previous (04): Can you see any other evidence of suspicious activity (...)

[05] Analyse the FTP session. Did the client (192.168.138.128) do anything suspicious?

(+) show hint

next (06): Now go though the data in (...)

contents