Explorer\ToolbarsLayout2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\Interface\Explorer\ToolbarsLayout Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ToolbarsLayout2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ToolbarsLayout Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\LocalPanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\RemotePanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\OtherLocalPanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Bookmarks Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Bookmarks\Local Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Bookmarks\Remote Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Bookmarks\ShortCuts Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Bookmarks\Options Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\CustomCommands Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\CustomCommandOptions Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor\0 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor\1 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor\2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\SshHostCAs Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Bookmarks\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Logging Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\Values Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\PeriodCounters Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\LifetimeCounters Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Usage\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\CopyParam Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\NewDirectory2 Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\SynchronizeChecklist Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\FindFile Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ConsoleWin Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\LoginDialog Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\History Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\HistoryParams Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Editor Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\QueueView Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Updates Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Explorer Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\LocalPanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\RemotePanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\OtherLocalPanel Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Commander\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\ Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security Jump to behavior
Searches for user specific document files
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe Directory queried: C:\Users\user\Documents Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1546344 Sample: WinSCP-6.3.5-Setup.exe Startdate: 31/10/2024 Architecture: WINDOWS Score: 24 42 winscp.net 2->42 44 stats.g.doubleclick.net 2->44 8 WinSCP-6.3.5-Setup.exe 2 2->8         started        process3 file4 32 C:\Users\user\...\WinSCP-6.3.5-Setup.tmp, PE32 8->32 dropped 11 WinSCP-6.3.5-Setup.tmp 36 97 8->11         started        process5 dnsIp6 50 winscp.net 88.198.21.111, 443, 49763, 60284 HETZNER-ASDE Germany 11->50 34 C:\Program Files (x86)\...\WinSCP.exe (copy), PE32 11->34 dropped 36 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 11->36 dropped 38 C:\...\unins000.exe (copy), PE32 11->38 dropped 40 90 other files (none is malicious) 11->40 dropped 64 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->64 16 regsvr32.exe 11->16         started        18 WinSCP.exe 99 6 11->18         started        21 WinSCP.exe 405 6 11->21         started        23 3 other processes 11->23 file7 signatures8 process9 dnsIp10 26 regsvr32.exe 5 16->26         started        58 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->58 46 192.168.2.6, 443, 49704, 49706 unknown unknown 23->46 48 239.255.255.250 unknown Reserved 23->48 29 chrome.exe 23->29         started        signatures11 process12 dnsIp13 60 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 26->60 62 Creates an undocumented autostart registry key 26->62 52 104.244.42.136, 443, 60489 TWITTERUS United States 29->52 54 104.244.42.200, 443, 60444 TWITTERUS United States 29->54 56 32 other IPs or domains 29->56 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.244.42.200
