Edit tour

Windows Analysis Report
WinSCP-6.3.5-Setup.exe

Overview

General Information

Sample name:	WinSCP-6.3.5-Setup.exe
Analysis ID:	1546344
MD5:	d77322dc956da781905d553e3feb9153
SHA1:	89db51587ecfb071fe71add71050e2d9e5377539
SHA256:	49e17ce8b1df637a71dfac483e9fef72f6747e4235cce3871a1bb3f3a1371127
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Creates an undocumented autostart registry key

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Drops PE files

Found dropped PE file which has not been started or loaded

HTML page contains hidden javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries keyboard layouts

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Classes Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

WinSCP-6.3.5-Setup.exe (PID: 7060 cmdline: "C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe" MD5: D77322DC956DA781905D553E3FEB9153)

WinSCP-6.3.5-Setup.tmp (PID: 2940 cmdline: "C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp" /SL5="$20406,10489221,930816,C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe" MD5: 11878001A28CE434F6EB02AA85C3199B)

regsvr32.exe (PID: 2976 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\WinSCP\DragExt64.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 5676 cmdline: /s "C:\Program Files (x86)\WinSCP\DragExt64.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

WinSCP.exe (PID: 4460 cmdline: "C:\Program Files (x86)\WinSCP\WinSCP.exe" /RegisterForDefaultProtocols MD5: 7C743153124BA4D8CE99C7DFC77F1C06)

WinSCP.exe (PID: 2800 cmdline: "C:\Program Files (x86)\WinSCP\WinSCP.exe" /ImportSitesIfAny MD5: 7C743153124BA4D8CE99C7DFC77F1C06)

WinSCP.exe (PID: 6268 cmdline: "C:\Program Files (x86)\WinSCP\WinSCP.exe" /Usage=TypicalInstallation:1,InstallationsUser+,InstallationParentProcess@,InstallationsFirstTypical+,LastInstallationAutomaticUpgrade:0,InstallationsGettingStarted+,InstallationsLaunch+, MD5: 7C743153124BA4D8CE99C7DFC77F1C06)

chrome.exe (PID: 6936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 --field-trial-handle=3276,i,636435449627489665,5607076903918076227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

WinSCP.exe (PID: 1548 cmdline: "C:\Program Files (x86)\WinSCP\WinSCP.exe" MD5: 7C743153124BA4D8CE99C7DFC77F1C06)

cleanup

Sigma Signatures

Sigma detected: Classes Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: {E15E1D68-0D1C-49F7-BEB8-812B1E00FA60}, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\regsvr32.exe, ProcessId: 5676, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\WinSCPCopyHook\(Default)

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T19:45:41.503825+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	49756	TCP
2024-10-31T19:46:22.198363+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	60493	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T19:45:42.291543+0100	2028371	3	Unknown Traffic	192.168.2.6	49763	88.198.21.111	443	TCP
2024-10-31T19:46:06.505711+0100	2028371	3	Unknown Traffic	192.168.2.6	60284	88.198.21.111	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0

HTTP Parser: Base64 decoded: [null,null,null,3]

Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon
Source: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	HTTP Parser: No favicon

Source: WinSCP-6.3.5-Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:60630 version: TLS 1.0

Source: WinSCP-6.3.5-Setup.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.198.21.111:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:60186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:60239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.198.21.111:443 -> 192.168.2.6:60284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:60372 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:60410 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:60493 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:60599 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:60648 version: TLS 1.2

Source: WinSCP-6.3.5-Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: c:\misto\wscpblda\build\dotnet\obj\Release\net40\WinSCPnet.pdbSHA256 source: is-MITNN.tmp.2.dr
Source:	Binary string: c:\misto\wscpblda\build\dotnet\obj\Release\net40\WinSCPnet.pdb source: is-MITNN.tmp.2.dr

Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: z:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: x:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: v:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: t:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: r:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: p:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: n:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: l:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: j:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: h:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: f:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: b:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: y:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: w:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: u:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: s:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: q:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: o:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: m:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: k:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: i:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: g:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: c:	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	File opened: a:	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.6:60162 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 104.244.42.200 104.244.42.200
Source: Joe Sandbox View	IP Address: 88.198.21.111 88.198.21.111
Source: Joe Sandbox View	IP Address: 104.244.42.136 104.244.42.136
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49763 -> 88.198.21.111:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:60284 -> 88.198.21.111:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49756
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:60493

