Create Interactive Tour

Windows Analysis Report
https://idcfars.bls.gov/

Overview

General Information

Sample URL:	https://idcfars.bls.gov/
Analysis ID:	676902
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3028 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,14495699213235314744,10476318232252177159,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5248 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://idcfars.bls.gov/ MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://idcfars.bls.gov/ARS/authentication/login	HTTP Parser: HTML title missing
Source: https://idcfars.bls.gov/ARS/authentication/login	HTTP Parser: HTML title missing
Source: https://idcfars.bls.gov/ARS/authentication/logout	HTTP Parser: HTML title missing

Source: https://idcfars.bls.gov/ARS/authentication/login	HTTP Parser: No <meta name="author".. found
Source: https://idcfars.bls.gov/ARS/authentication/login	HTTP Parser: No <meta name="author".. found
Source: https://idcfars.bls.gov/ARS/authentication/logout	HTTP Parser: No <meta name="author".. found

Source: https://idcfars.bls.gov/ARS/authentication/login	HTTP Parser: No <meta name="copyright".. found
Source: https://idcfars.bls.gov/ARS/authentication/login	HTTP Parser: No <meta name="copyright".. found
Source: https://idcfars.bls.gov/ARS/authentication/logout	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 146.142.252.60:443 -> 192.168.2.3:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.142.252.60:443 -> 192.168.2.3:49929 version: TLS 1.2

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /player_api HTTP/1.1Host: www.youtube.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://idcfars.bls.gov/ARS/authentication/loginAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /helprequest?page=/ARS/WEB-INF/views/ada.jsp HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GlobalContent/stylesheets/bootstrap-4.min.css HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/stylesheets/bootstrap4-idcf.css HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/themes/rules.css HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/javascripts/jquery-latest.js HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/javascripts/jquery.validate-1.9.0.js HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/javascripts/globalScripts.js HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/javascripts/bootstrap-session-timeout.min.js HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/javascripts/nextBox.js HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/javascripts/bootstrap-4.min.js HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/images/bls_star_emblem.png HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /helprequest/keepAlive HTTP/1.1Host: idcf.bls.govConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36X-Requested-With: XMLHttpRequestSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/javascripts/federated-analytics.js?agency=DOL&subagency=BLS HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/stylesheets/print.css HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
Source: global traffic	HTTP traffic detected: GET /GlobalContent/images/favicon.ico HTTP/1.1Host: idcf.bls.govConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jspAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832; _ga=GA1.3.683196181.1659412098; _gid=GA1.3.1962602156.1659412098; _gat_GSA_ENOR0=1
Source: global traffic	HTTP traffic detected: GET /GlobalContent/images/bls_star_emblem.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: idcf.bls.gov
Source: global traffic	HTTP traffic detected: GET /GlobalContent/images/favicon.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: idcf.bls.gov

Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr

String found in binary or memory: {"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://www.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://www.google.com","supports_spdy":true},{"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"isolation":[],"server":"https://play.google.com","supports_spdy":true},{"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"isolation":[],"server":"https://www.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"isolation":[],"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expiration":"13306477656711984","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://redirector.gvt1.com"},{"alternative_service":[{"advertised_versions":[50],"expiration":"13306477656739152","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://accounts.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expiration":"13306477656849672","port":443,"protocol_str":"quic"},{"advertised_versions":[50],"expiration":"13306477656849676","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://r4---sn-1gieen7e.gvt1.com"},{"alternative_service":[{"advertised_versions":[50],"expiration":"13306477667004875","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":92736},"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expiration":"13306477697536278","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://content-autofill.googleapis.com"},{"alternative_service":[{"advertised_versions":[50],"expiration":"13306477711941193","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://www.youtube.com"},{"alternative_service":[{"advertised_versions":[50],"expiration":"13306477712011592","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://www.google-analytics.com"}],"supports_quic":{"address":"192.168.2.3","used_quic":true},"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}} equals www.youtube.com (Youtube)

Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 01744fd7-0f51-4375-80ff-27000a8d9e8d.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://dns.google
Source: 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: History Provider Cache.0.dr	String found in binary or memory: https://idcfars.bls.gov/2#Annual
Source: History Provider Cache.0.dr	String found in binary or memory: https://idcfars.bls.gov/ARS/authentication/ada2&Annual
Source: History Provider Cache.0.dr	String found in binary or memory: https://idcfars.bls.gov/ARS/authentication/login2#Annual
Source: History Provider Cache.0.dr	String found in binary or memory: https://idcfars.bls.gov/ARS2#Annual
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr	String found in binary or memory: https://r4---sn-1gieen7e.gvt1.com
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr	String found in binary or memory: https://www.google-analytics.com
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: 1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr	String found in binary or memory: https://www.youtube.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	HTTPS traffic detected: 146.142.252.60:443 -> 192.168.2.3:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.142.252.60:443 -> 192.168.2.3:49929 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\8a9a9ce5-fee9-48c5-be5e-8c7ff48af047.tmp

Jump to behavior

Source: classification engine

Classification label: clean0.win@37/134@9/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,14495699213235314744,10476318232252177159,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://idcfars.bls.gov/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,14495699213235314744,10476318232252177159,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62E89E55-BD4.pma

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://idcfars.bls.gov/	0%	Virustotal		Browse
https://idcfars.bls.gov/	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
https://dns.google	0%	URL Reputation	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
youtube-ui.l.google.com	172.217.168.46	true	false	high
accounts.google.com	142.250.203.109	true	false	high
idcf.bls.gov	146.142.252.60	true	false	high
clients.l.google.com	216.58.215.238	true	false	high
idcfars.bls.gov	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://idcf.bls.gov/GlobalContent/images/bls_star_emblem.png	false	high
https://idcf.bls.gov/helprequest/keepAlive	false	high
https://www.youtube.com/player_api	false	high
https://idcfars.bls.gov/ARS/authentication/login	false	high
https://idcf.bls.gov/GlobalContent/javascripts/bootstrap-4.min.js	false	high
https://idcfars.bls.gov/ARS/authentication/ada	false	high
https://idcf.bls.gov/GlobalContent/stylesheets/print.css	false	high
https://idcfars.bls.gov/ARS/password/resetpwd	false	high
https://idcf.bls.gov/GlobalContent/javascripts/nextBox.js	false	high
https://idcf.bls.gov/GlobalContent/javascripts/federated-analytics.js?agency=DOL&subagency=BLS	false	high
https://idcf.bls.gov/GlobalContent/javascripts/jquery-latest.js	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp	false	high
https://idcf.bls.gov/GlobalContent/stylesheets/bootstrap-4.min.css	false	high
https://idcf.bls.gov/GlobalContent/javascripts/globalScripts.js	false	high
https://idcf.bls.gov/GlobalContent/images/favicon.ico	false	high
https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp	false	high
https://idcf.bls.gov/GlobalContent/stylesheets/bootstrap4-idcf.css	false	high
https://idcf.bls.gov/GlobalContent/themes/rules.css	false	high
https://idcf.bls.gov/GlobalContent/javascripts/bootstrap-session-timeout.min.js	false	high
https://idcfars.bls.gov/ARS/browser/browsercheck?bhcp=1	false	high
https://idcf.bls.gov/GlobalContent/javascripts/jquery.validate-1.9.0.js	false	high
https://idcfars.bls.gov/ARS/authentication/logout	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json0.0.dr, manifest.json.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://www.youtube.com	1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr	false		high
https://www.google.com	1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	false		high
https://accounts.google.com	1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	false		high
https://idcfars.bls.gov/2#Annual	History Provider Cache.0.dr	false		high
https://idcfars.bls.gov/ARS/authentication/login2#Annual	History Provider Cache.0.dr	false		high
https://idcfars.bls.gov/ARS2#Annual	History Provider Cache.0.dr	false		high
https://apis.google.com	1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	false		high
https://dns.google	1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 01744fd7-0f51-4375-80ff-27000a8d9e8d.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json0.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://idcfars.bls.gov/ARS/authentication/ada2&Annual	History Provider Cache.0.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://clients2.googleusercontent.com	1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp.1.dr, 7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp.1.dr	false		high
https://www.google.com/	manifest.json0.0.dr, manifest.json.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
172.217.168.46	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
146.142.252.60	idcf.bls.gov	United States	7046	RFC2270-UUNET-CUSTOMERUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
192.168.2.22
127.0.0.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	676902
Start date and time: 01/08/202220:46:24	2022-08-01 20:46:24 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://idcfars.bls.gov/
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@37/134@9/8
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://idcfars.bls.gov/ARS/authentication/ada Browse: https://idcfars.bls.gov/ARS/browser/browsercheck Browse: https://idcfars.bls.gov/ARS/password/resetpwd Browse: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Browse: https://idcfars.bls.gov/ARS/authentication/logout Browse: https://idcfars.bls.gov/ARS/authentication/ada Browse: https://idcfars.bls.gov/ARS/browser/browsercheck

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 142.250.203.110, 74.125.173.169, 23.205.188.190, 34.104.35.123, 142.250.203.99, 172.217.168.10, 216.239.34.178, 216.239.36.178, 216.239.32.178, 216.239.38.178, 80.67.82.211, 80.67.82.235, 52.242.101.226, 52.152.110.14, 20.238.103.94, 20.54.89.106, 20.223.24.244, 40.125.122.176
Excluded domains from analysis (whitelisted): r4.sn-1gieen7e.gvt1.com, asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, clientservices.googleapis.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, redirector.gvt1.com, login.live.com, e6329.dsca.akamaiedge.net, update.googleapis.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, www.gstatic.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.google-analytics.com, glb.sls.prod.dcat.dsp.trafficmanager.net, www.bing.com, fs.microsoft.com, content-autofill.googleapis.com, www.bls.gov.edgekey.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, www-alv.google-analytics.com, ctldl.windowsupdate.com, r4---sn-1gieen7e.gvt1.com, ris.api.iris.microsoft.com, edgedl.me.gvt1.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 1, 2022 20:47:36.248224974 CEST	64851	53	192.168.2.3	8.8.8.8
Aug 1, 2022 20:47:36.250776052 CEST	56417	53	192.168.2.3	8.8.8.8
Aug 1, 2022 20:47:36.270075083 CEST	53	56417	8.8.8.8	192.168.2.3
Aug 1, 2022 20:47:36.288644075 CEST	53	64851	8.8.8.8	192.168.2.3
Aug 1, 2022 20:47:36.651652098 CEST	58116	53	192.168.2.3	8.8.8.8
Aug 1, 2022 20:47:39.676156998 CEST	63548	53	192.168.2.3	8.8.8.8
Aug 1, 2022 20:47:39.715960979 CEST	53	63548	8.8.8.8	192.168.2.3
Aug 1, 2022 20:47:39.929574013 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:39.959541082 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:39.970726013 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.000349045 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.000375986 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.000392914 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.000408888 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.014297962 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.015335083 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.041176081 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.041886091 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.083611965 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.083930016 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.083980083 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.084033966 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.084053993 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.084080935 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.084105015 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.084120989 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.084136963 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.084152937 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.084178925 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.084194899 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.084220886 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.084477901 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.084536076 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.084606886 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.084672928 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.084738016 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.086425066 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.086448908 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.086464882 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.086481094 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.086822033 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.086886883 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.089798927 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.089826107 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.089843035 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.089859962 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.090029955 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.090095997 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.093316078 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.093341112 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.093362093 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.093393087 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.093915939 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.094003916 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.096189022 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.096213102 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.096416950 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.099304914 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.099329948 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.099582911 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.099581957 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.099606991 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.099745989 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.103385925 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.103411913 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.103430033 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.103441954 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.103856087 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.104294062 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.104506969 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.104526997 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.105052948 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.105725050 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.105742931 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.106101036 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.106801033 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.106865883 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.106883049 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.106929064 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:40.107114077 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.107201099 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.132664919 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:40.150091887 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:41.310132027 CEST	64452	53	192.168.2.3	8.8.8.8
Aug 1, 2022 20:47:46.194844007 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.224818945 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.225222111 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.253714085 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.253762960 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.253799915 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.253840923 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.305857897 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.309099913 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.313596010 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.313641071 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.313683033 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.313723087 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.420160055 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.607466936 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.607738972 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.608259916 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.622180939 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.622438908 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.624392986 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.624955893 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.663795948 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.664324045 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.678891897 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.678936005 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.678962946 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.809534073 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:47:46.957281113 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.957505941 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:46.957592964 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:47:54.481256962 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:54.525136948 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:54.525178909 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:54.525207996 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:54.525239944 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:47:54.533627033 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:47:54.533708096 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:00.047285080 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:00.090189934 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:00.092432976 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:00.092499971 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:00.092529058 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:00.092925072 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:00.118230104 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:01.628813028 CEST	61381	443	192.168.2.3	216.58.215.238
Aug 1, 2022 20:48:01.670819044 CEST	443	61381	216.58.215.238	192.168.2.3
Aug 1, 2022 20:48:02.167987108 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:02.210450888 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:02.210483074 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:02.210510015 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:02.210870028 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:02.236236095 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:04.299216986 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:04.341598034 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:04.341638088 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:04.341650963 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:04.342040062 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:04.367991924 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:14.719079971 CEST	50778	53	192.168.2.3	8.8.8.8
Aug 1, 2022 20:48:14.966322899 CEST	53	50778	8.8.8.8	192.168.2.3
Aug 1, 2022 20:48:18.258580923 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:18.301084995 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:18.301141977 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:18.301188946 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:18.301774979 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:18.329416990 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:19.275217056 CEST	64816	53	192.168.2.3	8.8.8.8
Aug 1, 2022 20:48:19.503421068 CEST	53	64816	8.8.8.8	192.168.2.3
Aug 1, 2022 20:48:31.884252071 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:31.926939964 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:31.927222013 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:31.927432060 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:31.927491903 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:31.953105927 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:41.603274107 CEST	51518	53	192.168.2.3	8.8.8.8
Aug 1, 2022 20:48:41.605678082 CEST	49723	53	192.168.2.3	8.8.8.8
Aug 1, 2022 20:48:41.623240948 CEST	53	49723	8.8.8.8	192.168.2.3
Aug 1, 2022 20:48:42.980819941 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:43.020560980 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:43.020607948 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:43.020628929 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:43.021123886 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:43.046626091 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:47.016431093 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:47.057125092 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:47.057238102 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:47.057267904 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:47.057616949 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:47.087498903 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:47.104032993 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:47.104916096 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:48.514720917 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:48.555948973 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:48.556018114 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:48.556133986 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:48.559422970 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:48.590924025 CEST	63551	443	192.168.2.3	172.217.168.46
Aug 1, 2022 20:48:48.603574991 CEST	443	63551	172.217.168.46	192.168.2.3
Aug 1, 2022 20:48:48.605812073 CEST	63551	443	192.168.2.3	172.217.168.46