 unknown United States
13414 TWITTERUS false
88.198.21.111
 winscp.net Germany
24940 HETZNER-ASDE false
142.250.185.226
 unknown United States
15169 GOOGLEUS false
104.244.42.136
 unknown United States
13414 TWITTERUS false
157.240.0.35
 star-mini.c10r.facebook.com United States
32934 FACEBOOKUS false
172.217.18.4
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.185.196
 unknown United States
15169 GOOGLEUS false
142.250.185.194
 td.doubleclick.net United States
15169 GOOGLEUS false
199.232.188.157
 platform.twitter.map.fastly.net United States
54113 FASTLYUS false
37.19.194.80
 1578389079.rsc.cdn77.org Ukraine
31343 INTERTELECOMUA false
172.217.16.194
 unknown United States
15169 GOOGLEUS false
169.150.255.180
 unknown United States
2711 SPIRITTEL-ASUS false
64.233.167.157
 stats.g.doubleclick.net United States
15169 GOOGLEUS false
142.250.185.129
 unknown United States
15169 GOOGLEUS false
57.144.134.128
 scontent-phx1-1.xx.fbcdn.net Belgium
2686 ATGS-MMD-ASUS false
216.58.206.78
 analytics.google.com United States
15169 GOOGLEUS false
216.58.206.33
 unknown United States
15169 GOOGLEUS false
157.240.0.6
 scontent.xx.fbcdn.net United States
32934 FACEBOOKUS false
142.250.185.164
 www.google.com United States
15169 GOOGLEUS false
172.217.16.206
 www3.l.google.com United States
15169 GOOGLEUS false
104.244.42.8
 syndication.twitter.com United States
13414 TWITTERUS false
216.58.206.66
 unknown United States
15169 GOOGLEUS false
157.240.251.9
 unknown United States
32934 FACEBOOKUS false
157.240.251.35
 unknown United States
32934 FACEBOOKUS false
142.250.185.97
 ep2.adtrafficquality.google United States
15169 GOOGLEUS false

Private

IP
192.168.2.6

Contacted Domains

Name IP Active
winscp.net 88.198.21.111 true
star-mini.c10r.facebook.com 157.240.0.35 true
twitter.com 104.244.42.1 true
ep1.adtrafficquality.google 142.250.186.66 true
ep2.adtrafficquality.google 142.250.185.97 true
1578389079.rsc.cdn77.org 37.19.194.80 true
platform.twitter.map.fastly.net 199.232.188.157 true
syndication.twitter.com 104.244.42.8 true
stats.g.doubleclick.net 64.233.167.157 true
scontent.xx.fbcdn.net 157.240.0.6 true
googleads.g.doubleclick.net 142.250.184.226 true
www3.l.google.com 172.217.16.206 true
www.google.com 142.250.185.164 true
td.doubleclick.net 142.250.185.194 true
analytics.google.com 216.58.206.78 true
scontent-phx1-1.xx.fbcdn.net 57.144.134.128 true
www.facebook.com unknown unknown
connect.facebook.net unknown unknown
fundingchoicesmessages.google.com unknown unknown
static.xx.fbcdn.net unknown unknown
winscp-static-746341.c.cdn77.org unknown unknown
platform.twitter.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://scontent-phx1-1.xx.fbcdn.net/v/t39.30808-1/351156904_264152706143983_3109134666055357303_n.jpg?stp=cp0_dst-jpg_s50x50&_nc_cat=100&ccb=1-7&_nc_sid=6738e8&_nc_ohc=VaXOflnuDHcQ7kNvgGYZY5H&_nc_zt=24&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYAVosyj27yGB-nAl8xsHDz4QfMDJaExqAWoiWH0J70L6Q&oe=672987CE false
    		unknown
    https://www.facebook.com/platform/plugin/page/logging/ false
      		unknown
      https://static.xx.fbcdn.net/rsrc.php/v3i7M54/y0/l/en_US/zYyn94Uppv5.js false
        		unknown
        https://static.xx.fbcdn.net/rsrc.php/v4/yk/l/0,cross/GY0bX-iB97s.css false
          		unknown
          https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/Chl8448Q49S.js false
            		unknown
            https://static.xx.fbcdn.net/rsrc.php/v3/yG/r/IJz2TIVxd6Q.js false
              		unknown
              https://winscp-static-746341.c.cdn77.org/assets/js/slick-init.js?v=7034 false
                		unknown
                https://www.facebook.com/ajax/bz?__a=1&__ccg=GOOD&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx60Vo1upE4W0OE1vE662y0um4o5-0me0sy0ny0oi0zE5W0PU1AE17U2ZwrU1Xo1UU3jwea&__hs=20027.BP%3Aplugin_default_pkg.2.0..0.0&__hsi=7432013032883179535&__req=5&__rev=1017838824&__s=%3A%3Aplzgdo&__sp=1&__user=0&dpr=1&jazoest=21919&locale=en_US&lsd=JmzYf9flXws1Rh6-Wn6T0u false
                  		unknown
                  https://static.xx.fbcdn.net/rsrc.php/v3/yz/r/c64elx0V1Fa.js false
                    		unknown
                    https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/p55HfXW__mM.js false
                      		unknown