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:60630 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AhOBy5EpbwybKXU&MD=OECBEy2h HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /install.php?mode=sponsorrequest&ver=6.3.5&lang=en&prevver=&scale=100&images= HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: winscp.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /install.php?mode=report&installed=1&silent=0&ver=6.3.5&lang=en&prevver=&sponsorstatus=F&sponsor=&sponsoringclicked=0& HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: winscp.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP/1.1Host: winscp.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0 HTTP/1.1Host: winscp.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/css/bootstrap-modified.css?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/slick/slick.css?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/styles-all.css?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/paypal.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/card-logo-visa.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/images/message-ok.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/arrow-horiz-soft.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/paypal.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/card-logo-visa.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/images/card-logo-mastercard.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/card-logo-amex.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/card-logo-unknown.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/logos/logo.png?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/sdk.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgets.js HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/fonts/roboto-regular.woff2?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://winscp.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fonts/roboto-light.woff2?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://winscp.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fonts/robotomono-bold.woff2?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://winscp.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fonts/robotomono-regular.woff2?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://winscp.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/jquery.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/bootstrap.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/arrow-horiz-soft.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/message-ok.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /en_US/sdk.js?hash=83bef744925782dcc0c213c2e72a4c1a HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://winscp.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwinscp.net HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/js/slick/slick.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/footer.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/svg-src-polyfill.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/slick-init.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/matchMedia.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/mediaQueryListener.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/card-logo-unknown.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/logos/logo.png?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/card-logo-amex.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/card-logo-mastercard.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/sdk.js HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/bootstrap.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/jquery.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgets.js HTTP/1.1Host: platform.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /en_US/sdk.js?hash=83bef744925782dcc0c213c2e72a4c1a HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/js/jquery.toggleSections.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/images/logos/facebook.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /x/oauth/status?client_id=215157521840905&input_token&origin=1&redirect_uri=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&sdk=joey&wants_cookie_data=false HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://winscp.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/images/logos/twitter.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/svg-src-polyfill.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/footer.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/matchMedia.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/mediaQueryListener.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/slick-init.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/slick/slick.min.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/logos/linkedin.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /pagead/html/r20241030/r20190131/zrt_lookup_fy2021.html HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=1870177922&adk=3109115863&adf=385219199&pi=t.ma~as.1870177922&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400372992&bpp=8&bdt=3637&idt=2601&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&correlator=6162542844500&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=30&ady=415&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=2636 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=6822944091&adk=2358527528&adf=101933203&pi=t.ma~as.6822944091&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373001&bpp=4&bdt=3647&idt=2647&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280&correlator=6162542844500&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=30&ady=1480&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=2652 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-1682759925159355&output=html&h=200&slotname=4424189075&adk=724910714&adf=1108650154&pi=t.ma~as.4424189075&w=233&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=3&format=233x200&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=1&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373005&bpp=2&bdt=3651&idt=2659&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280%2C649x280&correlator=6162542844500&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=739&ady=853&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&fsb=1&dtd=2666 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/ads?client=ca-pub-1682759925159355&output=html&adk=1812271804&adf=3025194257&abgtt=9&lmt=1730400375&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&pra=7&wgl=1&aihb=0&asro=0&ailel=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aslmct=0.7&asamct=0.7&aiict=1&aiapm=0.3221&aiapmi=0.33938&aiombap=1&aiopts=1&aief=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373007&bpp=6&bdt=3652&idt=2675&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280%2C649x280%2C233x200&nras=1&correlator=6162542844500&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fsapi=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=4&uci=a!4&fsb=1&dtd=2681 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /settings?session_id=dd9b3d302a9b92ee788c222ff5c4209225028450 HTTP/1.1Host: syndication.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://platform.twitter.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://platform.twitter.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/images/login.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/language.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/chevron-down.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp-static-746341.c.cdn77.org/assets/css/styles-all.css?v=7034Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/logos/facebook.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /x/oauth/status?client_id=215157521840905&input_token&origin=1&redirect_uri=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&sdk=joey&wants_cookie_data=false HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/logos/twitter.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2.10/plugins/page.php?adapt_container_width=true&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3042ea6f0e0127ef%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=664&height=400&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2.10/plugins/like.php?action=like&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd6823e2c4a4e036e%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&layout=button_count&locale=en_US&sdk=joey&share=true&show_faces=false&size=small HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /td/rul/1002628342?random=1730400376633&cv=11&fst=1730400376633&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4au0v9178989015za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&hn=www.googleadservices.com&frm=0&tiba=After%20Installation%20%3A%3A%20WinSCP&npa=0&pscdl=noapi&auid=1522412495.1730400377&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-97R014CLMR&gacid=1597569809.1730400377&gtm=45je4au0v9178989015za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101823848~101878899~101878944~101925629&z=499980162 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/jquery.toggleSections.js?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /settings?session_id=dd9b3d302a9b92ee788c222ff5c4209225028450 HTTP/1.1Host: syndication.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/images/logos/linkedin.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/login.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/language.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/chevron-down.svg?v=7034 HTTP/1.1Host: winscp-static-746341.c.cdn77.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v4/yL/l/0,cross/hx1QQk3LL6t.css HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/y8/r/m5WIH4zGOsj.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/y3/r/Vvet8_5H-wT.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3i7M54/y0/l/en_US/zYyn94Uppv5.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3issO4/yU/l/en_US/tC2E_WEPqHv.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yz/r/c64elx0V1Fa.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /pagead/adview?ai=CRgsAedAjZ7PyId2W78EPhPzI-A3Iha_UevSC4ebIE7_hHhABIJ7FjCRgyQagAbi97skoyAEJqQLUGZicGIpJPqgDAcgDywSqBIUCT9C6qZTGwntpOmlN8KMcESvEmXDCbLBJcQU8zM0SKGI6c9q6vi5j1GjqI81sswzYeRdPP3CqENOkB99L9u2XQ98t3H2nNuauEvoRS_EZ37khZuio54OCph_BGASL6xUjGd954VFKggisKf7njR0xo6vMECJAqmLEoR8RDZIOT44VHqCW26qykBha1TdqdK7WCuBDQ_aX-W8y0fZHBDua4IBDqSAL24aAEs_q9ixKfgoXuH3e_dEM8eMno2HNlaPYBtJs0NgrVrpdd0qZcNhCoYPqMakOE3GcBgL77jCvP9yf4MohHbrsNnNQ4tWFBVnTnLNiGQ9_Yap-nWGtk_FufglWbvvPwATk-e_6hgWIBY-LnI5RoAYugAe49b6pA6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQmb0k0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY4YPJ3qO5iQOaCcYDaHR0cHM6Ly93d3cuZmxpcGthcnRjb21tZXJjZWNsb3VkLmNvbS8_dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPWRpc3BsYXlfYXVkaWVuY2Vfc2VnbWVudF9pbmJ1aWx0X3RhcmdldGluZ19VUyZ1dG1fdGVybT1kaXNwbGF5X2F1ZGllbmNlX3NlZ21lbnRfaW5idWlsdF90YXJnZXRpbmdfVVMmdXRtX3Rlcm09JnV0bV9jYW1wYWlnbj0lNUJEaXNwbGF5JTVEK1VTKy0rQXVkaWVuY2UrU2VnbWVudHMrKy0rSW5idWlsdCtUYXJnZXRpbmcmdXRtX3NvdXJjZT1hZHdvcmRzJnV0bV9tZWRpdW09cHBjJmhzYV9hY2M9ODc2MjQ2NTk0OCZoc2FfY2FtPTIxNzczMDkyMjM5JmhzYV9ncnA9MTczNjY2OTkxMzMyJmhzYV9hZD03MTU4NzIxNDAxMjImaHNhX3NyYz1kJmhzYV90Z3Q9JmhzYV9rdz0maHNhX210PSZoc2FfbmV0PWFkd29yZHMmaHNhX3Zlcj0zJmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKELCXkZ79n9n8HhICAQO4E-QD2BMDiBQE0BUBmBYBgBcBshceChoIABIUcHViLTE2ODI3NTk5MjUxNTkzNTUYABgBuhcCOAGyGAkSArFfGC4iAQDQGAE&sigh=B_zKQ7fC5Js&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7dtTKmuHcIzYKGSqJdKUCZ9aXLRDivlsuq6E-te2CRc3jGOdg7nKpuT_RzSGqelLtZwt2bW49uVmFO5pbzTho4alaQKMEclVM4yhgB&template_id=484&vis=1&ebtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: trigger;navigation-source, event-sourceReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=1870177922&adk=3109115863&adf=385219199&pi=t.ma~as.1870177922&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400372992&bpp=8&bdt=3637&idt=2601&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&correlator=6162542844500&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1
Source: global traffic	HTTP traffic detected: GET /js/button.856debeac157d9669cf51e73a08fbc93.js HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /pagead/adview?ai=CdQwcedAjZ5H_IeCa78EP863DmQOx9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDSKoE_AFP0EtLn0pGydfWXKH5GLbyFNQbHkavtBzS9CBxW9RG_iPZGxqcK25ycPNC11bKozj0j5FBWNyONmQSmzaF302m8KTK30OzHihaWKPCbRSZxFCaHxMGtnP6FTlUYassmNMTHpM2UCphb4Z3Z9tPBUglRu6TMImCLUJJh3myq-fiKSRg2qqbOah6KsLwehMkIoFDzuXZqwxYb3uxZywLXhEAWuC0xNyVOADHVFrLeoH-4_OaHyWyjWGCLkdMbP10Pc5-I_QrnQ_rvQRVS1ak3lfwlA0HGKEyDWp57lpr_57aubjFyrojuEhszjYAFBbJ1iehMeupDVoUO_he8hjABNCM5bOHBYgFpMjT2FCgBi6AB7TSpyuoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEMD9BNIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WMqYyd6juYkDmgn1A2h0dHBzOi8vd3d3Lm5ld2VnZy5jb20vcC9wbD9kPVBQU1NKVEhMV0xCUlpDJlN1Ym1pdD1FTkUmREVQQT0wJk9yZGVyPUJFU1RNQVRDSCZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPXBhaWQrZGlzcGxheSZ1dG1fY2FtcGFpZ249S05DLUdvb2dsZUtXTGVzcy1fLWNvb3AtXy1XRC1fLUhEREdPTEQtXy0wOTA0MjQmaWQwPUdvb2dsZSZpZDE9MjE2NjA3NTQ5ODAmaWQyPTE3Mzc4NjM1MTE4NCZpZDM9JmlkND0maWQ1PSZpZDY9JmlkNz0yODQwJmlkOD0maWQ5PWQmaWQxMD1jJmlkMTE9JmlkMTI9e2djbGlkfSZpZDEzPSZpZDE0PSZpZDE1PVkmaWQxNj03MTIxOTczMzMzNTcmaWQxNz0maWQxOD13aW5zY3AubmV0JmlkMTk9cnVub2ZuZXR3b3JrJTNBJTNBMTAwJmlkMjA9JmlkMjE9JmlkMjI9JmlkMjM9JmlkMjQ9JmlkMjU9JmlkMjY9JmlkMjc9WSZpZDI4PSZpZDI5PSZpZDMwPTE5NzAyMzQwMTYxNjcyNzUzODE5JmlkMzE9JmlkMzI9JmlkMzM9JmlkMzQ9JmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKEKD49eOLmfKbfBICAQPYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=dM2PrCvZY78&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7drzW6gIA7HHmQY4Iyw7YfvzO6tXDvfkiTY9MwVZ2AB-WAItnU4XF2t1oW2NyE-ByFDavOoQ2HukJHkncCjyc6vSckEe1aoqjCCxgB&template_id=5042&vis=1&ebtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: event-source, trigger;navigation-sourceReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=200&slotname=4424189075&adk=724910714&adf=1108650154&pi=t.ma~as.4424189075&w=233&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=3&format=233x200&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=1&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373005&bpp=2&bdt=3651&idt=2659&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280%2C649x280&corr
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1002628342/?random=1730400376633&cv=11&fst=1730397600000&bg=ffffff&guid=ON&async=1&gtm=45je4au0v9178989015za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&hn=www.googleadservices.com&frm=0&tiba=After%20Installation%20%3A%3A%20WinSCP&npa=0&pscdl=noapi&auid=1522412495.1730400377&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7d0Gj3LPLJUUEyxSv0ZhifbpmjDRF7TQ&random=2553054213&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/ca-pub-1682759925159355?href=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation&ers=2 HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yD/r/FEppCFCt76d.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yF/r/p55HfXW__mM.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iLl54/yo/l/en_US/KroQaZupEyF.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yA/r/0q927cN1GZe.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iEpO4/y_/l/en_US/mEgqcU3S6-1.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.facebook.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1730400379385%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=dd9b3d302a9b92ee788c222ff5c4209225028450 HTTP/1.1Host: syndication.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html HTTP/1.1Host: platform.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/1002628342/?random=1730400376633&cv=11&fst=1730400376633&bg=ffffff&guid=ON&async=1&gtm=45je4au0v9178989015za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&hn=www.googleadservices.com&frm=0&tiba=After%20Installation%20%3A%3A%20WinSCP&npa=0&pscdl=noapi&auid=1522412495.1730400377&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/y3/r/Vvet8_5H-wT.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yz/r/c64elx0V1Fa.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3issO4/yU/l/en_US/tC2E_WEPqHv.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-6/354608791_694424149157111_1515153202108507038_n.png?stp=dst-png_s350x350&_nc_cat=110&ccb=1-7&_nc_sid=4cb600&_nc_ohc=-ogClF-bw9IQ7kNvgEkPep7&_nc_zt=23&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYBM1_XO-Gu7D2B4cl2zhQqQEAF28ThdFvPsIF23tTRHKA&oe=67299B7D HTTP/1.1Host: scontent-phx1-1.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3i7M54/y0/l/en_US/zYyn94Uppv5.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/button.856debeac157d9669cf51e73a08fbc93.js HTTP/1.1Host: platform.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/y8/r/m5WIH4zGOsj.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/351156904_264152706143983_3109134666055357303_n.jpg?stp=cp0_dst-jpg_s50x50&_nc_cat=100&ccb=1-7&_nc_sid=6738e8&_nc_ohc=VaXOflnuDHcQ7kNvgGYZY5H&_nc_zt=24&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYAVosyj27yGB-nAl8xsHDz4QfMDJaExqAWoiWH0J70L6Q&oe=672987CE HTTP/1.1Host: scontent-phx1-1.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AhOBy5EpbwybKXU&MD=OECBEy2h HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yy/r/Chl8448Q49S.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yw/r/UXtr_j2Fwe-.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://static.xx.fbcdn.net/rsrc.php/v4/yL/l/0,cross/hx1QQk3LL6t.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yo/r/UkQNrcmXeur.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f/AGSKWxV5O44YGhvfZhQy4ogLM_PJwYD2J-q58fjFOXUPEo0ud_bBWLGZeF8hIL6QMrtPWOHW4dljyykVlzdfOmevJlZLPj1bcbY3RqZWewWXBRmHQNYsDaeAST1Glqt-532zME_n6k71Yw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMwNDAwMzgwLDcwNjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly93aW5zY3AubmV0L2VuZy9kb2NzL2FmdGVyX2luc3RhbGxhdGlvbiIsbnVsbCxbWzgsIllzZ09PY3R1a3JJIl0sWzksImVuLVVTIl0sWzE4LCJbW1swXV1dIl0sWzE5LCIyIl1dXQ HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/drt/s?v=r20120211 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://googleads.g.doubleclick.net/pagead/html/r20241030/r20190131/zrt_lookup_fy2021.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic	HTTP traffic detected: GET /pagead/adview?ai=CDhqPedAjZ9XhIuOU78EP5YC10A6x9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDywSqBP0BT9DAQTMhS-ILCbEJJDaWMbiyUvke5GnZ1g8CvOCini_79bZducRK34cVbb4bnyTwixuYZ1DkjJJjuDY889SHTuGDQva4eEZB_oNxpmnneSjE3_DVl5CYeAU8uEeqaSVzHXNVSr-J1rK4-DFyIMJAdDUwj7cgw7_vCRMNmmQ0t_y1a32sJVzdBe8dfoe6D0_iL_A2N2kAWUuTo6k9Ka1PlYMpNCEVdCQn1B9y719lKYjTkqAC4NpptWUbmnuDbc-2SCkZfkDIGH4BcI9X9pSyGbsD37z2JfWntEMauY439J0AmRDAcL_D4-GvH2kDO_Ub7vF0FZbPBxqINFejzcAE0Izls4cFiAWkyNPYUKAGLoAHtNKnK6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQyI4b0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY2-jJ3qO5iQOaCYAEaHR0cHM6Ly93d3cubmV3ZWdnLmNvbS9wL3BsP2Q9UFBTU0pUSExXTEJSWkMmU3VibWl0PUVORSZERVBBPTAmT3JkZXI9QkVTVE1BVENIJnV0bV9zb3VyY2U9Z29vZ2xlJnV0bV9tZWRpdW09cGFpZCtkaXNwbGF5JnV0bV9jYW1wYWlnbj1LTkMtR29vZ2xlS1dMZXNzLV8tY29vcC1fLVdELV8tSERER09MRC1fLTA5MDQyNCZpZDA9R29vZ2xlJmlkMT0yMTY2MDc1NDk4MCZpZDI9MTczNzg2MzUxMTg0JmlkMz0maWQ0PSZpZDU9JmlkNj0maWQ3PTI4NDAmaWQ4PSZpZDk9ZCZpZDEwPWMmaWQxMT0maWQxMj17Z2NsaWR9JmlkMTM9JmlkMTQ9JmlkMTU9WSZpZDE2PTcxMjE5NzMzMzM1NyZpZDE3PSZpZDE4PXdpbnNjcC5uZXQmaWQxOT1zZWdtZW50X2JlX2FfMzIzMzkwOTI0MzA0MDEzODUxNCZpZDIwPSZpZDIxPSZpZDIyPSZpZDIzPSZpZDI0PSZpZDI1PSZpZDI2PSZpZDI3PVkmaWQyOD0maWQyOT0maWQzMD0xMDY1MzEyMTQ0MTEzMDAzOTE2OSZpZDMxPSZpZDMyPSZpZDMzPSZpZDM0PSZnYWRfc291cmNlPTWACgHICwHaDBEKCxDQtdnj677UgrUBEgIBA7gT5APYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=0aOzgEyc5FM&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwCa7L7dZM_x682mhf2KIIDx5yOCNjEcVDTj_NnjhLB_d36XrSCZcl8KEBgHXPYWQGe_b0nes6fdyOcCKV_xLeh2Kt4adEcMktFkeO9JsmwYAQ&template_id=484&vis=1&ebtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: event-source, trigger;navigation-sourceReferer: https://googleads.g.doubleclick.net/pagead/html/r20241030/r20190131/zrt_lookup_fy2021.