Loading ...

Play interactive tourEdit tour

Analysis Report https://getcloud.withgoogle.com/schedule/haissaoui

Overview

General Information

Joe Sandbox Version:26.0.0 Aquamarine
Analysis ID:132317
Start date:16.05.2019
Start time:02:05:19
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 4m 46s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:browseurl.jbs
Sample URL:https://getcloud.withgoogle.com/schedule/haissaoui
Analysis system description:Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Number of analysed new started processes analysed:18
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
Analysis stop reason:Timeout
Detection:CLEAN
Classification:clean0.win@3/270@7/6
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Browsing link: https://getcloud.withgoogle.com/schedule/haissaoui#
  • Browsing link: https://www.google.com/
  • Browsing link: https://support.google.com/
  • Browsing link: https://www.google.com/intl/en/policies/privacy/
  • Browsing link: https://www.google.com/intl/en/policies/terms/
Warnings:
Show All
  • Exclude process from analysis (whitelisted): sc.exe, dllhost.exe, ielowutil.exe, TiWorker.exe, wermgr.exe, MusNotifyIcon.exe, SIHClient.exe, conhost.exe, CompatTelRunner.exe, svchost.exe, TrustedInstaller.exe
  • Excluded IPs from analysis (whitelisted): 52.155.172.105, 13.74.179.117, 92.122.32.78, 172.217.168.81, 172.217.168.74, 172.217.168.10, 172.217.168.42, 216.58.215.234, 172.217.168.4, 108.177.119.95, 108.177.126.95, 108.177.127.95, 74.125.143.95, 172.217.168.46, 216.58.215.238, 172.217.168.14, 172.217.168.3, 172.217.168.78, 172.217.168.67, 172.217.168.35, 152.199.19.161, 172.217.168.45, 172.217.168.38, 93.184.221.240, 13.107.4.50
  • Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, consent.google.com, ssl.gstatic.com, storage.googleapis.com, commondatastorage.googleapis.com, policies.google.com, googleapis.l.google.com, googleadapis.l.google.com, e11290.dspg.akamaiedge.net, ytstatic.l.google.com, audownload.windowsupdate.nsatc.net, realtimesupport.clients6.google.com, hlb.apr-52dd2-0.edgecastdns.net, www.google.com, www.gstatic.com, services.google.com, www.google-analytics.com, fonts.googleapis.com, plus.l.google.com, ajax.googleapis.com, sls.update.microsoft.com.akadns.net, youtube-ui.l.google.com, au.au-msedge.net, www3.l.google.com, getcloud.withgoogle.com, cs9.wpc.v0cdn.net, support.google.com, adservice.google.com, geo.settings.data.microsoft.com.akadns.net, wu.azureedge.net, iecvlist.microsoft.com, maps.googleapis.com, go.microsoft.com, cloud.google.com, cs11.wpc.v0cdn.net, sls.update.microsoft.com, wu.wpc.apr-52dd2.edgecastdns.net, www-google-analytics.l.google.com, accounts.google.com, fonts.gstatic.com, wu.ec.azureedge.net, settings-win.data.microsoft.com, ctldl.windowsupdate.com, c-0001.c-msedge.net, db5.settings.data.microsoft.com.akadns.net, static-doubleclick-net.l.google.com, sls.emea.update.microsoft.com.akadns.net, play.google.com, go.microsoft.com.edgekey.net, gstatic.com, au.c-0001.c-msedge.net, apis.google.com, asimov-win.settings.data.microsoft.com.akadns.net
  • Report size getting too big, too many NtCreateFile calls found.
  • Report size getting too big, too many NtDeviceIoControlFile calls found.

Detection

StrategyScoreRangeReportingWhitelistedDetection
Threshold00 - 100falseclean

Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold40 - 5false
ConfidenceConfidence


Classification

Analysis Advice

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis



Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and Control
Valid AccountsWindows Remote ManagementWinlogon Helper DLLPort MonitorsFile System Logical OffsetsCredential DumpingFile and Directory Discovery1Application Deployment SoftwareData from Local SystemData Encrypted1Standard Cryptographic Protocol2
Replication Through Removable MediaService ExecutionPort MonitorsAccessibility FeaturesBinary PaddingNetwork SniffingApplication Window DiscoveryRemote ServicesData from Removable MediaExfiltration Over Other Network MediumStandard Non-Application Layer Protocol2
Drive-by CompromiseWindows Management InstrumentationAccessibility FeaturesPath InterceptionRootkitInput CaptureQuery RegistryWindows Remote ManagementData from Network Shared DriveAutomated ExfiltrationStandard Application Layer Protocol2

Signature Overview

Click to jump to signature section


Networking:

