[08] sample_3.pcap contains evidence of two FTP sessions from 192.168.138.128 to 192.168.138.1. The first started at timestamp 42.926102 (packet 211) and lasted until timestamp 82.412640 (packet 1091). The other started at timestamp 118.693882 (packet 1264) and lasted until timestamp 127.725290 (packet 1326). Take a closer look at the activities performed during the two sessions. Did either one (or perhaps both) involve potentially malicious operations?