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /btr/view?ai=CRgsAedAjZ7PyId2W78EPhPzI-A3Iha_UevSC4ebIE7_hHhABIJ7FjCRgyQagAbi97skoyAEJqQLUGZicGIpJPqgDAcgDywSqBIUCT9C6qZTGwntpOmlN8KMcESvEmXDCbLBJcQU8zM0SKGI6c9q6vi5j1GjqI81sswzYeRdPP3CqENOkB99L9u2XQ98t3H2nNuauEvoRS_EZ37khZuio54OCph_BGASL6xUjGd954VFKggisKf7njR0xo6vMECJAqmLEoR8RDZIOT44VHqCW26qykBha1TdqdK7WCuBDQ_aX-W8y0fZHBDua4IBDqSAL24aAEs_q9ixKfgoXuH3e_dEM8eMno2HNlaPYBtJs0NgrVrpdd0qZcNhCoYPqMakOE3GcBgL77jCvP9yf4MohHbrsNnNQ4tWFBVnTnLNiGQ9_Yap-nWGtk_FufglWbvvPwATk-e_6hgWIBY-LnI5RoAYugAe49b6pA6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQmb0k0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY4YPJ3qO5iQOaCcYDaHR0cHM6Ly93d3cuZmxpcGthcnRjb21tZXJjZWNsb3VkLmNvbS8_dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPWRpc3BsYXlfYXVkaWVuY2Vfc2VnbWVudF9pbmJ1aWx0X3RhcmdldGluZ19VUyZ1dG1fdGVybT1kaXNwbGF5X2F1ZGllbmNlX3NlZ21lbnRfaW5idWlsdF90YXJnZXRpbmdfVVMmdXRtX3Rlcm09JnV0bV9jYW1wYWlnbj0lNUJEaXNwbGF5JTVEK1VTKy0rQXVkaWVuY2UrU2VnbWVudHMrKy0rSW5idWlsdCtUYXJnZXRpbmcmdXRtX3NvdXJjZT1hZHdvcmRzJnV0bV9tZWRpdW09cHBjJmhzYV9hY2M9ODc2MjQ2NTk0OCZoc2FfY2FtPTIxNzczMDkyMjM5JmhzYV9ncnA9MTczNjY2OTkxMzMyJmhzYV9hZD03MTU4NzIxNDAxMjImaHNhX3NyYz1kJmhzYV90Z3Q9JmhzYV9rdz0maHNhX210PSZoc2FfbmV0PWFkd29yZHMmaHNhX3Zlcj0zJmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKELCXkZ79n9n8HhICAQO4E-QD2BMDiBQE0BUBmBYBgBcBshceChoIABIUcHViLTE2ODI3NTk5MjUxNTkzNTUYABgBuhcCOAGyGAkSArFfGC4iAQDQGAE&sigh=B_zKQ7fC5Js&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7dtTKmuHcIzYKGSqJdKUCZ9aXLRDivlsuq6E-te2CRc3jGOdg7nKpuT_RzSGqelLtZwt2bW49uVmFO5pbzTho4alaQKMEclVM4yhgB&template_id=484&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: trigger;navigation-source, event-sourceReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=1870177922&adk=3109115863&adf=385219199&pi=t.ma~as.1870177922&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400372992&bpp=8&bdt=3637&idt=2601&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&correlator=6162542844500&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yD/r/FEppCFCt76d.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yH/r/xgVgalBG80z.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://static.xx.fbcdn.net/rsrc.php/v4/yL/l/0,cross/hx1QQk3LL6t.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22215157521840905%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F%22%2C%22width%22%3A340%2C%22height%22%3A400%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Atrue%2C%22referer_uri%22%3A%22https%3A%2F%2Fwinscp.net%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__req=1&__hs=20027.BP%3Aplugin_default_pkg.2.0..0.0&dpr=1&__ccg=GOOD&__rev=1017838824&__s=%3A%3Aplzgdo&__hsi=7432013032883179535&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx60Vo1upE4W0OE1vE662y0um4o5-0me0sy0ny0oi0zE5W0PU1AE17U2ZwrU1Xo1UU3jwea&__csr=&locale=en_US&__sp=1 HTTP/1.1Host: www.facebook.comConnection: keep-aliveX-FB-LSD: JmzYf9flXws1Rh6-Wn6T0usec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-ASBD-ID: 129477sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.facebook.com/v2.10/plugins/page.php?adapt_container_width=true&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3042ea6f0e0127ef%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=664&height=400&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timelineAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yF/r/p55HfXW__mM.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1002628342/?random=1730400376633&cv=11&fst=1730397600000&bg=ffffff&guid=ON&async=1&gtm=45je4au0v9178989015za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&hn=www.googleadservices.com&frm=0&tiba=After%20Installation%20%3A%3A%20WinSCP&npa=0&pscdl=noapi&auid=1522412495.1730400377&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7d0Gj3LPLJUUEyxSv0ZhifbpmjDRF7TQ&random=2553054213&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /btr/view?ai=CdQwcedAjZ5H_IeCa78EP863DmQOx9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDSKoE_AFP0EtLn0pGydfWXKH5GLbyFNQbHkavtBzS9CBxW9RG_iPZGxqcK25ycPNC11bKozj0j5FBWNyONmQSmzaF302m8KTK30OzHihaWKPCbRSZxFCaHxMGtnP6FTlUYassmNMTHpM2UCphb4Z3Z9tPBUglRu6TMImCLUJJh3myq-fiKSRg2qqbOah6KsLwehMkIoFDzuXZqwxYb3uxZywLXhEAWuC0xNyVOADHVFrLeoH-4_OaHyWyjWGCLkdMbP10Pc5-I_QrnQ_rvQRVS1ak3lfwlA0HGKEyDWp57lpr_57aubjFyrojuEhszjYAFBbJ1iehMeupDVoUO_he8hjABNCM5bOHBYgFpMjT2FCgBi6AB7TSpyuoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEMD9BNIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WMqYyd6juYkDmgn1A2h0dHBzOi8vd3d3Lm5ld2VnZy5jb20vcC9wbD9kPVBQU1NKVEhMV0xCUlpDJlN1Ym1pdD1FTkUmREVQQT0wJk9yZGVyPUJFU1RNQVRDSCZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPXBhaWQrZGlzcGxheSZ1dG1fY2FtcGFpZ249S05DLUdvb2dsZUtXTGVzcy1fLWNvb3AtXy1XRC1fLUhEREdPTEQtXy0wOTA0MjQmaWQwPUdvb2dsZSZpZDE9MjE2NjA3NTQ5ODAmaWQyPTE3Mzc4NjM1MTE4NCZpZDM9JmlkND0maWQ1PSZpZDY9JmlkNz0yODQwJmlkOD0maWQ5PWQmaWQxMD1jJmlkMTE9JmlkMTI9e2djbGlkfSZpZDEzPSZpZDE0PSZpZDE1PVkmaWQxNj03MTIxOTczMzMzNTcmaWQxNz0maWQxOD13aW5zY3AubmV0JmlkMTk9cnVub2ZuZXR3b3JrJTNBJTNBMTAwJmlkMjA9JmlkMjE9JmlkMjI9JmlkMjM9JmlkMjQ9JmlkMjU9JmlkMjY9JmlkMjc9WSZpZDI4PSZpZDI5PSZpZDMwPTE5NzAyMzQwMTYxNjcyNzUzODE5JmlkMzE9JmlkMzI9JmlkMzM9JmlkMzQ9JmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKEKD49eOLmfKbfBICAQPYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=dM2PrCvZY78&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7drzW6gIA7HHmQY4Iyw7YfvzO6tXDvfkiTY9MwVZ2AB-WAItnU4XF2t1oW2NyE-ByFDavOoQ2HukJHkncCjyc6vSckEe1aoqjCCxgB&template_id=5042&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: event-source, trigger, not-navigation-sourceReferer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=200&slotname=4424189075&adk=724910714&adf=1108650154&pi=t.ma~as.4424189075&w=233&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=3&format=233x200&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=1&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373005&bpp=2&bdt=3651&idt=2659&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280%2C649x280&corr
Source: global traffic	HTTP traffic detected: GET /btr/view?ai=CDhqPedAjZ9XhIuOU78EP5YC10A6x9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDywSqBP0BT9DAQTMhS-ILCbEJJDaWMbiyUvke5GnZ1g8CvOCini_79bZducRK34cVbb4bnyTwixuYZ1DkjJJjuDY889SHTuGDQva4eEZB_oNxpmnneSjE3_DVl5CYeAU8uEeqaSVzHXNVSr-J1rK4-DFyIMJAdDUwj7cgw7_vCRMNmmQ0t_y1a32sJVzdBe8dfoe6D0_iL_A2N2kAWUuTo6k9Ka1PlYMpNCEVdCQn1B9y719lKYjTkqAC4NpptWUbmnuDbc-2SCkZfkDIGH4BcI9X9pSyGbsD37z2JfWntEMauY439J0AmRDAcL_D4-GvH2kDO_Ub7vF0FZbPBxqINFejzcAE0Izls4cFiAWkyNPYUKAGLoAHtNKnK6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQyI4b0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY2-jJ3qO5iQOaCYAEaHR0cHM6Ly93d3cubmV3ZWdnLmNvbS9wL3BsP2Q9UFBTU0pUSExXTEJSWkMmU3VibWl0PUVORSZERVBBPTAmT3JkZXI9QkVTVE1BVENIJnV0bV9zb3VyY2U9Z29vZ2xlJnV0bV9tZWRpdW09cGFpZCtkaXNwbGF5JnV0bV9jYW1wYWlnbj1LTkMtR29vZ2xlS1dMZXNzLV8tY29vcC1fLVdELV8tSERER09MRC1fLTA5MDQyNCZpZDA9R29vZ2xlJmlkMT0yMTY2MDc1NDk4MCZpZDI9MTczNzg2MzUxMTg0JmlkMz0maWQ0PSZpZDU9JmlkNj0maWQ3PTI4NDAmaWQ4PSZpZDk9ZCZpZDEwPWMmaWQxMT0maWQxMj17Z2NsaWR9JmlkMTM9JmlkMTQ9JmlkMTU9WSZpZDE2PTcxMjE5NzMzMzM1NyZpZDE3PSZpZDE4PXdpbnNjcC5uZXQmaWQxOT1zZWdtZW50X2JlX2FfMzIzMzkwOTI0MzA0MDEzODUxNCZpZDIwPSZpZDIxPSZpZDIyPSZpZDIzPSZpZDI0PSZpZDI1PSZpZDI2PSZpZDI3PVkmaWQyOD0maWQyOT0maWQzMD0xMDY1MzEyMTQ0MTEzMDAzOTE2OSZpZDMxPSZpZDMyPSZpZDMzPSZpZDM0PSZnYWRfc291cmNlPTWACgHICwHaDBEKCxDQtdnj677UgrUBEgIBA7gT5APYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=0aOzgEyc5FM&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwCa7L7dZM_x682mhf2KIIDx5yOCNjEcVDTj_NnjhLB_d36XrSCZcl8KEBgHXPYWQGe_b0nes6fdyOcCKV_xLeh2Kt4adEcMktFkeO9JsmwYAQ&template_id=484&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: trigger, event-sourceReferer: https://googleads.g.doubleclick.net/pagead/html/r20241030/r20190131/zrt_lookup_fy2021.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic	HTTP traffic detected: GET /i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1730400379385%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=dd9b3d302a9b92ee788c222ff5c4209225028450 HTTP/1.1Host: syndication.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/drt/ui HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/351156904_264152706143983_3109134666055357303_n.jpg?stp=cp0_dst-jpg_s50x50&_nc_cat=100&ccb=1-7&_nc_sid=6738e8&_nc_ohc=VaXOflnuDHcQ7kNvgGYZY5H&_nc_zt=24&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYAVosyj27yGB-nAl8xsHDz4QfMDJaExqAWoiWH0J70L6Q&oe=672987CE HTTP/1.1Host: scontent-phx1-1.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-6/354608791_694424149157111_1515153202108507038_n.png?stp=dst-png_s350x350&_nc_cat=110&ccb=1-7&_nc_sid=4cb600&_nc_ohc=-ogClF-bw9IQ7kNvgEkPep7&_nc_zt=23&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYBM1_XO-Gu7D2B4cl2zhQqQEAF28ThdFvPsIF23tTRHKA&oe=67299B7D HTTP/1.1Host: scontent-phx1-1.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yA/r/0q927cN1GZe.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iLl54/yo/l/en_US/KroQaZupEyF.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iEpO4/y_/l/en_US/mEgqcU3S6-1.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yw/r/UXtr_j2Fwe-.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f/AGSKWxXVqfKNZ1AyLwlJa28rypTcnPYQ147ARsW7OU8lpC1j5mMg7ihNSAWwZWfwx32gde6T_ynlDIJeIw88Y8BeD7FG_r7Pbc1RKS50zhIed6Xraq0Ke7LPQmj2IOpqqwkHaXbDYfPd5vuDmdksdZn_qnqVE-1bievWARExb9asQQxzPJaGTJCs1L0jGCIw/_-980x60-/bannerconduit./adsame1./affiliate_show_iframe._bg_ad_left. HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v4/yX/l/0,cross/Yd70QRXJCf6.css HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yo/r/UkQNrcmXeur.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yy/r/Chl8448Q49S.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v4/yk/l/0,cross/GY0bX-iB97s.css HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yH/r/ieeHDjcGsIR.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yg/r/gjl3ldnE08O.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yG/r/IJz2TIVxd6Q.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/drt/si?st=NO_DATA HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://googleads.g.doubleclick.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yL/r/a2pSKe6-4N_.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /btr/view?ai=CRgsAedAjZ7PyId2W78EPhPzI-A3Iha_UevSC4ebIE7_hHhABIJ7FjCRgyQagAbi97skoyAEJqQLUGZicGIpJPqgDAcgDywSqBIUCT9C6qZTGwntpOmlN8KMcESvEmXDCbLBJcQU8zM0SKGI6c9q6vi5j1GjqI81sswzYeRdPP3CqENOkB99L9u2XQ98t3H2nNuauEvoRS_EZ37khZuio54OCph_BGASL6xUjGd954VFKggisKf7njR0xo6vMECJAqmLEoR8RDZIOT44VHqCW26qykBha1TdqdK7WCuBDQ_aX-W8y0fZHBDua4IBDqSAL24aAEs_q9ixKfgoXuH3e_dEM8eMno2HNlaPYBtJs0NgrVrpdd0qZcNhCoYPqMakOE3GcBgL77jCvP9yf4MohHbrsNnNQ4tWFBVnTnLNiGQ9_Yap-nWGtk_FufglWbvvPwATk-e_6hgWIBY-LnI5RoAYugAe49b6pA6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQmb0k0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY4YPJ3qO5iQOaCcYDaHR0cHM6Ly93d3cuZmxpcGthcnRjb21tZXJjZWNsb3VkLmNvbS8_dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPWRpc3BsYXlfYXVkaWVuY2Vfc2VnbWVudF9pbmJ1aWx0X3RhcmdldGluZ19VUyZ1dG1fdGVybT1kaXNwbGF5X2F1ZGllbmNlX3NlZ21lbnRfaW5idWlsdF90YXJnZXRpbmdfVVMmdXRtX3Rlcm09JnV0bV9jYW1wYWlnbj0lNUJEaXNwbGF5JTVEK1VTKy0rQXVkaWVuY2UrU2VnbWVudHMrKy0rSW5idWlsdCtUYXJnZXRpbmcmdXRtX3NvdXJjZT1hZHdvcmRzJnV0bV9tZWRpdW09cHBjJmhzYV9hY2M9ODc2MjQ2NTk0OCZoc2FfY2FtPTIxNzczMDkyMjM5JmhzYV9ncnA9MTczNjY2OTkxMzMyJmhzYV9hZD03MTU4NzIxNDAxMjImaHNhX3NyYz1kJmhzYV90Z3Q9JmhzYV9rdz0maHNhX210PSZoc2FfbmV0PWFkd29yZHMmaHNhX3Zlcj0zJmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKELCXkZ79n9n8HhICAQO4E-QD2BMDiBQE0BUBmBYBgBcBshceChoIABIUcHViLTE2ODI3NTk5MjUxNTkzNTUYABgBuhcCOAGyGAkSArFfGC4iAQDQGAE&sigh=B_zKQ7fC5Js&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7dtTKmuHcIzYKGSqJdKUCZ9aXLRDivlsuq6E-te2CRc3jGOdg7nKpuT_RzSGqelLtZwt2bW49uVmFO5pbzTho4alaQKMEclVM4yhgB&template_id=484&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /platform/plugin/page/logging/ HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iEBX4/yr/l/en_US/jbkX5llFMP5.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yH/r/xgVgalBG80z.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /btr/view?ai=CdQwcedAjZ5H_IeCa78EP863DmQOx9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDSKoE_AFP0EtLn0pGydfWXKH5GLbyFNQbHkavtBzS9CBxW9RG_iPZGxqcK25ycPNC11bKozj0j5FBWNyONmQSmzaF302m8KTK30OzHihaWKPCbRSZxFCaHxMGtnP6FTlUYassmNMTHpM2UCphb4Z3Z9tPBUglRu6TMImCLUJJh3myq-fiKSRg2qqbOah6KsLwehMkIoFDzuXZqwxYb3uxZywLXhEAWuC0xNyVOADHVFrLeoH-4_OaHyWyjWGCLkdMbP10Pc5-I_QrnQ_rvQRVS1ak3lfwlA0HGKEyDWp57lpr_57aubjFyrojuEhszjYAFBbJ1iehMeupDVoUO_he8hjABNCM5bOHBYgFpMjT2FCgBi6AB7TSpyuoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEMD9BNIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WMqYyd6juYkDmgn1A2h0dHBzOi8vd3d3Lm5ld2VnZy5jb20vcC9wbD9kPVBQU1NKVEhMV0xCUlpDJlN1Ym1pdD1FTkUmREVQQT0wJk9yZGVyPUJFU1RNQVRDSCZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPXBhaWQrZGlzcGxheSZ1dG1fY2FtcGFpZ249S05DLUdvb2dsZUtXTGVzcy1fLWNvb3AtXy1XRC1fLUhEREdPTEQtXy0wOTA0MjQmaWQwPUdvb2dsZSZpZDE9MjE2NjA3NTQ5ODAmaWQyPTE3Mzc4NjM1MTE4NCZpZDM9JmlkND0maWQ1PSZpZDY9JmlkNz0yODQwJmlkOD0maWQ5PWQmaWQxMD1jJmlkMTE9JmlkMTI9e2djbGlkfSZpZDEzPSZpZDE0PSZpZDE1PVkmaWQxNj03MTIxOTczMzMzNTcmaWQxNz0maWQxOD13aW5zY3AubmV0JmlkMTk9cnVub2ZuZXR3b3JrJTNBJTNBMTAwJmlkMjA9JmlkMjE9JmlkMjI9JmlkMjM9JmlkMjQ9JmlkMjU9JmlkMjY9JmlkMjc9WSZpZDI4PSZpZDI5PSZpZDMwPTE5NzAyMzQwMTYxNjcyNzUzODE5JmlkMzE9JmlkMzI9JmlkMzM9JmlkMzQ9JmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKEKD49eOLmfKbfBICAQPYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=dM2PrCvZY78&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7drzW6gIA7HHmQY4Iyw7YfvzO6tXDvfkiTY9MwVZ2AB-WAItnU4XF2t1oW2NyE-ByFDavOoQ2HukJHkncCjyc6vSckEe1aoqjCCxgB&template_id=5042&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic	HTTP traffic detected: GET /platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22215157521840905%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F%22%2C%22width%22%3A340%2C%22height%22%3A400%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Atrue%2C%22referer_uri%22%3A%22https%3A%2F%2Fwinscp.net%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__req=1&__hs=20027.BP%3Aplugin_default_pkg.2.0..0.0&dpr=1&__ccg=GOOD&__rev=1017838824&__s=%3A%3Aplzgdo&__hsi=7432013032883179535&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx60Vo1upE4W0OE1vE662y0um4o5-0me0sy0ny0oi0zE5W0PU1AE17U2ZwrU1Xo1UU3jwea&__csr=&locale=en_US&__sp=1 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /btr/view?ai=CDhqPedAjZ9XhIuOU78EP5YC10A6x9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDywSqBP0BT9DAQTMhS-ILCbEJJDaWMbiyUvke5GnZ1g8CvOCini_79bZducRK34cVbb4bnyTwixuYZ1DkjJJjuDY889SHTuGDQva4eEZB_oNxpmnneSjE3_DVl5CYeAU8uEeqaSVzHXNVSr-J1rK4-DFyIMJAdDUwj7cgw7_vCRMNmmQ0t_y1a32sJVzdBe8dfoe6D0_iL_A2N2kAWUuTo6k9Ka1PlYMpNCEVdCQn1B9y719lKYjTkqAC4NpptWUbmnuDbc-2SCkZfkDIGH4BcI9X9pSyGbsD37z2JfWntEMauY439J0AmRDAcL_D4-GvH2kDO_Ub7vF0FZbPBxqINFejzcAE0Izls4cFiAWkyNPYUKAGLoAHtNKnK6gH1ckbqAfZtrECqAemvhuoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB_fCsQLYBwDyBwQQyI4b0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpY2-jJ3qO5iQOaCYAEaHR0cHM6Ly93d3cubmV3ZWdnLmNvbS9wL3BsP2Q9UFBTU0pUSExXTEJSWkMmU3VibWl0PUVORSZERVBBPTAmT3JkZXI9QkVTVE1BVENIJnV0bV9zb3VyY2U9Z29vZ2xlJnV0bV9tZWRpdW09cGFpZCtkaXNwbGF5JnV0bV9jYW1wYWlnbj1LTkMtR29vZ2xlS1dMZXNzLV8tY29vcC1fLVdELV8tSERER09MRC1fLTA5MDQyNCZpZDA9R29vZ2xlJmlkMT0yMTY2MDc1NDk4MCZpZDI9MTczNzg2MzUxMTg0JmlkMz0maWQ0PSZpZDU9JmlkNj0maWQ3PTI4NDAmaWQ4PSZpZDk9ZCZpZDEwPWMmaWQxMT0maWQxMj17Z2NsaWR9JmlkMTM9JmlkMTQ9JmlkMTU9WSZpZDE2PTcxMjE5NzMzMzM1NyZpZDE3PSZpZDE4PXdpbnNjcC5uZXQmaWQxOT1zZWdtZW50X2JlX2FfMzIzMzkwOTI0MzA0MDEzODUxNCZpZDIwPSZpZDIxPSZpZDIyPSZpZDIzPSZpZDI0PSZpZDI1PSZpZDI2PSZpZDI3PVkmaWQyOD0maWQyOT0maWQzMD0xMDY1MzEyMTQ0MTEzMDAzOTE2OSZpZDMxPSZpZDMyPSZpZDMzPSZpZDM0PSZnYWRfc291cmNlPTWACgHICwHaDBEKCxDQtdnj677UgrUBEgIBA7gT5APYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=0aOzgEyc5FM&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwCa7L7dZM_x682mhf2KIIDx5yOCNjEcVDTj_NnjhLB_d36XrSCZcl8KEBgHXPYWQGe_b0nes6fdyOcCKV_xLeh2Kt4adEcMktFkeO9JsmwYAQ&template_id=484&vis=1&ibtr=1&nis=6 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUl3d0oynO4vXy0MnrWkBpHUcFivFZGyPiBy1G61UpWw--IT3COPIChF_9nB
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/y9/r/ie38mp0O07P.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/?next=https%3A%2F%2Fwww.facebook.com%2Fv2.10%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%3D215157521840905%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df3042ea6f0e0127ef%2526domain%253Dwinscp.net%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fwinscp.net%25252Ff3552e4ccdc3ed298%2526relation%253Dparent.parent%26container_width%3D664%26height%3D400%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fwinscp%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dtimeline HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.facebook.com/v2.10/plugins/page.php?adapt_container_width=true&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3042ea6f0e0127ef%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=664&height=400&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timelineAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yH/r/ieeHDjcGsIR.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f/AGSKWxU-y2rFz-Ce8OJCCCxISoGpjhuSD_yS5noRCnScqS2dhxIr-s236ltohAks6xdVkCKl_LU-HYctKmZIYrhc7t17fb9g-cAdfNJnAwmMh_c1dBtlm3f8n_mk5rNkZ9_gVwNGuL7rXg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMwNDAwMzg0LDY2MjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd2luc2NwLm5ldC9lbmcvZG9jcy9hZnRlcl9pbnN0YWxsYXRpb24iLG51bGwsW1s4LCJZc2dPT2N0dWtySSJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0 HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yG/r/IJz2TIVxd6Q.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yg/r/gjl3ldnE08O.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yL/r/a2pSKe6-4N_.js HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /f/AGSKWxUxfHS3nsFGh3jPt-WE_M9eMNErpqa-Fo0yj5eajv4BOnnxydjVCmrFfNh-0lvehE938eAA2MekF7EUAFysihyv8kAv4UuNuoO1LzyhHbi79W11Elf7aAFK_zNCeq8O1bKGRNFTng==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMwNDAwMzg2LDYxODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd2luc2NwLm5ldC9lbmcvZG9jcy9hZnRlcl9pbnN0YWxsYXRpb24iLG51bGwsW1s4LCJZc2dPT2N0dWtySSJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0 HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f/AGSKWxWbQJa48ZAJagZ6aNbjQAilIzpXfchVVK2XnzVT0H4LRjFMnknhRno7Mpjj3_1v7aw9M2a_yHZcsQxjRpM_6DlkkPH7oTzPkcwyr55AQLgnhI5jdQBMjZaafUJ-Umq239I1bSpIFw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMwNDAwMzg3LDgwMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly93aW5zY3AubmV0L2VuZy9kb2NzL2FmdGVyX2luc3RhbGxhdGlvbiIsbnVsbCxbWzgsIllzZ09PY3R1a3JJIl0sWzksImVuLVVTIl0sWzE4LCJbW1swXV1dIl0sWzE5LCIyIl1dXQ HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: winscp.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://winscp.net/eng/docs/after_installation?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1522412495.1730400377; _ga=GA1.2.1597569809.1730400377; _gid=GA1.2.775442497.1730400377; _gat_gtag_UA_22775137_1=1; __gads=ID=4fc64484ea3a67f4:T=1730400377:RT=1730400377:S=ALNI_MZCGFZNuVPlnLwhTPBtUfQ8SHfCfA; __gpi=UID=00000f49230b3590:T=1730400377:RT=1730400377:S=ALNI_MYYZwgKMMjsWwz9qQN7_u4e-IZRLg; __eoi=ID=f798a6a35fe1b79b:T=1730400377:RT=1730400377:S=AA-AfjYahHiKob7appmsMjqaPUmu; _ga_97R014CLMR=GS1.1.1730400376.1.0.1730400381.55.0.0; FCNEC=%5B%5B%22AKsRol9EWnTKOY1-czcO0HoJc_8SsDqDUwhAExW69Xe4MgCoqN1dkhRdnIhGLMn5ny-8wmzWJb9FDkJnFRX5_WZYg-BG4J4D954-1aFM7X5sd35LB9N4JbNHEpM36Edgpf0x1xFShHeTSMqKRVj80I38trG_oACzaA%3D%3D%22%5D%5D
Source: global traffic	HTTP traffic detected: GET /sodar/sodar2.js HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getconfig/sodar?sv=200&tid=gda&tv=r20241030&st=env HTTP/1.1Host: ep1.adtrafficquality.googleConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: winscp.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1522412495.1730400377; _ga=GA1.2.1597569809.1730400377; _gid=GA1.2.775442497.1730400377; _gat_gtag_UA_22775137_1=1; __gads=ID=4fc64484ea3a67f4:T=1730400377:RT=1730400377:S=ALNI_MZCGFZNuVPlnLwhTPBtUfQ8SHfCfA; __gpi=UID=00000f49230b3590:T=1730400377:RT=1730400377:S=ALNI_MYYZwgKMMjsWwz9qQN7_u4e-IZRLg; __eoi=ID=f798a6a35fe1b79b:T=1730400377:RT=1730400377:S=AA-AfjYahHiKob7appmsMjqaPUmu; _ga_97R014CLMR=GS1.1.1730400376.1.0.1730400381.55.0.0; FCNEC=%5B%5B%22AKsRol9EWnTKOY1-czcO0HoJc_8SsDqDUwhAExW69Xe4MgCoqN1dkhRdnIhGLMn5ny-8wmzWJb9FDkJnFRX5_WZYg-BG4J4D954-1aFM7X5sd35LB9N4JbNHEpM36Edgpf0x1xFShHeTSMqKRVj80I38trG_oACzaA%3D%3D%22%5D%5D
Source: global traffic	HTTP traffic detected: GET /sodar/sodar2/232/runner.html HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/aframe HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sodar/sodar2.js HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /generate_204?RS9A5A HTTP/1.1Host: ep2.adtrafficquality.googleConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_399.16.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/A4tfXiHOGrs/ equals www.facebook.com (Facebook)
Source: chromecache_399.16.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/Ga6vBwdwgUx/ equals www.facebook.com (Facebook)
Source: chromecache_346.16.dr	String found in binary or memory: return b}lD.F="internal.enableAutoEventOnTimer";var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: winscp.net
Source: global traffic	DNS traffic detected: DNS query: winscp-static-746341.c.cdn77.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: platform.twitter.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: syndication.twitter.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: static.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: fundingchoicesmessages.google.com
Source: global traffic	DNS traffic detected: DNS query: scontent-phx1-1.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: ep1.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: ep2.adtrafficquality.google