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:47:36 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-01 18:47:36 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-A9uVOafmw3t7CS57pBkXBQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 01 Aug 2022 18:47:36 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5691 X-Daystart: 42456 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-01 18:47:36 UTC	2	IN	Data Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 39 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 32 34 35 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5691" elapsed_seconds="42456"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-08-01 18:47:36 UTC	2	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-08-01 18:47:36 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:47:36 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-01 18:47:36 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-08-01 18:47:36 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 01 Aug 2022 18:47:36 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-gmuO4RXyE80qZRgLqEUqZg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-gmuO4RXyE80qZRgLqEUqZg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-01 18:47:36 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-08-01 18:47:36 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:16 UTC	227	OUT	GET /GlobalContent/javascripts/bootstrap-session-timeout.min.js HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
2022-08-01 18:48:16 UTC	475	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Thu, 03 Jun 2021 21:06:38 GMT Accept-Ranges: bytes ETag: "1867de57bc58d71:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:16 GMT Content-Length: 4874 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P2 Cache-Control: no-cache, no-store, must-revalidate Vary: Accept-Encoding
2022-08-01 18:48:16 UTC	475	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 24 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 24 2e 73 65 73 73 69 6f 6e 54 69 6d 65 6f 75 74 3d 66 75 6e 63 74 69 6f 6e 28 6f 70 74 69 6f 6e 73 29 7b 76 61 72 20 64 65 66 61 75 6c 74 73 3d 7b 74 69 74 6c 65 3a 27 59 6f 75 72 20 53 65 73 73 69 6f 6e 20 69 73 20 41 62 6f 75 74 20 74 6f 20 45 78 70 69 72 65 21 27 2c 6d 65 73 73 61 67 65 3a 27 59 6f 75 72 20 73 65 73 73 69 6f 6e 20 69 73 20 61 62 6f 75 74 20 74 6f 20 65 78 70 69 72 65 2e 27 2c 6c 6f 67 6f 75 74 42 75 74 74 6f 6e 3a 27 4c 6f 67 6f 75 74 27 2c 6b 65 65 70 41 6c 69 76 65 42 75 74 74 6f 6e 3a 27 53 74 61 79 20 43 6f 6e 6e 65 63 74 65 64 27 2c 6b 65 65 70 41 6c 69 76 65 55 72 6c 3a 27 2f 6b 65 65 70 2d 61 6c 69 76 65 27 2c 61 6a 61 78 54 79 70 65 3a 27 50 4f 53 54 Data Ascii: (function($){'use strict';$.sessionTimeout=function(options){var defaults={title:'Your Session is About to Expire!',message:'Your session is about to expire.',logoutButton:'Logout',keepAliveButton:'Stay Connected',keepAliveUrl:'/keep-alive',ajaxType:'POST

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:16 UTC	316	OUT	GET /GlobalContent/javascripts/nextBox.js HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
2022-08-01 18:48:16 UTC	480	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Thu, 17 Feb 2011 15:48:00 GMT Accept-Ranges: bytes ETag: "038bedbacecb1:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:16 GMT Content-Length: 571 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P1 Cache-Control: no-cache, no-store, must-revalidate Vary: Accept-Encoding
2022-08-01 18:48:16 UTC	480	IN	Data Raw: 20 20 20 2f 2a 20 41 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 6a 75 6d 70 20 66 72 6f 6d 20 62 6f 78 20 74 6f 20 62 6f 78 20 6f 6e 20 61 20 66 6f 72 6d 2e 20 0d 0a 20 20 20 20 20 20 28 57 68 65 6e 20 6f 6e 65 20 62 6f 78 20 69 73 20 66 75 6c 6c 2c 20 6a 75 6d 70 20 74 6f 20 74 68 65 20 6e 65 78 74 20 20 20 20 20 20 20 2a 2f 0d 0a 20 20 20 0d 0a 20 20 20 0d 0a 20 20 20 76 61 72 20 62 6f 78 4c 65 6e 3b 0d 0a 0d 0a 20 20 20 66 75 6e 63 74 69 6f 6e 20 62 65 66 6f 72 65 28 45 6c 29 0d 0a 20 20 20 7b 0d 0a 20 20 20 20 20 20 62 6f 78 4c 65 6e 20 3d 20 45 6c 2e 76 61 6c 75 65 2e 6c 65 6e 67 74 68 3b 0d 0a 20 20 20 7d 0d 0a 0d 0a 20 20 20 66 75 6e 63 74 69 6f 6e 20 4e 65 78 74 42 6f 78 28 54 68 69 73 45 6c 2c 20 6e 65 78 74 45 6c 20 2c 20 69 4c 65 6e 2c 20 65 76 74 Data Ascii: /* Automatically jump from box to box on a form. (When one box is full, jump to the next */ var boxLen; function before(El) { boxLen = El.value.length; } function NextBox(ThisEl, nextEl , iLen, evt