                      https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=6822944091&adk=2358527528&adf=101933203&pi=t.ma~as.6822944091&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373001&bpp=4&bdt=3647&idt=2647&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280&correlator=6162542844500&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=30&ady=1480&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=2652 false
                        		unknown
                        https://www.facebook.com/platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22215157521840905%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F%22%2C%22width%22%3A340%2C%22height%22%3A400%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Atrue%2C%22referer_uri%22%3A%22https%3A%2F%2Fwinscp.net%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__req=1&__hs=20027.BP%3Aplugin_default_pkg.2.0..0.0&dpr=1&__ccg=GOOD&__rev=1017838824&__s=%3A%3Aplzgdo&__hsi=7432013032883179535&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx60Vo1upE4W0OE1vE662y0um4o5-0me0sy0ny0oi0zE5W0PU1AE17U2ZwrU1Xo1UU3jwea&__csr=&locale=en_US&__sp=1 false
                          		unknown
                          https://winscp.net/favicon.ico false
                            		unknown
                            https://fundingchoicesmessages.google.com/el/AGSKWxXVowT_P7UFkqWweTaxyBwibPZ8_cu1zf1cqGWD3U6li-jqPgcGXrvL6Uq1wL18CbD-6faE1WmeMeuKJ_DY9EBehS9v-cpooOhEdYCL9h_507RJOWCW40eVwldcjha9EJ0lEYQfSQ== false
                              		unknown
                              https://syndication.twitter.com/settings?session_id=dd9b3d302a9b92ee788c222ff5c4209225028450 false
                                		unknown
                                https://www.facebook.com/v2.10/plugins/page.php?adapt_container_width=true&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3042ea6f0e0127ef%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=664&height=400&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline false
                                  		unknown
                                  https://winscp-static-746341.c.cdn77.org/assets/css/bootstrap-modified.css?v=7034 false
                                    		unknown
                                    https://static.xx.fbcdn.net/rsrc.php/v3/yw/r/UXtr_j2Fwe-.png false
                                      		unknown
                                      https://googleads.g.doubleclick.net/pagead/html/r20241030/r20190131/zrt_lookup_fy2021.html false
                                        		unknown
                                        https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=200&slotname=4424189075&adk=724910714&adf=1108650154&pi=t.ma~as.4424189075&w=233&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=3&format=233x200&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=1&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373005&bpp=2&bdt=3651&idt=2659&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280%2C649x280&correlator=6162542844500&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=739&ady=853&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&fsb=1&dtd=2666 false
                                          		unknown
                                          https://winscp-static-746341.c.cdn77.org/assets/js/svg-src-polyfill.js?v=7034 false
                                            		unknown
                                            https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA false
                                              		unknown
                                              https://static.xx.fbcdn.net/rsrc.php/v4/yL/l/0,cross/hx1QQk3LL6t.css false
                                                		unknown
                                                https://fundingchoicesmessages.google.com/f/AGSKWxUxfHS3nsFGh3jPt-WE_M9eMNErpqa-Fo0yj5eajv4BOnnxydjVCmrFfNh-0lvehE938eAA2MekF7EUAFysihyv8kAv4UuNuoO1LzyhHbi79W11Elf7aAFK_zNCeq8O1bKGRNFTng==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMwNDAwMzg2LDYxODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd2luc2NwLm5ldC9lbmcvZG9jcy9hZnRlcl9pbnN0YWxsYXRpb24iLG51bGwsW1s4LCJZc2dPT2N0dWtySSJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0 false
                                                  		unknown
                                                  https://winscp-static-746341.c.cdn77.org/assets/images/arrow-horiz-soft.svg?v=7034 false
                                                    		unknown
                                                    https://static.xx.fbcdn.net/rsrc.php/v3/yA/r/0q927cN1GZe.js false