Source: unknown

HTTP traffic detected: POST /ccm/collect?en=page_view&dl=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation&scrsrc=www.googletagmanager.com&frm=0&rnd=568305074.1730400377&auid=1522412495.1730400377&npa=0&gtm=45je4au0v9178989015za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&tft=1730400376648&tfd=11066&apve=1 HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://winscp.netX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://winscp.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: ZieOJekdWo7uzrVx9OWBpcRykWHmb+SkjVCglQy/IZDSeISC+L8tzQPdCDlpgZG1c6/M7hbZD6RQfi+0TXPPfA==Date: Thu, 31 Oct 2024 18:46:26 GMTTransfer-Encoding: chunked

Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://169.254.169.254/latest/meta-data/iam/security-credentials/Retrieving
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: http://XXXXXXwinscp.net/
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: http://XXXXwinscp.net/forum/
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://acs.amazonaws.com/groups/global/AllUsers
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://acs.amazonaws.com/groups/global/AuthenticatedUsers
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://acs.amazonaws.com/groups/s3/LogDelivery
Source: WinSCP.exe, 00000007.00000002.2457040440.0000000001C92000.00000004.00000001.01000000.00000009.sdmp, WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp, WinSCP.exe, 0000000E.00000002.3403098508.0000000001C92000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://apache.org/dav/props/
Source: WinSCP.exe, 00000007.00000002.2457040440.0000000001C92000.00000004.00000001.01000000.00000009.sdmp, WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp, WinSCP.exe, 0000000E.00000002.3403098508.0000000001C92000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://apache.org/dav/props/T
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://apache.org/dav/propset/fs/1
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: is-MITNN.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: WinSCP.exe, 00000007.00000000.2427908055.0000000000EF6000.00000020.00000001.01000000.00000009.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002CAC000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.000000000453C000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FCD000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.00000000041FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: WinSCP.exe, 00000007.00000000.2427908055.0000000000EF6000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://webdav.org/neon/hooks/proxy-auth
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://webdav.org/neon/hooks/proxy-authProxy-AuthorizationProxy-AuthenticateProxy-Authentication-Inf
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://webdav.org/neon/hooks/server-auth
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://webdav.org/neon/hooks/server-authAuthorizationWWW-AuthenticateAuthentication-InfoCould
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://webdav.org/neon/hooks/server-authhttp://webdav.org/neon/hooks/proxy-authhttp://webdav.org/neo
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://webdav.org/neon/hooks/webdav-locking
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://webdav.org/neon/hooks/webdav-lockingHas
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://webdav.org/neon/hooks/webdav-lockinghttp://webdav.org/neon/hooks/webdav-lockingLocked
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://webdav.org/neon/hooks/webdav-lockinghttp://webdav.org/neon/hooks/webdav-lockinglock:
Source: is-MITNN.tmp.2.dr	String found in binary or memory: http://winscp.net/schema/session/1.0
Source: chromecache_381.16.dr, chromecache_358.16.dr	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F76000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.00000000041B5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types1
Source: WinSCP.exe, 0000000B.00000002.2483407064.00000000044FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesA;P
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesAV
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesQ
Source: WinSCP.exe, 0000000B.00000002.2483407064.00000000044FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesa
Source: WinSCP.exe, 0000000B.00000002.2483407064.00000000044FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesa9P
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesaT
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesaW
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesq
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr, is-MITNN.tmp.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.webdav.org/neon/hooks/http-passport-req
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.webdav.org/neon/hooks/http-passport-reqWWW-AuthenticatePassport1.4Passport1.4http://www.w
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.webdav.org/neon/hooks/http-redirect
Source: WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.webdav.org/neon/hooks/http-redirecthttp://www.webdav.org/neon/hooks/http-redirectAborted
Source: chromecache_346.16.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: is-G6EB7.tmp.2.dr	String found in binary or memory: https://filezilla-project.org/bAcest
Source: WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-A0EPI.tmp.2.dr	String found in binary or memory: https://filezilla-project.org/bThis
Source: is-S743B.tmp.2.dr	String found in binary or memory: https://filezilla-project.org/nAquest
Source: is-FQG0H.tmp.2.dr	String found in binary or memory: https://filezilla-project.org/xTen
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://filezilla-project.org/z
Source: chromecache_267.16.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_267.16.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v62/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://github.com/UweRaabe/PngComponents
Source: is-A0EPI.tmp.2.dr	String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE
Source: WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE$Error
Source: is-FQG0H.tmp.2.dr	String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE&BB
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE/
Source: is-G6EB7.tmp.2.dr	String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE3Eroare
Source: is-S743B.tmp.2.dr	String found in binary or memory: https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE6Hi
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://github.com/plashenkov/TBX
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://jcl.delphi-jedi.org/
Source: WinSCP-6.3.5-Setup.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://jrsoftware.org/tb2kdl.php
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://libexpat.github.io/?https://www.chiark.greenend.org.uk/~sgtatham/putty/licence.html
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://notroj.github.io/neon/
Source: is-FQG0H.tmp.2.dr	String found in binary or memory: https://openssl-library.org/
Source: WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-A0EPI.tmp.2.dr	String found in binary or memory: https://openssl-library.org/)WebDAV/HTTP
Source: is-S743B.tmp.2.dr	String found in binary or memory: https://openssl-library.org//Codi
Source: is-G6EB7.tmp.2.dr	String found in binary or memory: https://openssl-library.org/2Codul
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://openssl-library.org/4
Source: chromecache_346.16.dr, chromecache_305.16.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_369.16.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=fccs&
Source: chromecache_346.16.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_240.16.dr	String found in binary or memory: https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E89000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/1359793/850848#14699663
Source: chromecache_346.16.dr	String found in binary or memory: https://td.doubleclick.net
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002404000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.00000000025D4000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566078635.0000000006542000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2580960915.000000000655D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://winscp.net/#https://winscp.net/eng/docs/history
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2575911732.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-FQG0H.tmp.2.dr, is-A0EPI.tmp.2.dr	String found in binary or memory: https://winscp.net/&
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, is-S743B.tmp.2.dr	String found in binary or memory: https://winscp.net/(
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/2https://winscp.net/forum/Fhttps://winscp.net/eng/download.php
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2575612359.00000000008B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/=
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002CC3000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001FC7000.00000002.00000001.01000000.00000009.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004553000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FE3000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004213000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/D
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.00000000036AE000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://winscp.net/eng/docs/?ver=%s&lang=%s-https://winscp.net/eng/docs/%s?ver=%s&lang=%s
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BF2000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004490000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_archive_and_download
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E89000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E98000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_archive_and_download#options
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004149000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_archive_and_downloadP
Source: WinSCP.exe, 0000000B.00000002.2483407064.000000000446F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_compare_files
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BF2000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_compare_files#options
Source: WinSCP.exe, 0000000B.00000002.2483407064.0000000004490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_compare_files#options1
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004149000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_compare_files#optionsP
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_compare_files0
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BD1000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_compare_filesa
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C27000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.00000000044C6000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.000000000417F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_generate_http_url
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BC2000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004461000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EDF000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.000000000411A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_generate_http_url#options
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_generate_http_urlQ
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E6F000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E7D000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_synchronize_another_server
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E6F000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E7D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_synchronize_another_server#options
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C4F000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.00000000044ED000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_synchronize_another_server#optionsError
Source: WinSCP.exe, 0000000E.00000002.3405428504.00000000041A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/extension_synchronize_another_server#optionsErrorh
Source: WinSCP-6.3.5-Setup.exe, WinSCP-6.3.5-Setup.tmp.0.dr	String found in binary or memory: https://winscp.net/eng/docs/installation0
Source: is-MITNN.tmp.2.dr	String found in binary or memory: https://winscp.net/eng/docs/library
Source: WinSCP.exe, 0000000B.00000002.2483407064.0000000004490000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2526226023.0000000004862000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_advanced_rename
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E89000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E98000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2526226023.0000000004862000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_advanced_rename#options
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_advanced_rename)
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004149000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_advanced_renameP
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C4F000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.00000000044ED000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F68000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.00000000041A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_keep_local_directory_up_to_date
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004204000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_keep_local_directory_up_to_date#options
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002CB4000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004544000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FD4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_keep_local_directory_up_to_date#options1
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_text
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C4F000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_text#options_text
Source: WinSCP.exe, 0000000B.00000002.2483407064.00000000044ED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_text#options_textQ
Source: WinSCP.exe, 0000000E.00000002.3405428504.00000000041A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_text#options_texth
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_textI
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_textIu
Source: WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_recursive_search_textq
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_verify_file_checksum
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002C4F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_verify_file_checksum#optionscksum
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_verify_file_checksum#optionscksum1
Source: WinSCP.exe, 0000000B.00000002.2483407064.00000000044ED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_verify_file_checksum#optionscksuma
Source: WinSCP.exe, 0000000E.00000002.3405428504.00000000041A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_verify_file_checksum#optionscksumh
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004490000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E5A000.00000004.00001000.00020000.00000000.sdmp, is-P36QM.tmp.2.dr	String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_upload
Source: WinSCP.exe, 00000007.00000002.2463265894.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E5A000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp, is-P36QM.tmp.2.dr	String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_upload#options
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002CB4000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004544000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FD4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_upload#optionse
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002CB4000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004544000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FD4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_upload#optionsexe
Source: WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_uploadI=
Source: WinSCP.exe, 0000000E.00000002.3405428504.0000000004149000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_uploadP
Source: WinSCP.exe, 00000007.00000002.2458633360.0000000002BF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/library_example_zip_and_uploady
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2581546171.0000000006586000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2272176105.00000000008F0000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2269718517.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2575431470.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2562782819.000000000657C000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2577805992.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/license
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2272132445.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566998814.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2269718517.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2561749142.0000000006587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/docs/privacy
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://winscp.net/eng/donate.php
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.0000000003739000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/donate.php?
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.0000000003732000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/donate.php?amount=
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.00000000025D4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/download.php
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.000000000240C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/download.php)
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.0000000003740000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.0000000003756000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/installed.php?ver=6.3.5&lang=
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566078635.0000000006542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campai
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://winscp.net/eng/translations.php:https://winscp.net/eng/docs/search.php?ver=%s&lang=%s&q=%sKh
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://winscp.net/forum/
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/install.php?
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566078635.0000000006542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/install.php?mode=report&installed=1&silent=0&ver=6.3.5&lang=en&prevver=&sponsorst
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.000000000375D000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/install.php?mode=sponsor
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.000000000375D000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/install.php?mode=sponsoring
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566998814.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2578172782.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2576606616.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/install.php?mode=sponsorrequest&ver=6.3.5&lang=en&prevver=&scale=100&images=
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566998814.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2578172782.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/install.php?mode=sponsorrequest&ver=6.3.5&lang=en&prevver=&scale=100&images=-ae
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2579139130.000000000091A000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2565675597.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net/install.php?mode=sponsorrequest&ver=6.3.5&lang=en&prevver=&scale=100&images=4
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://winscp.net/updates.php#https://winscp.net/eng/download.php
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2579139130.000000000091A000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2565675597.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://winscp.net:443/install.php?mode=report&installed=1&silent=0&ver=6.3.5&lang=en&prevver=&spons
Source: WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/1
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2581546171.0000000006586000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2272176105.00000000008F0000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2269718517.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2562782819.000000000657C000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.fsf.org/
Source: WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.gnu.org/licenses/
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2272132445.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2269718517.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2561749142.0000000006587000.00000004.00000020.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.gnu.org/licenses/why-not-lgpl.html
Source: chromecache_346.16.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_346.16.dr	String found in binary or memory: https://www.google.com
Source: chromecache_385.16.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/1002628342/?random
Source: chromecache_414.16.dr	String found in binary or memory: https://www.google.com/pagead/drt/ui
Source: chromecache_346.16.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_346.16.dr	String found in binary or memory: https://www.googletagmanager.com
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136471090.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136058894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000000.2137712250.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WinSCP-6.3.5-Setup.tmp.0.dr	String found in binary or memory: https://www.innosetup.com/
Source: chromecache_399.16.dr	String found in binary or memory: https://www.internalfb.com/intern/invariant/
Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136471090.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136058894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000000.2137712250.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WinSCP-6.3.5-Setup.tmp.0.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 60334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 60655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 60414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60531
Source: unknown	Network traffic detected: HTTP traffic on port 60219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 60220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60543
Source: unknown	Network traffic detected: HTTP traffic on port 60587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60549
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60302
Source: unknown	Network traffic detected: HTTP traffic on port 60495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 60198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60317
Source: unknown	Network traffic detected: HTTP traffic on port 60368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60557
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 60310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 60278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60565
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60562
Source: unknown	Network traffic detected: HTTP traffic on port 60516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60567
Source: unknown	Network traffic detected: HTTP traffic on port 60346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60324
Source: unknown	Network traffic detected: HTTP traffic on port 60164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60505
Source: unknown	Network traffic detected: HTTP traffic on port 60256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60504
Source: unknown	Network traffic detected: HTTP traffic on port 60531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 60252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60519
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 60217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 60599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 60186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60375
Source: unknown	Network traffic detected: HTTP traffic on port 60395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60372
Source: unknown	Network traffic detected: HTTP traffic on port 60286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60371
Source: unknown	Network traffic detected: HTTP traffic on port 60234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60379
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60391
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60390
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60387
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60385
Source: unknown	Network traffic detected: HTTP traffic on port 60590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60384
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60395
Source: unknown	Network traffic detected: HTTP traffic on port 60182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60393
Source: unknown	Network traffic detected: HTTP traffic on port 60406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60170
Source: unknown	Network traffic detected: HTTP traffic on port 60618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60167
Source: unknown	Network traffic detected: HTTP traffic on port 60264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60166
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60164
Source: unknown	Network traffic detected: HTTP traffic on port 60451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60163
Source: unknown	Network traffic detected: HTTP traffic on port 60589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60332
Source: unknown	Network traffic detected: HTTP traffic on port 60324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60572
Source: unknown	Network traffic detected: HTTP traffic on port 60184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60335
Source: unknown	Network traffic detected: HTTP traffic on port 60276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60590
Source: unknown	Network traffic detected: HTTP traffic on port 60393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60345
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60587
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60343
Source: unknown	Network traffic detected: HTTP traffic on port 60453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60585
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60583
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60580
Source: unknown	Network traffic detected: HTTP traffic on port 60210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60589
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60588
Source: unknown	Network traffic detected: HTTP traffic on port 60441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60350
Source: unknown	Network traffic detected: HTTP traffic on port 60557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60359
Source: unknown	Network traffic detected: HTTP traffic on port 60232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60599
Source: unknown	Network traffic detected: HTTP traffic on port 60194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60370
Source: unknown	Network traffic detected: HTTP traffic on port 60209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60360
Source: unknown	Network traffic detected: HTTP traffic on port 60254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60368
Source: unknown	Network traffic detected: HTTP traffic on port 60443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60298
Source: unknown	Network traffic detected: HTTP traffic on port 60433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60295
Source: unknown	Network traffic detected: HTTP traffic on port 60536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60585 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60650
Source: unknown	Network traffic detected: HTTP traffic on port 60517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60419
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60418
Source: unknown	Network traffic detected: HTTP traffic on port 60437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60655
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60412
Source: unknown	Network traffic detected: HTTP traffic on port 60163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60420
Source: unknown	Network traffic detected: HTTP traffic on port 60323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60427
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60425
Source: unknown	Network traffic detected: HTTP traffic on port 60231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60430
Source: unknown	Network traffic detected: HTTP traffic on port 60586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60439
Source: unknown	Network traffic detected: HTTP traffic on port 60255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60437

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.198.21.111:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:60186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:60239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.198.21.111:443 -> 192.168.2.6:60284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:60372 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:60410 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:60493 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:60599 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:60648 version: TLS 1.2

Source: WinSCP-6.3.5-Setup.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-PM78M.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-O60P0.tmp.2.dr	Static PE information: Resource name: RT_STRING type: PDP-11 pure executable not stripped
Source: is-EKLQ1.tmp.2.dr	Static PE information: Resource name: RT_STRING type: PDP-11 demand-paged pure executable not stripped
Source: is-9C1M4.tmp.2.dr	Static PE information: Resource name: RT_STRING type: PDP-11 executable not stripped
Source: is-L7Q5O.tmp.2.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: is-NR0U8.tmp.2.dr	Static PE information: Resource name: RT_STRING type: PDP-11 overlaid pure executable not stripped
Source: is-FQG0H.tmp.2.dr	Static PE information: Resource name: RT_STRING type: 0420 Alliant virtual executable not stripped
Source: is-G6EB7.tmp.2.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: is-12FUS.tmp.2.dr	Static PE information: Resource name: RT_STRING type: PDP-11 executable not stripped - version 11
Source: is-PTP8A.tmp.2.dr	Static PE information: Resource name: RT_STRING type: 0420 Alliant virtual executable common library not stripped
Source: is-PTP8A.tmp.2.dr	Static PE information: Resource name: RT_STRING type: PDP-11 overlaid pure executable not stripped

Source: is-2OH6T.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-3OA4A.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-JJBU1.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-AQ578.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-RHNVA.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-12FUS.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-252L7.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-2NLBT.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-V0JFT.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-UNNRO.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-E9RG6.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-6D65U.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-2I3LS.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-FQG0H.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-SI23F.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-F9A3R.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-P7JQO.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-BO0F5.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-A0EPI.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-0PHNM.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-24MJE.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-I1HPU.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-MU78M.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-EJ8B7.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-O60P0.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-L0PL5.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-NR0U8.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-PTP8A.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-9C1M4.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-G6EB7.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-P93HC.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-L7Q5O.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-D09V8.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-SU27Q.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-S743B.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-25U96.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-B45FB.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-EKLQ1.tmp.2.dr	Static PE information: No import functions for PE file found
Source: is-7TGIJ.tmp.2.dr	Static PE information: No import functions for PE file found

Source: WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.00000000023D8000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamekernel32j% vs WinSCP-6.3.5-Setup.exe

Source: WinSCP-6.3.5-Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: sus24.spyw.winEXE@36/434@75/27

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

File created: C:\Program Files (x86)\WinSCP

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\WinSCPDragExtLogMutex
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Mutant created: \Sessions\1\BaseNamedObjects\WinSCP
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Mutant created: \Sessions\1\BaseNamedObjects\WinSCPDragExtMutex

Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe

File created: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp

Jump to behavior

Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: WinSCP-6.3.5-Setup.exe	String found in binary or memory: /LOADINF="filename"
Source: WinSCP-6.3.5-Setup.exe	String found in binary or memory: (https://winscp.net/eng/docs/installation0

Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe

File read: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe "C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe"
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp "C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp" /SL5="$20406,10489221,930816,C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /RegisterForDefaultProtocols
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /ImportSitesIfAny
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /Usage=TypicalInstallation:1,InstallationsUser+,InstallationParentProcess@,InstallationsFirstTypical+,LastInstallationAutomaticUpgrade:0,InstallationsGettingStarted+,InstallationsLaunch+,
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 --field-trial-handle=3276,i,636435449627489665,5607076903918076227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp "C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp" /SL5="$20406,10489221,930816,C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /RegisterForDefaultProtocols	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /ImportSitesIfAny	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe" /Usage=TypicalInstallation:1,InstallationsUser+,InstallationParentProcess@,InstallationsFirstTypical+,LastInstallationAutomaticUpgrade:0,InstallationsGettingStarted+,InstallationsLaunch+,	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process created: C:\Program Files (x86)\WinSCP\WinSCP.exe "C:\Program Files (x86)\WinSCP\WinSCP.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 --field-trial-handle=3276,i,636435449627489665,5607076903918076227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: WinSCP.lnk.2.dr	LNK file: ..\..\..\..\..\Program Files (x86)\WinSCP\WinSCP.exe
Source: WinSCP.lnk0.2.dr	LNK file: ..\..\..\Program Files (x86)\WinSCP\WinSCP.exe
Source: WinSCP (for upload).lnk.2.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\WinSCP\WinSCP.exe

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Automated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Automated click: Next