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:17 UTC	502	OUT	GET /GlobalContent/images/bls_star_emblem.png HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
2022-08-01 18:48:17 UTC	554	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Wed, 13 Feb 2013 13:47:16 GMT Accept-Ranges: bytes ETag: "0ca4ba2f09ce1:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:16 GMT Content-Length: 52204 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P2 Cache-Control: private, max-age=3600
2022-08-01 18:48:17 UTC	555	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2b 00 00 00 2e 08 06 00 00 00 b1 90 e0 73 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 00 16 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 30 38 2f 32 31 2f 31 32 18 5b cd 6f 00 00 00 1e 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 46 69 72 65 77 6f 72 6b 73 20 43 53 35 2e 31 ab 1f 48 eb 00 00 08 00 70 72 56 57 78 9c ed 5a df 8b 14 47 10 ee 99 b5 77 ca 75 76 bc bd d9 51 73 7d 9a bb c6 bc e4 21 44 f6 29 79 0b 68 7e 3d e5 5f 48 20 9b 57 09 79 cc 83 84 20 12 42 10 39 82 17 24 88 48 08 21 84 20 22 46 44 7c c8 83 c8 12 f2 90 40 08 21 88 88 84 20 89 88 48 10 f1 52 55 5d bb 3b 77 ee b9 b3 3b bd 6e 02 5b e3 78 fb 6d Data Ascii: PNGIHDR+.ssBIT\|dpHYsodtEXtCreation Time08/21/12[otEXtSoftwareAdobe Fireworks CS5.1HprVWxZGwuvQs}!D)yh~=_H Wy B9$H! "FD\|@! HRU];w;n[xm
2022-08-01 18:48:17 UTC	568	IN	Data Raw: 04 14 f6 53 e0 bf f4 d8 02 96 27 ec 99 50 59 0c d2 60 b8 3e 0a 13 0f ae 60 c0 be 9b f4 61 b7 b8 99 5e 2a db 4c b0 3e 39 fd 39 04 a4 43 40 da 29 43 9d 9b 9e f1 6c b3 04 a0 71 00 9f 71 00 5f a1 45 b3 e0 53 93 a8 83 c2 84 46 b1 e8 8d 90 b7 17 fa d5 c5 02 38 30 c5 58 52 1b 43 9b 07 4d a6 b5 a6 25 a5 48 86 73 e6 d1 44 1b c6 2a 82 2f e3 f3 d8 b0 ad d2 68 22 28 69 71 8c 8b 4d 1a e9 b6 4c 4f 29 00 b4 41 84 83 39 23 23 98 f7 b5 8a 03 2c f7 29 0d d9 9c 11 f6 ec ac be 5f 0e c6 32 4e b9 c7 ad 47 2f 69 3d 7a 4e 01 10 8b b8 9b eb 06 80 e4 2a aa cb 10 24 af 3c ee 05 85 93 6d 62 86 64 c0 97 63 6e 61 7f 54 de 0b 7c 09 43 d0 07 c5 83 a4 2c 18 ae 65 18 6a 96 49 18 b6 92 18 3a 25 20 6c 49 f5 50 6a d4 d0 d4 6f 15 ab 26 d0 c2 24 61 ea 5c 0d b1 34 b0 a4 de db e2 dd b7 38 68 81 Data Ascii: S'PY`>`a^L>99C@)Clqq_ESF80XRCM%HsD/h"(iqMLO)A9##,)_2NG/i=zN*$<mbdcnaT\|C,ejI:% lIPjo&$a\48h
2022-08-01 18:48:17 UTC	582	IN	Data Raw: 00 00 94 8a ff 01 df 4e 75 8d 13 25 74 26 00 00 0a b5 6d 6b 42 54 fa ce ca fe 00 7f 57 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 9c ed 9d 8d 91 db 38 0c 46 53 48 1a 49 21 29 24 8d a4 90 14 92 46 52 48 6e 90 9b 77 f3 ee 0b 48 c9 59 af 1d db 78 33 9e d5 ea 87 a4 08 12 a2 00 90 fa f9 73 18 86 61 18 86 61 18 86 61 18 86 61 78 49 be 7f ff fe db ef c7 8f 1f ff 1d bb 27 55 8e 7b 97 e1 d9 f9 f0 e1 c3 6f bf af 5f bf fe aa f7 da be 67 fd 57 39 aa 0c c3 fb 81 bc cf e2 f6 f0 96 fe b9 bb b6 8e d5 6f 27 7f ae 47 57 0d 7b 3e 7e fc d8 d6 d5 4a fe ee ff 6c 7f fa f4 e9 d7 df 6f df be fd fc f2 e5 cb 7f fa a2 Data Ascii: Nu%t&mkBTWx8FSHI!)$FRHnwHYx3saaaaxI'U{o_gW9o'GW{>~Jlo
2022-08-01 18:48:17 UTC	589	IN	Data Raw: 49 97 bd ee a5 32 9f a3 ee 97 6c 6f a3 fe cf 5a 1b b6 66 3f be 6b 34 f6 57 bc dc c7 2d e8 23 ac f3 ad 09 3f 56 2f ec 97 63 5e ff b7 21 f7 21 10 7b 19 75 cc b5 ca b4 55 a6 d9 f3 1a d9 b7 ff 13 41 9c d1 fd 91 ff 47 65 3e 47 7d fe 3f c5 ff 19 7f f6 fe 90 76 e2 9c bd 19 8e f8 33 ff c9 58 13 7e 6a bd fa 9c 97 7b 02 f8 7a 54 a7 f4 41 b7 4f 5e cf f2 ca b0 d1 3e 13 f7 b3 3f 73 9d 79 8f ca 7c ae b6 f0 7f df 47 29 9f 50 a6 3c 2f 31 d6 31 7e 32 96 d1 9e d7 86 9f 52 2f c2 18 37 f8 8f 00 1b d3 be 10 73 6d f7 7f 1f 73 72 8f f2 98 ff f9 7f 22 f3 28 f5 fb dd ff b3 32 9f ab 63 fe cf b9 1d 3b f4 7e 92 75 2d f5 f1 29 7d 83 bf 88 cb 3c b6 55 f8 31 bb 67 18 b6 e4 fd 3a e7 61 c6 70 e2 62 e7 b4 35 7b 9d f8 33 f7 28 8f 95 83 7f 6b f1 21 6d 27 6d ca 9e d9 c8 ff a3 32 9f f3 2e c8 Data Ascii: I2loZf?k4W-#?V/c^!!{uUAGe>G}?v3X~j{zTAO^>?sy\|G)P</11~2R/7smsr"(2c;~u-)}<U1g:apb5{3(k!m'm2.
2022-08-01 18:48:17 UTC	597	IN	Data Raw: 29 0c d4 a9 83 d9 6e 40 70 6f ef 8d e7 b2 5d dd cc 7b 33 ac 76 b6 3a 0b fa 0e 18 c7 fa b5 86 de c3 59 91 e8 cd 66 2a 61 57 ef d2 5f 87 26 27 0a 4a 6b 30 6e a5 89 a2 af 44 b8 78 e8 8f fb 7f 0b 94 5c 2f 48 93 dc cc c9 44 0c e1 75 03 ce 71 0f 5a 96 5c da 8c 47 2b e5 95 b5 58 0b 7f ec 5a a5 54 3e 7a 27 11 37 f9 51 87 81 71 11 9b 84 b9 8e be b9 c9 8c ed 02 23 4b e2 52 2e f2 2f 43 93 bb 07 56 d6 dc 67 c7 51 d7 c8 ac a8 e5 e9 e3 f3 1f 5c 0b e2 10 ec 60 b8 b7 3f 64 dc db 17 31 79 b3 94 e5 75 4d db 36 c6 b5 38 5a 58 5d 38 c3 f8 5e 70 85 aa 77 51 eb 16 45 be e7 0d 26 08 ef 8c 87 ad 31 16 66 72 13 52 9a 03 c1 4b 69 fb f1 e7 d0 24 10 47 a4 16 ce 13 d3 f0 d4 dd 9c 9d 8f db c7 01 d0 95 18 1e 8c af f0 68 33 27 81 c0 ae c2 f8 94 b7 93 06 c7 7b bc 1c 14 01 b1 9a 1e 1e 3b Data Ascii: )n@po]{3v:Yf*aW_&'Jk0nDx\/HDuqZ\G+XZT>z'7Qq#KR./CVgQ\`?d1yuM68ZX]8^pwQE&1frRKi$Gh3'{;
2022-08-01 18:48:17 UTC	598	IN	Data Raw: d2 b9 41 87 d9 99 66 73 94 0c bd cb 2c a8 83 de 3e bf fe 33 59 cf 1c d4 95 17 08 3b e7 3a 23 68 45 4c ac d7 9d 5b 01 52 4f 64 8b ca 11 5e 47 e9 9a 41 8d cb a9 66 df 7e 59 21 fd cb d0 e4 45 e5 ea 18 f1 08 6e 17 b7 0e f4 fc 30 af 7e c5 e0 2f ab 41 0e dd f2 81 0a 96 4b e5 6d f7 82 01 b1 10 3e 5e ff dd 57 59 a2 71 86 22 b5 01 12 13 a5 e2 3c 18 08 d1 86 46 8a b2 ce eb 2a 63 07 b9 bd 3a 1a 78 db 77 84 7c a4 cd 9e 77 ad 97 25 fd 65 68 52 67 b0 e5 d8 fa 01 e6 dc e6 64 bf 39 e7 b4 fc cc 95 aa cb c3 76 9e 33 c0 76 0d 44 67 99 8d 68 e7 3e 3e 3f ff f2 33 e9 89 68 9f 59 44 6b 90 67 43 e3 28 03 ca b9 10 c2 83 aa d4 95 8d f4 d7 53 c9 01 b7 86 ac d4 9c 7c e8 0d 11 32 51 c1 fc 39 34 a9 28 f1 bd 3f 4f 47 14 95 51 33 34 85 0d 66 eb 63 63 b3 b6 50 6f 70 03 54 80 59 61 83 96 Data Ascii: Afs,>3Y;:#hEL[ROd^GAf~Y!En0~/AKm>^WYq"<F*c:xw\|w%ehRgd9v3vDgh>>?3hYDkgC(S\|2Q94(?OGQ34fccPopTYa
2022-08-01 18:48:17 UTC	604	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2022-08-01 18:48:17 UTC	608	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2022-08-01 18:48:17 UTC	611	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 Data Ascii:

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:17 UTC	615	OUT	GET /helprequest/keepAlive HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 X-Requested-With: XMLHttpRequest Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
2022-08-01 18:48:17 UTC	616	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-US X-ORACLE-DMS-ECID: 6f043446-73d6-4120-99e5-61695e4a489b-0024acc1 X-ORACLE-DMS-RID: 0 X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:17 GMT Content-Length: 152 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P1 Cache-Control: no-cache, no-store, must-revalidate Vary: Accept-Encoding
2022-08-01 18:48:17 UTC	617	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 48 65 6c 70 20 52 65 71 75 65 73 74 20 46 6f 72 6d 20 2d 20 4b 65 65 70 20 41 6c 69 76 65 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 64 69 76 3e 4b 65 65 70 20 41 6c 69 76 65 3c 2f 64 69 76 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en"><head><title>Help Request Form - Keep Alive</title></head><body> <div>Keep Alive</div></body></html>

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:17 UTC	616	OUT	GET /GlobalContent/javascripts/federated-analytics.js?agency=DOL&subagency=BLS HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
2022-08-01 18:48:17 UTC	617	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Tue, 28 Jun 2016 15:48:56 GMT Accept-Ranges: bytes ETag: "0a4f19354d1d11:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:17 GMT Content-Length: 28655 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P1 Cache-Control: no-cache, no-store, must-revalidate Vary: Accept-Encoding
2022-08-01 18:48:17 UTC	617	IN	Data Raw: 2f 2a 0a 09 09 09 09 20 20 20 20 2e 6f 6f 6f 6f 6f 2e 20 20 20 20 20 20 20 20 20 20 6f 6f 6f 2e 20 2e 6f 6f 2e 20 20 20 20 20 2e 6f 6f 6f 6f 6f 2e 20 20 20 20 6f 6f 6f 6f 20 64 38 62 0a 09 09 09 09 20 20 20 64 38 38 22 20 60 38 38 62 20 20 20 20 20 20 20 20 20 60 38 38 38 50 22 59 38 38 62 20 20 20 64 38 38 22 20 60 38 38 62 20 20 20 60 38 38 38 22 22 38 50 0a 09 09 09 09 20 20 20 38 38 38 38 38 38 38 38 38 20 20 38 38 38 38 38 20 20 20 38 38 38 20 20 20 38 38 38 20 20 20 38 38 38 20 20 20 38 38 38 20 20 20 20 38 38 38 0a 09 09 09 09 20 20 20 38 38 38 20 20 20 20 20 20 20 20 38 38 38 38 38 20 20 20 38 38 38 20 20 20 38 38 38 20 20 20 38 38 38 20 20 20 38 38 38 20 20 20 20 38 38 38 20 20 20 20 20 20 20 0a 09 09 09 09 20 20 20 60 22 38 38 38 38 38 22 20 20 Data Ascii: /* .ooooo. ooo. .oo. .ooooo. oooo d8b d88" `88b `888P"Y88b d88" `88b `888""8P 888888888 88888 888 888 888 888 888 888 88888 888 888 888 888 888 `"88888"
2022-08-01 18:48:18 UTC	620	IN	Data Raw: 56 61 6c 75 65 73 28 29 3b 0a 7d 0a 0a 5f 6f 6e 45 76 65 72 79 50 61 67 65 28 29 3b 0a 0a 2f 2a 20 6e 61 6d 65 3a 20 5f 64 65 66 69 6e 65 43 6f 6f 6b 69 65 44 6f 6d 61 69 6e 20 2a 2f 0a 2f 2a 20 75 73 61 67 65 3a 20 74 6f 20 64 65 66 69 6e 65 20 63 6f 6f 6b 69 65 20 64 6f 6d 61 69 6e 20 62 61 73 65 64 20 6f 6e 20 74 68 65 20 53 55 42 44 4f 4d 41 49 4e 5f 42 41 53 45 44 20 76 61 72 69 61 62 6c 65 20 76 61 6c 75 65 20 2a 2f 0a 66 75 6e 63 74 69 6f 6e 20 5f 64 65 66 69 6e 65 43 6f 6f 6b 69 65 44 6f 6d 61 69 6e 28 29 0a 7b 0a 09 76 61 72 20 64 6f 6d 61 69 6e 50 61 74 74 65 72 6e 20 3d 20 2f 28 28 5b 5e 2e 5c 2f 5d 2b 5c 2e 5b 5e 2e 5c 2f 5d 7b 32 2c 33 7d 5c 2e 5b 5e 2e 5c 2f 5d 7b 32 7d 29 7c 28 28 5b 5e 2e 5c 2f 5d 2b 5c 2e 29 5b 5e 2e 5c 2f 5d 7b 32 2c 34 Data Ascii: Values();}_onEveryPage();/* name: _defineCookieDomain // usage: to define cookie domain based on the SUBDOMAIN_BASED variable value */function _defineCookieDomain(){var domainPattern = /(([^.\/]+\.[^.\/]{2,3}\.[^.\/]{2})\|(([^.\/]+\.)[^.\/]{2,4
2022-08-01 18:48:18 UTC	636	IN	Data Raw: 4e 46 49 47 2e 46 4f 52 43 45 5f 53 53 4c 29 20 7b 0a 09 09 09 77 69 6e 64 6f 77 5b 77 69 6e 64 6f 77 5b 27 47 6f 6f 67 6c 65 41 6e 61 6c 79 74 69 63 73 4f 62 6a 65 63 74 27 5d 5d 28 6f 43 4f 4e 46 49 47 2e 50 55 41 5f 4e 41 4d 45 20 2b 20 64 70 76 20 2b 20 27 2e 73 65 74 27 2c 20 27 66 6f 72 63 65 53 53 4c 27 2c 20 74 72 75 65 29 3b 0a 09 09 7d 0a 09 09 69 66 20 28 6f 43 4f 4e 46 49 47 2e 55 53 45 5f 4d 41 49 4e 5f 43 55 53 54 4f 4d 5f 44 49 4d 45 4e 53 49 4f 4e 53 20 26 26 20 64 70 76 20 3d 3d 20 30 29 20 7b 0a 09 09 09 77 69 6e 64 6f 77 5b 77 69 6e 64 6f 77 5b 27 47 6f 6f 67 6c 65 41 6e 61 6c 79 74 69 63 73 4f 62 6a 65 63 74 27 5d 5d 28 6f 43 4f 4e 46 49 47 2e 50 55 41 5f 4e 41 4d 45 20 2b 20 64 70 76 20 2b 20 27 2e 73 65 74 27 2c 20 6f 43 4f 4e 46 49 Data Ascii: NFIG.FORCE_SSL) {window[window['GoogleAnalyticsObject']](oCONFIG.PUA_NAME + dpv + '.set', 'forceSSL', true);}if (oCONFIG.USE_MAIN_CUSTOM_DIMENSIONS && dpv == 0) {window[window['GoogleAnalyticsObject']](oCONFIG.PUA_NAME + dpv + '.set', oCONFI
2022-08-01 18:48:18 UTC	643	IN	Data Raw: 63 6f 72 72 65 63 74 20 6d 69 6e 6f 72 20 65 72 72 6f 72 73 20 69 6e 20 59 6f 75 54 75 62 65 20 55 52 4c 73 0a 09 20 2a 2f 0a 09 66 75 6e 63 74 69 6f 6e 20 59 54 55 72 6c 48 61 6e 64 6c 65 72 5f 66 65 64 28 75 72 6c 29 0a 09 09 7b 0a 09 09 75 72 6c 20 3d 20 75 72 6c 2e 72 65 70 6c 61 63 65 28 2f 6f 72 69 67 69 6e 5c 3d 28 68 74 74 70 73 3f 3a 5c 2f 5c 2f 29 3f 28 5b 5c 64 61 2d 7a 5c 2e 2d 5d 2b 29 5c 2e 28 5b 61 2d 7a 5c 2e 5d 7b 32 2c 36 7d 29 5c 26 3f 2f 69 67 2c 27 6f 72 69 67 69 6e 3d 27 2b 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2b 27 2f 2f 27 2b 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 29 3b 0a 09 09 0a 09 09 73 74 41 64 64 20 3d 20 27 27 3b 0a 09 09 61 64 46 6c 61 67 20 3d 20 66 61 6c Data Ascii: correct minor errors in YouTube URLs */function YTUrlHandler_fed(url){url = url.replace(/origin\=(https?:\/\/)?([\da-z\.-]+)\.([a-z\.]{2,6})\&?/ig,'origin='+document.location.protocol+'//'+document.location.host);stAdd = '';adFlag = fal