                                                      		unknown
                                                      https://ep2.adtrafficquality.google/sodar/sodar2.js false
                                                        		unknown
                                                        https://www.facebook.com/x/oauth/status?client_id=215157521840905&input_token&origin=1&redirect_uri=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&sdk=joey&wants_cookie_data=false false
                                                          		unknown
                                                          https://static.xx.fbcdn.net/rsrc.php/v3/yH/r/xgVgalBG80z.png false
                                                            		unknown
                                                            https://static.xx.fbcdn.net/rsrc.php/v4/yX/l/0,cross/Yd70QRXJCf6.css false
                                                              		unknown
                                                              https://googleads.g.doubleclick.net/pagead/adview?ai=CdQwcedAjZ5H_IeCa78EP863DmQOx9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDSKoE_AFP0EtLn0pGydfWXKH5GLbyFNQbHkavtBzS9CBxW9RG_iPZGxqcK25ycPNC11bKozj0j5FBWNyONmQSmzaF302m8KTK30OzHihaWKPCbRSZxFCaHxMGtnP6FTlUYassmNMTHpM2UCphb4Z3Z9tPBUglRu6TMImCLUJJh3myq-fiKSRg2qqbOah6KsLwehMkIoFDzuXZqwxYb3uxZywLXhEAWuC0xNyVOADHVFrLeoH-4_OaHyWyjWGCLkdMbP10Pc5-I_QrnQ_rvQRVS1ak3lfwlA0HGKEyDWp57lpr_57aubjFyrojuEhszjYAFBbJ1iehMeupDVoUO_he8hjABNCM5bOHBYgFpMjT2FCgBi6AB7TSpyuoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEMD9BNIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WMqYyd6juYkDmgn1A2h0dHBzOi8vd3d3Lm5ld2VnZy5jb20vcC9wbD9kPVBQU1NKVEhMV0xCUlpDJlN1Ym1pdD1FTkUmREVQQT0wJk9yZGVyPUJFU1RNQVRDSCZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPXBhaWQrZGlzcGxheSZ1dG1fY2FtcGFpZ249S05DLUdvb2dsZUtXTGVzcy1fLWNvb3AtXy1XRC1fLUhEREdPTEQtXy0wOTA0MjQmaWQwPUdvb2dsZSZpZDE9MjE2NjA3NTQ5ODAmaWQyPTE3Mzc4NjM1MTE4NCZpZDM9JmlkND0maWQ1PSZpZDY9JmlkNz0yODQwJmlkOD0maWQ5PWQmaWQxMD1jJmlkMTE9JmlkMTI9e2djbGlkfSZpZDEzPSZpZDE0PSZpZDE1PVkmaWQxNj03MTIxOTczMzMzNTcmaWQxNz0maWQxOD13aW5zY3AubmV0JmlkMTk9cnVub2ZuZXR3b3JrJTNBJTNBMTAwJmlkMjA9JmlkMjE9JmlkMjI9JmlkMjM9JmlkMjQ9JmlkMjU9JmlkMjY9JmlkMjc9WSZpZDI4PSZpZDI5PSZpZDMwPTE5NzAyMzQwMTYxNjcyNzUzODE5JmlkMzE9JmlkMzI9JmlkMzM9JmlkMzQ9JmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKEKD49eOLmfKbfBICAQPYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=dM2PrCvZY78&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7drzW6gIA7HHmQY4Iyw7YfvzO6tXDvfkiTY9MwVZ2AB-WAItnU4XF2t1oW2NyE-ByFDavOoQ2HukJHkncCjyc6vSckEe1aoqjCCxgB&template_id=5042&vis=1&ebtr=1&nis=6 false
                                                                		unknown
                                                                https://fundingchoicesmessages.google.com/el/AGSKWxUw68y--w1CMz7Er8SakXH4R0S7Uiv-yVFOeaesYjdxtmzUncYmiR7ncZSD6ZrJl_ariS47RdOW9ny3cqFeamaFk-_8GSVmA-Ha7lCxKVQB3-CEgacz5yNc6i-14nhMEyy31hQ5Aw== false
                                                                  		unknown
                                                                  https://googleads.g.doubleclick.net/btr/view?ai=CdQwcedAjZ5H_IeCa78EP863DmQOx9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDSKoE_AFP0EtLn0pGydfWXKH5GLbyFNQbHkavtBzS9CBxW9RG_iPZGxqcK25ycPNC11bKozj0j5FBWNyONmQSmzaF302m8KTK30OzHihaWKPCbRSZxFCaHxMGtnP6FTlUYassmNMTHpM2UCphb4Z3Z9tPBUglRu6TMImCLUJJh3myq-fiKSRg2qqbOah6KsLwehMkIoFDzuXZqwxYb3uxZywLXhEAWuC0xNyVOADHVFrLeoH-4_OaHyWyjWGCLkdMbP10Pc5-I_QrnQ_rvQRVS1ak3lfwlA0HGKEyDWp57lpr_57aubjFyrojuEhszjYAFBbJ1iehMeupDVoUO_he8hjABNCM5bOHBYgFpMjT2FCgBi6AB7TSpyuoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEMD9BNIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WMqYyd6juYkDmgn1A2h0dHBzOi8vd3d3Lm5ld2VnZy5jb20vcC9wbD9kPVBQU1NKVEhMV0xCUlpDJlN1Ym1pdD1FTkUmREVQQT0wJk9yZGVyPUJFU1RNQVRDSCZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPXBhaWQrZGlzcGxheSZ1dG1fY2FtcGFpZ249S05DLUdvb2dsZUtXTGVzcy1fLWNvb3AtXy1XRC1fLUhEREdPTEQtXy0wOTA0MjQmaWQwPUdvb2dsZSZpZDE9MjE2NjA3NTQ5ODAmaWQyPTE3Mzc4NjM1MTE4NCZpZDM9JmlkND0maWQ1PSZpZDY9JmlkNz0yODQwJmlkOD0maWQ5PWQmaWQxMD1jJmlkMTE9JmlkMTI9e2djbGlkfSZpZDEzPSZpZDE0PSZpZDE1PVkmaWQxNj03MTIxOTczMzMzNTcmaWQxNz0maWQxOD13aW5zY3AubmV0JmlkMTk9cnVub2ZuZXR3b3JrJTNBJTNBMTAwJmlkMjA9JmlkMjE9JmlkMjI9JmlkMjM9JmlkMjQ9JmlkMjU9JmlkMjY9JmlkMjc9WSZpZDI4PSZpZDI5PSZpZDMwPTE5NzAyMzQwMTYxNjcyNzUzODE5JmlkMzE9JmlkMzI9JmlkMzM9JmlkMzQ9JmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKEKD49eOLmfKbfBICAQPYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=dM2PrCvZY78&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7drzW6gIA7HHmQY4Iyw7YfvzO6tXDvfkiTY9MwVZ2AB-WAItnU4XF2t1oW2NyE-ByFDavOoQ2HukJHkncCjyc6vSckEe1aoqjCCxgB&template_id=5042&vis=1&ibtr=1&nis=6 false