barindex
Found strings which match to known social media urlsShow sources
Source: haissaoui[1].htm.6.drString found in binary or memory: <script src="https://www.youtube.com/iframe_api"></script> equals www.youtube.com (Youtube)
Source: 48l-xdS4pXg[1].htm.6.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=48l-xdS4pXg"> equals www.youtube.com (Youtube)
Source: YlmVKT3Zvhw[1].htm.6.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=YlmVKT3Zvhw"> equals www.youtube.com (Youtube)
Source: ZdEIZNg3epQ[1].htm.6.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=ZdEIZNg3epQ"> equals www.youtube.com (Youtube)
Source: ggoJFaE71W8[1].htm.6.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=ggoJFaE71W8"> equals www.youtube.com (Youtube)
Source: microsite[1].css.6.drString found in binary or memory: * Copyright 2012 Twitter, Inc equals www.twitter.com (Twitter)
Source: privacy[1].htm0.6.drString found in binary or memory: like an email address to receive updates about our services.</p><p>We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos.</p><h2>Information we collect as you use our services</h2><h3>Your apps, browsers & devices</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/e79ea0ed464fc8952d5b5582f9f9ae53.svg"/></div><p>We collect information about the apps, browsers, and <a class="g1mG8c" href="privacy?hl=en#footnote-devices" data-name="devices" jsaction="click:IPbaae(preventDefault=true)">devices</a> you use to access Google services, which helps us provide features like automatic product updates and dimming your screen if your battery runs low.</p><p>The information we collect includes <a class="g1mG8c" href="privacy?hl=en#footnote-unique-id" data-name="unique-id" jsaction=
Source: microsite[1].js.6.drString found in binary or memory: ".carousel-control, .carousel-indicators li",$.proxy(a.onControlClick,this))},hideCarousel:function(){this.$el.find(".carousel-indicators").hide();this.$el.find(".carousel-control").hide()},initVideo:function(a){a.trigger("carousel:video:beforeplay");var b=a.data("videoId"),d="iframe"+b,e=a.data("videoWidth"),f=a.data("videoHeight"),g='<iframe class="yt-video" allowfullscreen id="'+d+'" src="https://www.youtube.com/embed/'+b+'?enablejsapi=1&wmode=transparent" type="text/html" width="'+e+'" height="'+ equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: "</li><li>"+(0,_.G)("Platforms like the Chrome browser and Android operating system")+"</li><li>"+(0,_.G)("Products that are integrated into third-party apps and sites, like ads and embedded Google Maps")+"</li></ul><p>"+(0,_.G)("You can use our services in a variety of ways to manage your privacy. For example, you can sign up for a Google Account if you want to create and manage content like emails and photos, or see more relevant search results. And you can use many Google services when you\u2019re signed out or without creating an account at all, like searching on Google or watching YouTube videos. You can also choose to browse the web privately using Chrome in Incognito mode. And across our services, you can adjust your privacy settings to control what we collect and how your information is used.")+ equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: "</li><li>"+(0,_.G)('<a href="https://kids.youtube.com/privacynotice">YouTube Kids</a>')+"</li><li>"+(0,_.G)('<a href="https://families.google.com/familylink/privacy/child-policy/">Google Accounts Managed with Family Link, for Children under 13 (or applicable age in your country)</a>')+"</li></ul><h2>"+(0,_.G)("Other useful resources")+"</h2><p>"+(0,_.G)("The following links highlight useful resources for you to learn more about our practices and privacy settings.")+"</p><ul><li>",O3=_.nY(L)+" "+ equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: "</p><p>",eE='href="'+_.Q(_.S(_.kY({url:"https://support.google.com/accounts?p=privpol_endorse"},L)))+'" '+R_(),fE=(0,_.P)(eE),gE="When you\u2019re signed in and interact with some Google services, like leaving comments on a YouTube video or reviewing a song in Play, your name and photo appear next to your activity. We may also display this information in "+("<a "+_.R(fE)+">ads depending on your Shared endorsements setting</a>.");var hE=(0,_.G)(gE);var iE=dE+hE+"</p><h2>"+(0,_.G)("When Google shares your information")+ equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: "</p><ul><li>"+(0,_.G)("Signed-out search personalization:")+" ",zD='href="'+_.Q(_.S(_.kY({url:(0,_.O)("https://www.google."+_.zx(L.hc)+"/history/optout?utm_source=pp")},L)))+'" '+R_(),AD=(0,_.P)(zD),BD="<a "+_.R(AD)+">Choose</a> whether your search activity is used to offer you more relevant results and recommendations.";var CD=(0,_.G)(BD);var DD=yD+CD+"</li><li>"+(0,_.G)("YouTube settings:")+" ",Qk='href="'+_.Q(_.S(_.kY({url:(0,_.O)("https://www.youtube.com/feed/history/search_history?utm_source=pp")}, equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: ">the people who matter most to you online</a>, or which YouTube videos you might like. The information Google collects, and how that information is used, depends on how you use our services and how you manage your privacy controls.")));var Lo=(0,_.G)(Ko);var Mo=Jd+Lo+"</p><p>",Hk={style:g},No=""+Q_(_.ix({name:_.K("device")},Hk),L),Pf=(0,_.P)(No),Oo=""+Q_(_.ix({name:_.K("unique-id")},Hk),L),Po=(0,_.P)(Oo),Qo="When you\u2019re not signed in to a Google Account, we store the information we collect with "+ equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: $S=function(a){if(!a.l){var b=(null!=Yr(["requestFullscreen","webkitRequestFullscreen","mozRequestFullScreen","msRequestFullscreen"],document.body)?"Full screen is unavailable. $BEGIN_LINKLearn More$END_LINK":"Your browser doesn't support full screen. $BEGIN_LINKLearn More$END_LINK").split(/\$(BEGIN|END)_LINK/);a.l=new XS(a.o,{C:"div",W:["ytp-popup","ytp-generic-popup"],L:{role:"alert",tabindex:"0"},J:[b[0],{C:"a",L:{href:"https://support.google.com/youtube/answer/6276924",target:g.X(a.o).u},U:b[2]}, equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: (" <a "+_.R(zq)+">"+_.H(_.hZ())+"</a></p>");var Aq=(0,_.G)(li);e=xq+Aq}break;case "specific-partners":switch(d){case 1:var Bq=e;var Cq=(0,_.G)("specific partners");e=Bq+Cq;break;case 2:var Dq=e;var mi="<p>For example, we allow YouTube creators and advertisers to work with measurement companies to learn about the audience of their YouTube videos or ads, using cookies or similar technologies. Another example is merchants on our shopping pages, who use cookies to understand how many different people see their product listings. "; equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: ("<a "+_.R(Yq)+">algorithms</a> to recognize patterns in data. For example, Google Translate helps people communicate across languages by detecting common language patterns in phrases you ask it to translate.")));var ni=(0,_.G)(Zq);var $q=Uq+ni+"</p><p>",Ok={style:g},ar=""+Q_(_.ix({name:_.K("combine-info")},Ok),L),br=(0,_.P)(ar),dD=""+Q_(_.ix({name:_.K("other-sites")},Ok),L),eD=(0,_.P)(dD),fD="We may "+("<a "+_.R(br)+">"+("combine the information we collect</a> among our services and across your devices for the purposes described above. For example, if you watch videos of guitar players on YouTube, you might see an ad for guitar lessons on a site that uses our ad products. Depending on your account settings, "+ equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: ("<a "+_.R(gi)+">"+("phone number</a> or "+("<a "+_.R(ap)+">payment information</a> to your account. Even if you aren\u2019t signed in to a Google Account, you might choose to provide us with information \u2014 like an email address to receive updates about our services.")))));var cp=(0,_.G)(bp);var dp=Xo+cp+"</p><p>"+(0,_.G)("We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos.")+ equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: ("<a "+_.R(t3)+">affiliates</a>, including YouTube, Android, and services offered on third-party sites, such as advertising services. This Privacy Policy doesn\u2019t apply to services that have separate privacy policies that do not incorporate this Privacy Policy.");var v3=(0,_.G)(u3);var w3=r3+v3+"</p><p>"+(0,_.G)("This Privacy Policy doesn\u2019t apply to:")+"</p><ul><li>"+(0,_.G)("The information practices of other companies and organizations that advertise our services")+"</li><li>"+(0,_.G)("Services offered by other companies or individuals, including products or sites that may include Google services, be displayed to you in search results, or be linked from our services")+ equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: (g.cn(b,"www.youtube.com"),c=b.toString()):c=rv(c);b=new g.wv(c);b.set("cmo=pf","1");d&&b.set("cmo=td","a1.googlevideo.com");return b}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.6.drString found in binary or memory: ;function Bi(a){if("1"!==Wa(ke(),"args","privembed")){a&&le();try{Ai().then(function(b){R("pass_biscotti_id_in_header_ajax_tv")||R("pass_biscotti_id_in_header_ajax")||(b=re(b),b.bsq=Ci++,Qe("//www.youtube.com/ad_data_204",{va:!1,C:b,withCredentials:!0}))},function(){}),S(Bi,18E5)}catch(b){Q(b)}}} equals www.youtube.com (Youtube)
Source: 6AM40329.htm.6.drString found in binary or memory: </script><div class="gb_wa"><div class="gb_A gb_z gb_O" aria-label="Google-Apps" aria-hidden="true" role="region"><ul class="gb_C gb_u" aria-dropeffect="move"><li class="gb_h" aria-grabbed="false"><a class="gb_c" data-pid="192" draggable="false" href="https://myaccount.google.com/?utm_source=OGB&amp;tab=wk&amp;utm_medium=app" id="gb192"><div class="gb_q"></div><div class="gb_r"></div><div class="gb_s"></div><div class="gb_t"></div><span class="gb_k" style="background-position:0 -1242px"></span><span class="gb_m">Google-Konto</span></a></li><li class="gb_h" aria-grabbed="false"><a class="gb_c" data-pid="1" draggable="false" href="https://www.google.ch/webhp?tab=ww" id="gb1"><div class="gb_q"></div><div class="gb_r"></div><div class="gb_s"></div><div class="gb_t"></div><span class="gb_k" style="background-position:0 -345px"></span><span class="gb_m">Suche</span></a></li><li class="gb_h" aria-grabbed="false"><a class="gb_c" data-pid="8" draggable="false" href="https://maps.google.ch/maps?hl=de&amp;tab=wl" id="gb8
Source: msapplication.xml0.3.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xb0275867,0x01d50bc6</date><accdate>0xb0275867,0x01d50bc6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.3.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xb0275867,0x01d50bc6</date><accdate>0xb0289b90,0x01d50bc6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.3.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xb0377763,0x01d50bc6</date><accdate>0xb0377763,0x01d50bc6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.3.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xb0377763,0x01d50bc6</date><accdate>0xb039500f,0x01d50bc6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.3.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xb03ec08f,0x01d50bc6</date><accdate>0xb03ec08f,0x01d50bc6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.3.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xb03ec08f,0x01d50bc6</date><accdate>0xb040acde,0x01d50bc6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: 48l-xdS4pXg[1].htm.6.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=48l-xdS4pXg" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
Source: YlmVKT3Zvhw[1].htm.6.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=YlmVKT3Zvhw" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
Source: ZdEIZNg3epQ[1].htm.6.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=ZdEIZNg3epQ" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
Source: ggoJFaE71W8[1].htm.6.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=ggoJFaE71W8" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: Az=function(a){var b=pz(a);!a.fa("yt_embeds_disable_new_error_lozenge_url")&&mga.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: CS=function(a){var b=g.X(a),c=b.i;if(c){var d=new tS(a);b={C:"div",W:["ytp-error","ytp-related-on-error"],L:{role:"alert"},J:[{C:"div",G:"ytp-error-content",J:[{C:"div",G:"ytp-error-icon-container",J:[PP()]},{C:"div",G:"ytp-error-content-wrap",J:[{C:"div",G:"ytp-error-content-wrap-reason",U:"{{content}}"},{C:"div",G:"ytp-error-content-wrap-subreason",U:"{{subreason}}"}]}]},{C:"div",G:"ytp-small-redirect",J:[{C:"a",G:"ytp-small-redirect-link",L:{href:Az(b),target:b.u,"aria-label":"Visit YouTube to search for more videos"}, equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: Dga=function(a,b,c,d,e){if(!(lr||jr()||fr()))return yr();var f=Cga(c),k=Tz(c);if(!k)return yr();c={};var l=(c.fairplay="https://youtube.com/api/drm/fps?ek=uninitialized",c),m;c=[];var n=[],p=[],r=g.S(a.experiments,"html5_hls_min_video_height"),u;for(u in k)if(!g.R(a.experiments,"html5_disable_drm_hfr_1080")||"383"!=u&&"373"!=u){var z=g.q(k[u]);for(m=z.next();!m.done;m=z.next()){var C=m.value;if(C.width){if(!(C.height<r)){var E=k[C.audioItag];if(E&&(c.push(C),m="fairplay"==C.g?l:null,p.push(Xz(E,[C], equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: EV=function(a,b){var c=g.X(a.l),d=2==a.l.getPresentingPlayerType(),e=!d||b.be;e=!c.H&&!!b.videoId&&e;"play"!=c.playerStyle?c="https://support.google.com/youtube/?p=report_playback":(c={contact_type:"playbackissue",html5:1,ei:b.eventId,v:b.videoId,p:"movies_playback"},b.sa&&(c.fmt=Tu(b.sa)),b.clientPlaybackNonce&&(c.cpn=b.clientPlaybackNonce),b.fe&&(c.partnerid=b.fe),c=g.dh("//support.google.com/googleplay/",c));g.cD(a.o,e&&b.allowEmbed);g.cD(a.A,e);g.cD(a.u,e&&!b.ra);a.R.nb(c,"href");g.cD(a.B,!b.ra&& equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: JD.prototype.xa=function(){if(this.g.videoData.ce){var a=this.g.videoData.ce;PD(this,"drm-"+a.flavor);PD(this,"eme-"+(a.i?"final":Dz(a)?"ms":"com.youtube.fairplay"==a.g?"ytfp":Gz(a)?"safarifp":"nonfinal"))}}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: Kz.prototype.getLanguageInfo=Kz.prototype.getLanguageInfo;Lz.prototype.getAvailableAudioTracks=function(){return this.audioTracks};g.t(Qz,g.H);Qz.prototype.D=function(){"fake.fairplay"==this.g[0]?(this.g.shift(),this.Qk&&(this.g.unshift("com.youtube.widevine.l3"),this.i["com.youtube.widevine.l3"]=this.i["com.widevine.alpha"].clone("com.youtube.widevine.l3"))):(this.B=!this.B&&"widevine"==this.i[this.g[0]].flavor)||this.g.shift();Sz(this)}; equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: L)))+'" '+R_(),ED=(0,_.P)(Qk),FD='href="'+_.Q(_.S(_.kY({url:(0,_.O)("https://www.youtube.com/feed/history?utm_source=pp")},L)))+'" '+R_(),GD=(0,_.P)(FD),HD="Pause and delete your "+("<a "+_.R(ED)+">"+("YouTube Search History</a> and your "+("<a "+_.R(GD)+">YouTube Watch History</a>.")));var ID=(0,_.G)(HD);var JD=DD+ID+"</li><li>"+(0,_.G)("Ad Settings:")+" ",KD='href="'+_.Q(_.S(_.kY({url:(0,_.O)("https://adssettings.google.com/?utm_source=pp")},L)))+'" '+R_(),LD=(0,_.P)(KD),MD="<a "+_.R(LD)+">Manage</a> your preferences about the ads shown to you on Google and on sites and apps that partner with Google to show ads."; equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: Of+=_.VZ({content:(0,_.N)(cr)}),dE=_.mX({id:_.K("infosharing")})+V_({name:"fa9e0e90d1e7ec399dad9f3257a9bb63",first:!0,style:g},L)+"<h1>"+_.H(_.qZ())+"</h1><h2>"+(0,_.G)("When you share your information")+"</h2><p>"+(0,_.G)("Many of our services let you share information with other people, and you have control over how you share. For example, you can share videos on YouTube publicly or you can decide to keep your videos private. Remember, when you share information publicly, your content may become accessible through search engines, including Google Search.")+ equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: Vt=function(a,b,c){this.g=a;this.uri=b||"http://youtube.com/streaming/metadata/segment/102015";this.o=void 0===c?null:c;this.i=Ut(this,"Sequence-Number");this.F=Ut(this,"Segment-Count");this.H=this.g["Segment-Durations-Ms"]||"";this.ingestionTime=Ut(this,"Ingestion-Walltime-Us")/1E6;this.l=(Ut(this,"First-Frame-Time-Us")+Ut(this,"First-Frame-Uncertainty-Us"))/1E6;this.D=Ut(this,"Target-Duration-Us")/1E6;this.B="T"==this.g["Overlayed-With-Slate"];this.A="T"==this.g["Stream-Finished"];this.u="T"==this.g.Streamable}; equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: W0=function(){var a=_.Bc(_.rc(_.sc("https://www.youtube.com/iframe_api"))),b={},c=b.document||document,d=_.Ac(a),e=document.createElement("SCRIPT"),f={an:e,Pg:void 0},g=new _.Hf(T0,f),h=null,k=null!=b.timeout?b.timeout:5E3;0<k&&(h=window.setTimeout(function(){S0(e,!0);g.Wb(new U0(1,"Timeout reached for loading script "+d))},k),f.Pg=h);e.onload=e.onreadystatechange=function(){e.readyState&&"loaded"!=e.readyState&&"complete"!=e.readyState||(S0(e,b.Iw||!1,h),g.Sa(null))};e.onerror=function(){S0(e,!0, equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: Yka=function(){if(!tQ){tQ=new Cp;var a=Pq("client_streamz_web_flush_count",-1);-1!==a&&(tQ.o=a);a=Pq("client_streamz_web_flush_interval_seconds",-1);-1!==a&&(tQ.flushInterval=1E3*a)}this.g=tQ;this.g.A("/client_streamz/youtube/video_ads/visibility_error",{fv:3,ev:"element_name"},{fv:3,ev:"error_reason"})}; equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: _.U_=function(a,b){var c=a.id,d=a.we,e="";switch(_.hb(c)?c.toString():c){case "useful-ads":switch(d){case 1:var f=e;var g=(0,_.G)("ads you\u2019ll find most useful");e=f+g;break;case 2:var h=e,k="",n='href="'+_.Q(_.S(_.kY({url:"https://support.google.com/accounts?p=privpol_whyad"},b)))+'"',t=(0,_.P)(n),v='href="'+_.Q(_.S(_.kY({url:"https://support.google.com/accounts?p=privpol_whyad"},b)))+'"',D=(0,_.P)(v);k+="<p>";var B="For example, if you watch videos about baking on YouTube, you may see more ads that relate to baking as you browse the web. We also may use your IP address to determine your approximate location, so that we can serve you ads for a nearby pizza delivery service if you search for \u201cpizza.\u201d Learn more "+ equals www.youtube.com (Youtube)