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\WinSCP\WinSCP.exe

Window detected: Number of UI elements: 16

Source: WinSCP-6.3.5-Setup.exe

Static PE information: certificate valid

Source: WinSCP-6.3.5-Setup.exe

Static file information: File size 11611592 > 1048576

Source: WinSCP-6.3.5-Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: c:\misto\wscpblda\build\dotnet\obj\Release\net40\WinSCPnet.pdbSHA256 source: is-MITNN.tmp.2.dr
Source:	Binary string: c:\misto\wscpblda\build\dotnet\obj\Release\net40\WinSCPnet.pdb source: is-MITNN.tmp.2.dr

Source: is-MITNN.tmp.2.dr

Static PE information: 0xA7F353B7 [Wed Apr 16 18:02:31 2059 UTC]

Source: WinSCP-6.3.5-Setup.exe	Static PE information: section name: .didata
Source: WinSCP-6.3.5-Setup.tmp.0.dr	Static PE information: section name: .didata
Source: is-PM78M.tmp.2.dr	Static PE information: section name: .didata
Source: is-HCFOU.tmp.2.dr	Static PE information: section name: .didata
Source: is-VH8LO.tmp.2.dr	Static PE information: section name: .rodata
Source: is-VH8LO.tmp.2.dr	Static PE information: section name: .xdata
Source: is-1UBMP.tmp.2.dr	Static PE information: section name: .00cfg
Source: is-1UBMP.tmp.2.dr	Static PE information: section name: .voltbl
Source: is-VK93L.tmp.2.dr	Static PE information: section name: .00cfg
Source: is-VK93L.tmp.2.dr	Static PE information: section name: .voltbl

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-MU78M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-BO0F5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-RHNVA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-2OH6T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fi (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-P7JQO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-252L7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-SU27Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.srl (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\PuTTY\puttygen.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\is-PM78M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-FQG0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\WinSCP.com (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.sk (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fa (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.uk (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-G6EB7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fr (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.hr (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-L0PL5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-3OA4A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-D09V8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ta (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-24MJE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.sv (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.nl (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.is (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\is-HCFOU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MJOGT.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.pl (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\PuTTY\is-1UBMP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.da (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ko (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.jp (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-E9RG6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-EKLQ1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-7TGIJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ch (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.de (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.lt (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-9C1M4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ptg (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\is-VH8LO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.bg (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ms (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-UNNRO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-V0JFT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.be (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ar (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.chs (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.el (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ru (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.tr (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-JJBU1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\PuTTY\is-VK93L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.pt (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-12FUS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.vi (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.es (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.et (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\PuTTY\pageant.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ro (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	File created: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.in (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-2I3LS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\DragExt64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-EJ8B7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-PTP8A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-0PHNM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.it (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.xxk (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\is-MITNN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-NR0U8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ca (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.hu (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\is-TES8D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-25U96.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-B45FB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-S743B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-AQ578.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-A0EPI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\WinSCPnet.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\WinSCP.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-I1HPU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-P93HC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-F9A3R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-6D65U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-O60P0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.cs (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-2NLBT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\WinSCP.no (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-SI23F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	File created: C:\Program Files (x86)\WinSCP\Translations\is-L7Q5O.tmp	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\System32\regsvr32.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\WinSCPCopyHook NULL			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\WinSCPCopyHook NULL			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinSCP.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior

Source: C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-MU78M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-BO0F5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-RHNVA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fi (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-2OH6T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-P7JQO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-252L7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-SU27Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.srl (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\PuTTY\puttygen.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-FQG0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\WinSCP.com (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.sk (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fa (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.uk (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-G6EB7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.fr (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.hr (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-L0PL5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-3OA4A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-D09V8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ta (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-24MJE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.sv (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.nl (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.is (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MJOGT.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.pl (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\PuTTY\is-1UBMP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.da (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ko (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.jp (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-E9RG6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-EKLQ1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-7TGIJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ch (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.de (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.lt (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-9C1M4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ptg (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\is-VH8LO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.bg (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ms (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-UNNRO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-V0JFT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.be (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ar (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.chs (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ru (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.el (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.tr (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-JJBU1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\PuTTY\is-VK93L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.pt (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-12FUS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.vi (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.es (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.et (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\PuTTY\pageant.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ro (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.in (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\DragExt64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-2I3LS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-PTP8A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-EJ8B7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-0PHNM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.xxk (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.it (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\is-MITNN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-NR0U8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.ca (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.hu (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\is-TES8D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-25U96.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-B45FB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-S743B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-AQ578.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-A0EPI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\WinSCPnet.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-I1HPU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-P93HC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-6D65U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-F9A3R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-O60P0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.cs (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-2NLBT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\WinSCP.no (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-SI23F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\WinSCP\Translations\is-L7Q5O.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp TID: 2852

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2580797215.000000000653D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$0"
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2579139130.000000000092D000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2565675597.0000000000920000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2580797215.000000000653D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2565675597.0000000000920000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566998814.00000000008EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WinSCP.exe, 0000000E.00000002.3403668297.0000000002628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@
Source: WinSCP.exe, 0000000B.00000002.2482832841.00000000028BB000.00000004.00000020.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524056750.0000000002429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: WinSCP.exe, 00000007.00000002.2458197253.00000000028B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllyy

Source: C:\Program Files (x86)\WinSCP\WinSCP.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0

Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Program Files (x86)\WinSCP\WinSCP.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	11 Process Injection	2 Masquerading	1 Credentials in Registry	1 Query Registry	Remote Services	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Regsvr32	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	32 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner
C:\Program Files (x86)\WinSCP\DragExt64.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\PuTTY\is-1UBMP.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\PuTTY\is-VK93L.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\PuTTY\pageant.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\PuTTY\puttygen.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.ar (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.be (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.bg (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.ca (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.ch (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.chs (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.cs (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.da (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.de (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.el (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.es (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.et (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.fa (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.fi (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.fr (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.hr (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.hu (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.in (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.is (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.it (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.jp (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.ko (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.lt (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.ms (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.nl (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.no (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.pl (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.pt (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.ptg (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.ro (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.ru (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.sk (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.srl (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.sv (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.ta (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.tr (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.uk (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.vi (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\WinSCP.xxk (copy)	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-0PHNM.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-12FUS.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-24MJE.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-252L7.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-25U96.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-2I3LS.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-2NLBT.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-2OH6T.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-3OA4A.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-6D65U.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-7TGIJ.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-9C1M4.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-A0EPI.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-AQ578.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-B45FB.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-BO0F5.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-D09V8.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-E9RG6.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-EJ8B7.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-EKLQ1.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-F9A3R.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-FQG0H.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-G6EB7.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-I1HPU.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-JJBU1.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-L0PL5.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-L7Q5O.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-MU78M.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-NR0U8.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-O60P0.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-P7JQO.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-P93HC.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-PTP8A.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-RHNVA.tmp	0%	ReversingLabs
C:\Program Files (x86)\WinSCP\Translations\is-S743B.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.internalfb.com/intern/invariant/	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
https://platform.twitter.com/widgets.js	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
winscp.net	88.198.21.111	true	false	unknown
star-mini.c10r.facebook.com	157.240.0.35	true	false	unknown
twitter.com	104.244.42.1	true	false	unknown
ep1.adtrafficquality.google	142.250.186.66	true	false	unknown
ep2.adtrafficquality.google	142.250.185.97	true	false	unknown
1578389079.rsc.cdn77.org	37.19.194.80	true	false	unknown
platform.twitter.map.fastly.net	199.232.188.157	true	false	unknown
syndication.twitter.com	104.244.42.8	true	false	unknown
stats.g.doubleclick.net	64.233.167.157	true	false	unknown
scontent.xx.fbcdn.net	157.240.0.6	true	false	unknown
googleads.g.doubleclick.net	142.250.184.226	true	false	unknown
www3.l.google.com	172.217.16.206	true	false	unknown
www.google.com	142.250.185.164	true	false	unknown
td.doubleclick.net	142.250.185.194	true	false	unknown
analytics.google.com	216.58.206.78	true	false	unknown
scontent-phx1-1.xx.fbcdn.net	57.144.134.128	true	false	unknown
www.facebook.com	unknown	unknown	false	unknown
connect.facebook.net	unknown	unknown	false	unknown
fundingchoicesmessages.google.com	unknown	unknown	false	unknown
static.xx.fbcdn.net	unknown	unknown	false	unknown
winscp-static-746341.c.cdn77.org	unknown	unknown	false	unknown
platform.twitter.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://scontent-phx1-1.xx.fbcdn.net/v/t39.30808-1/351156904_264152706143983_3109134666055357303_n.jpg?stp=cp0_dst-jpg_s50x50&_nc_cat=100&ccb=1-7&_nc_sid=6738e8&_nc_ohc=VaXOflnuDHcQ7kNvgGYZY5H&_nc_zt=24&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYAVosyj27yGB-nAl8xsHDz4QfMDJaExqAWoiWH0J70L6Q&oe=672987CE	false		unknown
https://www.facebook.com/platform/plugin/page/logging/	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3i7M54/y0/l/en_US/zYyn94Uppv5.js	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v4/yk/l/0,cross/GY0bX-iB97s.css	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/Chl8448Q49S.js	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yG/r/IJz2TIVxd6Q.js	false		unknown
https://winscp-static-746341.c.cdn77.org/assets/js/slick-init.js?v=7034	false		unknown
https://www.facebook.com/ajax/bz?__a=1&__ccg=GOOD&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx60Vo1upE4W0OE1vE662y0um4o5-0me0sy0ny0oi0zE5W0PU1AE17U2ZwrU1Xo1UU3jwea&__hs=20027.BP%3Aplugin_default_pkg.2.0..0.0&__hsi=7432013032883179535&__req=5&__rev=1017838824&__s=%3A%3Aplzgdo&__sp=1&__user=0&dpr=1&jazoest=21919&locale=en_US&lsd=JmzYf9flXws1Rh6-Wn6T0u	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yz/r/c64elx0V1Fa.js	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/p55HfXW__mM.js	false		unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=6822944091&adk=2358527528&adf=101933203&pi=t.ma~as.6822944091&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373001&bpp=4&bdt=3647&idt=2647&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280&correlator=6162542844500&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=30&ady=1480&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=2652	false		unknown
https://www.facebook.com/platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22215157521840905%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F%22%2C%22width%22%3A340%2C%22height%22%3A400%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Atrue%2C%22referer_uri%22%3A%22https%3A%2F%2Fwinscp.net%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__req=1&__hs=20027.BP%3Aplugin_default_pkg.2.0..0.0&dpr=1&__ccg=GOOD&__rev=1017838824&__s=%3A%3Aplzgdo&__hsi=7432013032883179535&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx60Vo1upE4W0OE1vE662y0um4o5-0me0sy0ny0oi0zE5W0PU1AE17U2ZwrU1Xo1UU3jwea&__csr=&locale=en_US&__sp=1	false		unknown
https://winscp.net/favicon.ico	false		unknown
https://fundingchoicesmessages.google.com/el/AGSKWxXVowT_P7UFkqWweTaxyBwibPZ8_cu1zf1cqGWD3U6li-jqPgcGXrvL6Uq1wL18CbD-6faE1WmeMeuKJ_DY9EBehS9v-cpooOhEdYCL9h_507RJOWCW40eVwldcjha9EJ0lEYQfSQ==	false		unknown
https://syndication.twitter.com/settings?session_id=dd9b3d302a9b92ee788c222ff5c4209225028450	false		unknown
https://www.facebook.com/v2.10/plugins/page.php?adapt_container_width=true&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3042ea6f0e0127ef%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=664&height=400&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline	false		unknown
https://winscp-static-746341.c.cdn77.org/assets/css/bootstrap-modified.css?v=7034	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yw/r/UXtr_j2Fwe-.png	false		unknown
https://googleads.g.doubleclick.net/pagead/html/r20241030/r20190131/zrt_lookup_fy2021.html	false		unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=200&slotname=4424189075&adk=724910714&adf=1108650154&pi=t.ma~as.4424189075&w=233&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=3&format=233x200&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=1&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400373005&bpp=2&bdt=3651&idt=2659&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=649x280%2C649x280&correlator=6162542844500&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=739&ady=853&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&fsb=1&dtd=2666	false		unknown
https://winscp-static-746341.c.cdn77.org/assets/js/svg-src-polyfill.js?v=7034	false		unknown
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v4/yL/l/0,cross/hx1QQk3LL6t.css	false		unknown
https://fundingchoicesmessages.google.com/f/AGSKWxUxfHS3nsFGh3jPt-WE_M9eMNErpqa-Fo0yj5eajv4BOnnxydjVCmrFfNh-0lvehE938eAA2MekF7EUAFysihyv8kAv4UuNuoO1LzyhHbi79W11Elf7aAFK_zNCeq8O1bKGRNFTng==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzMwNDAwMzg2LDYxODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd2luc2NwLm5ldC9lbmcvZG9jcy9hZnRlcl9pbnN0YWxsYXRpb24iLG51bGwsW1s4LCJZc2dPT2N0dWtySSJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0	false		unknown
https://winscp-static-746341.c.cdn77.org/assets/images/arrow-horiz-soft.svg?v=7034	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yA/r/0q927cN1GZe.js	false		unknown
https://ep2.adtrafficquality.google/sodar/sodar2.js	false		unknown
https://www.facebook.com/x/oauth/status?client_id=215157521840905&input_token&origin=1&redirect_uri=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&sdk=joey&wants_cookie_data=false	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yH/r/xgVgalBG80z.png	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v4/yX/l/0,cross/Yd70QRXJCf6.css	false		unknown
https://googleads.g.doubleclick.net/pagead/adview?ai=CdQwcedAjZ5H_IeCa78EP863DmQOx9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDSKoE_AFP0EtLn0pGydfWXKH5GLbyFNQbHkavtBzS9CBxW9RG_iPZGxqcK25ycPNC11bKozj0j5FBWNyONmQSmzaF302m8KTK30OzHihaWKPCbRSZxFCaHxMGtnP6FTlUYassmNMTHpM2UCphb4Z3Z9tPBUglRu6TMImCLUJJh3myq-fiKSRg2qqbOah6KsLwehMkIoFDzuXZqwxYb3uxZywLXhEAWuC0xNyVOADHVFrLeoH-4_OaHyWyjWGCLkdMbP10Pc5-I_QrnQ_rvQRVS1ak3lfwlA0HGKEyDWp57lpr_57aubjFyrojuEhszjYAFBbJ1iehMeupDVoUO_he8hjABNCM5bOHBYgFpMjT2FCgBi6AB7TSpyuoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEMD9BNIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WMqYyd6juYkDmgn1A2h0dHBzOi8vd3d3Lm5ld2VnZy5jb20vcC9wbD9kPVBQU1NKVEhMV0xCUlpDJlN1Ym1pdD1FTkUmREVQQT0wJk9yZGVyPUJFU1RNQVRDSCZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPXBhaWQrZGlzcGxheSZ1dG1fY2FtcGFpZ249S05DLUdvb2dsZUtXTGVzcy1fLWNvb3AtXy1XRC1fLUhEREdPTEQtXy0wOTA0MjQmaWQwPUdvb2dsZSZpZDE9MjE2NjA3NTQ5ODAmaWQyPTE3Mzc4NjM1MTE4NCZpZDM9JmlkND0maWQ1PSZpZDY9JmlkNz0yODQwJmlkOD0maWQ5PWQmaWQxMD1jJmlkMTE9JmlkMTI9e2djbGlkfSZpZDEzPSZpZDE0PSZpZDE1PVkmaWQxNj03MTIxOTczMzMzNTcmaWQxNz0maWQxOD13aW5zY3AubmV0JmlkMTk9cnVub2ZuZXR3b3JrJTNBJTNBMTAwJmlkMjA9JmlkMjE9JmlkMjI9JmlkMjM9JmlkMjQ9JmlkMjU9JmlkMjY9JmlkMjc9WSZpZDI4PSZpZDI5PSZpZDMwPTE5NzAyMzQwMTYxNjcyNzUzODE5JmlkMzE9JmlkMzI9JmlkMzM9JmlkMzQ9JmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKEKD49eOLmfKbfBICAQPYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=dM2PrCvZY78&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7drzW6gIA7HHmQY4Iyw7YfvzO6tXDvfkiTY9MwVZ2AB-WAItnU4XF2t1oW2NyE-ByFDavOoQ2HukJHkncCjyc6vSckEe1aoqjCCxgB&template_id=5042&vis=1&ebtr=1&nis=6	false		unknown
https://fundingchoicesmessages.google.com/el/AGSKWxUw68y--w1CMz7Er8SakXH4R0S7Uiv-yVFOeaesYjdxtmzUncYmiR7ncZSD6ZrJl_ariS47RdOW9ny3cqFeamaFk-_8GSVmA-Ha7lCxKVQB3-CEgacz5yNc6i-14nhMEyy31hQ5Aw==	false		unknown
https://googleads.g.doubleclick.net/btr/view?ai=CdQwcedAjZ5H_IeCa78EP863DmQOx9o-Ze4yn6PXOEgoQASCexYwkYMkGoAHjjOL8A8gBCagDAcgDSKoE_AFP0EtLn0pGydfWXKH5GLbyFNQbHkavtBzS9CBxW9RG_iPZGxqcK25ycPNC11bKozj0j5FBWNyONmQSmzaF302m8KTK30OzHihaWKPCbRSZxFCaHxMGtnP6FTlUYassmNMTHpM2UCphb4Z3Z9tPBUglRu6TMImCLUJJh3myq-fiKSRg2qqbOah6KsLwehMkIoFDzuXZqwxYb3uxZywLXhEAWuC0xNyVOADHVFrLeoH-4_OaHyWyjWGCLkdMbP10Pc5-I_QrnQ_rvQRVS1ak3lfwlA0HGKEyDWp57lpr_57aubjFyrojuEhszjYAFBbJ1iehMeupDVoUO_he8hjABNCM5bOHBYgFpMjT2FCgBi6AB7TSpyuoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEMD9BNIIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WMqYyd6juYkDmgn1A2h0dHBzOi8vd3d3Lm5ld2VnZy5jb20vcC9wbD9kPVBQU1NKVEhMV0xCUlpDJlN1Ym1pdD1FTkUmREVQQT0wJk9yZGVyPUJFU1RNQVRDSCZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPXBhaWQrZGlzcGxheSZ1dG1fY2FtcGFpZ249S05DLUdvb2dsZUtXTGVzcy1fLWNvb3AtXy1XRC1fLUhEREdPTEQtXy0wOTA0MjQmaWQwPUdvb2dsZSZpZDE9MjE2NjA3NTQ5ODAmaWQyPTE3Mzc4NjM1MTE4NCZpZDM9JmlkND0maWQ1PSZpZDY9JmlkNz0yODQwJmlkOD0maWQ5PWQmaWQxMD1jJmlkMTE9JmlkMTI9e2djbGlkfSZpZDEzPSZpZDE0PSZpZDE1PVkmaWQxNj03MTIxOTczMzMzNTcmaWQxNz0maWQxOD13aW5zY3AubmV0JmlkMTk9cnVub2ZuZXR3b3JrJTNBJTNBMTAwJmlkMjA9JmlkMjE9JmlkMjI9JmlkMjM9JmlkMjQ9JmlkMjU9JmlkMjY9JmlkMjc9WSZpZDI4PSZpZDI5PSZpZDMwPTE5NzAyMzQwMTYxNjcyNzUzODE5JmlkMzE9JmlkMzI9JmlkMzM9JmlkMzQ9JmdhZF9zb3VyY2U9NYAKAcgLAdoMEAoKEKD49eOLmfKbfBICAQPYEwOIFAHQFQGAFwGyFx4KGggAEhRwdWItMTY4Mjc1OTkyNTE1OTM1NRgAGAG6FwI4AbIYCRICg1UYLiIBANAYAegYAQ&sigh=dM2PrCvZY78&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgCa7L7drzW6gIA7HHmQY4Iyw7YfvzO6tXDvfkiTY9MwVZ2AB-WAItnU4XF2t1oW2NyE-ByFDavOoQ2HukJHkncCjyc6vSckEe1aoqjCCxgB&template_id=5042&vis=1&ibtr=1&nis=6	false		unknown
https://platform.twitter.com/widgets.js	false	URL Reputation: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1682759925159355&output=html&h=280&slotname=1870177922&adk=3109115863&adf=385219199&pi=t.ma~as.1870177922&w=649&abgtt=9&fwrn=4&fwrnh=100&lmt=1730400375&rafmt=1&format=649x280&url=https%3A%2F%2Fwinscp.net%2Feng%2Fdocs%2Fafter_installation%3Fver%3D6.3.5%26lang%3Den%26utm_source%3Dwinscp%26utm_medium%3Dsetup%26utm_campaign%3D6.3.5%26prevver%3D%26automatic%3D0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1730400372992&bpp=8&bdt=3637&idt=2601&shv=r20241030&mjsv=m202410240101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&correlator=6162542844500&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=30&ady=415&biw=1017&bih=870&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95346096%2C95331832%2C95343682%2C95344190%2C95345789%2C95345963%2C95345967&oid=2&pvsid=3008781997726900&tmod=996236526&uas=0&nvt=1&fc=896&brdim=10%2C10%2C10%2C10%2C1280%2C0%2C1050%2C964%2C1034%2C870&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1.02&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=2636	false		unknown
https://www.facebook.com/v2.10/plugins/like.php?action=like&app_id=215157521840905&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd6823e2c4a4e036e%26domain%3Dwinscp.net%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwinscp.net%252Ff3552e4ccdc3ed298%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fwinscp%2F&layout=button_count&locale=en_US&sdk=joey&share=true&show_faces=false&size=small	false		unknown
https://winscp-static-746341.c.cdn77.org/assets/images/card-logo-mastercard.svg?v=7034	false		unknown
https://ep2.adtrafficquality.google/generate_204?RS9A5A	false		unknown
https://www.google.com/pagead/drt/ui	false		unknown
https://winscp.net/eng/installed.php?ver=6.3.5&lang=en&utm_source=winscp&utm_medium=setup&utm_campaign=6.3.5&prevver=&automatic=0	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3iLl54/yo/l/en_US/KroQaZupEyF.js	false		unknown
https://winscp-static-746341.c.cdn77.org/assets/images/logos/linkedin.svg?v=7034	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/y_/l/en_US/mEgqcU3S6-1.js	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3iEBX4/yr/l/en_US/jbkX5llFMP5.js	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yL/r/a2pSKe6-4N_.js	false		unknown
https://scontent-phx1-1.xx.fbcdn.net/v/t39.30808-6/354608791_694424149157111_1515153202108507038_n.png?stp=dst-png_s350x350&_nc_cat=110&ccb=1-7&_nc_sid=4cb600&_nc_ohc=-ogClF-bw9IQ7kNvgEkPep7&_nc_zt=23&_nc_ht=scontent-phx1-1.xx&edm=AFugn8MEAAAA&_nc_gid=A5asr7dU5KxjBSbIZbIPEvJ&oh=00_AYBM1_XO-Gu7D2B4cl2zhQqQEAF28ThdFvPsIF23tTRHKA&oe=67299B7D	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://filezilla-project.org/bAcest	is-G6EB7.tmp.2.dr	false		unknown
https://jrsoftware.org/tb2kdl.php	WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	false		unknown
https://stackoverflow.com/q/1359793/850848#14699663	WinSCP.exe, 00000007.00000002.2463265894.0000000004E89000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E98000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/install.php?mode=sponsorrequest&ver=6.3.5&lang=en&prevver=&scale=100&images=-ae	WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566998814.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2578172782.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://webdav.org/neon/hooks/webdav-lockinghttp://webdav.org/neon/hooks/webdav-lockingLocked	WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	false		unknown
https://winscp.net/eng/docs/library_example_zip_and_uploadI=	WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://openssl-library.org//Codi	is-S743B.tmp.2.dr	false		unknown
https://winscp.net/eng/docs/library_example_keep_local_directory_up_to_date#options	WinSCP.exe, 0000000E.00000002.3405428504.0000000004204000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://filezilla-project.org/nAquest	is-S743B.tmp.2.dr	false		unknown
https://www.internalfb.com/intern/invariant/	chromecache_399.16.dr	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/	WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	false		unknown
https://www.remobjects.com/ps	WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136471090.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136058894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000000.2137712250.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WinSCP-6.3.5-Setup.tmp.0.dr	false	URL Reputation: safe	unknown
https://www.innosetup.com/	WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136471090.000000007FB20000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2136058894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000000.2137712250.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WinSCP-6.3.5-Setup.tmp.0.dr	false	URL Reputation: safe	unknown
http://apache.org/dav/propset/fs/1	WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	false		unknown
http://apache.org/dav/props/T	WinSCP.exe, 00000007.00000002.2457040440.0000000001C92000.00000004.00000001.01000000.00000009.sdmp, WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp, WinSCP.exe, 0000000E.00000002.3403098508.0000000001C92000.00000004.00000001.01000000.00000009.sdmp	false		unknown
https://winscp.net/eng/docs/library_example_zip_and_uploadP	WinSCP.exe, 0000000E.00000002.3405428504.0000000004149000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/(	WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, is-S743B.tmp.2.dr	false		unknown
https://winscp.net/&	WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2575911732.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-FQG0H.tmp.2.dr, is-A0EPI.tmp.2.dr	false		unknown
https://winscp.net/eng/docs/license	WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2581546171.0000000006586000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2272176105.00000000008F0000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2269718517.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2575431470.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2562782819.000000000657C000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.000000000359C000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2577805992.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://winscp.net/eng/docs/library_example_recursive_search_textI	WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/eng/docs/library_example_recursive_search_textIu	WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/eng/docs/library_example_advanced_rename	WinSCP.exe, 0000000B.00000002.2483407064.0000000004490000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2526226023.0000000004862000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/eng/docs/extension_compare_filesa	WinSCP.exe, 00000007.00000002.2458633360.0000000002BD1000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EEE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/eng/docs/library_example_verify_file_checksum#optionscksuma	WinSCP.exe, 0000000B.00000002.2483407064.00000000044ED000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/eng/docs/library_example_verify_file_checksum#optionscksumh	WinSCP.exe, 0000000E.00000002.3405428504.00000000041A6000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.webdav.org/neon/hooks/http-passport-reqWWW-AuthenticatePassport1.4Passport1.4http://www.w	WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	false		unknown
https://winscp.net/eng/docs/library_example_zip_and_uploady	WinSCP.exe, 00000007.00000002.2458633360.0000000002BF2000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/=	WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2575612359.00000000008B4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://winscp.net/eng/docs/extension_compare_files0	WinSCP.exe, 0000000E.00000002.3405428504.0000000004128000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/D	WinSCP.exe, 00000007.00000002.2458633360.0000000002CC3000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001FC7000.00000002.00000001.01000000.00000009.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004553000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003FE3000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004213000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net:443/install.php?mode=report&installed=1&silent=0&ver=6.3.5&lang=en&prevver=&spons	WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2579139130.000000000091A000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2565675597.0000000000917000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/UweRaabe/PngComponents	WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	false		unknown
http://acs.amazonaws.com/groups/global/AuthenticatedUsers	WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	false		unknown
https://winscp.net/eng/donate.php?	WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002397000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.000000000251E000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2570231833.0000000003739000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2567609512.00000000034D2000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/install.php?mode=sponsorrequest&ver=6.3.5&lang=en&prevver=&scale=100&images=4	WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2579139130.000000000091A000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2565675597.0000000000917000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://winscp.net/eng/docs/?ver=%s&lang=%s-https://winscp.net/eng/docs/%s?ver=%s&lang=%s	WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-FQG0H.tmp.2.dr, is-S743B.tmp.2.dr, is-A0EPI.tmp.2.dr, is-G6EB7.tmp.2.dr	false		unknown
http://webdav.org/neon/hooks/webdav-lockingHas	WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	false		unknown
https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE6Hi	is-S743B.tmp.2.dr	false		unknown
https://winscp.net/	WinSCP-6.3.5-Setup.exe, 00000000.00000003.2585283921.0000000002404000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2573149542.00000000025D4000.00000004.00001000.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566078635.0000000006542000.00000004.00000020.00020000.00000000.sdmp, WinSCP-6.3.5-Setup.tmp, 00000002.00000002.2580960915.000000000655D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.webdav.org/neon/hooks/http-redirecthttp://www.webdav.org/neon/hooks/http-redirectAborted	WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	false		unknown
https://winscp.net/eng/docs/extension_archive_and_download	WinSCP.exe, 00000007.00000002.2458633360.0000000002BF2000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004490000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003F0B000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.borland.com/namespaces/Types	WinSCP.exe, 0000000C.00000002.2524618352.0000000003F76000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.00000000041B5000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE	is-A0EPI.tmp.2.dr	false		unknown
http://www.webdav.org/neon/hooks/http-redirect	WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	false		unknown
http://www.webdav.org/neon/hooks/http-passport-req	WinSCP.exe, 00000007.00000000.2437945608.0000000001AFB000.00000008.00000001.01000000.00000009.sdmp	false		unknown
https://winscp.net/2https://winscp.net/forum/Fhttps://winscp.net/eng/download.php	WinSCP-6.3.5-Setup.exe, 00000000.00000003.2134713117.0000000002570000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://winscp.net/eng/docs/library_example_zip_and_upload#options	WinSCP.exe, 00000007.00000002.2463265894.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 00000007.00000002.2458633360.0000000002BCA000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2483407064.0000000004468000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000B.00000002.2484704727.0000000004E5A000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000C.00000002.2524618352.0000000003EE7000.00000004.00001000.00020000.00000000.sdmp, WinSCP.exe, 0000000E.00000002.3405428504.0000000004121000.00000004.00001000.00020000.00000000.sdmp, is-P36QM.tmp.2.dr	false		unknown
https://winscp.net/install.php?mode=report&installed=1&silent=0&ver=6.3.5&lang=en&prevver=&sponsorst	WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2566078635.0000000006542000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://openssl-library.org/)WebDAV/HTTP	WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp, is-A0EPI.tmp.2.dr	false		unknown
https://winscp.net/eng/docs/library_example_recursive_search_text#options_texth	WinSCP.exe, 0000000E.00000002.3405428504.00000000041A6000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.gnu.org/licenses/	WinSCP.exe, 00000007.00000000.2440107094.0000000001D9E000.00000002.00000001.01000000.00000009.sdmp	false		unknown
https://winscp.net/eng/docs/library_example_recursive_search_text#options_textQ	WinSCP.exe, 0000000B.00000002.2483407064.00000000044ED000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/1	WinSCP-6.3.5-Setup.tmp, 00000002.00000003.2548739501.0000000006A10000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://td.doubleclick.net	chromecache_346.16.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
104.244.42.200	unknown	United States	13414	TWITTERUS	false
88.198.21.111	winscp.net	Germany	24940	HETZNER-ASDE	false
142.250.185.226	unknown	United States	15169	GOOGLEUS	false
104.244.42.136	unknown	United States	13414	TWITTERUS	false
157.240.0.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
142.250.185.194	td.doubleclick.net	United States	15169	GOOGLEUS	false
199.232.188.157	platform.twitter.map.fastly.net	United States	54113	FASTLYUS	false
37.19.194.80	1578389079.rsc.cdn77.org	Ukraine	31343	INTERTELECOMUA	false
172.217.16.194	unknown	United States	15169	GOOGLEUS	false
169.150.255.180	unknown	United States	2711	SPIRITTEL-ASUS	false
64.233.167.157	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.185.129	unknown	United States	15169	GOOGLEUS	false
57.144.134.128	scontent-phx1-1.xx.fbcdn.net	Belgium	2686	ATGS-MMD-ASUS	false
216.58.206.78	analytics.google.com	United States	15169	GOOGLEUS	false
216.58.206.33	unknown	United States	15169	GOOGLEUS	false
157.240.0.6	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
172.217.16.206	www3.l.google.com	United States	15169	GOOGLEUS	false
104.244.42.8	syndication.twitter.com	United States	13414	TWITTERUS	false
216.58.206.66	unknown	United States	15169	GOOGLEUS	false
157.240.251.9	unknown	United States	32934	FACEBOOKUS	false
157.240.251.35	unknown	United States	32934	FACEBOOKUS	false
142.250.185.97	ep2.adtrafficquality.google	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546344
Start date and time:	2024-10-31 19:44:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WinSCP-6.3.5-Setup.exe
Detection:	SUS
Classification:	sus24.spyw.winEXE@36/434@75/27
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse
	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse
	https://www.miroslavska.com/pvt/language-prefs?return_url=https:///alrbanyon.com/..&lng=en&return_url=/plain-flange_red.thick./dn-800/glatter-flansch-dn-800:813x20-pn-10-id-8195-mm	Get hash	malicious	HTMLPhisher	Browse
	original.eml	Get hash	malicious	Mamba2FA	Browse
	https://fcs-aero.com/ilsmart/marketplace/inventory/#ksunya.chan@yogiproducts.com	Get hash	malicious	HTMLPhisher	Browse
	https://s3.timeweb.cloud/d2247a8d-ceb09c71-57ee-4411-a590-e4de8ca5cf86/Contract/contract.htm#andrew.wise@arrowbank.com	Get hash	malicious	HTMLPhisher	Browse
	https://0nmdby.data--8.co.uk/oGRApYgs	Get hash	malicious	Unknown	Browse
	https://flaviarc.com/sphp%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/index.php	Get hash	malicious	HTMLPhisher	Browse
104.244.42.136	https://jpbelgi.com/	Get hash	malicious	Unknown	Browse
	https://zupimages.net/up/24/42/ol13.jpg?d6mSMvU0ZvpGwffnuqPHYMR7NvlxIzVjDfTD4YJjdRSCOcc	Get hash	malicious	Unknown	Browse
	https://freeaccessonline.mystrikingly.com/	Get hash	malicious	Unknown	Browse
	https://shawri.weebly.com/	Get hash	malicious	HTMLPhisher	Browse
	https://shawri.weebly.com/	Get hash	malicious	HTMLPhisher	Browse
	http://mr-zkpak47.github.io/Netflix_Front_Page	Get hash	malicious	HTMLPhisher	Browse
	http://kartike1103.github.io/Netflix	Get hash	malicious	HTMLPhisher	Browse
	http://sachinchaunal.github.io/Netflix-Clone-Old-Version	Get hash	malicious	HTMLPhisher	Browse
	http://haribabu574.github.io/netflix-clone	Get hash	malicious	HTMLPhisher	Browse
	https://devilxhacker.github.io/Netflix_Clone/	Get hash	malicious	HTMLPhisher	Browse
104.244.42.200	http://scansourcce.com/	Get hash	malicious	Unknown	Browse
	http://ikergalindez.github.io/gofish/	Get hash	malicious	HTMLPhisher	Browse
	http://barik-ankita.github.io/Netflix-clone	Get hash	malicious	HTMLPhisher	Browse
	http://kartike1103.github.io/Netflix	Get hash	malicious	HTMLPhisher	Browse
	http://haribabu574.github.io/netflix-clone	Get hash	malicious	HTMLPhisher	Browse
	https://anubhav1604.github.io/Netflix-clone	Get hash	malicious	HTMLPhisher	Browse
	https://simu000.github.io/netflix/	Get hash	malicious	HTMLPhisher	Browse
	https://ranjitkumarmehta1.github.io/netflix/	Get hash	malicious	HTMLPhisher	Browse
	https://t.co/dvIdjH2Xsv	Get hash	malicious	Unknown	Browse
	https://rajkamalkanna.github.io/Facebook-Login-Page/	Get hash	malicious	HTMLPhisher	Browse
88.198.21.111	https://cdn.winscp.net/files/WinSCP-6.3.3-Setup.exe?secure=AAFzyfkIujLz8E5DTusHGg==,1717044260	Get hash	malicious	Unknown	Browse
	https://winscp.net/eng/download.php	Get hash	malicious	Unknown	Browse
	https://winscp.net/download/WinSCP-6.1.2-Setup.exe	Get hash	malicious	Unknown	Browse
	https://winscp.net/download/WinSCP-6.1.1-Setup.exe	Get hash	malicious	Unknown	Browse
	WinSCP_setup.iso	Get hash	malicious	Meterpreter	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://www.miroslavska.com/pvt/language-prefs?return_url=https:///alrbanyon.com/..&lng=en&return_url=/plain-flange_red.thick./dn-800/glatter-flansch-dn-800:813x20-pn-10-id-8195-mm	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	OPEN FOR MORE INFORMATION (1) (1).docx	Get hash	malicious	Unknown	Browse	173.222.162.64
	http://luckywinsweep.com/4tTAnN1826Wdfo84jjvakjqbux636KVMMHSLZEESXXFW54756LTNO308c9	Get hash	malicious	Phisher	Browse	173.222.162.64
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	173.222.162.64
	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	173.222.162.64
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 4.245.163.56 184.28.90.27 13.107.246.45
	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 184.28.90.27 13.107.246.45
	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 184.28.90.27 13.107.246.45
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse	20.109.210.53 4.245.163.56 184.28.90.27 13.107.246.45
	https://www.miroslavska.com/pvt/language-prefs?return_url=https:///alrbanyon.com/..&lng=en&return_url=/plain-flange_red.thick./dn-800/glatter-flansch-dn-800:813x20-pn-10-id-8195-mm	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 4.245.163.56 184.28.90.27 13.107.246.45
	SecuriteInfo.com.Win32.MalwareX-gen.14673.11544.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 184.28.90.27 13.107.246.45
	https://0nmdby.data--8.co.uk/oGRApYgs	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 184.28.90.27 13.107.246.45
	https://usps.com-trackrsm.top/l	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 4.245.163.56 184.28.90.27 13.107.246.45
	OPEN FOR MORE INFORMATION (1) (1).docx	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 184.28.90.27 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse	40.113.110.67
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	40.113.110.67
	file.exe	Get hash	malicious	LummaC	Browse	40.113.110.67
	Lana_Rhoades_Photoos.js	Get hash	malicious	Unknown	Browse	40.113.110.67
	rMT103_126021720924.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67
	https://t.ly/4Nq2x	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	40.113.110.67
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse	40.113.110.67
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse	40.113.110.67
	RFQ Proposals ADC-24-65.exe	Get hash	malicious	MassLogger RAT	Browse	40.113.110.67
	RFQ Q700mm CB St44 PN20 e=5.6 mm TSEN 10217-1 #U7edd#U7f18#U94a2#U7ba1#Uff1a200 #U7c73.exe	Get hash	malicious	MassLogger RAT	Browse	40.113.110.67
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	88.198.21.111
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	88.198.21.111
	file.exe	Get hash	malicious	LummaC	Browse	88.198.21.111
	Lana_Rhoades_Photoos.js	Get hash	malicious	Unknown	Browse	88.198.21.111
	file.exe	Get hash	malicious	LummaC	Browse	88.198.21.111
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XWorm	Browse	88.198.21.111
	a.hta	Get hash	malicious	DarkComet, DarkTortilla, Neshta	Browse	88.198.21.111
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	88.198.21.111
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	88.198.21.111
	Set-Up.exe	Get hash	malicious	LummaC	Browse	88.198.21.111