                                                                    		unknown
                                                                    https://platform.twitter.com/widgets.js false
                                                                    • URL Reputation: safe
                                                                    		 unknown
                                                                    https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=1870177922&adk=3109115863&adf=385219199&pi=t.ma~as.1870177922&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400372992&bpp=8&bdt=3637&idt=2601&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&correlator=6162542844500&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=30&ady=415&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=2636 false
                                                                      		unknown
                                                                      https://www.facebook.com/v2.10/plugins/like.php?action=like&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd6823e2c4a4e036e%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&layout=button_count&locale=en_US&sdk=joey&share=true&show_faces=false&size=small false
                                                                        		unknown
                                                                        https://winscp-static-746341.c.cdn77.org/assets/images/card-logo-mastercard.svg?v=7034 false
                                                                          		unknown
                                                                          https://ep2.adtrafficquality.google/generate_204?RS9A5A false
                                                                            		unknown
                                                                            https://www.google.com/pagead/drt/ui false
                                                                              		unknown
                                                                              https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 false
                                                                                		unknown
                                                                                https://static.xx.fbcdn.net/rsrc.php/v3iLl54/yo/l/en_US/KroQaZupEyF.js false
                                                                                  		unknown
                                                                                  https://winscp-static-746341.c.cdn77.org/assets/images/logos/linkedin.svg?v=7034 false
                                                                                    		unknown
                                                                                    https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/y_/l/en_US/mEgqcU3S6-1.js false
                                                                                      		unknown
                                                                                      https://static.xx.fbcdn.net/rsrc.php/v3iEBX4/yr/l/en_US/jbkX5llFMP5.js false
                                                                                        		unknown
                                                                                        https://static.xx.fbcdn.net/rsrc.php/v3/yL/r/a2pSKe6-4N_.js false
                                                                                          		unknown
                                                                                          https://scontent-phx1-1.xx.fbcdn.net/v/t39.30808-6/354608791_694424149157111_1515153202108507038_n.png?stp=dst-png_s350x350&_nc_cat=110&ccb=1-7&_nc_sid=4cb600&_nc_ohc=-ogClF-bw9IQ7kNvgEkPep7&_nc_zt=23&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYBM1_XO-Gu7D2B4cl2zhQqQEAF28ThdFvPsIF23tTRHKA&oe=67299B7D false
                                                                                            		unknown