Source: m=NTMZac,Y9atKf,ktZhLb,oPwyWd,qehskd,wX26lb,xXmYM[1].js.6.drString found in binary or memory: _.lX=function(a,b){a=a||{};var c=a.id,d=b.Qb;a=b.As;b=_.G;c&&!a?(a='<div class="'+_.Q("M3GAob")+'"><div class="'+_.Q("O3bgpc")+'">',d=(0,_.ox)("https://www.youtube.com/embed/"+_.yx(c)+"?rel=0&showinfo=0&theme=light&version=3&hl="+_.yx(d)+"&cc_lang_pref="+_.yx(d)+"&cc_load_policy=1&enablejsapi=1"),c=_.G,d=_.dx(d,_.Ww)?d.wd():d instanceof _.yc?_.Ac(d):"about:invalid#zSoyz",c=c('<iframe src="'+_.Q(d)+'" allowfullscreen="allowfullscreen"'+(' class="'+_.Q("Ylcf5b")+'"')+"></iframe>"),a=a+c+"</div></div>"): a="";return b(a)};_.mX=function(a){return(0,_.G)('<div id="'+_.Q(a.id)+'" class="'+_.Q("ahbJ5")+'"></div>')};_.nX=function(a){a=a.content;return(0,_.G)('<div class="'+_.Q("Ih2lSe")+'">'+_.H(a)+"</div>")}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: a.byteLength/2)).replace("skd://","https://")):a=this.i.o;g.R(this.l.experiments,"enable_shadow_yttv_channels")&&(a=new g.an(a),document.location.origin&&document.location.origin.includes("green")?g.cn(a,"web-green-qa.youtube.com"):g.cn(a,"www.youtube.com"),a=a.toString());e=a=this.I=a;var k=void 0===k?!1:k;iv(Dia.test(e),e,k,"Drm Licensor URL")||DH(this,"drm.net",!0,"t.x");for(var l in this.D)k=l,e=this.D[l],a=eh(g.ih(a,k),k,e);this.V=a;this.R=g.R(b.experiments,"html5_use_drm_retry");this.O=0;this.F= equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: a.g.g().g.D("/client_streamz/youtube/video_ads/visibility_error",c,f),0<k&&Math.random()<k)){k=["id","class","style","hidden","aria-hidden"];l=[];for(var m=b;m;){for(var n={tagName:m.tagName},p={},r=g.q(k),u=r.next();!u.done;u=r.next())u=u.value,m.hasAttribute(u)&&(p[u]=m.getAttribute(u));g.Wb(p)||(n.attributes=p);l.push(n);m=m.parentElement}k=bla(l);g.O(Error("vis_check_error_reason: "+f+", dump: "+k))}}}})(); equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: break a}catch(c){}this.fa("tvhtml5_retire_old_players")&&g.jz(this.A)&&XJ(this)}}if(WJ(a)&&this.g.ua&&this.g.ua.i){if(this.o)this.o.onError(a.errorCode,nx(a.details));this.Ta("highrepfallback","1",!0);$I(this);pha(this.g);KI(this);MI(this);RJ(this);this.playVideo()}else a.g?(b=this.u?this.u.B.o:null,b=WJ(a)&&b&&b.isLocked()?"FORMAT_UNAVAILABLE":void 0,g.dJ(this,a.errorCode,b,nx(a.details))):this.o&&(this.o.onError(a.errorCode,nx(a.details)),b&&"manifest.net.connect"==a.errorCode&&(a="https://www.youtube.com/generate_204?cpn="+ equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: break;case "fr":od+="L99kA9f72A4";break;case "it":od+="fQaiDJhICa4";break;case "de":od+="P31DFowd2Lw";break;case "ko":od+="nTN9HQgnlh8";break;case "nl":od+="1LMk791j64M";break;case "ja":od+="cVX10SMzNaM";break;default:od+="ggoJFaE71W8"}var yo=ci+=X_({id:_.K(od),style:g},L),zo="<p>"+(0,_.G)("We build a range of services that help millions of people daily to explore and interact with the world in new ways. Our services include:")+"</p><ul><li>"+(0,_.G)("Google apps, sites, and devices, like Search, YouTube, and Google Home")+ equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: c.nb(GS(c,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK","//www.youtube.com/html5"));else if(b=g.X(c.l).Ze,d="//support.google.com/youtube/?p=player_error1",b&&(d=g.dh(d,{hl:b})),c.nb(GS(c,"GENERIC_WITH_LINK_AND_CPN",d,!0)),a.X&&!a.i)for(a=(0,g.y)(c.F,c),b=c.element.getElementsByTagName("a"),d=0;d<b.length;d++)e=c.K(b[d],"click",a),c.B.push(e);this.o.show()}else this.o&&(this.o.dispose(),this.o=null)}; equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: d like saved in your account. For example, you can turn on Location History if you want traffic predictions for your daily commute, or you can save your YouTube Watch History to get better video suggestions.</p><p class="n8ZyWe"><a href="https://myaccount.google.com/activitycontrols?utm_source=pp&amp;hl=en" class="ky8S2" data-track-as="pgc-pp-activitycontrols">Go to Activity Controls</a></p></div></div><div class="h0yEnd"><div class="IN2z4b"><img class="mZPFM uTLSAb" alt="" src="https://www.gstatic.com/policies/privacy/900a793eae04f4bddd675f8d95c4a794.svg"/></div><div class="gwGFXb"><h3 class="SWFQ9e">Ad settings</h3><p class="n8ZyWe">Manage your preferences about the ads shown to you on Google and on sites and apps that <a class="g1mG8c" href="privacy?hl=en#footnote-partner" data-name="partner" jsaction="click:IPbaae(preventDefault=true)">partner with Google</a> to show ads. You can modify your interests, choose whether your personal information is used to make ads more relevant to you, and turn on or off cer
Source: ITZBXCXZ.js.6.drString found in binary or memory: e=Xo+fi}break;case "deliver-services":switch(d){case 1:var Yo=e;var Hg=(0,_.G)("deliver our services");e=Yo+Hg;break;case 2:var Zo=e,gi="",$o='href="'+_.Q(_.S(_.kY({url:"https://support.google.com/photos?p=privpol_manage"},b)))+'"',ap=(0,_.P)($o);gi=gi+"<p>Examples of how we use your information to deliver our services include:</p><ul><li>We use the IP address assigned to your device to send you the data you requested, such as loading a YouTube video</li><li>We use unique identifiers stored in cookies on your device to help us authenticate you as the person who should have access to your Google Account</li><li>Photos and videos you upload to Google Photos are used to help you create albums, animations, and other creations that you can share."+ equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.Fd("ytp-svg-volume-animation-hider",this.o.element));this.u=null;this.V=new eT;g.I(this,this.V);this.M=new eT;g.I(this,this.M);this.da("click",this.ca);this.K(a,"appresize",this.hc);this.K(a,"onVolumeChange",this.ia);var d=null;c.M?g.of(this,OS(b.fb(),this.element)):(d="Your browser doesn't support changing the volume. $BEGIN_LINKLearn More$END_LINK".split(/\$(BEGIN|END)_LINK/),d=new XS(a,{C:"span",W:["ytp-popup","ytp-generic-popup"],L:{tabindex:"0"},J:[d[0],{C:"a",L:{href:"https://support.google.com/youtube/?p=noaudio", equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.JB=function(a){return sB(a)&&a.rf?(a={},a.fairplay="https://youtube.com/api/drm/fps?ek=uninitialized",a):a.sa&&a.sa.xc||null}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.h.Hn=function(a){var b=this.g.sb,c=this.g.videoData,d={ns:b.V,el:$B(c),eurl:b.xa,fmt:c.sa?Tu(c.sa):0,html5:1,list:c.playlistId,cpn:c.clientPlaybackNonce,ei:c.eventId,ps:b.playerStyle,noflv:1,st:this.g.g(),video_id:c.videoId,metric:a};cC(c)&&(d.autoplay="1");"heartbeat"==a&&(d.tpmt=yD(this.l));g.Ra(d,b.deviceParams);$D(this,g.dh(g.R(b.experiments,"cardio_base_url_killswitch")?(b.g?b.protocol+"://www.youtube.com/":b.A)+"live_204":b.A+"live_204",d))}; equals www.youtube.com (Youtube)
Source: remote[1].js.6.drString found in binary or memory: g.h.T=function(){this.gs("");V7.Ha.T.call(this)};g.A(X7,V7);g.h=X7.prototype;g.h.es=function(a){if(this.g){if(this.g==a)return;W7(this,"Overriding cast sesison with new session object");this.g.removeUpdateListener(this.A);this.g.removeMessageListener("urn:x-cast:com.google.youtube.mdx",this.u)}this.g=a;this.g.addUpdateListener(this.A);this.g.addMessageListener("urn:x-cast:com.google.youtube.mdx",this.u);Gqa(this)}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.h.clone=function(){var a=new g.gn;a.i=this.i;this.g&&(a.g=this.g.clone(),a.Ca=this.Ca);return a};var Fn={wB:5E3,xB:15E3,Bt:"://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/sul www.google.com/pagead/xsul www.youtube.com/pagead/sul www.youtube.com/pagead/psul www.youtube.com/pagead/slav".split(" "),GB:/\bocr\b/,Zo:0,Kf:{},UL:function(a,b,c){a&&(Fn.wq(a)?Fn.Rz(a,b):Fn.Ek(a,b,c))}, equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.h.createSession=function(a){var b=a.initData;if(this.g.i){var c=this.u.createSession();"com.youtube.fairplay"==this.g.g&&(b=BH(this,b));b=c.generateRequest(a.contentType,b);c=new yH(null,null,null,c,null);b.then(null,Up((0,g.y)(c.hy,c,"t.generateRequest")));return c}if(Dz(this.g)){c=new Uint8Array(270);for(a=0;135>a;a++)c[2*a]='<PlayReadyCDMData type="LicenseAcquisition"><LicenseAcquisition version="1.0" Proactive="true"></LicenseAcquisition></PlayReadyCDMData>'.charCodeAt(a);b=this.l.createSession("video/mp4", equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.h.eD=function(a){if(this.ea())return this;this.P=a.status;a=a.responseText;a=(new DOMParser).parseFromString(a,"text/xml").getElementsByTagName("MPD")[0];this.B=1E3*ww(uw(a,"minimumUpdatePeriod"))||Infinity;if(!this.M){var b;a:{if(a.attributes)for(b=0;b<a.attributes.length;b++)if("http://youtube.com/yt/2012/10/10"==a.attributes[b].value){b=a.attributes[b].name.split(":")[1];break a}b=""}this.R=b}this.isLive=Infinity>this.B&&this.ca;this.O=parseInt(uw(a,Uw(this,"earliestMediaSequence")),10)||0;if(b= equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.h.getAvailablePlaybackRates=function(){var a=this.app.g;a.na?(a=a.Vb[0],a="https://admin.youtube.com"==a||"https://viacon.corp.google.com"==a?qna:vZ):a=[1];return a}; equals www.youtube.com (Youtube)
Source: remote[1].js.6.drString found in binary or memory: g.h.gs=g.Ga;g.h.T=function(){this.info("disposeInternal");g.bq(this.o);this.o=0;this.g&&(this.g.removeUpdateListener(this.A),this.g.removeMessageListener("urn:x-cast:com.google.youtube.mdx",this.u));this.g=null;X7.Ha.T.call(this)}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.h.hm=function(a){if(1==a.info.type)this.g||(a.l&&"http://youtube.com/streaming/otf/durations/112015"==a.l.uri&&Ffa(this,a.l),this.g=Zu(a));else if(2==a.info.type)if(g.$u(this.info)){if(!this.index.Eb()&&(a=g.au(Yu(a),0,1936286840))){var b=[],c=iu(a);a=c.Or.length;var d=c.Ds,e=c.Or,f=c.Nk;c=this.indexRange.end+c.kv+1;for(var k=0,l=0;l<a;l++){var m=f[l]/d,n=e[l];b.push(new Gt(l,k,m,NaN,"range/"+c+"-"+(c+n-1)));k+=m;c+=n}this.index.append(b)}}else if(2==this.info.containerType&&this.g&&(d=new nu(new DataView(this.g.buffer)), equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.h.iE=function(a){a=a||BB(this);if(this.ga&&!a){if(qB(this)&&(a=this.ga,!a.g["0"])){var b=new aw("0","fakesb",void 0,new Wv(0,0,0,void 0,void 0,"auto"),null,null,1);a.g["0"]=this.ra?new jw(new g.wv("http://www.youtube.com/videoplayback"),b,"fake"):new g.Dw(new g.wv("http://www.youtube.com/videoplayback"),b,new g.Iu(0,0),new g.Iu(0,0),0,NaN)}return Pz(rB(this),this.Oa.B,this.ga,this.ce).then(this.Ln,void 0,this)}return yr()}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.h.oe=function(a,b){b=void 0===b?!1:b;if("missing-qualities"==a)return{C:"a",L:{href:"https://support.google.com/youtube/?p=missing_quality",target:g.X(this.l).u},U:"Missing options?"};if("inline-survey"==a)return"";var c=[kU(this,a)],d=this.l.getPreferredQuality();b||"auto"!=d||"auto"!=a||(c.push(" "),c.push(kU(this,this.A,["ytp-menu-label-secondary"])));return{C:"div",J:c}};g.t(lU,g.W);lU.prototype.hc=function(a){g.cD(this,this.A&&400<=a.width)}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: g.h.removeChild=function(a,b){if(a){var c=g.v(a)?a:a.getId();a=this.A&&c?Zb(this.A,c)||null:null;if(c&&a){Yb(this.A,c);g.cb(this.D,a);b&&(a.mj(),a.i&&g.Wd(a.i));c=a;if(null==c)throw Error("Unable to set parent component");c.F=null;g.Do.Ha.ks.call(c,null)}}if(!a)throw Error("Child is not in parent component");return a};uc(g.pc("https://imasdk.googleapis.com/flash/sdkloader/flashinhtml.swf"));uc(g.pc("http://imasdk.googleapis.com/flash/sdkloader/flashinhtml.swf"));Go("d");Ho("d");Io("d");Go("f");Ho("f");Io("f");Go("i");Ho("i");Io("i");Go("j");Ho("j");Io("j");Io("j");Go("u");Ho("u");Io("u");Go("v");Ho("v");Io("v");Io("v");Go("b");Ho("b");Io("b");Go("e");Ho("e");Io("e");Go("s");Ho("s");Io("s");Go("B");Ho("B");Io("B");Go("x");Ho("x");Io("x");Go("y");Ho("y");Io("y");Io("y");Go("g");Ho("g");Io("g");Go("h");Ho("h");Io("h");Io("h");Go("n");Ho("n");Io("n");Go("o");Ho("o");Io("o");Io("o");uc(g.pc("https://imasdk.googleapis.com/flash/sdkloader/flashinhtml.swf"));uc(g.pc("http://imasdk.googleapis.com/flash/sdkloader/flashi
Source: remote[1].js.6.drString found in binary or memory: g.h.vL=function(a,b){if(!this.ea())if(b){var c=S5(b);if(g.Na(c)){var d=""+c.type;c=c.data||{};this.info("onYoutubeMessage_: "+d+" "+g.Mg(c));switch(d){case "mdxSessionStatus":Fqa(this,c.screenId);break;default:W7(this,"Unknown youtube message: "+d)}}else W7(this,"Unable to parse message.")}else W7(this,"No data in message.")}; equals www.youtube.com (Youtube)
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://www.youtube.com/embed/ggoJFaE71W8?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: iframe_api[2].js.6.drString found in binary or memory: if (!window['YT']) {var YT = {loading: 0,loaded: 0};}if (!window['YTConfig']) {var YTConfig = {'host': 'http://www.youtube.com'};}if (!YT.loading) {YT.loading = 1;(function(){var l = [];YT.ready = function(f) {if (YT.loaded) {f();} else {l.push(f);}};window.onYTReady = function() {YT.loaded = 1;for (var i = 0; i < l.length; i++) {try {l[i]();} catch (e) {}}};YT.setConfig = function(c) {for (var k in c) {if (c.hasOwnProperty(k)) {YTConfig[k] = c[k];}}};var a = document.createElement('script');a.type = 'text/javascript';a.id = 'www-widgetapi-script';a.src = 'https://s.ytimg.com/yts/jsbin/www-widgetapi-vflTZdOF2/www-widgetapi.js';a.async = true;var c = document.currentScript;if (c) {var n = c.nonce || c.getAttribute('nonce');if (n) {a.setAttribute('nonce', n);}}var b = document.getElementsByTagName('script')[0];b.parentNode.insertBefore(a, b);})();} equals www.youtube.com (Youtube)
Source: www-widgetapi[1].js.6.drString found in binary or memory: k.C=function(a){a.id=this.h;a.channel="widget";a=La(a);var b=this.b;var c=Pa(this.a.src);b=0==c.indexOf("https:")?[c]:b.a?[c.replace("http:","https:")]:b.f?[c]:[c,c.replace("http:","https:")];if(!this.a.contentWindow)throw Error("The YouTube player is not attached to the DOM.");for(c=0;c<b.length;c++)try{this.a.contentWindow.postMessage(a,b[c])}catch(d){if(d.name&&"SyntaxError"==d.name)Va(d,"WARNING");else throw d;}};function rb(a){return(0==a.search("cue")||0==a.search("load"))&&"loadModule"!=a} equals www.youtube.com (Youtube)