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:17 UTC	620	OUT	GET /GlobalContent/stylesheets/print.css HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
2022-08-01 18:48:18 UTC	634	IN	HTTP/1.1 200 OK Content-Type: text/css Last-Modified: Tue, 16 Sep 2014 16:13:48 GMT Accept-Ranges: bytes ETag: "0865332c9d1cf1:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:17 GMT Content-Length: 1209 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P1 Cache-Control: no-cache, no-store, must-revalidate Vary: Accept-Encoding
2022-08-01 18:48:18 UTC	635	IN	Data Raw: 0d 0a 2e 70 72 69 6e 74 42 72 20 7b 0d 0a 20 20 20 20 70 61 67 65 2d 62 72 65 61 6b 2d 62 65 66 6f 72 65 3a 20 61 6c 77 61 79 73 3b 0d 0a 7d 0d 0a 23 67 6c 6f 62 61 6c 2d 62 61 6e 6e 65 72 2c 20 23 67 6c 6f 62 61 6c 2d 6d 65 6e 75 2c 20 23 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 20 62 6f 64 79 7b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 23 67 6c 61 62 61 6c 2d 62 61 6e 6e 65 72 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 33 35 34 37 38 35 3b 0d 0a 7d 0d 0a 23 67 6c 6f 62 61 6c 2d 62 61 6e 6e 65 72 20 68 31 2c 20 23 67 6c 6f 62 61 6c 2d 6d 65 6e 75 20 68 33 2c 20 23 67 6c 6f 62 61 6c 2d 6d 65 6e 75 20 61 2c 20 23 67 6c 6f 62 61 6c 2d 6d 65 6e 75 20 61 3a 68 6f Data Ascii: .printBr { page-break-before: always;}#global-banner, #global-menu, #main-content, body{ background:none;}#glabal-banner { border-bottom: 2px solid #354785;}#global-banner h1, #global-menu h3, #global-menu a, #global-menu a:ho

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:18 UTC	647	OUT	GET /GlobalContent/images/favicon.ico HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832; _ga=GA1.3.683196181.1659412098; _gid=GA1.3.1962602156.1659412098; _gat_GSA_ENOR0=1
2022-08-01 18:48:18 UTC	648	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Last-Modified: Wed, 12 Dec 2012 15:40:22 GMT Accept-Ranges: bytes ETag: "0f7aff7ed8cd1:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:18 GMT Content-Length: 3638 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P2 Cache-Control: private, max-age=3600
2022-08-01 18:48:18 UTC	648	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 00 00 00 00 68 05 00 00 26 00 00 00 20 20 00 00 00 00 00 00 a8 08 00 00 8e 05 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 08 00 00 00 00 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 58 58 be 00 aa 51 1d 00 d8 af 98 00 01 01 98 00 49 1c 5b 00 97 97 d5 00 c3 84 5e 00 d1 d1 ed 00 32 32 ac 00 5c 46 8d 00 77 77 c9 00 99 33 00 00 ed d9 cd 00 b9 6b 3d 00 18 18 a3 00 ba ba e3 00 f5 eb e6 00 df c1 b1 00 5b 30 65 00 45 45 b7 00 d2 a1 82 00 a7 3f 0d 00 67 67 c2 00 e7 e6 f5 00 85 85 ce 00 ad ad de 00 25 25 a8 00 f3 f3 fa 00 07 07 a6 00 be 7b 53 00 dd ba a4 00 f1 e2 d8 00 0f 0f 9f 00 da da f0 00 c6 8c 66 00 6f 6f c5 00 e5 c9 b7 00 50 50 bc 00 ad 57 26 00 9c 3b 07 00 32 32 b7 00 a3 45 15 00 08 Data Ascii: h& ( @XXQI[^22\Fww3k=[0eEE?gg%%{SfooPPW&;22E

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	95428
Entropy (8bit):	3.7455290568432096
Encrypted:	false
SSDEEP:	384:l/Ol5HomfQzrVU6poNZrCvdX3mpzyHjSGa9rYLxRxmzfj+r8xm8oaoHZJxWOP3p5:dm2hNunM+EenJLDIvjCXKZ/dFD
MD5:	6ED0AAF1A948E87F05F6A28502BFE4C5
SHA1:	76A87491D9D8FA2A6D13E8C267B896B955027EDA
SHA-256:	C44CE1BD72D4F365800A93EBE898F3A917F1D8D2917DDAE8EFEC712B493BF670
SHA-512:	DA57EDC0EAE96AE57DC187A7D9A107D74C461ADFEEA021B06E70D981EBDB944B41D192AB683487DA2B6F72C15D562DAD907409451FA20815365E620C2CB27ACB
Malicious:	false
Reputation:	low
Preview:	.t.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:19 UTC	652	OUT	GET /GlobalContent/images/bls_star_emblem.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: idcf.bls.gov
2022-08-01 18:48:19 UTC	656	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Wed, 13 Feb 2013 13:47:16 GMT Accept-Ranges: bytes ETag: "0ca4ba2f09ce1:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:19 GMT Content-Length: 52204 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P1 Cache-Control: private, max-age=3600
2022-08-01 18:48:19 UTC	657	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2b 00 00 00 2e 08 06 00 00 00 b1 90 e0 73 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 00 16 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 30 38 2f 32 31 2f 31 32 18 5b cd 6f 00 00 00 1e 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 46 69 72 65 77 6f 72 6b 73 20 43 53 35 2e 31 ab 1f 48 eb 00 00 08 00 70 72 56 57 78 9c ed 5a df 8b 14 47 10 ee 99 b5 77 ca 75 76 bc bd d9 51 73 7d 9a bb c6 bc e4 21 44 f6 29 79 0b 68 7e 3d e5 5f 48 20 9b 57 09 79 cc 83 84 20 12 42 10 39 82 17 24 88 48 08 21 84 20 22 46 44 7c c8 83 c8 12 f2 90 40 08 21 88 88 84 20 89 88 48 10 f1 52 55 5d bb 3b 77 ee b9 b3 3b bd 6e 02 5b e3 78 fb 6d Data Ascii: PNGIHDR+.ssBIT\|dpHYsodtEXtCreation Time08/21/12[otEXtSoftwareAdobe Fireworks CS5.1HprVWxZGwuvQs}!D)yh~=_H Wy B9$H! "FD\|@! HRU];w;n[xm
2022-08-01 18:48:19 UTC	659	IN	Data Raw: 2a 5f d8 b6 b9 b2 50 e6 eb 22 a4 3d 7c 84 02 ed 99 30 5c 3c e5 66 1d ed d1 3c b3 b2 fe 68 6b a2 a3 dd ad fe 44 e8 ac a9 3f 22 46 65 34 e8 9e 31 7a ca 31 3a 60 f8 5c 33 24 ba ec f3 0b 43 eb 2d c7 ea 3b 8e 55 84 61 1e 3a d0 ee 18 3c 2d 93 f0 c1 fd 2b f1 b1 cd 04 3e 6a 02 1f 43 4f 22 34 5f b3 8f e9 84 90 4e 08 99 84 90 49 08 99 fe 64 f4 0b 49 75 32 61 5f dc 19 db 70 4e b7 31 99 9c e3 86 32 18 3e e1 18 4e 99 76 fd 83 e9 db 17 b6 7f 95 9e 19 ba 4c d1 f2 81 d4 3a 1c 4a 7d e6 96 80 d2 b5 09 4a dc 7e 67 60 ea 9d 62 60 ee 71 30 7b 4c e1 de b1 bf 2b e5 57 06 97 a3 7c 52 de 2a 5f 39 a0 3b 31 a5 7c cf be 7f 54 3e e6 82 a9 f1 5e ab 19 85 69 5f 53 4d 79 b7 55 73 ba ad a5 12 92 c8 07 80 a4 e7 14 ee b9 ba 5d 18 4b c3 d6 09 4b b0 44 ca 62 97 df a1 db 73 82 ce 76 09 b9 c5 Data Ascii: _P"=\|0\<f<hkD?"Fe41z1:`\3$C-;Ua:<-+>jCO"4_NIdIu2a_pN12>NvL:J}J~g`b`q0{L+W\|R_9;1\|T>^i_SMyUs]KKDbsv
2022-08-01 18:48:20 UTC	671	IN	Data Raw: b0 38 83 7b c8 dd c0 f0 6d f6 67 b2 e3 ab cb b8 6c c4 ca 12 c6 da 87 1d b1 2a a6 7b cf b1 9f bf c3 3e 90 90 bd f2 13 fc a5 34 f0 91 e2 08 b5 7f c3 d0 4f 22 f7 88 21 94 6f 51 88 1c 70 37 7a bd ea de e2 2d f8 4f a6 95 5d 56 87 87 2d 20 3e 7b c3 ea ba 46 4e 03 ab ee 77 f6 fb 26 6c 1f e8 fd 3f c3 9a 1e a1 96 ee c3 67 49 bd 9f 29 1d 86 86 cb 3e c1 56 59 a0 8d 63 a2 fd 17 e8 3d 44 d4 40 eb 3d 64 3c d2 54 38 1a 38 10 7a cb 9c 1d 9f d4 fb ef 94 79 5e cc 2b a1 25 4f 99 36 cd d9 18 ff 05 8f df 8f f5 92 e0 4d 7a 07 c8 ef 1f d9 be 61 c8 ef 9f 6b 8b 6e ca 6b df 06 c9 01 e3 98 6c bf 87 16 a8 86 8c a5 31 04 cc 94 75 6a 73 c9 39 c8 6c c0 69 73 f6 3f 58 e6 1d 41 72 df b3 d6 7d 04 1e 40 3b f7 0d 1f 77 de b0 fe 16 bc a9 39 cb 4a 4a 9e f7 96 5b a3 e9 33 ff c0 5a 60 09 fd 55 Data Ascii: 8{mgl*{>4O"!oQp7z-O]V- >{FNw&l?gI)>VYc=D@=d<T88zy^+%O6Mzaknkl1ujs9lis?XAr}@;w9JJ[3Z`U
2022-08-01 18:48:20 UTC	681	IN	Data Raw: 40 db 96 8e 53 1e 77 cd 38 42 07 1c 95 f2 71 ae c3 ee ff 5d fb a3 17 3d 8f e9 32 07 f4 6c 8f 42 d3 65 36 56 7d 65 f6 f7 b9 88 9e ad ab f2 52 fd 28 b7 d8 e9 c3 cb e1 de 09 56 fe df 65 ca f6 5a 54 1c a1 eb 84 34 dd fb 1f ef 61 7f 64 a2 ad 65 32 07 de 92 fd 2b 6e f1 59 f6 cf e6 7f f8 42 f5 97 ba 8f 02 9f 54 71 84 ae 53 fc 7f d7 ff 03 bb fe 0e df 94 e9 3c 9b c3 ef f8 7f ad 5b 26 cf 3d fc 7f 66 ff 8e 5b 7c 86 ff f7 0f f5 f7 73 b0 7a ee 50 e7 29 19 47 e8 e5 e8 d9 c1 aa 7d 7b 5a d7 85 ce 33 ab b3 99 6e 37 c5 6a fe 17 70 fb 57 f3 bf ce 77 66 e5 74 f6 ef b8 45 bf 77 cf f9 df 5b c7 bd d7 3b 83 f7 85 b1 ff 60 6c 3f 18 0c 06 83 c1 60 30 18 0c 06 83 c1 60 30 18 0c 06 83 c1 60 f0 f7 e1 11 7b d1 d9 fb f4 91 c1 7e 13 ff ac f6 bd b3 c7 d2 df 69 11 60 6f 4c f6 79 84 3e 75 Data Ascii: @Sw8Bq]=2lBe6V}eR(VeZT4ade2+nYBTqS<[&=f[\|szP)G}{Z3n7jpWwftEw[;`l?`0`0`{~i`oLy>u
2022-08-01 18:48:20 UTC	688	IN	Data Raw: b1 31 7e 11 eb 10 43 90 df 43 93 ff 94 f8 9e 43 93 39 a1 8e 08 67 4e 8d 11 e4 f3 fd ff fb 1a 93 f5 48 c8 04 38 42 16 6b 68 ea e7 ab 4a c1 8e 23 5a a4 2d 60 fa 56 81 6f a7 99 4d cb 61 20 39 72 18 11 17 24 00 13 ee d5 ba 14 03 5a 2d bc 68 f3 6b 68 f2 1f 0a 1f 3f 43 93 24 b7 09 fb 5e 96 f1 74 c4 8f f7 bf 39 64 28 91 38 16 50 dd 85 5d da b6 9a a3 d7 77 5b 12 a2 01 77 6c 18 e9 cf 3b b5 8c 64 95 d4 6e 97 d7 86 f4 6f ce 4b ab e8 8d 64 f9 0c 48 1a a6 de 84 28 44 fa af 85 af 9f a1 49 6e fc 49 cc 20 4d ef e3 fc 5f 28 00 f9 81 bc 0e 19 f0 1a 9c 92 18 ee f0 35 29 36 12 48 2f f6 f5 cc 59 cd 31 87 b8 20 b1 51 52 e6 8c 6b 1f 2c 6e cb d6 fb 58 48 bd ad 06 ca 89 f0 0e 91 83 ca cb 3f 14 3e ff 18 9a 64 66 93 04 01 e7 26 36 b3 7f fc fc bd 5e 45 7f 15 4a 96 6d 8b 12 14 aa e9 Data Ascii: 1~CCC9gNH8BkhJ#Z-`VoMa 9r$Z-hkh?C$^t9d(8P]w[wl;dnoKdH(DInI M_(5)6H/Y1 QRk,nXH?>df&6^EJm
2022-08-01 18:48:20 UTC	695	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2022-08-01 18:48:20 UTC	702	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2022-08-01 18:48:20 UTC	703	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 Data Ascii:

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:47:39 UTC	4	OUT	GET /player_api HTTP/1.1 Host: www.youtube.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://idcfars.bls.gov/ARS/authentication/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-01 18:47:39 UTC	4	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 X-Content-Type-Options: nosniff Expires: Mon, 01 Aug 2022 18:47:39 GMT Date: Mon, 01 Aug 2022 18:47:39 GMT Cache-Control: private, max-age=0 Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Critical-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main" Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF X-XSS-Protection: 0 Set-Cookie: YSC=MoQjhxo-8Es; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=JQFKjS6plRs; Domain=.youtube.com; Expires=Sat, 28-Jan-2023 18:47:39 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: CONSENT=PENDING+818; expires=Wed, 31-Jul-2024 18:47:39 GMT; path=/; domain=.youtube.com; Secure Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-01 18:47:39 UTC	6	IN	Data Raw: 33 64 34 0d 0a 76 61 72 20 73 63 72 69 70 74 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 5c 2f 73 5c 2f 70 6c 61 79 65 72 5c 2f 63 38 62 38 61 31 37 33 5c 2f 77 77 77 2d 77 69 64 67 65 74 61 70 69 2e 76 66 6c 73 65 74 5c 2f 77 77 77 2d 77 69 64 67 65 74 61 70 69 2e 6a 73 27 3b 74 72 79 7b 76 61 72 20 74 74 50 6f 6c 69 63 79 3d 77 69 6e 64 6f 77 2e 74 72 75 73 74 65 64 54 79 70 65 73 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 79 6f 75 74 75 62 65 2d 77 69 64 67 65 74 2d 61 70 69 22 2c 7b 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 66 75 6e 63 74 69 6f 6e 28 78 29 7b 72 65 74 75 72 6e 20 78 7d 7d 29 3b 73 63 72 69 70 74 55 72 6c 3d 74 74 50 6f 6c 69 63 79 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 Data Ascii: 3d4var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/c8b8a173\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptUR
2022-08-01 18:47:39 UTC	7	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:15 UTC	7	OUT	GET /helprequest?page=/ARS/WEB-INF/views/ada.jsp HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-01 18:48:15 UTC	8	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-US X-ORACLE-DMS-ECID: 6f043446-73d6-4120-99e5-61695e4a489b-0024acb9 X-ORACLE-DMS-RID: 0 Set-Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832; path=/; HttpOnly; Version=1; Secure X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:15 GMT Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P2 Cache-Control: no-cache, no-store, must-revalidate Vary: Accept-Encoding Transfer-Encoding: chunked
2022-08-01 18:48:15 UTC	8	IN	Data Raw: 66 35 37 0d 0a 0a 0a 0a 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 48 65 6c 70 20 52 65 71 75 65 73 74 20 46 6f 72 6d 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 52 4f 42 4f 54 53 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 4e 45 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 Data Ascii: f57<!DOCTYPE html><html lang="en"><head><title>Help Request Form</title><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="ROBOTS" content="NONE" /><meta http-equiv="Content-Type" content="text/html; cha
2022-08-01 18:48:15 UTC	13	IN	Data Raw: 33 38 65 63 0d 0a 0a 09 09 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 64 69 61 20 68 69 64 65 5f 66 6f 72 5f 70 72 69 6e 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 70 75 6c 6c 2d 6c 65 66 74 22 3e 3c 69 6d 67 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3d 22 2f 47 6c 6f 62 61 6c 43 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 62 6c 73 5f 73 74 61 72 5f 65 6d 62 6c 65 6d 2e 70 6e 67 22 20 61 6c 74 3d 22 42 4c 53 20 4c 6f 67 6f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 3d 22 6d 65 64 69 61 2d 6f 62 6a 65 63 74 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: 38ec<header> <div class="media hide_for_print"> <span class="pull-left"><img src="/GlobalContent/images/bls_star_emblem.png" alt="BLS Logo" class="media-object" /> </span>
2022-08-01 18:48:15 UTC	30	IN	Data Raw: 31 64 34 36 0d 0a 64 2d 36 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 67 72 6f 75 70 20 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 73 74 61 74 65 5f 6e 61 6d 65 22 20 69 64 3d 22 73 74 61 74 65 54 22 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 73 6d 2d 34 20 63 6f 6c 2d 6d 64 2d 33 20 63 6f 6c 2d 66 6f 72 6d 2d 6c 61 62 65 6c 20 74 65 78 74 2d 72 69 67 68 74 22 3e 3c 73 74 72 6f 6e 67 3e 57 68 69 63 68 20 53 74 61 74 65 20 61 72 65 20 79 6f 75 20 63 75 72 72 65 6e 74 6c 79 20 74 72 79 69 6e 67 20 74 6f 20 72 65 70 6f 72 74 20 66 6f 72 3f 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 6c 61 62 65 Data Ascii: 1d46d-6"></div> </div> <div class="form-group row"> <label for="state_name" id="stateT" class="col-sm-4 col-md-3 col-form-label text-right"><strong>Which State are you currently trying to report for?</strong></labe
2022-08-01 18:48:15 UTC	37	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:15 UTC	52	OUT	GET /GlobalContent/themes/rules.css HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
2022-08-01 18:48:16 UTC	100	IN	HTTP/1.1 200 OK Content-Type: text/css Last-Modified: Sun, 20 Jul 2014 18:42:48 GMT Accept-Ranges: bytes ETag: "0c45674aa4cf1:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:16 GMT Content-Length: 1349 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P1 Cache-Control: no-cache, no-store, must-revalidate Vary: Accept-Encoding
2022-08-01 18:48:16 UTC	101	IN	Data Raw: 2e 62 68 61 77 6b 72 75 6c 65 73 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 61 72 69 61 6c 3b 0a 20 20 62 6f 72 64 65 72 2d 73 70 61 63 69 6e 67 3a 20 32 70 78 3b 0a 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 3b 0a 7d 0a 0a 2f 2a 2e 62 68 61 77 6b 74 65 73 74 6e 61 6d 65 20 7b 20 66 6f 6e 74 2d 76 61 72 69 61 6e 74 3a 20 73 6d 61 6c 6c 2d 63 61 70 73 3b 20 7d 2a 2f 0a 2e 62 68 61 77 6b 70 61 73 73 20 7b 20 63 6f 6c 6f 72 3a 20 67 72 65 65 6e 3b 20 7d 0a 2e 62 68 61 77 6b 66 61 69 6c 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 3b 20 7d 0a 2e 62 68 61 77 6b 77 61 72 6e 20 7b 20 63 6f 6c 6f 72 3a 20 6f 72 61 6e 67 65 3b 20 7d 0a 0a 2e 62 68 61 77 6b 66 61 69 6c 20 2e 62 68 61 77 6b 74 65 73 74 73 74 61 74 75 73 20 7b 20 74 Data Ascii: .bhawkrules { font-family: arial; border-spacing: 2px; border: 1px solid #ccc;}/.bhawktestname { font-variant: small-caps; }/.bhawkpass { color: green; }.bhawkfail { color: red; }.bhawkwarn { color: orange; }.bhawkfail .bhawkteststatus { t