Process:	C:\Users\user\AppData\Local\Temp\is-9B42P.tmp\WinSCP-6.3.5-Setup.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	492456
Entropy (8bit):	6.1399923925547695
Encrypted:	false
SSDEEP:	6144:ybL80w8/HGgkXcl9hKJBSPxXq3d8VL0LMMMoBvmyHhUOrhSALIDlWJDl2aUaesZq:ys0w1gksl9hoA0ZBvmmlIiZkr8D5Gd
MD5:	BE89EA8516602A811554DF2C62C811DD
SHA1:	F535562499DEE9830338CEB7549659655022B4B2
SHA-256:	AB0CA9BEA36AE579C28832E4F0B80A0675428ADAD27A5866AEC220B73C73822A
SHA-512:	AF4CBE6B051EFD95B999A5EAEDB720C7994AE1673B928CEB762D9B76CF70E4B8CD537A2891905D054D751E6542D524FC062E29CCADBB677BB806BB962436B277
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..d......f...........".....p...@................@.............................. ............@.....................................................%............P...2...0...R......p....................................................................................text...Xi.......j.................. ..`.rodata. 4.......6...r..............@....data....~..........................@....tls.........@.......b..............@....pdata...2...P...4...d..............@..@.xdata...L.......N......

Process:	C:\Users\user\Desktop\WinSCP-6.3.5-Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3288176
Entropy (8bit):	6.3674533010795615
Encrypted:	false
SSDEEP:	49152:cWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbF333K/ogj7m50yIUO9:4tLutqgwh4NYxtJpkxhGK333k
MD5:	11878001A28CE434F6EB02AA85C3199B
SHA1:	47DD4E5FB52236913B63D4B520775BA0685A8334
SHA-256:	B3A2140B8CA0BABC75DAEA00D59A3804B616B10BACF2559A3B3F510298882065
SHA-512:	9AFA2DAFFEA483A57F0D85BCE9E598792714433BCDA3F100562F60066E84D5B506C79B638C20C859C80F039E4B784AD0ADCE6D10CF059503E624B0FB05CE5BE0
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................2.......2...@......@....................-.......-..9......X.............1.pR...........................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc...X.............-.............@..@..............1.......0.............@..@........................................................

Process:	C:\Program Files (x86)\WinSCP\WinSCP.exe
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (723)
Category:	downloaded
Size (bytes):	7076
Entropy (8bit):	5.52488676121649
Encrypted:	false
SSDEEP:	192:bttd4a6O1T6ahNU3dJ+SrM0hjUYIW2WX8ISlY:bBJ1T9UNJ+SrM0lXV2WXXSlY
MD5:	88A2E0A522036C0B87E03552E56629AA
SHA1:	EC9D1157518E753A84DBDE1333A29B34CF776D63
SHA-256:	788AFB96F2DA68E8729EC35F3D5E381FAD3482D37C54C2195C7311440EE4C27E
SHA-512:	44B953878BD650FE2BCC8B6904620955C3E396B7DC8F41F85D021A8E0404DA41DB15C5499A03F7D4FE9129BB340AA3F6782942CF5327502FD4569BEBBB17073F
Malicious:	false
URL:	https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fwinscp.net
Preview:	'use strict';var k=function(a){function b(c){return a.next(c)}function e(c){return a.throw(c)}return new Promise(function(c,d){function f(h){h.done?c(h.value):Promise.resolve(h.value).then(b,e).then(f,d)}f(a.next())})};/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var m=this\|\|self;var u,v;a:{for(var x=["CLOSURE_FLAGS"],B=m,C=0;C<x.length;C++)if(B=B[x[C]],B==null){v=null;break a}v=B}var G=v&&v[610401301];u=G!=null?G:!1;var H;const I=m.navigator;H=I?I.userAgentData\|\|null:null;function J(a){return u?H?H.brands.some(({brand:b})=>b&&b.indexOf(a)!=-1):!1:!1}function K(a){var b;a:{const e=m.navigator;if(e){const c=e.userAgent;if(c){b=c;break a}}b=""}return b.indexOf(a)!=-1};function L(){return u?!!H&&H.brands.length>0:!1}function O(){return L()?J("Chromium"):(K("Chrome")\|\|K("CriOS"))&&!(L()?0:K("Edge"))\|\|K("Silk")};!K("Android")\|\|O();O();!K("Safari")\|\|O()\|\|(L()?0:K("Coast"))\|\|(L()?0:K("Opera"))\|\|(L()?0:K("Edge"))\|\|(L()?J("Microsoft Edge"):K("Edg/"))\|\|L()&

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	24/11/2022 01:00:00 18/02/2026 00:59:59
Subject Chain	CN=Martin Prikryl, O=Martin Prikryl, L=Prague, C=CZ, SERIALNUMBER=87331519, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=CZ
Version:	3
Thumbprint MD5:	D56AE2459990C688005B94D5F49C6F73
Thumbprint SHA-1:	0DEE8F52D6B8D8C4B2C9573F4299FD97D707BAB7
Thumbprint SHA-256:	21B966B533E4239954A1D385CDF0AD038B7CA88A8632A7CE0B87691DF6C1606D
Serial:	04292E45125096FE6D57AB7C648AA118

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x28e60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb0db58	0x5270
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	43af0a9476ca224d8e8461f1e22c94da	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	185e04b9a1f554e31f7f848515dc890c	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	cab2107c933b696aa5cf0cc6c3fd3980	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	e7d1635e2624b124cfdce6c360ac21cd	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	8ced971d8a7705c98b173e255d8c9aa7	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	8d4e1e508031afe235bf121c80fd7d5f	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x28e60	0x29000	d3c420c712b6d1e5b5b6f42f3208aa91	False	0.3165432069359756	data	5.20133620837365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WinSCP-6.3.5-Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\WinSCP\DragExt64.dll (copy)

C:\Program Files (x86)\WinSCP\Extensions\ArchiveDownload.WinSCPextension.ps1 (copy)

C:\Program Files (x86)\WinSCP\Extensions\BatchRename.WinSCPextension.ps1 (copy)

C:\Program Files (x86)\WinSCP\Extensions\CompareFiles.WinSCPextension.ps1 (copy)

C:\Program Files (x86)\WinSCP\Extensions\GenerateHttpUrl.WinSCPextension.ps1 (copy)

C:\Program Files (x86)\WinSCP\Extensions\KeepLocalUpToDate.WinSCPextension.ps1 (copy)

C:\Program Files (x86)\WinSCP\Extensions\SearchText.WinSCPextension.ps1 (copy)

C:\Program Files (x86)\WinSCP\Extensions\SynchronizeAnotherServer.WinSCPextension.ps1 (copy)

C:\Program Files (x86)\WinSCP\Extensions\VerifyFileChecksum.WinSCPextension.ps1 (copy)

C:\Program Files (x86)\WinSCP\Extensions\ZipUpload.WinSCPextension.ps1 (copy)

C:\Program Files (x86)\WinSCP\Extensions\is-2OK6J.tmp

C:\Program Files (x86)\WinSCP\Extensions\is-8TIJ5.tmp

C:\Program Files (x86)\WinSCP\Extensions\is-BQ1JP.tmp

C:\Program Files (x86)\WinSCP\Extensions\is-CQOQS.tmp

C:\Program Files (x86)\WinSCP\Extensions\is-HUOBU.tmp

C:\Program Files (x86)\WinSCP\Extensions\is-O19AE.tmp

C:\Program Files (x86)\WinSCP\Extensions\is-P36QM.tmp

C:\Program Files (x86)\WinSCP\Extensions\is-PDQCT.tmp

Windows Analysis Report
WinSCP-6.3.5-Setup.exe

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7618	0x4f85	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9975438424129293
RT_ICON	0xcc5a0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.136327339406128
RT_ICON	0xdcdc8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.26405290505432216
RT_ICON	0xe0ff0	0x3a48	Device independent bitmap graphic, 60 x 120 x 32, image size 14880	English	United States	0.2675603217158177
RT_ICON	0xe4a38	0x2734	Device independent bitmap graphic, 49 x 98 x 32, image size 9996	English	United States	0.3156636110003986
RT_ICON	0xe716c	0x1d08	Device independent bitmap graphic, 42 x 84 x 32, image size 7392	English	United States	0.36033369214208827
RT_ICON	0xe8e74	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.35133136094674555
RT_ICON	0xea8dc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.45684803001876173
RT_ICON	0xeb984	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5520491803278689
RT_ICON	0xec30c	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.6075581395348837
RT_ICON	0xec9c4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6959219858156028
RT_STRING	0xece2c	0x360	data			0.34375
RT_STRING	0xed18c	0x260	data			0.3256578947368421
RT_STRING	0xed3ec	0x45c	data			0.4068100358422939
RT_STRING	0xed848	0x40c	data			0.3754826254826255
RT_STRING	0xedc54	0x2d4	data			0.39226519337016574
RT_STRING	0xedf28	0xb8	data			0.6467391304347826
RT_STRING	0xedfe0	0x9c	data			0.6410256410256411
RT_STRING	0xee07c	0x374	data			0.4230769230769231
RT_STRING	0xee3f0	0x398	data			0.3358695652173913
RT_STRING	0xee788	0x368	data			0.3795871559633027
RT_STRING	0xeeaf0	0x2a4	data			0.4275147928994083
RT_RCDATA	0xeed94	0x10	data			1.5
RT_RCDATA	0xeeda4	0x2c4	data			0.6384180790960452
RT_RCDATA	0xef068	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0xef094	0xa0	data	English	United States	0.7
RT_VERSION	0xef134	0x584	data	English	United States	0.31444759206798867
RT_MANIFEST	0xef6b8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 19:45:41.397495985 CET	192.168.2.6	1.1.1.1	0xaff0	Standard query (0)	winscp.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:07.523555040 CET	192.168.2.6	1.1.1.1	0xd7e4	Standard query (0)	winscp.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:07.523992062 CET	192.168.2.6	1.1.1.1	0x4eaf	Standard query (0)	winscp.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:10.189886093 CET	192.168.2.6	1.1.1.1	0x46b7	Standard query (0)	winscp-static-746341.c.cdn77.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:10.190100908 CET	192.168.2.6	1.1.1.1	0x5fe0	Standard query (0)	winscp-static-746341.c.cdn77.org	65	IN (0x0001)	false
Oct 31, 2024 19:46:11.299395084 CET	192.168.2.6	1.1.1.1	0xc09e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.299547911 CET	192.168.2.6	1.1.1.1	0x5fe1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:11.332516909 CET	192.168.2.6	1.1.1.1	0x122f	Standard query (0)	winscp-static-746341.c.cdn77.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.332676888 CET	192.168.2.6	1.1.1.1	0x836b	Standard query (0)	winscp-static-746341.c.cdn77.org	65	IN (0x0001)	false
Oct 31, 2024 19:46:11.678601980 CET	192.168.2.6	1.1.1.1	0x1f4	Standard query (0)	platform.twitter.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.678752899 CET	192.168.2.6	1.1.1.1	0xc0b3	Standard query (0)	platform.twitter.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:11.692612886 CET	192.168.2.6	1.1.1.1	0x3fc0	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.692922115 CET	192.168.2.6	1.1.1.1	0x11a7	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:13.244843960 CET	192.168.2.6	1.1.1.1	0x910d	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:13.248400927 CET	192.168.2.6	1.1.1.1	0x9d66	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:14.106070995 CET	192.168.2.6	1.1.1.1	0x2e6e	Standard query (0)	platform.twitter.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:14.106487036 CET	192.168.2.6	1.1.1.1	0xb818	Standard query (0)	platform.twitter.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:14.504627943 CET	192.168.2.6	1.1.1.1	0x20f8	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:14.504868984 CET	192.168.2.6	1.1.1.1	0x4acf	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:14.513597012 CET	192.168.2.6	1.1.1.1	0x641c	Standard query (0)	platform.twitter.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:14.513824940 CET	192.168.2.6	1.1.1.1	0x3cf	Standard query (0)	platform.twitter.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:15.135045052 CET	192.168.2.6	1.1.1.1	0x4f3e	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:15.135466099 CET	192.168.2.6	1.1.1.1	0x93ca	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:16.492069006 CET	192.168.2.6	1.1.1.1	0x8cf9	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:16.492208004 CET	192.168.2.6	1.1.1.1	0x59bc	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:16.767883062 CET	192.168.2.6	1.1.1.1	0x186b	Standard query (0)	syndication.twitter.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:16.768313885 CET	192.168.2.6	1.1.1.1	0x4932	Standard query (0)	syndication.twitter.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:16.891869068 CET	192.168.2.6	1.1.1.1	0x1d97	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:16.892009020 CET	192.168.2.6	1.1.1.1	0xf192	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:17.153805017 CET	192.168.2.6	1.1.1.1	0x858f	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:17.153985977 CET	192.168.2.6	1.1.1.1	0xdb89	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:17.437694073 CET	192.168.2.6	1.1.1.1	0x4975	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:17.437881947 CET	192.168.2.6	1.1.1.1	0x1e15	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:17.475003958 CET	192.168.2.6	1.1.1.1	0x9aaa	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:17.475435972 CET	192.168.2.6	1.1.1.1	0x837	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:17.517657995 CET	192.168.2.6	1.1.1.1	0x62b1	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:17.519588947 CET	192.168.2.6	1.1.1.1	0x9e38	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:17.812571049 CET	192.168.2.6	1.1.1.1	0xfed6	Standard query (0)	syndication.twitter.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:17.812963009 CET	192.168.2.6	1.1.1.1	0x508e	Standard query (0)	syndication.twitter.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:18.502113104 CET	192.168.2.6	1.1.1.1	0x2d16	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:18.502388954 CET	192.168.2.6	1.1.1.1	0x2313	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:19.141536951 CET	192.168.2.6	1.1.1.1	0x6f3d	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:19.142016888 CET	192.168.2.6	1.1.1.1	0x3ec5	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:19.411484003 CET	192.168.2.6	1.1.1.1	0x28d4	Standard query (0)	fundingchoicesmessages.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:19.411636114 CET	192.168.2.6	1.1.1.1	0x22d3	Standard query (0)	fundingchoicesmessages.google.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:20.085741997 CET	192.168.2.6	1.1.1.1	0x5af	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:20.086129904 CET	192.168.2.6	1.1.1.1	0xa072	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:20.180753946 CET	192.168.2.6	1.1.1.1	0x14b7	Standard query (0)	syndication.twitter.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:20.180907965 CET	192.168.2.6	1.1.1.1	0xd2a3	Standard query (0)	syndication.twitter.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:20.428756952 CET	192.168.2.6	1.1.1.1	0x688	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:20.428911924 CET	192.168.2.6	1.1.1.1	0x4786	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:20.764033079 CET	192.168.2.6	1.1.1.1	0xb35	Standard query (0)	scontent-phx1-1.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:20.764296055 CET	192.168.2.6	1.1.1.1	0x4d08	Standard query (0)	scontent-phx1-1.xx.fbcdn.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:21.765151024 CET	192.168.2.6	1.1.1.1	0x8920	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:21.765286922 CET	192.168.2.6	1.1.1.1	0x602a	Standard query (0)	twitter.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:22.904077053 CET	192.168.2.6	1.1.1.1	0x29a3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:22.904246092 CET	192.168.2.6	1.1.1.1	0x8db	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:23.382941008 CET	192.168.2.6	1.1.1.1	0x99bc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:23.383071899 CET	192.168.2.6	1.1.1.1	0xe50f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:23.621501923 CET	192.168.2.6	1.1.1.1	0xfdc	Standard query (0)	fundingchoicesmessages.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:23.621762037 CET	192.168.2.6	1.1.1.1	0x78ee	Standard query (0)	fundingchoicesmessages.google.com	65	IN (0x0001)	false
Oct 31, 2024 19:46:23.631755114 CET	192.168.2.6	1.1.1.1	0xab0	Standard query (0)	scontent-phx1-1.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:23.631975889 CET	192.168.2.6	1.1.1.1	0xb00a	Standard query (0)	scontent-phx1-1.xx.fbcdn.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:30.096498966 CET	192.168.2.6	1.1.1.1	0x99f	Standard query (0)	ep1.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:30.096719980 CET	192.168.2.6	1.1.1.1	0xe194	Standard query (0)	ep1.adtrafficquality.google	65	IN (0x0001)	false
Oct 31, 2024 19:46:31.437722921 CET	192.168.2.6	1.1.1.1	0xcb3a	Standard query (0)	winscp.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:31.437959909 CET	192.168.2.6	1.1.1.1	0xdb8b	Standard query (0)	winscp.net	65	IN (0x0001)	false
Oct 31, 2024 19:46:31.464193106 CET	192.168.2.6	1.1.1.1	0x1deb	Standard query (0)	ep2.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:31.464456081 CET	192.168.2.6	1.1.1.1	0xda3c	Standard query (0)	ep2.adtrafficquality.google	65	IN (0x0001)	false
Oct 31, 2024 19:46:31.465231895 CET	192.168.2.6	1.1.1.1	0x5212	Standard query (0)	ep1.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:31.465367079 CET	192.168.2.6	1.1.1.1	0x5696	Standard query (0)	ep1.adtrafficquality.google	65	IN (0x0001)	false
Oct 31, 2024 19:46:32.747023106 CET	192.168.2.6	1.1.1.1	0xdbc8	Standard query (0)	ep2.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:32.747205019 CET	192.168.2.6	1.1.1.1	0xc19d	Standard query (0)	ep2.adtrafficquality.google	65	IN (0x0001)	false
Oct 31, 2024 19:46:32.781239033 CET	192.168.2.6	1.1.1.1	0x9f66	Standard query (0)	ep2.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:32.781538010 CET	192.168.2.6	1.1.1.1	0x3cce	Standard query (0)	ep2.adtrafficquality.google	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 19:45:41.405142069 CET	1.1.1.1	192.168.2.6	0xaff0	No error (0)	winscp.net		88.198.21.111	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:07.541435003 CET	1.1.1.1	192.168.2.6	0xd7e4	No error (0)	winscp.net		88.198.21.111	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:10.209089041 CET	1.1.1.1	192.168.2.6	0x5fe0	No error (0)	winscp-static-746341.c.cdn77.org	1578389079.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:10.216609955 CET	1.1.1.1	192.168.2.6	0x46b7	No error (0)	winscp-static-746341.c.cdn77.org	1578389079.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:10.216609955 CET	1.1.1.1	192.168.2.6	0x46b7	No error (0)	1578389079.rsc.cdn77.org		37.19.194.80	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:10.216609955 CET	1.1.1.1	192.168.2.6	0x46b7	No error (0)	1578389079.rsc.cdn77.org		195.181.170.19	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:10.216609955 CET	1.1.1.1	192.168.2.6	0x46b7	No error (0)	1578389079.rsc.cdn77.org		195.181.175.40	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:10.216609955 CET	1.1.1.1	192.168.2.6	0x46b7	No error (0)	1578389079.rsc.cdn77.org		212.102.56.178	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:10.216609955 CET	1.1.1.1	192.168.2.6	0x46b7	No error (0)	1578389079.rsc.cdn77.org		169.150.255.180	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:10.216609955 CET	1.1.1.1	192.168.2.6	0x46b7	No error (0)	1578389079.rsc.cdn77.org		207.211.211.26	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:10.216609955 CET	1.1.1.1	192.168.2.6	0x46b7	No error (0)	1578389079.rsc.cdn77.org		169.150.255.183	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.306508064 CET	1.1.1.1	192.168.2.6	0x5fe1	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 19:46:11.307311058 CET	1.1.1.1	192.168.2.6	0xc09e	No error (0)	www.google.com		142.250.185.164	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.349499941 CET	1.1.1.1	192.168.2.6	0x122f	No error (0)	winscp-static-746341.c.cdn77.org	1578389079.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:11.349499941 CET	1.1.1.1	192.168.2.6	0x122f	No error (0)	1578389079.rsc.cdn77.org		169.150.255.180	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.349499941 CET	1.1.1.1	192.168.2.6	0x122f	No error (0)	1578389079.rsc.cdn77.org		169.150.255.184	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.349499941 CET	1.1.1.1	192.168.2.6	0x122f	No error (0)	1578389079.rsc.cdn77.org		195.181.175.40	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.349499941 CET	1.1.1.1	192.168.2.6	0x122f	No error (0)	1578389079.rsc.cdn77.org		37.19.194.81	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.349499941 CET	1.1.1.1	192.168.2.6	0x122f	No error (0)	1578389079.rsc.cdn77.org		212.102.56.178	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.349499941 CET	1.1.1.1	192.168.2.6	0x122f	No error (0)	1578389079.rsc.cdn77.org		195.181.170.18	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.349499941 CET	1.1.1.1	192.168.2.6	0x122f	No error (0)	1578389079.rsc.cdn77.org		207.211.211.26	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.361048937 CET	1.1.1.1	192.168.2.6	0x836b	No error (0)	winscp-static-746341.c.cdn77.org	1578389079.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:11.685792923 CET	1.1.1.1	192.168.2.6	0x1f4	No error (0)	platform.twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:11.685792923 CET	1.1.1.1	192.168.2.6	0x1f4	No error (0)	platform.twitter.map.fastly.net		199.232.188.157	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.686084032 CET	1.1.1.1	192.168.2.6	0xc0b3	No error (0)	platform.twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:11.699618101 CET	1.1.1.1	192.168.2.6	0x3fc0	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:11.699618101 CET	1.1.1.1	192.168.2.6	0x3fc0	No error (0)	scontent.xx.fbcdn.net		157.240.0.6	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:11.700712919 CET	1.1.1.1	192.168.2.6	0x11a7	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:11.700712919 CET	1.1.1.1	192.168.2.6	0x11a7	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:11.700712919 CET	1.1.1.1	192.168.2.6	0x11a7	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:13.254472017 CET	1.1.1.1	192.168.2.6	0x910d	No error (0)	googleads.g.doubleclick.net		142.250.184.226	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:13.257999897 CET	1.1.1.1	192.168.2.6	0x9d66	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:14.113023996 CET	1.1.1.1	192.168.2.6	0x2e6e	No error (0)	platform.twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:14.113023996 CET	1.1.1.1	192.168.2.6	0x2e6e	No error (0)	platform.twitter.map.fastly.net		199.232.188.157	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:14.113926888 CET	1.1.1.1	192.168.2.6	0xb818	No error (0)	platform.twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:14.511864901 CET	1.1.1.1	192.168.2.6	0x20f8	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:14.511864901 CET	1.1.1.1	192.168.2.6	0x20f8	No error (0)	scontent.xx.fbcdn.net		157.240.251.9	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:14.512243986 CET	1.1.1.1	192.168.2.6	0x4acf	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:14.512243986 CET	1.1.1.1	192.168.2.6	0x4acf	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:14.512243986 CET	1.1.1.1	192.168.2.6	0x4acf	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:14.521922112 CET	1.1.1.1	192.168.2.6	0x641c	No error (0)	platform.twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:14.521922112 CET	1.1.1.1	192.168.2.6	0x641c	No error (0)	platform.twitter.map.fastly.net		199.232.188.157	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:14.521934032 CET	1.1.1.1	192.168.2.6	0x3cf	No error (0)	platform.twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:15.143398046 CET	1.1.1.1	192.168.2.6	0x4f3e	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:15.143398046 CET	1.1.1.1	192.168.2.6	0x4f3e	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:15.144476891 CET	1.1.1.1	192.168.2.6	0x93ca	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:16.499356985 CET	1.1.1.1	192.168.2.6	0x8cf9	No error (0)	googleads.g.doubleclick.net		172.217.16.194	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:16.499461889 CET	1.1.1.1	192.168.2.6	0x59bc	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:16.774754047 CET	1.1.1.1	192.168.2.6	0x186b	No error (0)	syndication.twitter.com		104.244.42.8	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:16.899138927 CET	1.1.1.1	192.168.2.6	0xf192	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:16.899818897 CET	1.1.1.1	192.168.2.6	0x1d97	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:16.899818897 CET	1.1.1.1	192.168.2.6	0x1d97	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:17.160593987 CET	1.1.1.1	192.168.2.6	0x858f	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:17.160593987 CET	1.1.1.1	192.168.2.6	0x858f	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:17.160914898 CET	1.1.1.1	192.168.2.6	0xdb89	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:17.445360899 CET	1.1.1.1	192.168.2.6	0x1e15	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 19:46:17.445379972 CET	1.1.1.1	192.168.2.6	0x4975	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:17.482273102 CET	1.1.1.1	192.168.2.6	0x9aaa	No error (0)	td.doubleclick.net		142.250.185.194	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:17.524415970 CET	1.1.1.1	192.168.2.6	0x62b1	No error (0)	analytics.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:17.819868088 CET	1.1.1.1	192.168.2.6	0xfed6	No error (0)	syndication.twitter.com		104.244.42.200	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:18.511442900 CET	1.1.1.1	192.168.2.6	0x2313	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:18.511442900 CET	1.1.1.1	192.168.2.6	0x2313	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:18.511442900 CET	1.1.1.1	192.168.2.6	0x2313	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:18.511615992 CET	1.1.1.1	192.168.2.6	0x2d16	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:18.511615992 CET	1.1.1.1	192.168.2.6	0x2d16	No error (0)	scontent.xx.fbcdn.net		157.240.251.9	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:19.148832083 CET	1.1.1.1	192.168.2.6	0x6f3d	No error (0)	stats.g.doubleclick.net		64.233.167.157	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:19.148832083 CET	1.1.1.1	192.168.2.6	0x6f3d	No error (0)	stats.g.doubleclick.net		64.233.167.154	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:19.148832083 CET	1.1.1.1	192.168.2.6	0x6f3d	No error (0)	stats.g.doubleclick.net		64.233.167.156	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:19.148832083 CET	1.1.1.1	192.168.2.6	0x6f3d	No error (0)	stats.g.doubleclick.net		64.233.167.155	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:19.418400049 CET	1.1.1.1	192.168.2.6	0x28d4	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:19.418400049 CET	1.1.1.1	192.168.2.6	0x28d4	No error (0)	www3.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:19.418608904 CET	1.1.1.1	192.168.2.6	0x22d3	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:20.135684967 CET	1.1.1.1	192.168.2.6	0x5af	No error (0)	googleads.g.doubleclick.net		216.58.206.66	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:20.135704994 CET	1.1.1.1	192.168.2.6	0xa072	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:20.227293968 CET	1.1.1.1	192.168.2.6	0x14b7	No error (0)	syndication.twitter.com		104.244.42.136	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:20.435465097 CET	1.1.1.1	192.168.2.6	0x688	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:20.435465097 CET	1.1.1.1	192.168.2.6	0x688	No error (0)	scontent.xx.fbcdn.net		157.240.0.6	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:20.436147928 CET	1.1.1.1	192.168.2.6	0x4786	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:20.436147928 CET	1.1.1.1	192.168.2.6	0x4786	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:20.436147928 CET	1.1.1.1	192.168.2.6	0x4786	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:20.772290945 CET	1.1.1.1	192.168.2.6	0x4d08	No error (0)	scontent-phx1-1.xx.fbcdn.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:20.777973890 CET	1.1.1.1	192.168.2.6	0xb35	No error (0)	scontent-phx1-1.xx.fbcdn.net		57.144.134.128	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:21.771894932 CET	1.1.1.1	192.168.2.6	0x8920	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:22.910909891 CET	1.1.1.1	192.168.2.6	0x29a3	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:22.911613941 CET	1.1.1.1	192.168.2.6	0x8db	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 19:46:23.389810085 CET	1.1.1.1	192.168.2.6	0xe50f	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 19:46:23.390057087 CET	1.1.1.1	192.168.2.6	0x99bc	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:23.628443956 CET	1.1.1.1	192.168.2.6	0xfdc	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:23.628443956 CET	1.1.1.1	192.168.2.6	0xfdc	No error (0)	www3.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:23.629136086 CET	1.1.1.1	192.168.2.6	0x78ee	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 19:46:23.639036894 CET	1.1.1.1	192.168.2.6	0xab0	No error (0)	scontent-phx1-1.xx.fbcdn.net		57.144.134.128	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:23.639224052 CET	1.1.1.1	192.168.2.6	0xb00a	No error (0)	scontent-phx1-1.xx.fbcdn.net			65	IN (0x0001)	false
Oct 31, 2024 19:46:30.103543997 CET	1.1.1.1	192.168.2.6	0xe194	No error (0)	ep1.adtrafficquality.google			65	IN (0x0001)	false
Oct 31, 2024 19:46:30.103993893 CET	1.1.1.1	192.168.2.6	0x99f	No error (0)	ep1.adtrafficquality.google		142.250.186.66	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:31.445070982 CET	1.1.1.1	192.168.2.6	0xcb3a	No error (0)	winscp.net		88.198.21.111	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:31.472379923 CET	1.1.1.1	192.168.2.6	0x1deb	No error (0)	ep2.adtrafficquality.google		142.250.185.97	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:31.473539114 CET	1.1.1.1	192.168.2.6	0x5212	No error (0)	ep1.adtrafficquality.google		142.250.185.226	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:31.473727942 CET	1.1.1.1	192.168.2.6	0x5696	No error (0)	ep1.adtrafficquality.google			65	IN (0x0001)	false
Oct 31, 2024 19:46:32.757405996 CET	1.1.1.1	192.168.2.6	0xdbc8	No error (0)	ep2.adtrafficquality.google		142.250.185.129	A (IP address)	IN (0x0001)	false
Oct 31, 2024 19:46:32.788455963 CET	1.1.1.1	192.168.2.6	0x9f66	No error (0)	ep2.adtrafficquality.google		216.58.206.33	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-31 18:45:26 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 55 6d 7a 33 71 37 76 75 38 6b 32 6b 32 78 68 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 65 65 36 32 39 61 35 63 61 66 39 33 63 39 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Umz3q7vu8k2k2xhE.1Context: 9ee629a5caf93c93
2024-10-31 18:45:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-31 18:45:26 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 55 6d 7a 33 71 37 76 75 38 6b 32 6b 32 78 68 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 65 65 36 32 39 61 35 63 61 66 39 33 63 39 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: Umz3q7vu8k2k2xhE.2Context: 9ee629a5caf93c93<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-10-31 18:45:26 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 55 6d 7a 33 71 37 76 75 38 6b 32 6b 32 78 68 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 65 65 36 32 39 61 35 63 61 66 39 33 63 39 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Umz3q7vu8k2k2xhE.3Context: 9ee629a5caf93c93<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-31 18:45:27 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-31 18:45:27 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 6c 70 64 75 4c 6f 33 6d 45 79 71 61 51 48 72 6e 61 77 45 64 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: glpduLo3mEyqaQHrnawEdA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-10-31 18:45:28 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6c 69 48 39 79 70 73 66 2f 6b 4b 65 58 4c 4e 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 34 34 33 63 31 61 37 39 39 61 38 65 31 66 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: liH9ypsf/kKeXLNN.1Context: b443c1a799a8e1f4
2024-10-31 18:45:28 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-31 18:45:28 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6c 69 48 39 79 70 73 66 2f 6b 4b 65 58 4c 4e 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 34 34 33 63 31 61 37 39 39 61 38 65 31 66 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 48 31 32 41 41 55 38 4f 4d 55 6a 6a 4f 42 6a 4f 49 49 74 52 31 64 6a 77 45 54 44 78 51 68 70 30 43 30 4b 6c 4d 62 77 78 6e 76 39 75 2b 79 6e 43 56 6f 59 70 57 74 76 33 42 78 4a 4b 4d 5a 72 37 56 42 2f 70 31 54 54 49 67 5a 64 34 49 78 4a 77 42 63 51 50 76 6c 67 48 39 6d 4c 69 6f 6f 58 43 37 54 6c 72 54 5a 47 44 57 6b 42 67 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: liH9ypsf/kKeXLNN.2Context: b443c1a799a8e1f4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfH12AAU8OMUjjOBjOIItR1djwETDxQhp0C0KlMbwxnv9u+ynCVoYpWtv3BxJKMZr7VB/p1TTIgZd4IxJwBcQPvlgH9mLiooXC7TlrTZGDWkBg
2024-10-31 18:45:28 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6c 69 48 39 79 70 73 66 2f 6b 4b 65 58 4c 4e 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 34 34 33 63 31 61 37 39 39 61 38 65 31 66 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: liH9ypsf/kKeXLNN.3Context: b443c1a799a8e1f4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-31 18:45:28 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-31 18:45:28 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 45 51 63 75 4f 34 35 39 6b 6d 61 6d 2f 57 53 50 42 47 2b 54 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gEQcuO459kmam/WSPBG+TA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-10-31 18:45:31 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 18:45:32 UTC	561	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 18:45:31 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 30 Oct 2024 23:56:08 GMT ETag: "0x8DCF93E6CAB67A0" x-ms-request-id: 3ed0e151-601e-0032-5264-2beebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T184531Z-16849878b78km6fmmkbenhx76n000000097g00000000p0w7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 18:45:32 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-31 18:45:32 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-31 18:45:32 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-31 18:45:32 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-31 18:45:32 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-31 18:45:32 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-31 18:45:32 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-31 18:45:32 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-31 18:45:32 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-31 18:45:32 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Timestamp	Bytes transferred	Direction	Data
2024-10-31 18:45:33 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 18:45:33 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 18:45:33 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 85f3058c-201e-00aa-6c2c-283928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T184533Z-15b8d89586fmhjx6a8nf3qm53c00000003tg00000000ay65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 18:45:33 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-31 18:45:33 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 18:45:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 18:45:33 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T184533Z-16849878b78fssff8btnns3b140000000a200000000118z1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 18:45:33 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">