Source: www-widgetapi[1].js.6.drString found in binary or memory: kb.prototype.g=function(a){if(a.origin==W(this,"host")||a.origin==W(this,"host").replace(/^http:/,"https:")){try{var b=JSON.parse(a.data)}catch(c){return}this.f=!0;this.a||0!=a.origin.indexOf("https:")||(this.a=!0);if(a=V[b.id])a.B=!0,a.B&&(z(a.u,a.C,a),a.u.length=0),a.I(b)}};function X(a,b,c){this.i=this.a=this.b=null;this.h=this[v]||(this[v]=++ba);this.f=0;this.B=!1;this.u=[];this.g=null;this.m=c;this.o={};c=document;if(a=m(a)?c.getElementById(a):a)if(c="iframe"==a.tagName.toLowerCase(),b.host||(b.host=c?Pa(a.src):"https://www.youtube.com"),this.b=new kb(b),c||(b=mb(this,a),this.i=a,(c=a.parentNode)&&c.replaceChild(b,a),a=b),this.a=a,this.a.id||(a=b=this.a,a=a[v]||(a[v]=++ba),b.id="widget"+a),T[this.a.id]=this,window.postMessage){this.g=new P;nb(this);b=W(this.b,"events"); equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: ll find most useful</a>, <a class="g1mG8c" href="privacy?hl=en#footnote-people-online" data-name="people-online" jsaction="click:IPbaae(preventDefault=true)">the people who matter most to you online</a>, or which YouTube videos you might like. The information Google collects, and how that information is used, depends on how you use our services and how you manage your privacy controls.</p><p>When you equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: ll find most useful</h3><p>For example, if you watch videos about baking on YouTube, you may see more ads that relate to baking as you browse the web. We also may use your IP address to determine your approximate location, so that we can serve you ads for a nearby pizza delivery service if you search for equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: ll keep a record of your request in order to help solve any issues you might be facing.</p><h3>Protect Google, our users, and the public</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/02f8664b95445de6f27ba682f3c5f9ab.svg"/></div><p>We use information to help improve the <a class="g1mG8c" href="privacy?hl=en#footnote-safety-reliability" data-name="safety-reliability" jsaction="click:IPbaae(preventDefault=true)">safety and reliability</a> of our services. This includes detecting, preventing, and responding to fraud, abuse, security risks, and technical issues that could harm Google, our users, or the public.</p><hr/><p>We use different technologies to process your information for these purposes. We use automated systems that analyze your content to provide you with things like customized search results, personalized ads, or other features tailored to how you use our services. And we analyze your content to help us <a class="g1mG8c" href="privacy?hl=en#footnote-de
Source: privacy[1].htm0.6.drString found in binary or memory: ll provide a more prominent notice (including, for certain services, email notification of Privacy Policy changes).</p></div></div><div class="m9JGT xXnO1d"><div class="nrAB0c"><div id="products" class="ahbJ5"></div><h1>Related privacy practices</h1><h2>Specific Google services</h2><p>The following privacy notices provide additional information about some Google services:</p><ul><li><a href="https://www.google.com/chrome/intl/en/privacy.html">Chrome & the Chrome Operating System</a></li><li><a href="https://play.google.com/books/intl/en/privacy.html">Play Books</a></li><li><a href="https://payments.google.com/legaldocument?family=0.privacynotice&hl=en">Payments</a></li><li><a href="https://fiber.google.com/legal/privacy.html">Fiber</a></li><li><a href="https://fi.google.com/about/tos/#project-fi-privacy-notice">Google Fi</a></li><li><a href="https://www.google.com/work/apps/terms/education_privacy.html">G Suite for Education</a></li><li><a href="https://kids.youtube.com/privacynotice">YouTube Kids</a></li><li>
Source: base[1].js.6.drString found in binary or memory: mv=function(a){var b=void 0===b?!1:b;return iv(lfa.test(a),a,b,"Google/YouTube Brand Lift URL")}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: mz.prototype.getVideoUrl=function(a,b,c,d,e){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=pz(this);d&&"www.youtube.com"==c?d="https://youtu.be/"+a:g.kz(this)?(d="https://"+c+"/fire",b.v=a):(d=this.protocol+"://"+c+"/watch",b.v=a,lr&&(a=yq())&&(b.ebc=a));return g.dh(d,b)}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: null;p=null;if(n=vw(b,"ContentProtection"))if(g.er())if((p=n.attributes.schemeIdUri)&&"http://youtube.com/drm/2012/10/10"==p.value)for(p={},n=n.firstChild;null!=n;n=n.nextSibling)"yt:SystemURL"==n.nodeName&&(p[n.attributes.type.value]=n.textContent.trim());else p=null;else if((p=n.attributes.schemeIdUri)&&"http://youtube.com/drm/2012/10/10"==p.textContent)for(p={},n=n.firstChild;null!=n;n=n.nextSibling)"SystemURL"==n.localName&&"http://youtube.com/yt/2012/10/10"==n.namespaceURI&&(p[n.attributes.type.textContent]= equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: oz=function(a){a=gz(a.A);return"www.youtube-nocookie.com"==a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: pz=function(a){return"gaming"==a.playerStyle?"gaming.youtube.com":oz(a)}; equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: re responding to <a class="g1mG8c" href="privacy?hl=en#footnote-legal" data-name="legal" jsaction="click:IPbaae(preventDefault=true)">legal process or an enforceable governmental request</a>.</p><hr/><p>If you have questions, <a href="https://support.google.com/policies/troubleshooter/7575787?hl=en" class="XddVQ" target="_blank">you can contact Google and our data protection office</a>. And you can contact your local data protection authority if you have concerns regarding your rights under local law.</p></div></div><div class=" xXnO1d"><div class="nrAB0c"><div id="about" class="ahbJ5"></div><h1>About this policy</h1><h2>When this policy applies</h2><p>This Privacy Policy applies to all of the services offered by Google LLC and its <a class="g1mG8c" href="privacy?hl=en#footnote-affiliates" data-name="affiliates" jsaction="click:IPbaae(preventDefault=true)">affiliates</a>, including YouTube, Android, and services offered on third-party sites, such as advertising services. This Privacy Policy doesn equals www.yo
Source: privacy[1].htm0.6.drString found in binary or memory: re signed in and interact with some Google services, like leaving comments on a YouTube video or reviewing a song in Play, your name and photo appear next to your activity. We may also display this information in <a href="https://support.google.com/accounts?p=privpol_endorse&amp;hl=en" class="XddVQ" target="_blank">ads depending on your Shared endorsements setting</a>.</p><h2>When Google shares your information</h2><p>We do not share your personal information with companies, organizations, or individuals outside of Google except in the following cases:</p><h3>With your consent</h3><p>We equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: re signed in to a Google Account, including:</p><ul><li>Browser settings: For example, you can configure your browser to indicate when Google has set a <a class="g1mG8c" href="privacy?hl=en#footnote-cookies-and-similar-technologies" data-name="cookies-and-similar-technologies" jsaction="click:IPbaae(preventDefault=true)">cookie</a> in your browser. You can also configure your browser to block all cookies from a specific domain or all domains. But remember that our services <a class="g1mG8c" href="privacy?hl=en#footnote-rely-on-cookies" data-name="rely-on-cookies" jsaction="click:IPbaae(preventDefault=true)">rely on cookies to function properly</a>, for things like remembering your language preferences.</li><li>Device-level settings: Your device may have controls that determine what information we collect. For example, you can <a href="https://support.google.com/websearch?p=privpol_locserp&amp;hl=en" class="XddVQ" target="_blank">modify location settings</a> on your Android device.</li></ul></div></div><div cla
Source: privacy[1].htm0.6.drString found in binary or memory: re signed out or without creating an account at all, like searching on Google or watching YouTube videos. You can also choose to browse the web privately using Chrome in Incognito mode. And across our services, you can adjust your privacy settings to control what we collect and how your information is used.</p><p>To help explain things as clearly as possible, we equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: re signed out, you can manage information associated with your browser or device, including:</p><ul><li>Signed-out search personalization: <a href="https://www.google.com/history/optout?utm_source=pp&amp;hl=en" class="XddVQ" target="_blank">Choose</a> whether your search activity is used to offer you more relevant results and recommendations.</li><li>YouTube settings: Pause and delete your <a href="https://www.youtube.com/feed/history/search_history?utm_source=pp&amp;hl=en" class="XddVQ" target="_blank">YouTube Search History</a> and your <a href="https://www.youtube.com/feed/history?utm_source=pp&amp;hl=en" class="XddVQ" target="_blank">YouTube Watch History</a>.</li><li>Ad Settings: <a href="https://adssettings.google.com/?utm_source=pp&amp;hl=en" class="XddVQ" target="_blank">Manage</a> your preferences about the ads shown to you on Google and on sites and apps that partner with Google to show ads.</li></ul><h2>Exporting, removing & deleting your information</h2><p>You can export a copy of content in your G
Source: privacy[1].htm0.6.drString found in binary or memory: re using an <a class="g1mG8c" href="privacy?hl=en#footnote-android-device" data-name="android-device" jsaction="click:IPbaae(preventDefault=true)">Android device with Google apps</a>, your device periodically contacts Google servers to provide information about your device and connection to our services. This information includes things like your device type, carrier name, crash reports, and which apps you've installed.</p><h3>Your activity</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/39b031d352a2e1586cf50ac7f2bbc18b.svg"/></div><p>We collect information about your activity in our services, which we use to do things like recommend a YouTube video you might like. The activity information we collect may include:</p><ul><li>Terms you search for</li><li>Videos you watch</li><li><a class="g1mG8c" href="privacy?hl=en#footnote-content-views" data-name="content-views" jsaction="click:IPbaae(preventDefault=true)">Views and interactions with content and ads</a></li><li
Source: privacy[1].htm0.6.drString found in binary or memory: s Search engine may index that article and display it to other people if they search for your name. We may also collect information about you from trusted partners, including marketing partners who provide us with information about potential customers of our business services, and security partners who provide us with information to <a class="g1mG8c" href="privacy?hl=en#footnote-against-abuse" data-name="against-abuse" jsaction="click:IPbaae(preventDefault=true)">protect against abuse</a>. We also receive information from advertisers to provide <a class="g1mG8c" href="privacy?hl=en#footnote-ad-services" data-name="ad-services" jsaction="click:IPbaae(preventDefault=true)">advertising and research services on their behalf</a>.</p><p>We use various technologies to collect and store information, including <a class="g1mG8c" href="privacy?hl=en#footnote-cookies-and-similar-technologies" data-name="cookies-and-similar-technologies" jsaction="click:IPbaae(preventDefault=true)">cookies</a>, <a class="g1mG8c" href="priv
Source: ITZBXCXZ.js.6.drString found in binary or memory: style:g},L)+"<p>",yq=""+Q_(_.ix({name:_.K("customized-search")},{style:g}),L),zq=(0,_.P)(yq),Aq='href="'+_.Q(_.S(_.kY({url:(0,_.O)("https://myaccount.google.com/security-checkup?utm_source=pp")},L)))+'" '+R_(),Bq=(0,_.P)(Aq),Cq="We use the information we collect to customize our services for you, including providing recommendations, personalized content, and "+("<a "+_.R(zq)+">"+("customized search results</a>. For example, "+("<a "+_.R(Bq)+">Security Checkup</a> provides security tips adapted to how you use Google products. And Google Play uses information like apps you\u2019ve already installed and videos you\u2019ve watched on YouTube to suggest new apps you might like."))); equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: t covered in this Privacy Policy.</p></div></div><div class=" xXnO1d"><div class="nrAB0c"><div id="infochoices" class="ahbJ5"></div><div class="pTrV6d"><div class="M3GAob"><div class="O3bgpc"><iframe src="https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=en&amp;cc_lang_pref=en&amp;cc_load_policy=1&amp;enablejsapi=1" allowfullscreen="allowfullscreen" class="Ylcf5b"></iframe></div></div></div><h1>Your privacy controls</h1><p class="vxK8q">You have choices regarding the information we collect and how it's used</p><p>This section describes key controls for managing your privacy across our services. You can also visit the <a href="https://myaccount.google.com/privacycheckup?utm_source=pp&amp;hl=en" class="XddVQ" target="_blank">Privacy Checkup</a>, which provides an opportunity to review and adjust important privacy settings. In addition to these tools, we also offer specific privacy settings in our products equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: t follow the correct process. Learn more in our <a href="https://transparencyreport.google.com/user-data/overview?hl=en">Transparency Report</a>.</p><div id="footnote-trends" class="ahbJ5"></div><h3>show trends</h3><p>When lots of people start searching for something, it can provide useful information about particular trends at that time. Google Trends samples Google web searches to estimate the popularity of searches over a certain period of time and shares those results publicly in aggregated terms. <a href="https://support.google.com/trends?p=privpol_about&amp;hl=en">Learn more</a></p><div id="footnote-specific-partners" class="ahbJ5"></div><h3>specific partners</h3><p>For example, we allow YouTube creators and advertisers to work with measurement companies to learn about the audience of their YouTube videos or ads, using cookies or similar technologies. Another example is merchants on our shopping pages, who use cookies to understand how many different people see their product listings. <a href="privacy/go
Source: privacy[1].htm0.6.drString found in binary or memory: t reveal information about individual people.</p><div id="footnote-deliver-services" class="ahbJ5"></div><h3>deliver our services</h3><p>Examples of how we use your information to deliver our services include:</p><ul><li>We use the IP address assigned to your device to send you the data you requested, such as loading a YouTube video</li><li>We use unique identifiers stored in cookies on your device to help us authenticate you as the person who should have access to your Google Account</li><li>Photos and videos you upload to Google Photos are used to help you create albums, animations, and other creations that you can share. <a href="https://support.google.com/photos?p=privpol_manage&amp;hl=en">Learn more</a></li><li>A flight confirmation email you receive may be used to create a equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: this.ql?(c=c.vss_host||"s.youtube.com",this.fa("www_for_videostats")&&"s.youtube.com"==c&&(c=gz(this.A)||"www.youtube.com")):c="video.google.com";this.Wi=c;this.Nf(a);this.I=new fy;g.I(this,this.I);this.D=this.g&&!this.fa("enable_svg_mode_on_embed_mobile");this.Tb={bq:Fy("",a.innertube_api_key),cq:Fy("",a.innertube_api_version),eq:this.deviceParams.c,fq:Fy("",a.innertube_context_client_version),hq:this.Ze,gq:this.region,lm:""};this.gf=void 0!=window.WebKitPlaybackTargetAvailabilityEvent;this.B=new Gx(this.experiments, equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: this.wa=T(!1,a.privembed);this.protocol=0==this.kb.indexOf("http:")?"http":"https";this.A=jv(a.BASE_YT_URL||"")||jv(this.kb)||this.protocol+"://www.youtube.com/";c=a.el;b="detailpage";"adunit"==c?b=this.i?"embedded":"detailpage":"embedded"==c||this.ub?b=Dy(b,c,jga):c&&(b="embedded");this.R=b;ts();c=null;b=a.ps;var d=g.$a(Ly,b);!b||d&&!this.ub||(c=b);this.playerStyle=c;this.H=(this.Ob=g.$a(Ly,this.playerStyle))&&"play"!=this.playerStyle&&"jamboard"!=this.playerStyle;this.ql=!this.H;c={};this.deviceParams= equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: uga=function(a,b,c){for(var d in b)for(var e=g.q(b[d]),f=e.next();!f.done;f=e.next()){f=f.value;if(!f.xc)return;for(var k in f.xc){if(!Rz[k])return;for(var l=g.q(Rz[k]),m=l.next();!m.done;m=l.next())m=m.value,a.i[m]=a.i[m]||new Bz(k,m,f.xc[k],a.u),a.o[k]=a.o[k]||{},a.o[k][f.mimeType]=!0}}fr()?(a.g=["com.youtube.fairplay"],a.i["com.youtube.fairplay"]=new Bz("fairplay","com.youtube.fairplay","",a.u),a.o.fairplay={"audio/mp4":!0,"video/mp4":!0},a.Qk&&(a.g.unshift("fake.fairplay"),a.i["fake.fairplay"]= equals www.youtube.com (Youtube)