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:15 UTC	53	OUT	GET /GlobalContent/javascripts/jquery-latest.js HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
2022-08-01 18:48:16 UTC	140	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Sun, 23 Aug 2020 15:29:03 GMT Accept-Ranges: bytes ETag: "e6e1f3216279d61:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:16 GMT Content-Length: 89476 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P1 Cache-Control: no-cache, no-store, must-revalidate Vary: Accept-Encoding
2022-08-01 18:48:16 UTC	141	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 35 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2022-08-01 18:48:16 UTC	210	IN	Data Raw: 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c 78 37 66 2d 5c 75 46 46 46 46 5c 77 2d 5d 2f 67 2c 69 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3f 22 5c 30 22 3d 3d 3d 65 3f 22 5c 75 66 66 Data Ascii: ([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\x7f-\uFFFF\w-]/g,ie=function(e,t){return t?"\0"===e?"\uff
2022-08-01 18:48:16 UTC	226	IN	Data Raw: 6e 3d 72 2e 73 68 69 66 74 28 29 2c 69 2e 70 75 73 68 28 7b 76 61 6c 75 65 3a 6e 2c 74 79 70 65 3a 6f 2c 6d 61 74 63 68 65 73 3a 72 7d 29 2c 61 3d 61 2e 73 6c 69 63 65 28 6e 2e 6c 65 6e 67 74 68 29 29 3b 69 66 28 21 6e 29 62 72 65 61 6b 7d 72 65 74 75 72 6e 20 74 3f 61 2e 6c 65 6e 67 74 68 3a 61 3f 73 65 2e 65 72 72 6f 72 28 65 29 3a 78 28 65 2c 73 29 2e 73 6c 69 63 65 28 30 29 7d 2c 66 3d 73 65 2e 63 6f 6d 70 69 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 76 2c 79 2c 6d 2c 78 2c 72 2c 69 3d 5b 5d 2c 6f 3d 5b 5d 2c 61 3d 41 5b 65 2b 22 20 22 5d 3b 69 66 28 21 61 29 7b 74 7c 7c 28 74 3d 68 28 65 29 29 2c 6e 3d 74 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6e 2d 2d 29 28 61 3d 45 65 28 74 5b 6e 5d 29 29 5b 53 5d 3f 69 2e 70 75 73 68 Data Ascii: n=r.shift(),i.push({value:n,type:o,matches:r}),a=a.slice(n.length));if(!n)break}return t?a.length:a?se.error(e):x(e,s).slice(0)},f=se.compile=function(e,t){var n,v,y,m,x,r,i=[],o=[],a=A[e+" "];if(!a){t\|\|(t=h(e)),n=t.length;while(n--)(a=Ee(t[n]))[S]?i.push
2022-08-01 18:48:16 UTC	255	IN	Data Raw: 2c 74 2c 21 45 2c 6e 2c 21 74 7c 7c 65 65 2e 74 65 73 74 28 65 29 26 26 79 65 28 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 74 29 2c 6e 7d 2c 64 2e 73 6f 72 74 53 74 61 62 6c 65 3d 53 2e 73 70 6c 69 74 28 22 22 29 2e 73 6f 72 74 28 44 29 2e 6a 6f 69 6e 28 22 22 29 3d 3d 3d 53 2c 64 2e 64 65 74 65 63 74 44 75 70 6c 69 63 61 74 65 73 3d 21 21 6c 2c 54 28 29 2c 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 3d 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 26 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 43 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 66 69 65 6c 64 73 65 74 22 29 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 Data Ascii: ,t,!E,n,!t\|\|ee.test(e)&&ye(t.parentNode)\|\|t),n},d.sortStable=S.split("").sort(D).join("")===S,d.detectDuplicates=!!l,T(),d.sortDetached=ce(function(e){return 1&e.compareDocumentPosition(C.createElement("fieldset"))}),ce(function(e){return e.innerHTML="<a
2022-08-01 18:48:16 UTC	259	IN	Data Raw: 7b 72 65 74 75 72 6e 20 54 28 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 7b 7d 29 2e 66 69 72 73 74 43 68 69 6c 64 2c 65 29 7d 2c 63 68 69 6c 64 72 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 54 28 65 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 2c 63 6f 6e 74 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 65 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 26 26 72 28 65 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 29 3f 65 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 3a 28 41 28 65 2c 22 74 65 6d 70 6c 61 74 65 22 29 26 26 28 65 3d 65 2e 63 6f 6e 74 65 6e 74 7c 7c 65 29 2c 53 2e 6d 65 72 67 65 28 5b 5d 2c 65 2e 63 68 69 6c 64 4e 6f 64 65 73 29 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 72 2c Data Ascii: {return T((e.parentNode\|\|{}).firstChild,e)},children:function(e){return T(e.firstChild)},contents:function(e){return null!=e.contentDocument&&r(e.contentDocument)?e.contentDocument:(A(e,"template")&&(e=e.content\|\|e),S.merge([],e.childNodes))}},function(r,
2022-08-01 18:48:16 UTC	266	IN	Data Raw: 28 74 3d 5a 28 6f 2c 6e 29 29 3f 74 3a 76 6f 69 64 20 30 3b 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 51 2e 73 65 74 28 74 68 69 73 2c 6e 2c 65 29 7d 29 7d 2c 6e 75 6c 6c 2c 65 2c 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6e 75 6c 6c 2c 21 30 29 7d 2c 72 65 6d 6f 76 65 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 51 2e 72 65 6d 6f 76 65 28 74 68 69 73 2c 65 29 7d 29 7d 7d 29 2c 53 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3b 69 66 28 65 29 72 65 74 75 72 6e 20 74 3d 28 74 7c 7c 22 66 78 22 29 2b 22 71 75 65 75 65 22 2c 72 3d 59 2e 67 65 74 28 65 2c 74 29 2c 6e 26 26 Data Ascii: (t=Z(o,n))?t:void 0;this.each(function(){Q.set(this,n,e)})},null,e,1<arguments.length,null,!0)},removeData:function(e){return this.each(function(){Q.remove(this,e)})}}),S.extend({queue:function(e,t,n){var r;if(e)return t=(t\|\|"fx")+"queue",r=Y.get(e,t),n&&
2022-08-01 18:48:16 UTC	309	IN	Data Raw: 2a 29 24 22 2c 22 69 22 29 2c 6e 65 3d 5b 22 54 6f 70 22 2c 22 52 69 67 68 74 22 2c 22 42 6f 74 74 6f 6d 22 2c 22 4c 65 66 74 22 5d 2c 72 65 3d 45 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 69 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 63 6f 6e 74 61 69 6e 73 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 65 29 7d 2c 6f 65 3d 7b 63 6f 6d 70 6f 73 65 64 3a 21 30 7d 3b 72 65 2e 67 65 74 52 6f 6f 74 4e 6f 64 65 26 26 28 69 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 63 6f 6e 74 61 69 6e 73 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 65 29 7c 7c 65 2e 67 65 74 52 6f 6f 74 4e 6f 64 65 28 6f 65 29 3d 3d 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7d 29 3b 76 61 72 20 61 65 3d 66 75 6e 63 Data Ascii: *)$","i"),ne=["Top","Right","Bottom","Left"],re=E.documentElement,ie=function(e){return S.contains(e.ownerDocument,e)},oe={composed:!0};re.getRootNode&&(ie=function(e){return S.contains(e.ownerDocument,e)\|\|e.getRootNode(oe)===e.ownerDocument});var ae=func
2022-08-01 18:48:16 UTC	332	IN	Data Raw: 22 21 3d 3d 65 2e 74 79 70 65 7c 7c 21 30 21 3d 3d 6c 2e 64 69 73 61 62 6c 65 64 29 29 7b 66 6f 72 28 6f 3d 5b 5d 2c 61 3d 7b 7d 2c 6e 3d 30 3b 6e 3c 75 3b 6e 2b 2b 29 76 6f 69 64 20 30 3d 3d 3d 61 5b 69 3d 28 72 3d 74 5b 6e 5d 29 2e 73 65 6c 65 63 74 6f 72 2b 22 20 22 5d 26 26 28 61 5b 69 5d 3d 72 2e 6e 65 65 64 73 43 6f 6e 74 65 78 74 3f 2d 31 3c 53 28 69 2c 74 68 69 73 29 2e 69 6e 64 65 78 28 6c 29 3a 53 2e 66 69 6e 64 28 69 2c 74 68 69 73 2c 6e 75 6c 6c 2c 5b 6c 5d 29 2e 6c 65 6e 67 74 68 29 2c 61 5b 69 5d 26 26 6f 2e 70 75 73 68 28 72 29 3b 6f 2e 6c 65 6e 67 74 68 26 26 73 2e 70 75 73 68 28 7b 65 6c 65 6d 3a 6c 2c 68 61 6e 64 6c 65 72 73 3a 6f 7d 29 7d 72 65 74 75 72 6e 20 6c 3d 74 68 69 73 2c 75 3c 74 2e 6c 65 6e 67 74 68 26 26 73 2e 70 75 73 68 28 Data Ascii: "!==e.type\|\|!0!==l.disabled)){for(o=[],a={},n=0;n<u;n++)void 0===a[i=(r=t[n]).selector+" "]&&(a[i]=r.needsContext?-1<S(i,this).index(l):S.find(i,this,null,[l]).length),a[i]&&o.push(r);o.length&&s.push({elem:l,handlers:o})}return l=this,u<t.length&&s.push(
2022-08-01 18:48:16 UTC	341	IN	Data Raw: 69 73 2e 67 65 74 7d 7d 7d 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 69 66 28 6c 29 7b 75 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 2d 31 31 31 31 31 70 78 3b 77 69 64 74 68 3a 36 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 70 78 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 22 2c 6c 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6f 76 65 72 66 6c 6f 77 3a 73 63 72 6f 6c 6c 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 62 6f 72 64 65 72 3a 31 70 78 3b 70 61 64 64 69 6e 67 3a 31 70 Data Ascii: is.get}}}!function(){function e(){if(l){u.style.cssText="position:absolute;left:-11111px;width:60px;margin-top:1px;padding:0;border:0",l.style.cssText="position:relative;display:block;box-sizing:border-box;overflow:scroll;margin:auto;border:1px;padding:1p
2022-08-01 18:48:16 UTC	349	IN	Data Raw: 28 65 29 3f 28 74 3d 65 2c 65 3d 5b 22 2a 22 5d 29 3a 65 3d 65 2e 6d 61 74 63 68 28 50 29 3b 66 6f 72 28 76 61 72 20 6e 2c 72 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 72 2b 2b 29 6e 3d 65 5b 72 5d 2c 66 74 2e 74 77 65 65 6e 65 72 73 5b 6e 5d 3d 66 74 2e 74 77 65 65 6e 65 72 73 5b 6e 5d 7c 7c 5b 5d 2c 66 74 2e 74 77 65 65 6e 65 72 73 5b 6e 5d 2e 75 6e 73 68 69 66 74 28 74 29 7d 2c 70 72 65 66 69 6c 74 65 72 73 3a 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 2c 66 3d 22 77 69 64 74 68 22 69 6e 20 74 7c 7c 22 68 65 69 67 68 74 22 69 6e 20 74 2c 70 3d 74 68 69 73 2c 64 3d 7b 7d 2c 68 3d 65 2e 73 74 79 6c 65 2c 67 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 61 65 28 65 29 2c 76 3d 59 2e 67 Data Ascii: (e)?(t=e,e=["*"]):e=e.match(P);for(var n,r=0,i=e.length;r<i;r++)n=e[r],ft.tweeners[n]=ft.tweeners[n]\|\|[],ft.tweeners[n].unshift(t)},prefilters:[function(e,t,n){var r,i,o,a,s,u,l,c,f="width"in t\|\|"height"in t,p=this,d={},h=e.style,g=e.nodeType&&ae(e),v=Y.g
2022-08-01 18:48:16 UTC	352	IN	Data Raw: 2c 69 3d 53 2e 74 69 6d 65 72 73 2c 6f 3d 6e 3f 6e 2e 6c 65 6e 67 74 68 3a 30 3b 66 6f 72 28 74 2e 66 69 6e 69 73 68 3d 21 30 2c 53 2e 71 75 65 75 65 28 74 68 69 73 2c 61 2c 5b 5d 29 2c 72 26 26 72 2e 73 74 6f 70 26 26 72 2e 73 74 6f 70 2e 63 61 6c 6c 28 74 68 69 73 2c 21 30 29 2c 65 3d 69 2e 6c 65 6e 67 74 68 3b 65 2d 2d 3b 29 69 5b 65 5d 2e 65 6c 65 6d 3d 3d 3d 74 68 69 73 26 26 69 5b 65 5d 2e 71 75 65 75 65 3d 3d 3d 61 26 26 28 69 5b 65 5d 2e 61 6e 69 6d 2e 73 74 6f 70 28 21 30 29 2c 69 2e 73 70 6c 69 63 65 28 65 2c 31 29 29 3b 66 6f 72 28 65 3d 30 3b 65 3c 6f 3b 65 2b 2b 29 6e 5b 65 5d 26 26 6e 5b 65 5d 2e 66 69 6e 69 73 68 26 26 6e 5b 65 5d 2e 66 69 6e 69 73 68 2e 63 61 6c 6c 28 74 68 69 73 29 3b 64 65 6c 65 74 65 20 74 2e 66 69 6e 69 73 68 7d 29 7d Data Ascii: ,i=S.timers,o=n?n.length:0;for(t.finish=!0,S.queue(this,a,[]),r&&r.stop&&r.stop.call(this,!0),e=i.length;e--;)i[e].elem===this&&i[e].queue===a&&(i[e].anim.stop(!0),i.splice(e,1));for(e=0;e<o;e++)n[e]&&n[e].finish&&n[e].finish.call(this);delete t.finish})}
2022-08-01 18:48:16 UTC	392	IN	Data Raw: 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 74 3f 74 3a 76 74 28 53 2e 74 65 78 74 28 65 29 29 7d 7d 2c 73 65 6c 65 63 74 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 65 2e 6f 70 74 69 6f 6e 73 2c 6f 3d 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 61 3d 22 73 65 6c 65 63 74 2d 6f 6e 65 22 3d 3d 3d 65 2e 74 79 70 65 2c 73 3d 61 3f 6e 75 6c 6c 3a 5b 5d 2c 75 3d 61 3f 6f 2b 31 3a 69 2e 6c 65 6e 67 74 68 3b 66 6f 72 28 72 3d 6f 3c 30 3f 75 3a 61 3f 6f 3a 30 3b 72 3c 75 3b 72 2b 2b 29 69 66 28 28 28 6e 3d 69 5b 72 5d 29 2e 73 65 6c 65 63 74 65 64 7c 7c 72 3d 3d 3d 6f 29 26 26 21 6e 2e 64 69 73 61 62 6c 65 64 26 26 28 21 6e 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 64 69 73 61 62 6c 65 64 7c 7c 21 41 28 6e 2e 70 61 72 65 6e 74 Data Ascii: eturn null!=t?t:vt(S.text(e))}},select:{get:function(e){var t,n,r,i=e.options,o=e.selectedIndex,a="select-one"===e.type,s=a?null:[],u=a?o+1:i.length;for(r=o<0?u:a?o:0;r<u;r++)if(((n=i[r]).selected\|\|r===o)&&!n.disabled&&(!n.parentNode.disabled\|\|!A(n.parent
2022-08-01 18:48:16 UTC	401	IN	Data Raw: 2c 73 3d 65 2e 63 6f 6e 74 65 6e 74 73 2c 75 3d 65 2e 64 61 74 61 54 79 70 65 73 3b 77 68 69 6c 65 28 22 2a 22 3d 3d 3d 75 5b 30 5d 29 75 2e 73 68 69 66 74 28 29 2c 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 65 2e 6d 69 6d 65 54 79 70 65 7c 7c 74 2e 67 65 74 52 65 73 70 6f 6e 73 65 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 29 29 3b 69 66 28 72 29 66 6f 72 28 69 20 69 6e 20 73 29 69 66 28 73 5b 69 5d 26 26 73 5b 69 5d 2e 74 65 73 74 28 72 29 29 7b 75 2e 75 6e 73 68 69 66 74 28 69 29 3b 62 72 65 61 6b 7d 69 66 28 75 5b 30 5d 69 6e 20 6e 29 6f 3d 75 5b 30 5d 3b 65 6c 73 65 7b 66 6f 72 28 69 20 69 6e 20 6e 29 7b 69 66 28 21 75 5b 30 5d 7c 7c 65 2e 63 6f 6e 76 65 72 74 65 72 73 5b 69 2b 22 20 22 2b 75 5b 30 5d 5d 29 7b 6f 3d 69 3b 62 72 Data Ascii: ,s=e.contents,u=e.dataTypes;while("*"===u[0])u.shift(),void 0===r&&(r=e.mimeType\|\|t.getResponseHeader("Content-Type"));if(r)for(i in s)if(s[i]&&s[i].test(r)){u.unshift(i);break}if(u[0]in n)o=u[0];else{for(i in n){if(!u[0]\|\|e.converters[i+" "+u[0]]){o=i;br
2022-08-01 18:48:16 UTC	426	IN	Data Raw: 54 2c 76 2c 69 3f 6f 3a 61 5d 29 2c 62 2e 66 69 72 65 57 69 74 68 28 79 2c 5b 54 2c 6c 5d 29 2c 67 26 26 28 6d 2e 74 72 69 67 67 65 72 28 22 61 6a 61 78 43 6f 6d 70 6c 65 74 65 22 2c 5b 54 2c 76 5d 29 2c 2d 2d 53 2e 61 63 74 69 76 65 7c 7c 53 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 28 22 61 6a 61 78 53 74 6f 70 22 29 29 29 7d 72 65 74 75 72 6e 20 54 7d 2c 67 65 74 4a 53 4f 4e 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 53 2e 67 65 74 28 65 2c 74 2c 6e 2c 22 6a 73 6f 6e 22 29 7d 2c 67 65 74 53 63 72 69 70 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 53 2e 67 65 74 28 65 2c 76 6f 69 64 20 30 2c 74 2c 22 73 63 72 69 70 74 22 29 7d 7d 29 2c 53 2e 65 61 63 68 28 5b 22 67 65 74 22 2c 22 70 6f 73 74 22 5d 2c Data Ascii: T,v,i?o:a]),b.fireWith(y,[T,l]),g&&(m.trigger("ajaxComplete",[T,v]),--S.active\|\|S.event.trigger("ajaxStop")))}return T},getJSON:function(e,t,n){return S.get(e,t,n,"json")},getScript:function(e,t){return S.get(e,void 0,t,"script")}}),S.each(["get","post"],
2022-08-01 18:48:16 UTC	433	IN	Data Raw: 4d 65 2e 74 65 73 74 28 74 29 3f 53 28 65 29 2e 70 6f 73 69 74 69 6f 6e 28 29 5b 6e 5d 2b 22 70 78 22 3a 74 7d 29 7d 29 2c 53 2e 65 61 63 68 28 7b 48 65 69 67 68 74 3a 22 68 65 69 67 68 74 22 2c 57 69 64 74 68 3a 22 77 69 64 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 73 29 7b 53 2e 65 61 63 68 28 7b 70 61 64 64 69 6e 67 3a 22 69 6e 6e 65 72 22 2b 61 2c 63 6f 6e 74 65 6e 74 3a 73 2c 22 22 3a 22 6f 75 74 65 72 22 2b 61 7d 2c 66 75 6e 63 74 69 6f 6e 28 72 2c 6f 29 7b 53 2e 66 6e 5b 6f 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 28 72 7c 7c 22 62 6f 6f 6c 65 61 6e 22 21 3d 74 79 70 65 6f 66 20 65 29 2c 69 3d 72 7c 7c 28 21 30 3d 3d 3d 65 7c 7c 21 30 3d 3d 3d 74 3f 22 6d 61 72 67 Data Ascii: Me.test(t)?S(e).position()[n]+"px":t})}),S.each({Height:"height",Width:"width"},function(a,s){S.each({padding:"inner"+a,content:s,"":"outer"+a},function(r,o){S.fn[o]=function(e,t){var n=arguments.length&&(r\|\|"boolean"!=typeof e),i=r\|\|(!0===e\|\|!0===t?"marg