Source: remote[1].js.6.drString found in binary or memory: var b={type:"getMdxSessionStatus"};a.g?a.g.sendMessage("urn:x-cast:com.google.youtube.mdx",b,g.Ga,(0,g.y)(function(){W7(this,"Failed to send message: getMdxSessionStatus.")},a)):W7(a,"Sending yt message without session: "+g.Mg(b))},Fqa=function(a,b){g.bq(a.o); equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: var lZ={},Rz=(lZ.playready=["com.youtube.playready","com.microsoft.playready"],lZ.widevine=["com.widevine.alpha"],lZ);g.h=g.Iz.prototype;g.h.getId=function(){return this.Ea}; equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: var qp=(0,_.G)(pp);var rp=mp+qp+"</p><h3>"+(0,_.G)("Your activity")+"</h3>"+V_({name:"39b031d352a2e1586cf50ac7f2bbc18b",style:g},L)+"<p>"+(0,_.G)("We collect information about your activity in our services, which we use to do things like recommend a YouTube video you might like. The activity information we collect may include:")+"</p><ul><li>"+(0,_.G)("Terms you search for")+"</li><li>"+(0,_.G)("Videos you watch")+"</li><li>",Jk="",hi=""+Q_(_.ix({name:_.K("content-views")},{style:g}),L),sp=(0,_.P)(hi); equals www.youtube.com (Youtube)
Source: ITZBXCXZ.js.6.drString found in binary or memory: var sD=(0,_.G)(rD);var tD=oD+sD+"</p><h3>"+(0,_.G)("Privacy controls")+"</h3>"+Y_({title:(0,_.N)(""+(0,_.G)("Activity Controls")),body:(0,_.N)(""+(0,_.G)("Decide what types of activity you\u2019d like saved in your account. For example, you can turn on Location History if you want traffic predictions for your daily commute, or you can save your YouTube Watch History to get better video suggestions.")),url:(0,_.O)("https://myaccount.google.com/activitycontrols?utm_source=pp"),label:(0,_.N)(""+(0,_.G)("Go to Activity Controls")), equals www.youtube.com (Youtube)
Source: base[1].js.6.drString found in binary or memory: var wn=new vn;xn.prototype.getId=function(){return this.Ea};yn.prototype.getId=function(){return this.Ea};var An=null;var Fda=["*.youtu.be","*.youtube.com"],Jda="ad.doubleclick.net bid.g.doubleclick.net corp.google.com ggpht.com google.co.uk google.com googleads.g.doubleclick.net googleads4.g.doubleclick.net googleadservices.com googlesyndication.com googleusercontent.com gstatic.com gvt1.com prod.google.com pubads.g.doubleclick.net s0.2mdn.net static.doubleclick.net static.doubleclick.net surveys.g.doubleclick.net youtube.com ytimg.com".split(" "),Ida=["c.googlesyndication.com"];var Kda=function(){if(g.Jx)return Hn(/Firefox\/([0-9.]+)/);if(g.Ld||g.Vx||g.Dh)return ld;if(g.fx)return hd()?Hn(/CriOS\/([0-9.]+)/):Hn(/Chrome\/([0-9.]+)/);if(g.wz&&!hd())return Hn(/Version\/([0-9.]+)/);if(dz||UB){var a=/Version\/(\S+).*Mobile\/(\S+)/.exec(g.Hb);if(a)return a[1]+"."+a[2]}else if(g.Oy)return(a=Hn(/Android\s+([0-9.]+)/))?a:Hn(/Version\/([0-9.]+)/);return""}();var WY; equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: ve added examples, explanatory videos, and definitions for <a href="privacy/key-terms?hl=en#key-terms">key terms</a>. And if you have any questions about this Privacy Policy, you can <a href="https://support.google.com/policies?p=privpol_privts&amp;hl=en" class="XddVQ" target="_blank">contact us</a>.</p></div></div><div class=" xXnO1d"><div class="nrAB0c"><div id="infocollect" class="ahbJ5"></div><div class="pTrV6d"><div class="M3GAob"><div class="O3bgpc"><iframe src="https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=en&amp;cc_lang_pref=en&amp;cc_load_policy=1&amp;enablejsapi=1" allowfullscreen="allowfullscreen" class="Ylcf5b"></iframe></div></div></div><h1>Information Google collects</h1><p class="vxK8q">We want you to understand the types of information we collect as you use our services</p><p>We collect information to provide better services to all our users equals www.youtube.com (Youtube)
Source: privacy[1].htm0.6.drString found in binary or memory: ve watched on YouTube to suggest new apps you might like.</p><p>Depending on your settings, we may also show you <a class="g1mG8c" href="privacy?hl=en#footnote-personalized-ads" data-name="personalized-ads" jsaction="click:IPbaae(preventDefault=true)">personalized ads</a> based on your interests. For example, if you search for equals www.youtube.com (Youtube)
Source: microsite[1].js.6.drString found in binary or memory: {},locus.tracker.active_element.assetid=b.find("div.active").attr("assetid"),locus.tracker.active_element.asset_index=b.find("div.active").index()+1,locus.tracker.trackSection.call(locus.tracker)})},h:function(){console.log("Says hello!!")},initVideo:function(a){var b=a.data("videoId"),d="iframe"+b,e=a.data("videoWidth"),f=a.data("videoHeight"),g='<iframe class="yt-video" allowfullscreen id="'+d+'" src="https://www.youtube.com/embed/'+b+'?enablejsapi=1&wmode=transparent" type="text/html" width="'+ equals www.youtube.com (Youtube)
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: www.youtube.com
Urls found in memory or binary dataShow sources
Source: jsapi[1].js.6.drString found in binary or memory: http://books.google.com/books/api.js
Source: operatordeferred_bin_base__en[1].js.6.dr, cb=gapi[1].js.6.dr, cb=gapi[2].js.6.drString found in binary or memory: http://csi.gstatic.com/csi
Source: js[1].js.6.drString found in binary or memory: http://g.co/dev/maps-no-account
Source: base[1].js.6.drString found in binary or memory: http://imasdk.googleapis.com/flash/sdkloader/flashinhtml.swf
Source: jsapi[1].js.6.drString found in binary or memory: http://maps.google.com/maps?file
Source: jsapi[1].js.6.drString found in binary or memory: http://maps.googleapis.com/maps/api/js
Source: util[1].js.6.drString found in binary or memory: http://maps.gstatic.cn/mapfiles/api-3/images/mapcnt6.png
Source: util[1].js.6.drString found in binary or memory: http://maps.gstatic.cn/mapfiles/api-3/images/mapcnt6_hdpi.png
Source: util[1].js.6.drString found in binary or memory: http://maps.gstatic.cn/mapfiles/transparent.png)
Source: base[1].js.6.drString found in binary or memory: http://pagead2.googlesyndication.com/pagead/gen_204
Source: msapplication.xml.3.drString found in binary or memory: http://www.amazon.com/
Source: microsite[1].css.6.dr, proxy[1].htm.6.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: operatordeferred_bin_base__en[1].js.6.drString found in binary or memory: http://www.broofa.com
Source: common_app[1].js.6.drString found in binary or memory: http://www.ecma-international.org/ecma-262/5.1/#sec-C
Source: common[1].js.6.drString found in binary or memory: http://www.google.cn
Source: msapplication.xml1.3.drString found in binary or memory: http://www.google.com/
Source: UKTRRE7P.htm.6.drString found in binary or memory: http://www.google.com/appsstatus
Source: jsapi[1].js.6.drString found in binary or memory: http://www.google.com/friendconnect/script/friendconnect.js
Source: operatordeferred_bin_base__en[1].js.6.drString found in binary or memory: http://www.google.com/help/chatsupport/loading.html
Source: rest[1].json.6.drString found in binary or memory: http://www.google.com/images/icons/product/search-16.gif
Source: rest[1].json.6.drString found in binary or memory: http://www.google.com/images/icons/product/search-32.gif
Source: operatordeferred_bin_base__en[1].js.6.drString found in binary or memory: http://www.google.com/intl/en/policies/privacy/
Source: operatordeferred_bin_base__en[1].js.6.drString found in binary or memory: http://www.google.com/policies/privacy/
Source: jsapi[1].js.6.drString found in binary or memory: http://www.google.com/reviews/scripts/annotations_bootstrap.js
Source: jsapi[1].js.6.drString found in binary or memory: http://www.google.com/s2/sharing/js
Source: UKTRRE7P.htm.6.drString found in binary or memory: http://www.google.com/support/websearch/bin/answer.py?hl=
Source: msapplication.xml2.3.drString found in binary or memory: http://www.live.com/
Source: msapplication.xml3.3.drString found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.3.drString found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.3.drString found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.3.drString found in binary or memory: http://www.wikipedia.com/
Source: iframe_api[2].js.6.drString found in binary or memory: http://www.youtube.com
Source: msapplication.xml7.3.drString found in binary or memory: http://www.youtube.com/
Source: base[1].js.6.drString found in binary or memory: http://www.youtube.com/videoplayback
Source: 48l-xdS4pXg[1].htm.6.drString found in binary or memory: http://www.youtube.com/watch?v=48l-xdS4pXg
Source: YlmVKT3Zvhw[1].htm.6.drString found in binary or memory: http://www.youtube.com/watch?v=YlmVKT3Zvhw
Source: ZdEIZNg3epQ[1].htm.6.drString found in binary or memory: http://www.youtube.com/watch?v=ZdEIZNg3epQ
Source: ggoJFaE71W8[1].htm.6.drString found in binary or memory: http://www.youtube.com/watch?v=ggoJFaE71W8
Source: base[1].js.6.drString found in binary or memory: http://youtube.com/drm/2012/10/10
Source: base[1].js.6.drString found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: base[1].js.6.drString found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: base[1].js.6.drString found in binary or memory: http://youtube.com/yt/2012/10/10
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://aboutme.google.com/?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://aboutme.google.com/?utm_source=pp&amp;hl=en
Source: m=WgDvvc,aa,abd,async,dv7Bfe,dvl,foot,k27Oqb,lu,m,mUpTid,mu,sb_wiz,sf,tnqaT,xz7cCd[1].js.6.drString found in binary or memory: https://accounts.google.com/Login
Source: 6AM40329.htm.6.drString found in binary or memory: https://accounts.google.com/ServiceLogin?hl=de&amp;passive=true&amp;continue=https://www.google.com/
Source: cb=gapi[2].js0.6.drString found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: cb=gapi[2].js0.6.drString found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: cb=gapi[1].js.6.drString found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fsupport.google.com&jsh=m%
Source: base[1].js.6.drString found in binary or memory: https://admin.youtube.com
Source: 6AM40329.htm.6.drString found in binary or memory: https://adservice.google.com/adsid/google/ui
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://adssettings.google.com/?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://adssettings.google.com/?utm_source=pp&amp;hl=en
Source: jsapi[1].js.6.drString found in binary or memory: https://ajax.googleapis.com/ajax
Source: analytics[1].js.6.drString found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: cb=gapi[1].js.6.dr, googleapis.proxy[1].js.6.dr, rs=AA2YrTvKzvLx63Uw_tpqCjC3fh8PoMY0Dw[1].js.6.dr, client_platform[1].js.6.dr, 6AM40329.htm.6.dr, rs=AA2YrTv2wV1gwO6Yy08ibXkCoa_I6UJf5w[1].js.6.drString found in binary or memory: https://apis.google.com
Source: privacy[1].htm0.6.dr, 6AM40329.htm.6.drString found in binary or memory: https://apis.google.com/js/api.js
Source: operatordeferred_bin_base__en[1].js.6.drString found in binary or memory: https://apis.google.com/js/client.js?onload=%
Source: proxy[1].htm0.6.dr, proxy[1].htm.6.drString found in binary or memory: https://apis.google.com/js/googleapis.proxy.js?onload=startup
Source: postmessageRelay[1].htm.6.drString found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js?onload=init
Source: js[1].js.6.drString found in binary or memory: https://cbks0.googleapis.com/cbk?
Source: js[1].js.6.drString found in binary or memory: https://cbks1.googleapis.com/cbk?
Source: cb=gapi[1].js.6.dr, cb=gapi[2].js.6.dr, cb=gapi[2].js0.6.dr, UKTRRE7P.htm.6.drString found in binary or memory: https://clients6.google.com
Source: imagestore.dat.6.dr, haissaoui[1].htm.6.drString found in binary or memory: https://cloud.google.com/_static/12f9a4d461/images/cloud/icons/favicons/onecloud/favicon.ico
Source: imagestore.dat.6.drString found in binary or memory: https://cloud.google.com/_static/12f9a4d461/images/cloud/icons/favicons/onecloud/favicon.ico~
Source: 6AM40329.htm.6.drString found in binary or memory: https://consent.google.com/setx?hl
Source: 6AM40329.htm.6.drString found in binary or memory: https://consent.google.com/status?continue=https://www.google.com&amp;m=0&amp;pc=s&amp;timestamp=155
Source: 6AM40329.htm.6.drString found in binary or memory: https://consent.google.com?hl
Source: cb=gapi[1].js.6.dr, cb=gapi[2].js0.6.drString found in binary or memory: https://console.developers.google.com/
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://contacts.google.com
Source: 6AM40329.htm.6.drString found in binary or memory: https://contacts.google.com/?hl=de&amp;tab=wC
Source: privacy[1].htm0.6.drString found in binary or memory: https://contacts.google.com?hl=en
Source: operatordeferred_bin_base__en[1].js.6.dr, UKTRRE7P.htm.6.drString found in binary or memory: https://content-googleapis-staging.sandbox.google.com
Source: operatordeferred_bin_base__en[1].js.6.dr, UKTRRE7P.htm.6.drString found in binary or memory: https://content-googleapis-test.sandbox.google.com
Source: cb=gapi[1].js.6.dr, cb=gapi[2].js.6.dr, cb=gapi[2].js0.6.drString found in binary or memory: https://content.googleapis.com
Source: operatordeferred_bin_base__en[1].js.6.dr, cb=gapi[1].js.6.dr, cb=gapi[2].js.6.drString found in binary or memory: https://csi.gstatic.com/csi
Source: cb=gapi[1].js.6.dr, cb=gapi[2].js0.6.drString found in binary or memory: https://developers.google.com/
Source: cb=gapi[1].js.6.dr, cb=gapi[2].js0.6.drString found in binary or memory: https://developers.google.com/api-client-library/javascript/reference/referencedocs
Source: common[1].js.6.dr, util[1].js.6.drString found in binary or memory: https://developers.google.com/maps/documentation/javascript/error-messages#
Source: base[1].js.6.drString found in binary or memory: https://docs.google.com/get_video_info
Source: cb=gapi[1].js.6.drString found in binary or memory: https://domains.google.com/suggest/flow
Source: 6AM40329.htm.6.drString found in binary or memory: https://drive.google.com/?tab=wo
Source: js[1].js.6.drString found in binary or memory: https://earthbuilder.googleapis.com
Source: m=NTMZac,Y9atKf,ktZhLb,oPwyWd,qehskd,wX26lb,xXmYM[1].js.6.dr, terms[1].htm0.6.drString found in binary or memory: https://ec.europa.eu/consumers/odr/main/index.cfm?event=main.home2.show
Source: jsapi[1].js.6.drString found in binary or memory: https://encrypted.google.com/books/api.js
Source: ITZBXCXZ.js.6.dr, privacy[1].htm0.6.drString found in binary or memory: https://families.google.com/familylink/privacy/child-policy/
Source: ITZBXCXZ.js.6.dr, privacy[1].htm0.6.drString found in binary or memory: https://fi.google.com/about/tos/#project-fi-privacy-notice
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://fiber.google.com/
Source: privacy[1].htm0.6.drString found in binary or memory: https://fiber.google.com/legal/privacy.html
Source: css[1].css0.6.drString found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: haissaoui[1].htm.6.drString found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: haissaoui[1].htm.6.drString found in binary or memory: https://fonts.googleapis.com/icon?family=Material
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/adobeblank/v4/ieV62YNKKGqPJteRQT8EQmod.woff)
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://fonts.gstatic.com/s/googlesans/v9/4UaGrENHsxJlGDuGo1OIlL3Owpg.woff)format(
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://fonts.gstatic.com/s/googlesans/v9/4UabrENHsxJlGDuGo1OIlLU94YtzCwA.woff)format(
Source: icon[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/materialicons/v47/flUhRq6tzZclQEJ-Vdg-IuiaDsNa.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN_r8-Vg.woff)
Source: css[1].css0.6.drString found in binary or memory: https://fonts.gstatic.com/s/productsans/v10/pxiDypQkot1TnFhsFMOfGShVF9eI.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/productsans/v10/pxiDypQkot1TnFhsFMOfGShlEw.woff)
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc-.woff)format(
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff)format(
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff)format(
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v19/KFOkCnqEu92Fr1MmgWxM.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v19/KFOlCnqEu92Fr1MmEU9vAA.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v19/KFOlCnqEu92Fr1MmSU5vAA.woff)
Source: css[1].css0.6.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v19/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v19/KFOlCnqEu92Fr1MmWUlvAA.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v19/KFOmCnqEu92Fr1Me5g.woff)
Source: css[1].css0.6.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v19/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/robotocondensed/v17/ieVl2ZhZI2eCN5jzbjEETS9weq8-59Y.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/robotomono/v6/L0x5DF4xlVMF-BfR8bXMIghP.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/robotomono/v6/L0xkDF4xlVMF-BfR8bXMIjDwjlq1.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v8/BngMUXZYTXPIvIBgJJSb6tfJ.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v8/BngOUXZYTXPIvIBgJJSb6u-u5qM.woff)
Source: css[1].css.6.drString found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v8/BngRUXZYTXPIvIBgJJSb6u9mxICC.woff)
Source: js[1].js.6.drString found in binary or memory: https://geo0.ggpht.com/cbk
Source: js[1].js.6.drString found in binary or memory: https://geo1.ggpht.com/cbk
Source: js[1].js.6.drString found in binary or memory: https://geo2.ggpht.com/cbk
Source: js[1].js.6.drString found in binary or memory: https://geo3.ggpht.com/cbk
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withg
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaou.com/Root
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaou/gle.com/schedule/haissaoui#Root
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaou/intl/en/policies/privacy/Root
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaou/intl/en/policies/terms/Root
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaouRoot
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaoue.com/privacy?hl=enivacy/Root
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaoue.com/terms?hl=enterms/Root
Source: ~DF62C4601B3403A075.TMP.3.dr, {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaoui
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaoui#
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaoui#cloud/favicon.ico
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaouiRoot
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaouiWdtRWdtRF24A3D5198CA1845D63774B82BE8
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaouioogle.com/schedule/haissaouiRoot
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://getcloud.withgoogle.com/schedule/haissaouoogle.com/schedule/haissaoui#Root
Source: angular-material.min[1].css.6.drString found in binary or memory: https://github.com/angular/material
Source: microsite[1].css.6.drString found in binary or memory: https://github.com/jonsuh/hamburgers
Source: common_app[1].js.6.drString found in binary or memory: https://github.com/maximepvrt/angular-google-gapi
Source: cb=gapi[1].js.6.dr, cb=gapi[2].js.6.drString found in binary or memory: https://gsuite.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: base[1].js.6.drString found in binary or memory: https://imasdk.googleapis.com/flash/sdkloader/flashinhtml.swf
Source: microsite[1].css.6.drString found in binary or memory: https://jonsuh.com/hamburgers
Source: js[1].js.6.drString found in binary or memory: https://khms.googleapis.com/mz?v=844
Source: js[1].js.6.drString found in binary or memory: https://khms0.google.com/kh?v=124
Source: js[1].js.6.drString found in binary or memory: https://khms0.google.com/kh?v=844
Source: js[1].js.6.drString found in binary or memory: https://khms0.googleapis.com/kh?v=124
Source: js[1].js.6.drString found in binary or memory: https://khms0.googleapis.com/kh?v=844
Source: js[1].js.6.drString found in binary or memory: https://khms1.google.com/kh?v=124
Source: js[1].js.6.drString found in binary or memory: https://khms1.google.com/kh?v=844
Source: js[1].js.6.drString found in binary or memory: https://khms1.googleapis.com/kh?v=124
Source: js[1].js.6.drString found in binary or memory: https://khms1.googleapis.com/kh?v=844
Source: ITZBXCXZ.js.6.dr, privacy[1].htm0.6.drString found in binary or memory: https://kids.youtube.com/privacynotice
Source: js[1].js.6.drString found in binary or memory: https://lh3.ggpht.com/
Source: js[1].js.6.drString found in binary or memory: https://lh4.ggpht.com/
Source: js[1].js.6.drString found in binary or memory: https://lh5.ggpht.com/
Source: js[1].js.6.drString found in binary or memory: https://lh6.ggpht.com/
Source: haissaoui[1].htm.6.drString found in binary or memory: https://locus-hipo.appspot.com
Source: rest[1].json.6.drString found in binary or memory: https://locus-hipo.appspot.com/_ah/api/
Source: rest[1].json.6.drString found in binary or memory: https://locus-hipo.appspot.com/_ah/api/Locus/v4.0/
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://locus-hipo.appspot.com/_ah/api/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%
Source: 6AM40329.htm.6.drString found in binary or memory: https://mail.google.com/mail/?tab=wm
Source: jsapi[1].js.6.drString found in binary or memory: https://maps-api-ssl.google.com/maps?file
Source: 6AM40329.htm.6.drString found in binary or memory: https://maps.google.ch/maps?hl=de&amp;tab=wl
Source: js[1].js.6.drString found in binary or memory: https://maps.google.com
Source: js[1].js.6.drString found in binary or memory: https://maps.googleapis.com
Source: js[1].js.6.drString found in binary or memory: https://maps.googleapis.com/maps-api-v3/api/js/37/1
Source: jsapi[1].js.6.drString found in binary or memory: https://maps.googleapis.com/maps/api/js
Source: js[1].js.6.drString found in binary or memory: https://maps.googleapis.com/maps/api/js/GeoPhotoService.GetMetadata
Source: js[1].js.6.drString found in binary or memory: https://maps.googleapis.com/maps/api/js/GeoPhotoService.SingleImageSearch
Source: haissaoui[1].htm.6.drString found in binary or memory: https://maps.googleapis.com/maps/api/js?key=AIzaSyD2vA3qQC9DPEmfVQpVL_yA3J6LmJwEsTs&libraries=places
Source: js[1].js.6.drString found in binary or memory: https://maps.googleapis.com/maps/vt
Source: js[1].js.6.drString found in binary or memory: https://maps.gstatic.com/mapfiles/
Source: util[1].js.6.drString found in binary or memory: https://maps.gstatic.com/mapfiles/api-3/images/mapcnt6.png
Source: util[1].js.6.drString found in binary or memory: https://maps.gstatic.com/mapfiles/api-3/images/mapcnt6_hdpi.png
Source: util[1].js.6.drString found in binary or memory: https://maps.gstatic.com/mapfiles/transparent.png);height:10px;width:4px;float:left;margin-top:3px;m
Source: js[1].js.6.drString found in binary or memory: https://maps.gstatic.com/maps-api-v3/api/images/
Source: js[1].js.6.drString found in binary or memory: https://mts.googleapis.com/maps/vt/icon
Source: js[1].js.6.drString found in binary or memory: https://mts0.googleapis.com/mapslt?hl=en-US
Source: js[1].js.6.drString found in binary or memory: https://mts1.googleapis.com/mapslt?hl=en-US
Source: m=ApfnBb,BM62mb,E05aSc,NTMZac,Y9atKf,oPwyWd,wX26lb[1].js.6.dr, m=NTMZac,Y9atKf,ktZhLb,oPwyWd,qehskd,wX26lb,xXmYM[1].js.6.drString found in binary or memory: https://myaccount.google.com/
Source: terms[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/?hl=en
Source: 6AM40329.htm.6.drString found in binary or memory: https://myaccount.google.com/?utm_source=OGB&amp;tab=wk&amp;utm_medium=app
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/activitycontrols?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/activitycontrols?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/dashboard?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/dashboard?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/deleteaccount?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/deleteaccount?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/deleteservices?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/deleteservices?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/inactive?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/inactive?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/preferences?utm_source=pp#deleteservices
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/preferences?utm_source=pp&amp;hl=en#deleteservices
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/privacy?utm_source=pp#personalinfo
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/privacy?utm_source=pp&amp;hl=en#personalinfo
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/privacycheckup?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/privacycheckup?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/security-checkup?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/security-checkup?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myaccount.google.com/shared-endorsements?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myaccount.google.com/shared-endorsements?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myactivity.google.com/?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myactivity.google.com/?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://myactivity.google.com/myactivity?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://myactivity.google.com/myactivity?utm_source=pp&amp;hl=en
Source: 6AM40329.htm.6.drString found in binary or memory: https://news.google.ch/nwshp?hl=de&amp;tab=wn
Source: rs=AA2YrTv2wV1gwO6Yy08ibXkCoa_I6UJf5w[1].js.6.drString found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=drsl&drsl=
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://payments.google.com/legaldocument?family=0.privacynotice&hl=
Source: privacy[1].htm0.6.drString found in binary or memory: https://payments.google.com/legaldocument?family=0.privacynotice&hl=en
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://payments.google.com/manage/
Source: 6AM40329.htm.6.drString found in binary or memory: https://play.google.com/?hl=de&amp;tab=w8
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://play.google.com/books/intl/
Source: privacy[1].htm0.6.drString found in binary or memory: https://play.google.com/books/intl/en/privacy.html
Source: rs=ACT90oG6wXM5L0gk56QczlC-9WYY-k4x_w[1].js.6.dr, ITZBXCXZ.js.6.dr, rs=AA2YrTvKzvLx63Uw_tpqCjC3fh8PoMY0Dw[1].js.6.dr, 6AM40329.htm.6.drString found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: rs=AA2YrTvKzvLx63Uw_tpqCjC3fh8PoMY0Dw[1].js.6.dr, 6AM40329.htm.6.drString found in binary or memory: https://play.googleapis.com/staging/log
Source: cb=gapi[1].js.6.dr, rs=AA2YrTv2wV1gwO6Yy08ibXkCoa_I6UJf5w[1].js.6.drString found in binary or memory: https://plus.google.com
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://plus.google.com/settings?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://plus.google.com/settings?utm_source=pp&amp;hl=en
Source: cb=gapi[1].js.6.drString found in binary or memory: https://plus.googleapis.com
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://policies.googl
Source: ~DF62C4601B3403A075.TMP.3.dr, privacy[1].htm0.6.drString found in binary or memory: https://policies.google.com/
Source: privacy[1].htm.6.drString found in binary or memory: https://policies.google.com/privacy
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://policies.google.com/privacy?hl=en
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://policies.google.com/privacy?hl=enRPrivacy
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://policies.google.com/privacy?hl=enivacy/
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://policies.google.com/privacy?hl=enivacy/&
Source: terms[1].htm.6.drString found in binary or memory: https://policies.google.com/terms
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://policies.google.com/terms?hl=en
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://policies.google.com/terms?hl=endGoogle
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://policies.google.com/terms?hl=enterms/
Source: m=NTMZac,Y9atKf,ktZhLb,oPwyWd,qehskd,wX26lb,xXmYM[1].js.6.drString found in binary or memory: https://privacy.google.com/businesses/affiliates
Source: privacy[1].htm0.6.drString found in binary or memory: https://privacy.google.com/businesses/affiliates?hl=en
Source: operatordeferred_bin_base__en[1].js.6.drString found in binary or memory: https://realtimesupport.clients6.google.com
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://realtimesupport.clients6.google.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-sta
Source: iframe_api[2].js.6.drString found in binary or memory: https://s.ytimg.com/yts/jsbin/www-widgetapi-vflTZdOF2/www-widgetapi.js
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://safebrowsing.google.com/?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://safebrowsing.google.com/?utm_source=pp&amp;hl=en
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://scone-pa.clients6.google.com
Source: postmessageRelay[1].htm.6.drString found in binary or memory: https://ssl.gstatic.com/accounts/o/3956660502-postmessagerelay.js
Source: 6AM40329.htm.6.drString found in binary or memory: https://ssl.gstatic.com/gb/images/silhouette_27.png)
Source: 6AM40329.htm.6.drString found in binary or memory: https://ssl.gstatic.com/gb/images/silhouette_96.png)
Source: rs=AA2YrTvKzvLx63Uw_tpqCjC3fh8PoMY0Dw[1].js.6.dr, rs=AA2YrTv2wV1gwO6Yy08ibXkCoa_I6UJf5w[1].js.6.drString found in binary or memory: https://ssl.gstatic.com/gb/images/spinner_32.gif
Source: cb=gapi[1].js.6.dr, cb=gapi[2].js.6.drString found in binary or memory: https://ssl.gstatic.com/gb/js/
Source: ~DF62C4601B3403A075.TMP.3.dr, imagestore.dat.6.drString found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico
Source: imagestore.dat.6.drString found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico~
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://ssl.gstatic.com/support/realtime/operator/
Source: operatorParams[1].json.6.drString found in binary or memory: https://ssl.gstatic.com/support/realtime/operator/1557734594959/operatordeferred_bin_base.js
Source: operatordeferred_bin_base__en[1].js.6.drString found in binary or memory: https://staging-realtimesupport-googleapis.sandbox.google.com
Source: js[1].js.6.drString found in binary or memory: https://static.panoramio.com.storage.googleapis.com/photos/
Source: analytics[1].js.6.drString found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: analytics[1].js.6.drString found in binary or memory: https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&
Source: haissaoui[1].htm.6.drString found in binary or memory: https://storage.googleapis.com/locus-multi-logos/hipo-images/cloud-logo.png
Source: operatordeferred_bin_base__en[1].js.6.drString found in binary or memory: https://support-content-apiary-gkmsstaging.sandbox.google.com
Source: {D71EC12E-77B9-11E9-AAD9-C25F135D3C65}.dat.3.drString found in binary or memory: https://support.google
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://support.google.com
Source: UKTRRE7P.htm.6.dr, haissaoui[1].htm.6.drString found in binary or memory: https://support.google.com/
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://support.google.com/?hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/a?p=privpol_admin&amp;hl=en
Source: m=NTMZac,Y9atKf,ktZhLb,oPwyWd,qehskd,wX26lb,xXmYM[1].js.6.drString found in binary or memory: https://support.google.com/accounts/bin/answer.py?hl=
Source: terms[1].htm0.6.drString found in binary or memory: https://support.google.com/accounts/bin/answer.py?hl=en&answer=58585
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/accounts?p=autocontacts&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_agereq&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_androidloc&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_controlads&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_endorse
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_endorse&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_location
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_location&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_lochistory
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_lochistory&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_phone&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_whyad
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/accounts?p=privpol_whyad&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/adwordspolicy?p=privpol_p13nad&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/analytics?p=privpol_data&amp;hl=en
Source: m=NTMZac,Y9atKf,ktZhLb,oPwyWd,qehskd,wX26lb,xXmYM[1].js.6.drString found in binary or memory: https://support.google.com/bin/static.py?hl=
Source: terms[1].htm0.6.drString found in binary or memory: https://support.google.com/bin/static.py?hl=en&ts=1114905&page=ts.cs
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/blogger?p=privpol_blog&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://support.google.com/chrome?p=privpol_chrsync
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/chrome?p=privpol_chrsync&amp;hl=en
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://support.google.com/com/schedule/haissaoui#
Source: imagestore.dat.6.drString found in binary or memory: https://support.google.com/favicon.ico
Source: imagestore.dat.6.drString found in binary or memory: https://support.google.com/favicon.ico~
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/googlehome?p=privpol_actions&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/googlehome?p=privpol_homedata&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/googleplay?p=privpol_review&amp;hl=en
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://support.google.com/inapp/rts_frame
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/legal?p=privpol_remove&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/mail?p=privpol_signinactivity&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://support.google.com/photos?p=privpol_manage
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/photos?p=privpol_manage&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/policies/troubleshooter/7575787?hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://support.google.com/policies?p=privpol_privts
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/policies?p=privpol_privts&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/sites?p=privpol_delete&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://support.google.com/trends?p=privpol_about
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/trends?p=privpol_about&amp;hl=en
Source: rs=ACT90oG6wXM5L0gk56QczlC-9WYY-k4x_w[1].js.6.drString found in binary or memory: https://support.google.com/websearch/answer/106230
Source: 6AM40329.htm.6.drString found in binary or memory: https://support.google.com/websearch/answer/106230?hl=de-CH
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/websearch?p=privpol_feed&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/websearch?p=privpol_incognito&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/websearch?p=privpol_locserp&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/websearch?p=privpol_privresults&amp;hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://support.google.com/websearch?p=privpol_searchactivity&amp;hl=en
Source: base[1].js.6.drString found in binary or memory: https://support.google.com/youtube/?p=missing_quality
Source: base[1].js.6.drString found in binary or memory: https://support.google.com/youtube/?p=noaudio
Source: base[1].js.6.drString found in binary or memory: https://support.google.com/youtube/?p=report_playback
Source: base[1].js.6.drString found in binary or memory: https://support.google.com/youtube/answer/6276924
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://takeout.google.com/?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://takeout.google.com/?utm_source=pp&amp;hl=en
Source: operatordeferred_bin_base__en[1].js.6.drString found in binary or memory: https://test-realtimesupport-googleapis.sandbox.google.com
Source: 6AM40329.htm.6.drString found in binary or memory: https://translate.google.ch/?hl=de&amp;tab=wT
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://transparencyreport.google.com/user-data/overview
Source: privacy[1].htm0.6.drString found in binary or memory: https://transparencyreport.google.com/user-data/overview?hl=en
Source: base[1].js.6.drString found in binary or memory: https://viacon.corp.google.com
Source: analytics[1].js.6.drString found in binary or memory: https://www.google-analytics.com/analytics
Source: ITZBXCXZ.js.6.dr, haissaoui[1].htm.6.drString found in binary or memory: https://www.google-analytics.com/analytics.js
Source: analytics[1].js.6.drString found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.6.drString found in binary or memory: https://www.google-analytics.com/u/d
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://www.google.
Source: analytics[1].js.6.drString found in binary or memory: https://www.google.%/ads/ga-audiences
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.ch/domainless/read?igu
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.ch/imghp?hl=de&amp;tab=wi
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.ch/intl/de/about/products?tab=wh
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.ch/webhp?tab=ww
Source: 6AM40329.htm.6.dr, UKTRRE7P.htm.6.drString found in binary or memory: https://www.google.com
Source: 6AM40329.htm.6.dr, haissaoui[1].htm.6.drString found in binary or memory: https://www.google.com/
Source: terms[1].htm0.6.drString found in binary or memory: https://www.google.com/?hl=en
Source: privacy[1].htm0.6.dr, terms[1].htm0.6.drString found in binary or memory: https://www.google.com/about/
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://www.google.com/about/datacenters/inside/locations
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.google.com/about/datacenters/inside/locations?hl=en
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://www.google.com/accounts/TOS
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://www.google.com/accounts/recovery
Source: analytics[1].js.6.drString found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/calendar?tab=wc
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.google.com/chrome/intl/en/privacy.html
Source: m=NTMZac,Y9atKf,ktZhLb,oPwyWd,qehskd,wX26lb,xXmYM[1].js.6.dr, terms[1].htm0.6.drString found in binary or memory: https://www.google.com/contact/
Source: imagestore.dat.6.drString found in binary or memory: https://www.google.com/favicon.ico
Source: imagestore.dat.6.drString found in binary or memory: https://www.google.com/favicon.ico~
Source: jsapi[1].js.6.drString found in binary or memory: https://www.google.com/friendconnect/script/friendconnect.js
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://www.google.com/get/googletips
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://www.google.com/gle.com/schedule/haissaoui#
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://www.google.com/gle.com/schedule/haissaoui#User
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://www.google.com/history/optout
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.google.com/history/optout?hl=en
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.google.com/history/optout?utm_source=pp&amp;hl=en
Source: terms[1].htm0.6.drString found in binary or memory: https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_74x24dp.png
Source: terms[1].htm0.6.drString found in binary or memory: https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/images/hpp/Chrome_Owned_96x96.png
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/intl/de_ch/about/?utm_source=google-CH&amp;utm_medium=referral&amp;utm_campai
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/intl/de_ch/ads/?subid=ww-ww-et-g-awa-a-g_hpafoot1_1
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/intl/de_ch/policies/privacy/?fg=1
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/intl/de_ch/policies/terms/?fg=1
Source: haissaoui[1].htm.6.drString found in binary or memory: https://www.google.com/intl/en/policies/privacy/
Source: ~DF62C4601B3403A075.TMP.3.dr, haissaoui[1].htm.6.drString found in binary or memory: https://www.google.com/intl/en/policies/terms/
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.google.com/intl/en/safetycenter/
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.google.com/landing/2step/?utm_source=pp&amp;hl=en
Source: rs=ACT90oG6wXM5L0gk56QczlC-9WYY-k4x_w[1].js.6.dr, ITZBXCXZ.js.6.dr, rs=AA2YrTvKzvLx63Uw_tpqCjC3fh8PoMY0Dw[1].js.6.dr, 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: js[1].js.6.drString found in binary or memory: https://www.google.com/maps
Source: js[1].js.6.drString found in binary or memory: https://www.google.com/maps/preview/log204
Source: js[1].js.6.drString found in binary or memory: https://www.google.com/maps/vt
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/preferences?hl=de
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/preferences?hl=de-CH&amp;fg=1
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/services/?subid=ww-ww-et-g-awa-a-g_hpbfoot1_1
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/setprefs?sig=0_SoCMIjUyla_tRpYohtjff1QefeU%3D&amp;hl=en&amp;source=homepage&a
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/setprefs?sig=0_SoCMIjUyla_tRpYohtjff1QefeU%3D&amp;hl=fr&amp;source=homepage&a
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/setprefs?sig=0_SoCMIjUyla_tRpYohtjff1QefeU%3D&amp;hl=it&amp;source=homepage&a
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/setprefs?sig=0_SoCMIjUyla_tRpYohtjff1QefeU%3D&amp;hl=rm&amp;source=homepage&a
Source: rs=AA2YrTv2wV1gwO6Yy08ibXkCoa_I6UJf5w[1].js.6.drString found in binary or memory: https://www.google.com/support/profiles/?p=plusone_button_error&hl=en-US
Source: jsapi[1].js.6.drString found in binary or memory: https://www.google.com/uds
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.google.com/url?q=https://www.google.com/chrome/browser/desktop/index.html%3Fbrand%3DOKWM
Source: haissaoui[1].htm.6.drString found in binary or memory: https://www.google.com/work/apps/business/
Source: ITZBXCXZ.js.6.dr, privacy[1].htm0.6.drString found in binary or memory: https://www.google.com/work/apps/terms/education_privacy.html
Source: operatordeferred_bin_base__en[1].js.6.drString found in binary or memory: https://www.googleapis.com
Source: nested_template[1].js.6.drString found in binary or memory: https://www.googleapis.com/auth/calendar
Source: common_app[1].js.6.dr, nested_template[1].js.6.drString found in binary or memory: https://www.googleapis.com/auth/drive
Source: common_app[1].js.6.dr, nested_template[1].js.6.drString found in binary or memory: https://www.googleapis.com/auth/drive.readonly
Source: nested_template[1].js.6.drString found in binary or memory: https://www.googleapis.com/auth/photos
Source: cb=gapi[2].js0.6.drString found in binary or memory: https://www.googleapis.com/auth/plus.login
Source: cb=gapi[1].js.6.drString found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: cb=gapi[1].js.6.drString found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: rest[1].json.6.drString found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: base[1].js.6.drString found in binary or memory: https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2i
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://www.gstatic.
Source: privacy[1].htm0.6.dr, terms[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdentityPoliciesUi.en.AkfmbuXRUAs.O/a
Source: logo_google_ads_32px[1].htm.6.drString found in binary or memory: https://www.gstatic.com/ads/external/images/logo_google_ads_32px.png
Source: logo_google_ads_64px[1].htm.6.drString found in binary or memory: https://www.gstatic.com/ads/external/images/logo_google_ads_64px.png
Source: remote[1].js.6.drString found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: UKTRRE7P.htm.6.drString found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/search_black_24dp.png
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/02698a3383765bd3c250471c53a86c5a.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/02f8664b95445de6f27ba682f3c5f9ab.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/0d6da8d8c44e7e3ee95c4d56c19f04e1.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/13062c65605335a46d14656c46af3868.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/1fa3e4ce8ac456f39ed02a6f9eb49b14.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/2951277d4c35389d7d304ed78d4fb6f6.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/3394102be0315326fd760e503b31c7b6.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/39b031d352a2e1586cf50ac7f2bbc18b.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/4165cd3aa643abb80fe1953668f67551.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/4c5ee41d52605ff6f43538d46a1c0d35.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/4f19891c43001db11efc8048f9bc7cdb.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/51cd09d6239edc9652bc05ad1d149a5c.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/546f2b674b407304a2570e71a216e509.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/5959e84c2197c8a27da0a717f1cd47d5.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/5e7cd445f8861a262a3da876f855a4cc.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/900a793eae04f4bddd675f8d95c4a794.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/9c1bd42ba6ec58ce82eef30bbb30ecc3.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/a8e78fa7fa279aa946fe1a9d6a0508f2.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/acad335ad7ba163209d8c3e671b2c445.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/b18d13e9ea8a362642b7d25bce665039.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/c1b97d74dace7e43a9ccb26841a7cae4.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/d1b68e2cd423aba52d74f02573df2d2d.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/e28714c71f217892f72b2698ea5cefef.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/e60586c0029adec0bacd3e48470ca6c6.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/e79ea0ed464fc8952d5b5582f9f9ae53.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/fa9e0e90d1e7ec399dad9f3257a9bb63.svg
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.gstatic.com/policies/privacy/fb61fc4bfc85ad86f11342e699d685e9.svg
Source: www-widgetapi[1].js.6.drString found in binary or memory: https://www.youtube.com
Source: 6AM40329.htm.6.drString found in binary or memory: https://www.youtube.com/?gl=CH
Source: microsite[1].js.6.drString found in binary or memory: https://www.youtube.com/embed/
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: ~DF62C4601B3403A075.TMP.3.drString found in binary or memory: https://www.youtube.com/embed/ggoJFaE71W8?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://www.youtube.com/feed/history/search_history?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.youtube.com/feed/history/search_history?utm_source=pp&amp;hl=en
Source: ITZBXCXZ.js.6.drString found in binary or memory: https://www.youtube.com/feed/history?utm_source=pp
Source: privacy[1].htm0.6.drString found in binary or memory: https://www.youtube.com/feed/history?utm_source=pp&amp;hl=en
Source: base[1].js.6.drString found in binary or memory: https://www.youtube.com/generate_204?cpn=
Source: ITZBXCXZ.js.6.dr, base[1].js.6.dr, haissaoui[1].htm.6.drString found in binary or memory: https://www.youtube.com/iframe_api
Source: 48l-xdS4pXg[1].htm.6.drString found in binary or memory: https://www.youtube.com/watch?v=48l-xdS4pXg
Source: YlmVKT3Zvhw[1].htm.6.drString found in binary or memory: https://www.youtube.com/watch?v=YlmVKT3Zvhw
Source: ZdEIZNg3epQ[1].htm.6.drString found in binary or memory: https://www.youtube.com/watch?v=ZdEIZNg3epQ
Source: ggoJFaE71W8[1].htm.6.drString found in binary or memory: https://www.youtube.com/watch?v=ggoJFaE71W8
Source: base[1].js.6.drString found in binary or memory: https://youtu.be/
Source: base[1].js.6.drString found in binary or memory: https://youtube.com/api/drm/fps?ek=uninitialized
Uses HTTPSShow sources
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844

System Summary:

barindex
Classification labelShow sources
Source: classification engineClassification label: clean0.win@3/270@7/6
Creates files inside the user directoryShow sources
Source: C:\Program Files\internet explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\HighJump to behavior
Creates temporary filesShow sources
Source: C:\Program Files\internet explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Temp\~DF55A3B849FB5B8618.TMPJump to behavior
Reads ini filesShow sources
Source: C:\Program Files\internet explorer\iexplore.exeFile read: C:\Users\desktop.iniJump to behavior
Spawns processesShow sources
Source: unknownProcess created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknownProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3572 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3572 CREDAT:17410 /prefetch:2Jump to behavior
Found graphical window changes (likely an installer)Show sources
Source: Window RecorderWindow detected: More than 3 window changes detected
Uses new MSVCR DllsShow sources
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile opened: C:\Program Files (x86)\Java\jre1.8.0_171\bin\msvcr100.dllJump to behavior

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 132317 URL: https://getcloud.withgoogle.com/schedule/haissaoui Startdate: 16/05/2019 Architecture: WINDOWS Score: 0 5 iexplore.exe 10 84 2->5         started        process3 7 iexplore.exe 6 300 5->7         started        dnsIp4 10 storage.l.googleusercontent.com 172.217.168.16, 443, 49805, 49806 unknown United States 7->10 12 172.217.168.2, 443, 49862, 49863 unknown United States 7->12 14 10 other IPs or domains 7->14

Simulations

Behavior and APIs

No simulations

Antivirus and Machine Learning Detection

Initial Sample

SourceDetectionScannerLabelLink
https://getcloud.withgoogle.com/schedule/haissaoui0%virustotalBrowse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://locus-hipo.appspot.com/_ah/api/0%Avira URL Cloudsafe
https://locus-hipo.appspot.com/_ah/api/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%0%Avira URL Cloudsafe
https://locus-hipo.appspot.com/_ah/api/Locus/v4.0/0%Avira URL Cloudsafe
https://locus-hipo.appspot.com0%Avira URL Cloudsafe
https://getcloud.withg0%Avira URL Cloudsafe

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.