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:15 UTC	53	OUT	GET /GlobalContent/javascripts/jquery.validate-1.9.0.js HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
2022-08-01 18:48:16 UTC	146	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Mon, 18 Jun 2012 14:32:32 GMT Accept-Ranges: bytes ETag: "0804325f4dcd1:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:16 GMT Content-Length: 39112 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P1 Cache-Control: no-cache, no-store, must-revalidate Vary: Accept-Encoding
2022-08-01 18:48:16 UTC	147	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 6a 51 75 65 72 79 20 56 61 6c 69 64 61 74 69 6f 6e 20 50 6c 75 67 69 6e 20 40 56 45 52 53 49 4f 4e 0a 20 2a 0a 20 2a 20 68 74 74 70 3a 2f 2f 62 61 73 73 69 73 74 61 6e 63 65 2e 64 65 2f 6a 71 75 65 72 79 2d 70 6c 75 67 69 6e 73 2f 6a 71 75 65 72 79 2d 70 6c 75 67 69 6e 2d 76 61 6c 69 64 61 74 69 6f 6e 2f 0a 20 2a 20 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6a 71 75 65 72 79 2e 63 6f 6d 2f 50 6c 75 67 69 6e 73 2f 56 61 6c 69 64 61 74 69 6f 6e 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 32 20 4a c3 b6 72 6e 20 5a 61 65 66 66 65 72 65 72 0a 20 2a 0a 20 2a 20 44 75 61 6c 20 6c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 61 6e 64 20 47 50 4c 20 6c 69 63 65 6e 73 65 73 3a 0a 20 2a 20 20 20 68 74 Data Ascii: /** * jQuery Validation Plugin @VERSION * * http://bassistance.de/jquery-plugins/jquery-plugin-validation/ * http://docs.jquery.com/Plugins/Validation * * Copyright (c) 2012 Jrn Zaefferer * * Dual licensed under the MIT and GPL licenses: * ht
2022-08-01 18:48:16 UTC	267	IN	Data Raw: 6e 64 65 78 2c 20 6d 65 74 68 6f 64 29 20 7b 0a 09 09 09 09 09 66 69 6c 74 65 72 65 64 5b 6d 65 74 68 6f 64 5d 20 3d 20 65 78 69 73 74 69 6e 67 52 75 6c 65 73 5b 6d 65 74 68 6f 64 5d 3b 0a 09 09 09 09 09 64 65 6c 65 74 65 20 65 78 69 73 74 69 6e 67 52 75 6c 65 73 5b 6d 65 74 68 6f 64 5d 3b 0a 09 09 09 09 7d 29 3b 0a 09 09 09 09 72 65 74 75 72 6e 20 66 69 6c 74 65 72 65 64 3b 0a 09 09 09 7d 0a 09 09 7d 0a 0a 09 09 76 61 72 20 64 61 74 61 20 3d 20 24 2e 76 61 6c 69 64 61 74 6f 72 2e 6e 6f 72 6d 61 6c 69 7a 65 52 75 6c 65 73 28 0a 09 09 24 2e 65 78 74 65 6e 64 28 0a 09 09 09 7b 7d 2c 0a 09 09 09 24 2e 76 61 6c 69 64 61 74 6f 72 2e 6d 65 74 61 64 61 74 61 52 75 6c 65 73 28 65 6c 65 6d 65 6e 74 29 2c 0a 09 09 09 24 2e 76 61 6c 69 64 61 74 6f 72 2e 63 6c 61 73 Data Ascii: ndex, method) {filtered[method] = existingRules[method];delete existingRules[method];});return filtered;}}var data = $.validator.normalizeRules($.extend({},$.validator.metadataRules(element),$.validator.clas
2022-08-01 18:48:16 UTC	282	IN	Data Raw: 61 6c 69 64 43 6c 61 73 73 20 29 3b 0a 09 09 09 09 7d 0a 09 09 09 09 74 68 69 73 2e 73 68 6f 77 4c 61 62 65 6c 28 20 65 72 72 6f 72 2e 65 6c 65 6d 65 6e 74 2c 20 65 72 72 6f 72 2e 6d 65 73 73 61 67 65 20 29 3b 0a 09 09 09 7d 0a 09 09 09 69 66 28 20 74 68 69 73 2e 65 72 72 6f 72 4c 69 73 74 2e 6c 65 6e 67 74 68 20 29 20 7b 0a 09 09 09 09 74 68 69 73 2e 74 6f 53 68 6f 77 20 3d 20 74 68 69 73 2e 74 6f 53 68 6f 77 2e 61 64 64 28 20 74 68 69 73 2e 63 6f 6e 74 61 69 6e 65 72 73 20 29 3b 0a 09 09 09 7d 0a 09 09 09 69 66 20 28 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 73 75 63 63 65 73 73 29 20 7b 0a 09 09 09 09 66 6f 72 20 28 20 69 20 3d 20 30 3b 20 74 68 69 73 2e 73 75 63 63 65 73 73 4c 69 73 74 5b 69 5d 3b 20 69 2b 2b 20 29 20 7b 0a 09 09 09 09 09 74 68 69 73 Data Ascii: alidClass );}this.showLabel( error.element, error.message );}if( this.errorList.length ) {this.toShow = this.toShow.add( this.containers );}if (this.settings.success) {for ( i = 0; this.successList[i]; i++ ) {this
2022-08-01 18:48:16 UTC	283	IN	Data Raw: 73 65 74 74 69 6e 67 73 2e 77 72 61 70 70 65 72 20 29 20 7b 0a 09 09 09 09 09 2f 2f 20 6d 61 6b 65 20 73 75 72 65 20 74 68 65 20 65 6c 65 6d 65 6e 74 20 69 73 20 76 69 73 69 62 6c 65 2c 20 65 76 65 6e 20 69 6e 20 49 45 0a 09 09 09 09 09 2f 2f 20 61 63 74 75 61 6c 6c 79 20 73 68 6f 77 69 6e 67 20 74 68 65 20 77 72 61 70 70 65 64 20 65 6c 65 6d 65 6e 74 20 69 73 20 68 61 6e 64 6c 65 64 20 65 6c 73 65 77 68 65 72 65 0a 09 09 09 09 09 6c 61 62 65 6c 20 3d 20 6c 61 62 65 6c 2e 68 69 64 65 28 29 2e 73 68 6f 77 28 29 2e 77 72 61 70 28 22 3c 22 20 2b 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 77 72 61 70 70 65 72 20 2b 20 22 2f 3e 22 29 2e 70 61 72 65 6e 74 28 29 3b 0a 09 09 09 09 7d 0a 09 09 09 09 69 66 20 28 20 21 74 68 69 73 2e 6c 61 62 65 6c 43 6f 6e 74 61 Data Ascii: settings.wrapper ) {// make sure the element is visible, even in IE// actually showing the wrapped element is handled elsewherelabel = label.hide().show().wrap("<" + this.settings.wrapper + "/>").parent();}if ( !this.labelConta
2022-08-01 18:48:16 UTC	290	IN	Data Raw: 65 64 20 22 6d 65 73 73 61 67 65 73 22 0a 09 09 69 66 20 28 72 75 6c 65 73 2e 6d 65 73 73 61 67 65 73 29 20 7b 0a 09 09 09 64 65 6c 65 74 65 20 72 75 6c 65 73 2e 6d 65 73 73 61 67 65 73 3b 0a 09 09 7d 0a 0a 09 09 72 65 74 75 72 6e 20 72 75 6c 65 73 3b 0a 09 7d 2c 0a 0a 09 2f 2f 20 43 6f 6e 76 65 72 74 73 20 61 20 73 69 6d 70 6c 65 20 73 74 72 69 6e 67 20 74 6f 20 61 20 7b 73 74 72 69 6e 67 3a 20 74 72 75 65 7d 20 72 75 6c 65 2c 20 65 2e 67 2e 2c 20 22 72 65 71 75 69 72 65 64 22 20 74 6f 20 7b 72 65 71 75 69 72 65 64 3a 74 72 75 65 7d 0a 09 6e 6f 72 6d 61 6c 69 7a 65 52 75 6c 65 3a 20 66 75 6e 63 74 69 6f 6e 28 64 61 74 61 29 20 7b 0a 09 09 69 66 28 20 74 79 70 65 6f 66 20 64 61 74 61 20 3d 3d 3d 20 22 73 74 72 69 6e 67 22 20 29 20 7b 0a 09 09 09 76 61 72 Data Ascii: ed "messages"if (rules.messages) {delete rules.messages;}return rules;},// Converts a simple string to a {string: true} rule, e.g., "required" to {required:true}normalizeRule: function(data) {if( typeof data === "string" ) {var
2022-08-01 18:48:16 UTC	358	IN	Data Raw: 7b 0a 09 09 09 09 72 65 74 75 72 6e 20 22 64 65 70 65 6e 64 65 6e 63 79 2d 6d 69 73 6d 61 74 63 68 22 3b 0a 09 09 09 7d 0a 0a 09 09 09 76 61 72 20 70 72 65 76 69 6f 75 73 20 3d 20 74 68 69 73 2e 70 72 65 76 69 6f 75 73 56 61 6c 75 65 28 65 6c 65 6d 65 6e 74 29 3b 0a 09 09 09 69 66 20 28 21 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 6d 65 73 73 61 67 65 73 5b 65 6c 65 6d 65 6e 74 2e 6e 61 6d 65 5d 20 29 20 7b 0a 09 09 09 09 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 6d 65 73 73 61 67 65 73 5b 65 6c 65 6d 65 6e 74 2e 6e 61 6d 65 5d 20 3d 20 7b 7d 3b 0a 09 09 09 7d 0a 09 09 09 70 72 65 76 69 6f 75 73 2e 6f 72 69 67 69 6e 61 6c 4d 65 73 73 61 67 65 20 3d 20 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 6d 65 73 73 61 67 65 73 5b 65 6c 65 6d 65 6e 74 2e 6e 61 6d 65 Data Ascii: {return "dependency-mismatch";}var previous = this.previousValue(element);if (!this.settings.messages[element.name] ) {this.settings.messages[element.name] = {};}previous.originalMessage = this.settings.messages[element.name
2022-08-01 18:48:16 UTC	365	IN	Data Raw: 20 62 6c 75 72 20 65 76 65 6e 74 20 6f 66 20 74 68 65 20 74 61 72 67 65 74 20 69 6e 20 6f 72 64 65 72 20 74 6f 20 72 65 76 61 6c 69 64 61 74 65 20 77 68 65 6e 65 76 65 72 20 74 68 65 20 74 61 72 67 65 74 20 66 69 65 6c 64 20 69 73 20 75 70 64 61 74 65 64 0a 09 09 09 2f 2f 20 54 4f 44 4f 20 66 69 6e 64 20 61 20 77 61 79 20 74 6f 20 62 69 6e 64 20 74 68 65 20 65 76 65 6e 74 20 6a 75 73 74 20 6f 6e 63 65 2c 20 61 76 6f 69 64 69 6e 67 20 74 68 65 20 75 6e 62 69 6e 64 2d 72 65 62 69 6e 64 20 6f 76 65 72 68 65 61 64 0a 09 09 09 76 61 72 20 74 61 72 67 65 74 20 3d 20 24 28 70 61 72 61 6d 29 2e 75 6e 62 69 6e 64 28 22 2e 76 61 6c 69 64 61 74 65 2d 65 71 75 61 6c 54 6f 22 29 2e 62 69 6e 64 28 22 62 6c 75 72 2e 76 61 6c 69 64 61 74 65 2d 65 71 75 61 6c 54 6f 22 2c Data Ascii: blur event of the target in order to revalidate whenever the target field is updated// TODO find a way to bind the event just once, avoiding the unbind-rebind overheadvar target = $(param).unbind(".validate-equalTo").bind("blur.validate-equalTo",
2022-08-01 18:48:16 UTC	366	IN	Data Raw: 20 66 6f 63 75 73 69 6e 20 61 6e 64 20 66 6f 63 75 73 6f 75 74 20 65 76 65 6e 74 73 0a 2f 2f 20 49 45 20 68 61 73 20 6e 61 74 69 76 65 20 73 75 70 70 6f 72 74 2c 20 69 6e 20 6f 74 68 65 72 20 62 72 6f 77 73 65 72 73 2c 20 75 73 65 20 65 76 65 6e 74 20 63 61 70 75 74 75 72 69 6e 67 20 28 6e 65 69 74 68 65 72 20 62 75 62 62 6c 65 73 29 0a 0a 2f 2f 20 70 72 6f 76 69 64 65 73 20 64 65 6c 65 67 61 74 65 28 74 79 70 65 3a 20 53 74 72 69 6e 67 2c 20 64 65 6c 65 67 61 74 65 3a 20 53 65 6c 65 63 74 6f 72 2c 20 68 61 6e 64 6c 65 72 3a 20 43 61 6c 6c 62 61 63 6b 29 20 70 6c 75 67 69 6e 20 66 6f 72 20 65 61 73 69 65 72 20 65 76 65 6e 74 20 64 65 6c 65 67 61 74 69 6f 6e 0a 2f 2f 20 68 61 6e 64 6c 65 72 20 69 73 20 6f 6e 6c 79 20 63 61 6c 6c 65 64 20 77 68 65 6e 20 24 Data Ascii: focusin and focusout events// IE has native support, in other browsers, use event caputuring (neither bubbles)// provides delegate(type: String, delegate: Selector, handler: Callback) plugin for easier event delegation// handler is only called when $

Timestamp	kBytes transferred	Direction	Data
2022-08-01 18:48:16 UTC	77	OUT	GET /GlobalContent/javascripts/globalScripts.js HTTP/1.1 Host: idcf.bls.gov Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://idcf.bls.gov/helprequest?page=/ARS/WEB-INF/views/ada.jsp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=D7davL-Y46P6grzo5wp_MRVmPO5CNeHvwwhGTFdFJ8O5RvMPf9Gm!-778362014!1296113832
2022-08-01 18:48:16 UTC	151	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Thu, 15 Sep 2016 11:35:28 GMT Accept-Ranges: bytes ETag: "040e74145fd21:0" X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Date: Mon, 01 Aug 2022 18:48:15 GMT Content-Length: 2005 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains Pool-Info: P2 Cache-Control: no-cache, no-store, must-revalidate Vary: Accept-Encoding
2022-08-01 18:48:16 UTC	151	IN	Data Raw: ef bb bf 0d 0a 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 6c 69 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 20 0d 0a 20 20 20 20 6c 69 2e 74 79 70 65 20 3d 20 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3b 20 0d 0a 20 20 20 20 6c 69 2e 73 72 63 3d 20 22 2f 47 6c 6f 62 61 6c 43 6f 6e 74 65 6e 74 2f 6a 61 76 61 73 63 72 69 70 74 73 2f 66 65 64 65 72 61 74 65 64 2d 61 6e 61 6c 79 74 69 63 73 2e 6a 73 3f 61 67 65 6e 63 79 3d 44 4f 4c 26 73 75 62 61 67 65 6e 63 79 3d 42 4c 53 22 3b 20 0d 0a 20 20 20 20 6c 69 2e 61 73 79 6e 63 3d 74 72 75 65 3b 20 0d 0a 20 20 20 20 6c 69 2e 69 64 20 3d 22 5f 66 65 64 5f 61 6e 5f 75 61 5f 74 61 67 22 3b 0d 0a 20 20 20 20 76 61 72 Data Ascii: (function () { var li = document.createElement('script'); li.type = 'text/javascript'; li.src= "/GlobalContent/javascripts/federated-analytics.js?agency=DOL&subagency=BLS"; li.async=true; li.id ="_fed_an_ua_tag"; var

Target ID:	0
Start time:	20:47:32
Start date:	01/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	1
Start time:	20:47:33
Start date:	01/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,14495699213235314744,10476318232252177159,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	3
Start time:	20:47:34
Start date:	01/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://idcfars.bls.gov/
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://idcfars.bls.gov/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\3cc89cd2-5a52-4f9f-8ce0-95ad52cf4742.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\60aa78fb-8ede-4de2-bc9e-935c2b7a3597.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\17b5edf4-a7f6-4f5e-8fe5-04f0851e5886.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1cfa69de-f6f3-42b7-b6c8-5b3acd3dc69c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4ccd50c6-0d89-4f96-9539-f209f944d549.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\54a80425-7372-49e9-a98f-44294c4ff4eb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7089395c-4508-4736-bc01-c921a5868138.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\71fae89f-9a2d-4e07-be26-97f5bd337831.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\72c70029-4e4d-4c19-b742-68fb09bc2dcb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7a536e59-f39e-4c76-b77b-3b114fde0f6d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8750806c-578b-402e-9100-a6769e2db6d7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9b42c8be-fdc8-4995-b1a8-d0ca84065083.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\01744fd7-0f51-4375-80ff-27000a8d9e8d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\a3bfd011-8637-41dd-bd35-8bc67fb11594.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\a7f02789-f7bf-444a-a5c3-f3f4d61fa057.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\aa27d1f9-85cc-4ee1-8e44-200a5f1a5ed4.tmp

Windows Analysis Report
https://idcfars.bls.gov/

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre