Loading ...

Play interactive tourEdit tour

Analysis Report https://forms.gle/6ydC3USmA3Exzw5x5

Overview

General Information

Joe Sandbox Version:28.0.0 Lapis Lazuli
Analysis ID:193305
Start date:03.12.2019
Start time:08:53:15
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 33s
Hypervisor based Inspection enabled:false
Report type:light
Cookbook file name:browseurl.jbs
Sample URL:https://forms.gle/6ydC3USmA3Exzw5x5
Analysis system description:Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Number of analysed new started processes analysed:8
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
Analysis stop reason:Timeout
Detection:CLEAN
Classification:clean1.win@3/64@0/15
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Browsing link: https://docs.google.com/forms/d/e/1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/reportabuse?source=https://docs.google.com/forms/d/e/1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/viewform?usp%3Dsend_form
  • Browsing link: https://policies.google.com/terms
  • Browsing link: https://policies.google.com/privacy
  • Browsing link: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms
Warnings:
Show All
  • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
  • Exclude process from analysis (whitelisted): dllhost.exe, ielowutil.exe, MusNotifyIcon.exe, conhost.exe, CompatTelRunner.exe
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size getting too big, too many NtCreateFile calls found.
  • Report size getting too big, too many NtDeviceIoControlFile calls found.

Detection

StrategyScoreRangeReportingWhitelistedDetection
Threshold10 - 100falseclean

Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold40 - 5false
ConfidenceConfidence


Classification

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")



Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlImpact
Drive-by Compromise1Command-Line Interface2Winlogon Helper DLLProcess Injection2Web Service1Credential DumpingProcess Discovery1Application Deployment SoftwareData from Local SystemData CompressedWeb Service1Data Destruction
Replication Through Removable MediaGraphical User Interface1Port MonitorsAccessibility FeaturesMasquerading1Network SniffingSecurity Software Discovery1Remote ServicesData from Removable MediaExfiltration Over Other Network MediumFallback ChannelsData Encrypted for Impact
External Remote ServicesWindows Management InstrumentationAccessibility FeaturesPath InterceptionProcess Injection2Input CaptureFile and Directory Discovery1Windows Remote ManagementData from Network Shared DriveAutomated ExfiltrationCustom Cryptographic ProtocolDisk Structure Wipe

Signature Overview

Click to jump to signature section


Phishing:

barindex
Found iframesShow sources
Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsHTTP Parser: Iframe src: //2542116.fls.doubleclick.net/activityi;src=2542116;type=gdrive;cat=googl004;ord=5840484344059.864?
META author tag missingShow sources
Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsHTTP Parser: No <meta name="author".. found
META copyright tag missingShow sources
Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsHTTP Parser: No <meta name="copyright".. found

Networking:

barindex
Social media urls found in memory dataShow sources
Source: iexplore.exeString found in binary or memory: http://www.facebook.com/
Source: iexplore.exeString found in binary or memory: http://www.facebook.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.twitter.com/
Found strings which match to known social media urlsShow sources
Source: 48l-xdS4pXg[1].htm.3.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=48l-xdS4pXg"> equals www.youtube.com (Youtube)
Source: YlmVKT3Zvhw[1].htm.3.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=YlmVKT3Zvhw"> equals www.youtube.com (Youtube)
Source: ZdEIZNg3epQ[1].htm.3.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=ZdEIZNg3epQ"> equals www.youtube.com (Youtube)
Source: ggoJFaE71W8[1].htm.3.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=ggoJFaE71W8"> equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: like an email address to receive updates about our services.</p><p>We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos.</p><h2>Information we collect as you use our services</h2><h3>Your apps, browsers & devices</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/e79ea0ed464fc8952d5b5582f9f9ae53.svg"/></div><p>We collect information about the apps, browsers, and <a class="g1mG8c" href="privacy#footnote-devices" data-name="devices" jsaction="click:IPbaae(preventDefault=true)">devices</a> you use to access Google services, which helps us provide features like automatic product updates and dimming your screen if your battery runs low.</p><p>The information we collect includes <a class="g1mG8c" href="privacy#footnote-unique-id" data-name="unique-id" jsaction="click:IPbaa
Source: 8QTA8CVS.js.3.drString found in binary or memory: "";k+=q}k+="</div>"}l=a.length;for(n=0;n<l;n++){q=a[n];if(q.K()){u=(0,_.eA)('role="listitem"');var w=f,v=q.K().H();q=q.K().K();q=""+Jhb({attributes:u,Aa:w,Un:c,dh:v,icon:51,index:n,link:q,Zy:"Remove link"},b);q=(0,_.S)(q)}else if(q.H()&&!h){u=(0,_.eA)('role="listitem"');w=f;v=q.H().K();q=q.H().H();var F=b;q=""+Jhb({attributes:u,Aa:w,Un:c,dh:v,icon:F.eh?142:73,index:n,link:""+(0,_.bFa)("//youtube.com/watch?v="+Chb(q)),Zy:"Remove video"},F);q=(0,_.S)(q)}else q="";k+=q}b=(0,_.S)(k);return(0,_.S)(d+(e+ equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: ", including YouTube, Android, and services offered on third" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: ":methodGET:path/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1:authoritywww.youtube.com:schemehttpsaccepttext/html, application/xhtml+xml, image/jxr, */*refererhttps://policies.google.com/accept-languageen-USuser-agentMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoaccept-encodinggzip, deflaten" equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: "</li><li>"+(0,_.I)("Platforms like the Chrome browser and Android operating system")+"</li><li>"+(0,_.I)("Products that are integrated into third-party apps and sites, like ads and embedded Google Maps")+"</li></ul><p>"+(0,_.I)("You can use our services in a variety of ways to manage your privacy. For example, you can sign up for a Google Account if you want to create and manage content like emails and photos, or see more relevant search results. And you can use many Google services when you\u2019re signed out or without creating an account at all, like searching on Google or watching YouTube videos. You can also choose to browse the web privately using Chrome in Incognito mode. And across our services, you can adjust your privacy settings to control what we collect and how your information is used.")+ equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: "</li><li>"+(0,_.I)('<a href="https://kids.youtube.com/privacynotice">YouTube Kids</a>')+"</li><li>"+(0,_.I)('<a href="https://families.google.com/familylink/privacy/child-policy/">Google Accounts Managed with Family Link, for Children under 13 (or applicable age in your country)</a>')+"</li><li>",CX="",hja='href="'+_.R(_.T(_.iY({url:"https://assistant.google.com/privacy-notice-childrens-features/"},O)))+'" '+_.jZ(),ija=(0,_.Q)(hja);CX+="<a "+_.S(ija)+">";var jja=(0,_.I)(CX+"Voice and Audio Collection from Children\u2019s Features on the Google Assistant</a>"); equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: "</p><p>",Re={style:f},Kj=""+h_(_.Dy({name:"useful-ads"},Re),O),Lj=(0,_.Q)(Kj),Mj=""+h_(_.Dy({name:"people-online"},Re),O),Nj=(0,_.Q)(Mj),kd="We collect information to provide better services to all our users \u2014 from figuring out basic stuff like which language you speak, to more complex things like which <a "+(_.S(Lj)+">ads you\u2019ll find most useful</a>, <a "+(_.S(Nj)+">the people who matter most to you online</a>, or which YouTube videos you might like. The information Google collects, and how that information is used, depends on how you use our services and how you manage your privacy controls.")); equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: "</p><p>",Uk=_.lY(O)+" "+_.jZ(),jI=(0,_.Q)(Uk),kI="We also built a place for you to review and control information saved in your Google Account. Your <a "+(_.S(jI)+">Google Account</a> includes:");var lI=(0,_.I)(kI);var mI=iI+lI+"</p><h3>"+(0,_.I)("Privacy controls")+"</h3>"+o_({title:(0,_.N)(""+(0,_.I)("Activity Controls")),body:(0,_.N)(""+(0,_.I)("Decide what types of activity you\u2019d like saved in your account. For example, you can turn on Location History if you want traffic predictions for your daily commute, or you can save your YouTube Watch History to get better video suggestions.")), equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: "</p><p>",ZI='href="'+_.R(_.T(_.iY({url:"https://support.google.com/accounts?p=privpol_endorse"},O)))+'" '+_.jZ(),$I=(0,_.Q)(ZI),aJ="When you\u2019re signed in and interact with some Google services, like leaving comments on a YouTube video or reviewing an app in Play, your name and photo appear next to your activity. We may also display this information in <a "+(_.S($I)+">ads depending on your Shared endorsements setting</a>.");var Mx=(0,_.I)(aJ);var bJ=YI+Mx+"</p><h2>"+(0,_.I)("When Google shares your information")+ equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: "</p><ul><li>"+(0,_.I)("Signed-out search personalization:")+" ",tI='href="'+_.R(_.T(_.iY({url:(0,_.P)("https://www.google."+_.Vy(O.Wc)+"/history/optout?utm_source=pp")},O)))+'" '+_.jZ(),vn=(0,_.Q)(tI),uI="<a "+_.S(vn)+">Choose</a> whether your search activity is used to offer you more relevant results and recommendations.";var vI=(0,_.I)(uI);var wI=sI+vI+"</li><li>"+(0,_.I)("YouTube settings:")+" ",xI='href="'+_.R(_.T(_.iY({url:(0,_.P)("https://www.youtube.com/feed/history/search_history?utm_source=pp")}, equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "<a href='//www.facebook.com/googledocsofficial'><img alt='Facebook' src='../../docs/about/images/footer_facebook_2x.png' data-retina='16x16'></a> <a href='//twitter.com/googledocs'><img alt='YouTube' src='../../docs/about/images/footer_twitter_2x.png' data-retina='16x16'></a> <a href='http://googledocs.blogspot.com'><img alt='Blogger' src='../../docs/about/images/footer_blogger_2x.jpg' data-retina='16x16'></a> <a href='https://www.youtube.com/channel/UC-VcHhNdm1soluxzo5Fm3fQ'><img class='footer-youtube' alt='Youtube' src='../../docs/about/images/footer_youtube_2x.png' data-retina='34x16'></a></span>" equals www.facebook.com (Facebook)
Source: iexplore.exeString found in binary or memory: "<a href='//www.facebook.com/googledocsofficial'><img alt='Facebook' src='../../docs/about/images/footer_facebook_2x.png' data-retina='16x16'></a> <a href='//twitter.com/googledocs'><img alt='YouTube' src='../../docs/about/images/footer_twitter_2x.png' data-retina='16x16'></a> <a href='http://googledocs.blogspot.com'><img alt='Blogger' src='../../docs/about/images/footer_blogger_2x.jpg' data-retina='16x16'></a> <a href='https://www.youtube.com/channel/UC-VcHhNdm1soluxzo5Fm3fQ'><img class='footer-youtube' alt='Youtube' src='../../docs/about/images/footer_youtube_2x.png' data-retina='34x16'></a></span>" equals www.twitter.com (Twitter)
Source: iexplore.exeString found in binary or memory: "<a href='//www.facebook.com/googledocsofficial'><img alt='Facebook' src='../../docs/about/images/footer_facebook_2x.png' data-retina='16x16'></a> <a href='//twitter.com/googledocs'><img alt='YouTube' src='../../docs/about/images/footer_twitter_2x.png' data-retina='16x16'></a> <a href='http://googledocs.blogspot.com'><img alt='Blogger' src='../../docs/about/images/footer_blogger_2x.jpg' data-retina='16x16'></a> <a href='https://www.youtube.com/channel/UC-VcHhNdm1soluxzo5Fm3fQ'><img class='footer-youtube' alt='Youtube' src='../../docs/about/images/footer_youtube_2x.png' data-retina='34x16'></a></span>" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "<browserconfig><msapplication><config><site src='http://www.youtube.com/'/><date>0x63e62ddf,0x01d5a9fa</date><accdate>0x63e6c6ac,0x01d5a9fa</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src='C:\Users\user\Favorites\Youtube.url'/></tile></msapplication></browserconfig>" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "<browserconfig><msapplication><config><site src='http://www.youtube.com/'/><date>0x63e62ddf,0x01d5a9fa</date><accdate>0x63e6c6ac,0x01d5a9fa<Q" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\D1YBPPLZ\www.youtube[1].xml" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "Free Hotmail.url" equals www.hotmail.com (Hotmail)
Source: iexplore.exeString found in binary or memory: "Many of our services let you share information with other people, and you have control over how you share. For example, you can share videos on YouTube publicly or you can decide to keep your videos private. Remember, when you share information publicly, your content may become accessible through search engines, including Google Search." equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "Visited: user@https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "Visited: user@https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsa" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "Visited: user@https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "Visited: user@https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "Visited: user@https://www.youtube.com/embed/ggoJFaE71W8?rel=0&showinfo=0&theme=light&ve" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "Visited: user@https://www.youtube.com/embed/ggoJFaE71W8?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos." equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "We collect information about your activity in our services, which we use to do things like recommend a YouTube video you might like. The activity information we collect may include:" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "ading a YouTube video" equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "among our services and across your devices for the purposes described above. For example, if you watch videos of guitar players on YouTube, you might see an ad for guitar lessons on a site that uses our ad products. Depending on your account settings," equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: "html5_playready_enable_non_persist_license")&&(this.B.pst="0"));a="fairplay"==this.u.flavor?uG(d.initData).replace("skd://","https://"):this.u.A;g.S(this.w.experiments,"enable_shadow_yttv_channels")&&(a=new g.Am(a),document.location.origin&&document.location.origin.includes("green")?g.Cm(a,"web-green-qa.youtube.com"):g.Cm(a,"www.youtube.com"),a=a.toString());e=a=this.H=a;var k=void 0===k?!1:k;St(Ut(e,Kia,null),e,k,"Drm Licensor URL")||EG(this,"drm.net",!0,"t.x");for(var l in this.B)k=l,e=this.B[l], equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: "http":"https";this.B=Wt((b?b.customBaseYoutubeUrl:a.BASE_YT_URL)||"")||Wt(this.Fb)||this.protocol+"://www.youtube.com/";d=b?b.eventLabel:a.el;c="detailpage";"adunit"==d?c=this.u?"embedded":"detailpage":"embedded"==d||this.wb?c=qx(c,d,Dfa):d&&(c="embedded");this.P=c;mr();d=null;c=b?b.playerStyle:a.ps;var e=g.Ya(Ex,c);!c||e&&!this.wb||(d=c);this.playerStyle=d;this.G=(this.Mb=g.Ya(Ex,this.playerStyle))&&"play"!=this.playerStyle&&"jamboard"!=this.playerStyle;this.vl=!this.G;this.H=U(!1,a.disableplaybackui); equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: "igned out or without creating an account at all, like searching on Google or watching YouTube videos. You can also choose to browse the web privately using Chrome in Incognito mode. And across our services, you can adjust your privacy settings to control what we collect and how your information is used." equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: "oYBL453b0QM";break;case "fr":jd+="L99kA9f72A4";break;case "it":jd+="fQaiDJhICa4";break;case "de":jd+="P31DFowd2Lw";break;case "ko":jd+="nTN9HQgnlh8";break;case "nl":jd+="1LMk791j64M";break;case "ja":jd+="cVX10SMzNaM";break;default:jd+="ggoJFaE71W8"}var le=Gg+=n_({id:jd,style:f},O),Dj="<p>"+(0,_.I)("We build a range of services that help millions of people daily to explore and interact with the world in new ways. Our services include:")+"</p><ul><li>"+(0,_.I)("Google apps, sites, and devices, like Search, YouTube, and Google Home")+ equals www.youtube.com (Youtube)
Source: 8QTA8CVS.js.3.drString found in binary or memory: '" role="list" aria-label="'+_.W("Supporting material for the feedback.")+'">';h={Un:!1,Nx:c.H(),TB:"freebirdFormviewerViewItemsItemGradingFeedbackChip"};c=h.Un;_.Na(h.Nx);a=h.Nx;f=h.TB;h=h.YR;var k="";if(h=!(c||h)){k+='<div class="'+_.W("freebirdMaterialWidgetsFeedbackchipVideos")+'">';for(var l=a.length,n=0;n<l;n++){var q=a[n];if(q.H()){var u=_.S;q=q.H().H();q=u('<iframe src="'+_.W((0,_.cFa)("//youtube.com/embed/"+Chb(q)+"?rel=0"))+'" frameBorder="0" allowfullscreen="allowfullscreen"></iframe>')}else q= equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: (_.S(As)+">algorithms</a> to recognize patterns in data. For example, Google Translate helps people communicate across languages by detecting common language patterns in phrases you ask it to translate."));var Cs=(0,_.I)(Bs);var Ds=ws+Cs+"</p><p>",un={style:f},Es=""+h_(_.Dy({name:"combine-info"},un),O),Fs=(0,_.Q)(Es),Gs=""+h_(_.Dy({name:"other-sites"},un),O),Sk=(0,_.Q)(Gs),Hs="We may <a "+(_.S(Fs)+">combine the information we collect</a> among our services and across your devices for the purposes described above. For example, if you watch videos of guitar players on YouTube, you might see an ad for guitar lessons on a site that uses our ad products. Depending on your account settings, <a "+ equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: (_.S(Oia)+">affiliates</a>, including YouTube, Android, and services offered on third-party sites, such as advertising services. This Privacy Policy doesn\u2019t apply to services that have separate privacy policies that do not incorporate this Privacy Policy.");var Qia=(0,_.I)(Pia);var Ria=Mia+Qia+"</p><p>"+(0,_.I)("This Privacy Policy doesn\u2019t apply to:")+"</p><ul><li>"+(0,_.I)("The information practices of other companies and organizations that advertise our services")+"</li><li>"+(0,_.I)("Services offered by other companies or individuals, including products or sites that may include Google services, be displayed to you in search results, or be linked from our services")+ equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: (_.S(hs)+">"+_.J(_.eZ())+"</a></p>");var is=(0,_.I)(Qk);e=fs+is}break;case "specific-partners":switch(d){case 1:var js=e;var ks=(0,_.I)("specific partners");e=js+ks;break;case 2:var ls=e;var Rk="<p>For example, we allow YouTube creators and advertisers to work with measurement companies to learn about the audience of their YouTube videos or ads, using cookies or similar technologies. Another example is merchants on our shopping pages, who use cookies to understand how many different people see their product listings. "; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: (g.Cm(b,"www.youtube.com"),c=b.toString()):c=du(c);b=new hu(c);b.set("cmo=pf","1");d&&b.set("cmo=td","a1.googlevideo.com");return b}; equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: *.youtube.com equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: .hotmail.com1&0 equals www.hotmail.com (Hotmail)
Source: iexplore.exeString found in binary or memory: <FavoriteIcon>http://search.yahoo.co.jp/favicon.ico</FavoriteIcon> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <FavoriteIcon>http://search.yahoo.com/favicon.ico</FavoriteIcon> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: iexplore.exeString found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: iexplore.exeString found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: iexplore.exeString found in binary or memory: <SuggestionsURL>http://ie.search.yahoo.com/os?command={SearchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://br.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://de.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://es.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://espanol.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://fr.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://in.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://it.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://kr.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://ru.search.yahoo.com</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://sads.myspace.com/</URL> equals www.myspace.com (Myspace)
Source: iexplore.exeString found in binary or memory: <URL>http://search.cn.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://search.yahoo.co.jp</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://tw.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://uk.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: iexplore.exeString found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: iexplore.exeString found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: msapplication.xml0.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x63d0460b,0x01d5a9fa</date><accdate>0x63d0460b,0x01d5a9fa</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x63d0460b,0x01d5a9fa</date><accdate>0x63d0f187,0x01d5a9fa</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x63decde8,0x01d5a9fa</date><accdate>0x63decde8,0x01d5a9fa</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x63decde8,0x01d5a9fa</date><accdate>0x63e024ca,0x01d5a9fa</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x63e62ddf,0x01d5a9fa</date><accdate>0x63e62ddf,0x01d5a9fa</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x63e62ddf,0x01d5a9fa</date><accdate>0x63e6c6ac,0x01d5a9fa</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: 48l-xdS4pXg[1].htm.3.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=48l-xdS4pXg" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
Source: YlmVKT3Zvhw[1].htm.3.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=YlmVKT3Zvhw" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
Source: ZdEIZNg3epQ[1].htm.3.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=ZdEIZNg3epQ" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
Source: ggoJFaE71W8[1].htm.3.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=ggoJFaE71W8" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: @https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: Bha=function(a,b){var c=b||oC(a);if(a.ka&&!c){if(bC(a)){c=a.ka;var d=a.sa;if(!c.o["0"]){var e=new ws("0","fakesb",void 0,new os(0,0,0,void 0,void 0,"auto"),null,null,1);c.o["0"]=d?new Fy(new hu("http://www.youtube.com/videoplayback"),e,"fake"):new Vy(new hu("http://www.youtube.com/videoplayback"),e,new Mv(0,0),new Mv(0,0),0,NaN)}}return sga(dC(a),a.Na.w,a.ka,a.Wc).then(a.Es,void 0,a)}return Pp()}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: Cga=function(a,b,c,d,e){if(!(Ep||Cp()||yp()))return Pp();var f=Bga(c),k=Iz(c);if(!k)return Pp();c={};var l=(c.fairplay="https://youtube.com/api/drm/fps?ek=uninitialized",c),m;c=[];var n=[],q=[],t=g.T(a.experiments,"html5_hls_min_video_height"),v;for(v in k)if(!g.S(a.experiments,"html5_disable_drm_hfr_1080")||"383"!=v&&"373"!=v){var z=g.p(k[v]);for(m=z.next();!m.done;m=z.next()){var C=m.value;if(C.width){if(!(C.height<t)){var D=k[C.audioItag];if(D&&(c.push(C),m="fairplay"==C.o?l:null,q.push(Mz(D,[C], equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: Fka=function(){var a=_.za(_.Xc(_.Yc("https://www.youtube.com/iframe_api"))),b={},c=b.document||document,d=_.hd(a),e=_.Je(document,"SCRIPT"),f={vr:e,Wi:void 0},g=new _.Bg(Dka,f),h=null,m=null!=b.timeout?b.timeout:5E3;0<m&&(h=window.setTimeout(function(){W_(e,!0);g.Gc(new X_(1,"Timeout reached for loading script "+d))},m),f.Wi=h);e.onload=e.onreadystatechange=function(){e.readyState&&"loaded"!=e.readyState&&"complete"!=e.readyState||(W_(e,b.FD||!1,h),g.tb(null))};e.onerror=function(){W_(e,!0,h);g.Gc(new X_(0, equals www.youtube.com (Youtube)
Source: m=viewer_base[1].js.3.drString found in binary or memory: Hfa=I(L(Ig(Jg(H(f("docs-video").label("Video"),50),"video"),"Insert video"),"film | youtube | add ||"));Ifa=I(L(Ig(Jg(H(f("docs-audio").label("Audio"),29602),"volume-up"),"Insert audio"),"music | sound | add | audio |"));rfa=I(H(f("docs-insert-image-sidebar-close"),29364));sfa=I(Jg(H(f("docs-insert-image-menu").label("Image").hint("Insert image"),29365),"image-type"));tfa=I(Jg(L(H(Ig(f("docs-insert-image-upload").label("Upload from computer"),"Upload and insert image"),29366),"upload and insert image | insert via upload | upload and insert picture | upload image from computer |"), equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: Hu=function(a,b,c){this.o=a;this.uri=b||"http://youtube.com/streaming/metadata/segment/102015";this.B=void 0===c?null:c;this.u=Gu(this,"Sequence-Number");this.G=Gu(this,"Segment-Count");this.H=this.o["Segment-Durations-Ms"]||"";this.ingestionTime=Gu(this,"Ingestion-Walltime-Us")/1E6;this.w=(Gu(this,"First-Frame-Time-Us")+Gu(this,"First-Frame-Uncertainty-Us"))/1E6;this.A=Gu(this,"Target-Duration-Us")/1E6;this.D="T"==this.o["Stream-Finished"];this.C="T"==this.o.Streamable;this.cryptoPeriodIndex=Gu(this, equals www.youtube.com (Youtube)
Source: remote[1].js.3.drString found in binary or memory: I:"ytp-mdx-popup-dialog",N:{role:"dialog"},K:[{F:"div",I:"ytp-mdx-popup-dialog-inner-content",K:[{F:"div",I:"ytp-mdx-popup-title",W:"You're signed out"},{F:"div",I:"ytp-mdx-popup-description",W:"Videos you watch may be added to the TV's watch history and influence TV recommendations. To avoid this, cancel and sign in to YouTube on your computer."},{F:"div",I:"ytp-mdx-privacy-popup-buttons",K:[{F:"button",X:["ytp-button","ytp-mdx-privacy-popup-cancel"],W:"Cancel"},{F:"button",X:["ytp-button","ytp-mdx-privacy-popup-confirm"], equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: O)))+'" '+_.jZ(),yI=(0,_.Q)(xI),zI='href="'+_.R(_.T(_.iY({url:(0,_.P)("https://www.youtube.com/feed/history?utm_source=pp")},O)))+'" '+_.jZ(),AI=(0,_.Q)(zI),BI="Pause and delete your <a "+(_.S(yI)+">YouTube Search History</a> and your <a "+(_.S(AI)+">YouTube Watch History</a>."));var CI=(0,_.I)(BI);var wn=wI+CI+"</li><li>"+(0,_.I)("Ad Settings:")+" ",DI='href="'+_.R(_.T(_.iY({url:(0,_.P)("https://adssettings.google.com/?utm_source=pp")},O)))+'" '+_.jZ(),EI=(0,_.Q)(DI),FI="<a "+_.S(EI)+">Manage</a> your preferences about the ads shown to you on Google and on sites and apps that partner with Google to show ads."; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: Qia=function(a){var b,c;ya(function(d){if(1==d.o){if(!a.o)return d["return"]();g.kh(a.o,{position:"absolute",width:"1px",height:"1px",display:"block"});a.o.src=a.w.B;document.body.appendChild(a.o);a.B.M(a.o,"encrypted",a.C);b=[{initDataTypes:["keyids","cenc"],audioCapabilities:[{contentType:'audio/mp4; codecs="mp4a"'}],videoCapabilities:[{contentType:'video/mp4; codecs="avc1"'}]}];return va(d,navigator.requestMediaKeySystemAccess("com.youtube.fairplay",b),2)}c=d.u;a.w.u=c;a.u=new AG(a.o,a.w);g.B(a, equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: RG=function(a,b){g.A.call(this);this.o=g.Ld("video");this.u=null;this.w=new rz("fairplay","com.youtube.fairplay","",b);this.w.le=a;this.A=[];this.B=new g.R(this);g.B(this,this.B);Qia(this)}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: U(!0,a.deviceHasDisplay);this.Ff=rx(this.Ff,a.ismb);d=a;g.nw(this.experiments,"html5_qoe_intercept")?d=g.nw(this.experiments,"html5_qoe_intercept"):this.vl?(d=d.vss_host||"s.youtube.com",this.ea("www_for_videostats")&&"s.youtube.com"==d&&(d=Ux(this.B)||"www.youtube.com")):d="video.google.com";this.Tf=d;this.cf(a,!0);this.D=new Qw;g.B(this,this.D);this.C=this.o&&!this.ea("enable_svg_mode_on_embed_mobile");this.Ba={innertubeApiKey:sx("",a.innertube_api_key),innertubeApiVersion:sx("",a.innertube_api_version), equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: UH.prototype.D=function(a){var b=this.o.Ya,c=this.o.videoData,d={ns:b.L,el:GC(c),eurl:b.Ga,fmt:c.za?vs(c.za):0,html5:1,list:c.playlistId,cpn:c.clientPlaybackNonce,ei:c.eventId,ps:b.playerStyle,noflv:1,st:this.o.o(),video_id:c.videoId,metric:a};IC(c)&&(d.autoplay="1");"heartbeat"==a&&(d.tpmt=LH(this.u));g.Pa(d,b.deviceParams);ZH(this,g.Wg(g.S(b.experiments,"cardio_base_url_killswitch")?(b.o?b.protocol+"://www.youtube.com/":b.B)+"live_204":b.B+"live_204",d))}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: WN=function(a){var b=a.O(),c=b.u;if(c){var d=new ON(a);b={F:"div",X:["ytp-error","ytp-related-on-error"],N:{role:"alert"},K:[{F:"div",I:"ytp-error-content",K:[{F:"div",I:"ytp-error-icon-container",K:[eN()]},{F:"div",I:"ytp-error-content-wrap",K:[{F:"div",I:"ytp-error-content-wrap-reason",W:"{{content}}"},{F:"div",I:"ytp-error-content-wrap-subreason",W:"{{subreason}}"}]}]},{F:"div",I:"ytp-small-redirect",K:[{F:"a",I:"ytp-small-redirect-link",N:{href:g.py(b),target:b.A,"aria-label":"Visit YouTube to search for more videos"}, equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: Zt=function(a){var b=void 0===b?!1:b;return St(Ut(a,Yea,null),a,b,"Google/YouTube Brand Lift URL")}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: _.XZ({content:(0,_.N)(Tk)}),YI=_.rX({id:"infosharing"})+l_({name:"fa9e0e90d1e7ec399dad9f3257a9bb63",first:!0,style:f},O)+"<h1>"+_.J(_.oZ())+"</h1><h2>"+(0,_.I)("When you share your information")+"</h2><p>"+(0,_.I)("Many of our services let you share information with other people, and you have control over how you share. For example, you can share videos on YouTube publicly or you can decide to keep your videos private. Remember, when you share information publicly, your content may become accessible through search engines, including Google Search.")+ equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: _.k_=function(a,b){var c=a.id,d=a.Mf,e="";switch(_.ib(c)?c.toString():c){case "useful-ads":switch(d){case 1:var f=e;var g=(0,_.I)("ads you\u2019ll find most useful");e=f+g;break;case 2:var h=e,m="",n='href="'+_.R(_.T(_.iY({url:"https://support.google.com/accounts?p=privpol_whyad"},b)))+'"',u=(0,_.Q)(n),w='href="'+_.R(_.T(_.iY({url:"https://support.google.com/accounts?p=privpol_whyad"},b)))+'"',H=(0,_.Q)(w);m+="<p>";var E="For example, if you watch videos about baking on YouTube, you may see more ads that relate to baking as you browse the web. We also may use your IP address to determine your approximate location, so that we can serve you ads for a nearby pizza delivery service if you search for \u201cpizza.\u201d Learn more <a "+ equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: _.qX=function(a,b){a=a||{};var c=a.id,d=b.yc;a=b.uy;b=_.I;c&&!a?(a='<div class="'+_.R("M3GAob")+'"><div class="'+_.R("O3bgpc")+'">',d=(0,_.Ky)("https://www.youtube.com/embed/"+_.Uy(c)+"?rel=0&showinfo=0&theme=light&version=3&hl="+_.Uy(d)+"&cc_lang_pref="+_.Uy(d)+"&cc_load_policy=1&enablejsapi=1"),c=_.I,d=_.yy(d,_.ry)?d.Le():d instanceof _.fd?_.hd(d):"about:invalid#zSoyz",c=c('<iframe src="'+_.R(d)+'" allowfullscreen="allowfullscreen" class="'+(_.R("Ylcf5b")+'"></iframe>')),a=a+c+"</div></div>"):a= equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: a.o.o().o.G("/client_streamz/youtube/video_ads/visibility_error",c,f),0<k&&Math.random()<k)){k=["id","class","style","hidden","aria-hidden"];l=[];for(var m=b;m;){for(var n={tagName:m.tagName},q={},t=g.p(k),v=t.next();!v.done;v=t.next())v=v.value,m.hasAttribute(v)&&(q[v]=m.getAttribute(v));g.Wb(q)||(n.attributes=q);l.push(n);m=m.parentElement}k=tma(l);g.O(Error("vis_check_error_reason: "+f+", dump: "+k))}}}})(); equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: b.jb($N(b,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK","//www.youtube.com/supported_browsers"));else if(c=b.w.O().hostLanguage,d="//support.google.com/youtube/?p=player_error1",c&&(d=g.Wg(d,{hl:c})),b.jb($N(b,"GENERIC_WITH_LINK_AND_CPN",d,!0)),a.ga&&!a.u)for(a=(0,g.x)(b.H,b),c=b.element.getElementsByTagName("a"),d=0;d<c.length;d++)e=b.M(c[d],"click",a),b.D.push(e);this.w.show()}else this.w&&(this.w.dispose(),this.w=null)}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: c&&"manifest.net.connect"==a.errorCode&&(a="https://www.youtube.com/generate_204?cpn="+this.T.clientPlaybackNonce+"&t="+(0,g.Kq)(),(new bF(a,"manifest",function(f){b.Sh=!0;b.Qa("pathprobe",f)},function(f){return b.B.onError(f.errorCode,es(f.details))})).send())}}; equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: com.youtube equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: d like saved in your account. For example, you can turn on Location History if you want traffic predictions for your daily commute, or you can save your YouTube Watch History to get better video suggestions.</p><p class="n8ZyWe"><a href="https://myaccount.google.com/activitycontrols?utm_source=pp" class="ky8S2" data-track-as="pgc-pp-activitycontrols">Go to Activity Controls</a></p></div></div><div class="h0yEnd"><div class="IN2z4b"><img class="mZPFM uTLSAb" alt="" src="https://www.gstatic.com/policies/privacy/900a793eae04f4bddd675f8d95c4a794.svg"/></div><div class="gwGFXb"><h3 class="SWFQ9e">Ad settings</h3><p class="n8ZyWe">Manage your preferences about the ads shown to you on Google and on sites and apps that <a class="g1mG8c" href="privacy#footnote-partner" data-name="partner" jsaction="click:IPbaae(preventDefault=true)">partner with Google</a> to show ads. You can modify your interests, choose whether your personal information is used to make ads more relevant to you, and turn on or off certain advertising
Source: www-embed-player[1].js.3.drString found in binary or memory: e=ak+bk}break;case "deliver-services":switch(d){case 1:var Zh=e;var Ff=(0,_.I)("deliver our services");e=Zh+Ff;break;case 2:var ck=e,Gf="",dk='href="'+_.R(_.T(_.iY({url:"https://support.google.com/photos?p=privpol_manage"},b)))+'"',ek=(0,_.Q)(dk);Gf=Gf+"<p>Examples of how we use your information to deliver our services include:</p><ul><li>We use the IP address assigned to your device to send you the data you requested, such as loading a YouTube video</li><li>We use unique identifiers stored in cookies on your device to help us authenticate you as the person who should have access to your Google Account</li><li>Photos and videos you upload to Google Photos are used to help you create albums, animations, and other creations that you can share. <a "+ equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.by=function(a){a=Ux(a.B);return"www.youtube-nocookie.com"==a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.cy=function(a){return g.Sx(a)?"music.youtube.com":g.by(a)}; equals www.youtube.com (Youtube)
Source: remote[1].js.3.drString found in binary or memory: g.h.As=g.Ea;g.h.Y=function(){this.info("disposeInternal");g.ro(this.A);this.A=0;this.o&&(this.o.removeUpdateListener(this.C),this.o.removeMessageListener("urn:x-cast:com.google.youtube.mdx",this.B));this.o=null;A7.xb.Y.call(this)}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.h.MD=function(a){if(this.ia())return this;this.U=a.status;a=a.responseText;a=(new DOMParser).parseFromString(a,"text/xml").getElementsByTagName("MPD")[0];this.H=1E3*Oy(My(a,"minimumUpdatePeriod"))||Infinity;if(!this.da){var b;a:{if(a.attributes)for(b=0;b<a.attributes.length;b++)if("http://youtube.com/yt/2012/10/10"==a.attributes[b].value){b=a.attributes[b].name.split(":")[1];break a}b=""}this.ba=b}this.isLive=Infinity>this.H&&this.oa;this.aa=parseInt(My(a,hz(this,"earliestMediaSequence")),10)|| equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.h.Oj=function(a){if(1==a.info.type)this.o||(this.o=Nt(a.o)),a.u&&"http://youtube.com/streaming/otf/durations/112015"==a.u.uri&&Tfa(this,a.u);else if(2==a.info.type)if(g.As(this.info)){if(!this.index.Hb()&&(a=g.Su(bw(a),0,1936286840))){var b=[],c=cv(a);a=c.ks.length;var d=c.fo,e=c.ks,f=c.Uk;c=this.indexRange.end+c.ev+1;for(var k=0,l=0;l<a;l++){var m=f[l]/d,n=e[l];b.push(new ru(l,k,m,NaN,"range/"+c+"-"+(c+n-1)));k+=m;c+=n}this.index.append(b)}}else if(2==this.info.ac&&this.o&&(d=new lv(new DataView(this.o.buffer)), equals www.youtube.com (Youtube)
Source: remote[1].js.3.drString found in binary or memory: g.h.Y=function(){this.As("");y7.xb.Y.call(this)};g.Qa(A7,y7);g.h=A7.prototype;g.h.zs=function(a){if(this.o){if(this.o==a)return;z7(this,"Overriding cast sesison with new session object");this.o.removeUpdateListener(this.C);this.o.removeMessageListener("urn:x-cast:com.google.youtube.mdx",this.B)}this.o=a;this.o.addUpdateListener(this.C);this.o.addMessageListener("urn:x-cast:com.google.youtube.mdx",this.B);Ora(this)}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.h.clone=function(){var a=new Gm;a.w=this.w;this.o&&(a.o=this.o.clone(),a.u=this.u);return a};var Nm="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),zda=/\bocr\b/;var Ada=/(?:\[|%5B)([a-zA-Z0-9_]+)(?:\]|%5D)/g;g.Qa(g.Qm,g.A);g.h=g.Qm.prototype;g.h.start=function(){this.stop();this.A=!1;var a=Rm(this),b=Sm(this);a&&!b&&this.u.mozRequestAnimationFrame?(this.o=pe(this.u,"MozBeforePaint",this.w),this.u.mozRequestAnimationFrame(null),this.A=!0):this.o=a&&b?a.call(this.u,this.w):this.u.setTimeout(saa(this.w),20)}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.h.createSession=function(a){var b=a.initData;if(this.o.u){var c=this.C.createSession();"com.youtube.fairplay"==this.o.o&&(b=CG(b,this.o.le));b=c.generateRequest(a.contentType,b);c=new yG(null,null,null,c,null);b.then(null,jo((0,g.x)(c.Ay,c,"t.generateRequest")));return c}if(tz(this.o)){c=new Uint8Array(270);for(a=0;135>a;a++)c[2*a]='<PlayReadyCDMData type="LicenseAcquisition"><LicenseAcquisition version="1.0" Proactive="true"></LicenseAcquisition></PlayReadyCDMData>'.charCodeAt(a);b=this.w.createSession("video/mp4", equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.h.gA=function(){if(this.o.videoData.Wc){var a=this.o.videoData.Wc;IH(this,"drm-"+a.flavor);IH(this,"eme-"+(a.u?"final":tz(a)?"ms":"com.youtube.fairplay"==a.o?"ytfp":wz(a)?"safarifp":"nonfinal"))}}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.h.getAvailablePlaybackRates=function(){var a=this.app.O();a.xa?(a=a.Wb[0],a="https://admin.youtube.com"==a||"https://viacon.corp.google.com"==a?doa:D0):a=[1];return a}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.h.getVideoUrl=function(a,b,c,d,e){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=g.cy(this);d&&"www.youtube.com"==c?d="https://youtu.be/"+a:g.Yx(this)?(d="https://"+c+"/fire",b.v=a):(d=this.protocol+"://"+c+"/watch",b.v=a,Ep&&(a=Qo())&&(b.ebc=a));return g.Wg(d,b)}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.h.oe=function(a,b){b=void 0===b?!1:b;if("missing-qualities"==a)return{F:"a",N:{href:"https://support.google.com/youtube/?p=missing_quality",target:this.w.O().A},W:"Missing options?"};if("inline-survey"==a)return"";var c=[JP(this,a)],d=this.w.getPreferredQuality();b||"auto"!=d||"auto"!=a||(c.push(" "),c.push(JP(this,this.C,["ytp-menu-label-secondary"])));return{F:"div",K:c}};g.r(KP,g.X);KP.prototype.dc=function(a){g.oK(this,this.C&&400<=a.width)}; equals www.youtube.com (Youtube)
Source: remote[1].js.3.drString found in binary or memory: g.h.yM=function(a,b){if(!this.ia())if(b){var c=x6(b);if(g.La(c)){var d=""+c.type;c=c.data||{};this.info("onYoutubeMessage_: "+d+" "+g.Hk(c));switch(d){case "mdxSessionStatus":Nra(this,c.screenId);break;default:z7(this,"Unknown youtube message: "+d)}}else z7(this,"Unable to parse message.")}else z7(this,"No data in message.")}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.py=function(a){var b=g.cy(a);!a.ea("yt_embeds_disable_new_error_lozenge_url")&&Ffa.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.vC=function(a){return eC(a)&&a.le?(a={},a.fairplay="https://youtube.com/api/drm/fps?ek=uninitialized",a):a.za&&a.za.Ac||null}; equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: g.yd("ytp-svg-volume-animation-hider",this.A.element));this.B=null;this.aa=new yO;g.B(this,this.aa);this.P=new yO;g.B(this,this.P);this.ha("click",this.ga);this.M(a,"appresize",this.dc);this.M(a,"onVolumeChange",this.fa);var d=null;c.J?g.ce(this,g.hO(b.Va(),this.element)):(d="Your browser doesn't support changing the volume. $BEGIN_LINKLearn More$END_LINK".split(/\$(BEGIN|END)_LINK/),d=new qO(a,{F:"span",X:["ytp-popup","ytp-generic-popup"],N:{tabindex:"0"},K:[d[0],{F:"a",N:{href:"https://support.google.com/youtube/?p=noaudio", equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: hotmail.co.uk1 equals www.hotmail.com (Hotmail)
Source: iexplore.exeString found in binary or memory: hotmail.com1 equals www.hotmail.com (Hotmail)
Source: iexplore.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: iexplore.exeString found in binary or memory: http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: iexplore.exeString found in binary or memory: http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.gstatic.com/youtube/img/originals/ckee/crane-kick.png equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/channel/UCK8sQmJBp8GCxrOtXWBpyEA equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&c equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablej equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_p equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_p equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&show equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=l equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ggoJFaE71W8?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/feed/history/search_history?utm_source=pp equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/feed/history?utm_source=pp equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/generate_204?OmtfVA equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/yts/cssbin/www-player-vfl-sWJSq.css equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/yts/jsbin/player_ias-vflVQDSr2/en_US/remote.js equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/yts/jsbin/www-embed-player-vfl16YY-w/www-embed-player.js equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: https:www.youtube.com equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: i1.TOO_MANY_REQUESTS="Please log in to watch this video.",i1.TOO_MANY_REQUESTS_WITH_LINK="Please $BEGIN_LINKclick here$END_LINK to watch this video on YouTube.",i1.TOO_MANY_STREAMS_PER_USER="Playback stopped because too many videos belonging to the same account are playing.",i1.TOO_MANY_STREAMS_PER_ENTITLEMENT="Playback stopped because this video has been played on too many devices.",i1.UNSUPPORTED_DEVICE="Playback isn't supported on this device.",i1.VIDEO_FORBIDDEN="Access to this video is forbidden.", equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: iba=function(){if(!vf){vf=new uf;var a=wf("client_streamz_web_flush_count",-1);-1!==a&&(vf.A=a)}this.o=vf;this.o.C("/client_streamz/youtube/video_ads/visibility_error",{bv:3,av:"element_name"},{bv:3,av:"error_reason"})}; equals www.youtube.com (Youtube)
Source: remote[1].js.3.drString found in binary or memory: if (!window['YT']) {var YT = {loading: 0,loaded: 0};}if (!window['YTConfig']) {var YTConfig = {'host': 'http://www.youtube.com'};}if (!YT.loading) {YT.loading = 1;(function(){var l = [];YT.ready = function(f) {if (YT.loaded) {f();} else {l.push(f);}};window.onYTReady = function() {YT.loaded = 1;for (var i = 0; i < l.length; i++) {try {l[i]();} catch (e) {}}};YT.setConfig = function(c) {for (var k in c) {if (c.hasOwnProperty(k)) {YTConfig[k] = c[k];}}};var a = document.createElement('script');a.type = 'text/javascript';a.id = 'www-widgetapi-script';a.src = 'https://s.ytimg.com/yts/jsbin/www-widgetapi-vfl2ZwPj7/www-widgetapi.js';a.async = true;var c = document.currentScript;if (c) {var n = c.nonce || c.getAttribute('nonce');if (n) {a.setAttribute('nonce', n);}}var b = document.getElementsByTagName('script')[0];b.parentNode.insertBefore(a, b);})();} equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: if(n=Ny(b,"ContentProtection"))if(g.xp())if((q=n.attributes.schemeIdUri)&&"http://youtube.com/drm/2012/10/10"==q.value)for(q={},n=n.firstChild;null!=n;n=n.nextSibling)"yt:SystemURL"==n.nodeName&&(q[n.attributes.type.value]=n.textContent.trim());else q=null;else if((q=n.attributes.schemeIdUri)&&"http://youtube.com/drm/2012/10/10"==q.textContent)for(q={},n=n.firstChild;null!=n;n=n.nextSibling)"SystemURL"==n.localName&&"http://youtube.com/yt/2012/10/10"==n.namespaceURI&&(q[n.attributes.type.textContent]= equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: ll find most useful</a>, <a class="g1mG8c" href="privacy#footnote-people-online" data-name="people-online" jsaction="click:IPbaae(preventDefault=true)">the people who matter most to you online</a>, or which YouTube videos you might like. The information Google collects, and how that information is used, depends on how you use our services and how you manage your privacy controls.</p><p>When you equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: ll find most useful</h3><p>For example, if you watch videos about baking on YouTube, you may see more ads that relate to baking as you browse the web. We also may use your IP address to determine your approximate location, so that we can serve you ads for a nearby pizza delivery service if you search for equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: ll keep a record of your request in order to help solve any issues you might be facing.</p><h3>Protect Google, our users, and the public</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/02f8664b95445de6f27ba682f3c5f9ab.svg"/></div><p>We use information to help improve the <a class="g1mG8c" href="privacy#footnote-safety-reliability" data-name="safety-reliability" jsaction="click:IPbaae(preventDefault=true)">safety and reliability</a> of our services. This includes detecting, preventing, and responding to fraud, abuse, security risks, and technical issues that could harm Google, our users, or the public.</p><hr/><p>We use different technologies to process your information for these purposes. We use automated systems that analyze your content to provide you with things like customized search results, personalized ads, or other features tailored to how you use our services. And we analyze your content to help us <a class="g1mG8c" href="privacy#footnote-detect-abuse"
Source: privacy[1].htm.3.drString found in binary or memory: ll provide a more prominent notice (including, for certain services, email notification of Privacy Policy changes).</p></div></div><div class="m9JGT xXnO1d"><div class="nrAB0c"><div id="products" class="ahbJ5"></div><h1>Related privacy practices</h1><h2>Specific Google services</h2><p>The following privacy notices provide additional information about some Google services:</p><ul><li><a href="https://www.google.com/chrome/intl/en/privacy.html">Chrome & the Chrome Operating System</a></li><li><a href="https://play.google.com/books/intl/en/privacy.html">Play Books</a></li><li><a href="https://payments.google.com/legaldocument?family=0.privacynotice&hl=en">Payments</a></li><li><a href="https://fiber.google.com/legal/privacy.html">Fiber</a></li><li><a href="https://fi.google.com/about/tos/#project-fi-privacy-notice">Google Fi</a></li><li><a href="https://www.google.com/work/apps/terms/education_privacy.html">G Suite for Education</a></li><li><a href="https://kids.youtube.com/privacynotice">YouTube Kids</a></li><li>
Source: www-embed-player[1].js.3.drString found in binary or memory: nga=function(a,b){var c=yp(),d=c?["com.youtube.fairplay"]:["com.widevine.alpha"];b&&d.unshift("com.youtube.widevine.l3");return c?d:a?[].concat(g.ea(d),g.ea(yz.playready)):[].concat(g.ea(yz.playready),g.ea(d))}; equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: re responding to <a class="g1mG8c" href="privacy#footnote-legal" data-name="legal" jsaction="click:IPbaae(preventDefault=true)">legal process or an enforceable governmental request</a>.</p><hr/><p>If you have questions, <a href="https://support.google.com/policies/troubleshooter/7575787" class="XddVQ" target="_blank">you can contact Google and our data protection office</a>. And you can contact your local data protection authority if you have concerns regarding your rights under local law.</p></div></div><div class=" xXnO1d"><div class="nrAB0c"><div id="about" class="ahbJ5"></div><h1>About this policy</h1><h2>When this policy applies</h2><p>This Privacy Policy applies to all of the services offered by Google LLC and its <a class="g1mG8c" href="privacy#footnote-affiliates" data-name="affiliates" jsaction="click:IPbaae(preventDefault=true)">affiliates</a>, including YouTube, Android, and services offered on third-party sites, such as advertising services. This Privacy Policy doesn equals www.youtube.com (Youtube
Source: privacy[1].htm.3.drString found in binary or memory: re signed in and interact with some Google services, like leaving comments on a YouTube video or reviewing an app in Play, your name and photo appear next to your activity. We may also display this information in <a href="https://support.google.com/accounts?p=privpol_endorse" class="XddVQ" target="_blank">ads depending on your Shared endorsements setting</a>.</p><h2>When Google shares your information</h2><p>We do not share your personal information with companies, organizations, or individuals outside of Google except in the following cases:</p><h3>With your consent</h3><p>We equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: re signed in to a Google Account, including:</p><ul><li>Browser settings: For example, you can configure your browser to indicate when Google has set a <a class="g1mG8c" href="privacy#footnote-cookies-and-similar-technologies" data-name="cookies-and-similar-technologies" jsaction="click:IPbaae(preventDefault=true)">cookie</a> in your browser. You can also configure your browser to block all cookies from a specific domain or all domains. But remember that our services <a class="g1mG8c" href="privacy#footnote-rely-on-cookies" data-name="rely-on-cookies" jsaction="click:IPbaae(preventDefault=true)">rely on cookies to function properly</a>, for things like remembering your language preferences.</li><li>Device-level settings: Your device may have controls that determine what information we collect. For example, you can <a href="https://support.google.com/websearch?p=privpol_locserp" class="XddVQ" target="_blank">modify location settings</a> on your Android device.</li></ul></div></div><div class=" xXnO1d"><div clas
Source: privacy[1].htm.3.drString found in binary or memory: re signed out or without creating an account at all, like searching on Google or watching YouTube videos. You can also choose to browse the web privately using Chrome in Incognito mode. And across our services, you can adjust your privacy settings to control what we collect and how your information is used.</p><p>To help explain things as clearly as possible, we equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: re signed out, you can manage information associated with your browser or device, including:</p><ul><li>Signed-out search personalization: <a href="https://www.google.com/history/optout?utm_source=pp" class="XddVQ" target="_blank">Choose</a> whether your search activity is used to offer you more relevant results and recommendations.</li><li>YouTube settings: Pause and delete your <a href="https://www.youtube.com/feed/history/search_history?utm_source=pp" class="XddVQ" target="_blank">YouTube Search History</a> and your <a href="https://www.youtube.com/feed/history?utm_source=pp" class="XddVQ" target="_blank">YouTube Watch History</a>.</li><li>Ad Settings: <a href="https://adssettings.google.com/?utm_source=pp" class="XddVQ" target="_blank">Manage</a> your preferences about the ads shown to you on Google and on sites and apps that partner with Google to show ads.</li></ul><h2>Exporting, removing & deleting your information</h2><p>You can export a copy of content in your Google Account if you want to back it up
Source: privacy[1].htm.3.drString found in binary or memory: re using an <a class="g1mG8c" href="privacy#footnote-android-device" data-name="android-device" jsaction="click:IPbaae(preventDefault=true)">Android device with Google apps</a>, your device periodically contacts Google servers to provide information about your device and connection to our services. This information includes things like your device type, carrier name, crash reports, and which apps you've installed.</p><h3>Your activity</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/39b031d352a2e1586cf50ac7f2bbc18b.svg"/></div><p>We collect information about your activity in our services, which we use to do things like recommend a YouTube video you might like. The activity information we collect may include:</p><ul><li>Terms you search for</li><li>Videos you watch</li><li><a class="g1mG8c" href="privacy#footnote-content-views" data-name="content-views" jsaction="click:IPbaae(preventDefault=true)">Views and interactions with content and ads</a></li><li>Voice and a
Source: iexplore.exeString found in binary or memory: refererhttps://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: refererhttps://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1m equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: rz.prototype.Ld=function(){switch(this.o){case "com.youtube.playready":return"PRY";case "com.microsoft.playready":return"PRM";case "com.widevine.alpha":return"WVA";case "com.youtube.widevine.l3":return"WVY";case "com.youtube.fairplay":return"FPY";case "com.apple.fps.1_0":return"FPA";default:return this.o}}; equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: s Search engine may index that article and display it to other people if they search for your name. We may also collect information about you from trusted partners, including marketing partners who provide us with information about potential customers of our business services, and security partners who provide us with information to <a class="g1mG8c" href="privacy#footnote-against-abuse" data-name="against-abuse" jsaction="click:IPbaae(preventDefault=true)">protect against abuse</a>. We also receive information from advertisers to provide <a class="g1mG8c" href="privacy#footnote-ad-services" data-name="ad-services" jsaction="click:IPbaae(preventDefault=true)">advertising and research services on their behalf</a>.</p><p>We use various technologies to collect and store information, including <a class="g1mG8c" href="privacy#footnote-cookies-and-similar-technologies" data-name="cookies-and-similar-technologies" jsaction="click:IPbaae(preventDefault=true)">cookies</a>, <a class="g1mG8c" href="privacy#footnote-pixel
Source: privacy[1].htm.3.drString found in binary or memory: t covered in this Privacy Policy.</p></div></div><div class=" xXnO1d"><div class="nrAB0c"><div id="infochoices" class="ahbJ5"></div><div class="pTrV6d"><div class="M3GAob"><div class="O3bgpc"><iframe src="https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=en&amp;cc_lang_pref=en&amp;cc_load_policy=1&amp;enablejsapi=1" allowfullscreen="allowfullscreen" class="Ylcf5b"></iframe></div></div></div><h1>Your privacy controls</h1><p class="vxK8q">You have choices regarding the information we collect and how it's used</p><p>This section describes key controls for managing your privacy across our services. You can also visit the <a href="https://myaccount.google.com/privacycheckup?utm_source=pp" class="XddVQ" target="_blank">Privacy Checkup</a>, which provides an opportunity to review and adjust important privacy settings. In addition to these tools, we also offer specific privacy settings in our products equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: t follow the correct process. Learn more in our <a href="https://transparencyreport.google.com/user-data/overview">Transparency Report</a>.</p><div id="footnote-trends" class="ahbJ5"></div><h3>show trends</h3><p>When lots of people start searching for something, it can provide useful information about particular trends at that time. Google Trends samples Google web searches to estimate the popularity of searches over a certain period of time and shares those results publicly in aggregated terms. <a href="https://support.google.com/trends?p=privpol_about">Learn more</a></p><div id="footnote-specific-partners" class="ahbJ5"></div><h3>specific partners</h3><p>For example, we allow YouTube creators and advertisers to work with measurement companies to learn about the audience of their YouTube videos or ads, using cookies or similar technologies. Another example is merchants on our shopping pages, who use cookies to understand how many different people see their product listings. <a href="privacy/google-partners">L
Source: privacy[1].htm.3.drString found in binary or memory: t reveal information about individual people.</p><div id="footnote-deliver-services" class="ahbJ5"></div><h3>deliver our services</h3><p>Examples of how we use your information to deliver our services include:</p><ul><li>We use the IP address assigned to your device to send you the data you requested, such as loading a YouTube video</li><li>We use unique identifiers stored in cookies on your device to help us authenticate you as the person who should have access to your Google Account</li><li>Photos and videos you upload to Google Photos are used to help you create albums, animations, and other creations that you can share. <a href="https://support.google.com/photos?p=privpol_manage">Learn more</a></li><li>A flight confirmation email you receive may be used to create a equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: tO=function(a){if(!a.w){var b=(null!=Sq(["requestFullscreen","webkitRequestFullscreen","mozRequestFullScreen","msRequestFullscreen"],document.body)?"Full screen is unavailable. $BEGIN_LINKLearn More$END_LINK":"Your browser doesn't support full screen. $BEGIN_LINKLearn More$END_LINK").split(/\$(BEGIN|END)_LINK/);a.w=new qO(a.A,{F:"div",X:["ytp-popup","ytp-generic-popup"],N:{role:"alert",tabindex:"0"},K:[b[0],{F:"a",N:{href:"https://support.google.com/youtube/answer/6276924",target:a.A.O().A},W:b[2]}, equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: tga=function(a,b,c){for(var d in b)for(var e=g.p(b[d]),f=e.next();!f.done;f=e.next()){f=f.value;if(!f.Ac){if(g.S(a.w,"html5_continue_probing_on_missing_drminfo"))continue;return}for(var k in f.Ac){if(!yz[k]){if(g.S(a.w,"html5_continue_probing_on_missing_drminfo"))continue;return}for(var l=g.p(yz[k]),m=l.next();!m.done;m=l.next())m=m.value,a.u[m]=a.u[m]||new rz(k,m,f.Ac[k],a.w),a.B[k]=a.B[k]||{},a.B[k][f.mimeType]=!0}}yp()&&(a.u["com.youtube.fairplay"]=new rz("fairplay","com.youtube.fairplay","",a.w), equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: this.lu,this);VG(this,"cks"+this.o.Ld());a=this.o;"com.youtube.widevine.l3"==a.o&&a.B&&(this.oa=new RG(this.T.le,this.u.experiments),g.B(this,this.oa))}; equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: url(https://www.gstatic.com/youtube/img/originals/ckee/crane-kick@2x.png) equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: var Ff=(0,_.I)(Zh);var ck=Xh+Ff+"</p><p>"+(0,_.I)("We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos.")+"</p><h2>"+(0,_.I)("Information we collect as you use our services")+"</h2><h3>"+(0,_.I)("Your apps, browsers & devices")+"</h3>"+l_({name:"e79ea0ed464fc8952d5b5582f9f9ae53",style:f},O)+"<p>",Gf= equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: var V0={},yz=(V0.playready=["com.youtube.playready","com.microsoft.playready"],V0.widevine=["com.youtube.widevine.l3","com.widevine.alpha"],V0);g.h=g.zz.prototype;g.h.getId=function(){return this.H}; equals www.youtube.com (Youtube)
Source: remote[1].js.3.drString found in binary or memory: var b={type:"getMdxSessionStatus"};a.o?a.o.sendMessage("urn:x-cast:com.google.youtube.mdx",b,g.Ea,(0,g.x)(function(){z7(this,"Failed to send message: getMdxSessionStatus.")},a)):z7(a,"Sending yt message without session: "+g.Hk(b))},Nra=function(a,b){g.ro(a.A); equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: var nk=(0,_.I)(Hf);var If=lk+nk+"</p><h3>"+(0,_.I)("Your activity")+"</h3>"+l_({name:"39b031d352a2e1586cf50ac7f2bbc18b",style:f},O)+"<p>"+(0,_.I)("We collect information about your activity in our services, which we use to do things like recommend a YouTube video you might like. The activity information we collect may include:")+"</p><ul><li>"+(0,_.I)("Terms you search for")+"</li><li>"+(0,_.I)("Videos you watch")+"</li><li>",Jg="",ok=""+h_(_.Dy({name:"content-views"},{style:f}),O),pk=(0,_.Q)(ok); equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: ve added examples, explanatory videos, and definitions for <a href="privacy/key-terms#key-terms">key terms</a>. And if you have any questions about this Privacy Policy, you can <a href="https://support.google.com/policies?p=privpol_privts" class="XddVQ" target="_blank">contact us</a>.</p></div></div><div class=" xXnO1d"><div class="nrAB0c"><div id="infocollect" class="ahbJ5"></div><div class="pTrV6d"><div class="M3GAob"><div class="O3bgpc"><iframe src="https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=en&amp;cc_lang_pref=en&amp;cc_load_policy=1&amp;enablejsapi=1" allowfullscreen="allowfullscreen" class="Ylcf5b"></iframe></div></div></div><h1>Information Google collects</h1><p class="vxK8q">We want you to understand the types of information we collect as you use our services</p><p>We collect information to provide better services to all our users equals www.youtube.com (Youtube)
Source: privacy[1].htm.3.drString found in binary or memory: ve watched on YouTube to suggest new apps you might like.</p><p>Depending on your settings, we may also show you <a class="g1mG8c" href="privacy#footnote-personalized-ads" data-name="personalized-ads" jsaction="click:IPbaae(preventDefault=true)">personalized ads</a> based on your interests. For example, if you search for equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: wR=function(a,b){var c=a.w.O(),d=2==a.w.getPresentingPlayerType(),e=!d||b.isListed;e=!c.G&&!!b.videoId&&e;"play"!=c.playerStyle?c="https://support.google.com/youtube/?p=report_playback":(c={contact_type:"playbackissue",html5:1,ei:b.eventId,v:b.videoId,p:"movies_playback"},b.za&&(c.fmt=vs(b.za)),b.clientPlaybackNonce&&(c.cpn=b.clientPlaybackNonce),b.ie&&(c.partnerid=b.ie),c=g.Wg("//support.google.com/googleplay/",c));g.oK(a.A,e&&b.allowEmbed);g.oK(a.C,e);g.oK(a.B,e&&!b.sa);a.V.jb(c,"href");g.oK(a.D, equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: iexplore.exeString found in binary or memory: youtube.com equals www.youtube.com (Youtube)
Source: www-embed-player[1].js.3.drString found in binary or memory: {style:f}),O),cs=(0,_.Q)(bs),ds='href="'+_.R(_.T(_.iY({url:(0,_.P)("https://myaccount.google.com/security-checkup?utm_source=pp")},O)))+'" '+_.jZ(),es=(0,_.Q)(ds),fs="We use the information we collect to customize our services for you, including providing recommendations, personalized content, and <a "+(_.S(cs)+">customized search results</a>. For example, <a "+(_.S(es)+">Security Checkup</a> provides security tips adapted to how you use Google products. And Google Play uses information like apps you\u2019ve already installed and videos you\u2019ve watched on YouTube to suggest new apps you might like.")); equals www.youtube.com (Youtube)
Urls found in memory or binary dataShow sources
Source: iexplore.exeString found in binary or memory: http://%s.com
Source: iexplore.exeString found in binary or memory: http://amazon.fr/
Source: iexplore.exeString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: iexplore.exeString found in binary or memory: http://ariadna.elmundo.es/
Source: iexplore.exeString found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: iexplore.exeString found in binary or memory: http://arianna.libero.it/
Source: iexplore.exeString found in binary or memory: http://arianna.libero.it/favicon.ico
Source: iexplore.exeString found in binary or memory: http://asp.usatoday.com/
Source: iexplore.exeString found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://auone.jp/favicon.ico
Source: iexplore.exeString found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: iexplore.exeString found in binary or memory: http://br.search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://browse.guardian.co.uk/
Source: iexplore.exeString found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: iexplore.exeString found in binary or memory: http://busca.buscape.com.br/
Source: iexplore.exeString found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: iexplore.exeString found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: iexplore.exeString found in binary or memory: http://busca.igbusca.com.br/
Source: iexplore.exeString found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: iexplore.exeString found in binary or memory: http://busca.orange.es/
Source: iexplore.exeString found in binary or memory: http://busca.u
Source: iexplore.exeString found in binary or memory: http://busca.uol.com.br/
Source: iexplore.exeString found in binary or memory: http://buscador.lycos.es/
Source: iexplore.exeString found in binary or memory: http://buscador.terra.com.br/
Source: iexplore.exeString found in binary or memory: http://buscador.terra.com/
Source: iexplore.exeString found in binary or memory: http://buscador.terra.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://buscador.terra.es/
Source: iexplore.exeString found in binary or memory: http://buscar.ozu.es/
Source: iexplore.exeString found in binary or memory: http://buscar.ya.com/
Source: iexplore.exeString found in binary or memory: http://busqueda.aol.com.mx/
Source: iexplore.exeString found in binary or memory: http://cerca.lycos.it/
Source: iexplore.exeString found in binary or memory: http://cert.int-x3.letsencrypt.org/0
Source: iexplore.exeString found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: iexplore.exeString found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: iexplore.exeString found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: iexplore.exeString found in binary or memory: http://cnet.search.com/
Source: iexplore.exeString found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: iexplore.exeString found in binary or memory: http://corp.naukri.com/
Source: iexplore.exeString found in binary or memory: http://corp.naukri.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://cps.letsencrypt.org0
Source: iexplore.exeString found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: iexplore.exeString found in binary or memory: http://crl.globalsign.net/roo
Source: iexplore.exeString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: iexplore.exeString found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: iexplore.exeString found in binary or memory: http://crl.pki.g
Source: iexplore.exeString found in binary or memory: http://crl.pki.goog/GTS1O1.crl0
Source: iexplore.exeString found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: iexplore.exeString found in binary or memory: http://de.search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://es.ask.com/
Source: iexplore.exeString found in binary or memory: http://es.search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://esearch.rakuten.co.jp/
Source: iexplore.exeString found in binary or memory: http://espanol.search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://espn.go.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://find.joins.com/
Source: iexplore.exeString found in binary or memory: http://fr.search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://go.mi
Source: iexplore.exeString found in binary or memory: http://google.pchome.com.tw/
Source: iexplore.exeString found in binary or memory: http://googledocs.blogspot.com
Source: iexplore.exeString found in binary or memory: http://home.altervista.org/
Source: iexplore.exeString found in binary or memory: http://home.altervista.org/favicon.ico
Source: iexplore.exeString found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: iexplore.exeString found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: iexplore.exeString found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: iexplore.exeString found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: iexplore.exeString found in binary or memory: http://images.monster.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://img.atlas.cz/favicon.ico
Source: iexplore.exeString found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: iexplore.exeString found in binary or memory: http://in.search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: iexplore.exeString found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
Source: iexplore.exeString found in binary or memory: http://it.search.dada.net/
Source: iexplore.exeString found in binary or memory: http://it.search.dada.net/favicon.ico
Source: iexplore.exeString found in binary or memory: http://it.search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://jobsearch.monster.com/
Source: iexplore.exeString found in binary or memory: http://kr.search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://list.taobao.com/
Source: iexplore.exeString found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: iexplore.exeString found in binary or memory: http://mail.live.com/
Source: iexplore.exeString found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: iexplore.exeString found in binary or memory: http://msk.afisha.ru/
Source: iexplore.exeString found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: iexplore.exeString found in binary or memory: http://ocsp.int-x3.letsencrypt.org0/
Source: iexplore.exeString found in binary or memory: http://ocsp.pki.goog/gsr202
Source: iexplore.exeString found in binary or memory: http://ocsp.pki.goog/gts1o10
Source: iexplore.exeString found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: iexplore.exeString found in binary or memory: http://p.zhongsou.com/
Source: iexplore.exeString found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: iexplore.exeString found in binary or memory: http://price.ru/
Source: iexplore.exeString found in binary or memory: http://price.ru/favicon.ico
Source: iexplore.exeString found in binary or memory: http://recherche.linternaute.com/
Source: iexplore.exeString found in binary or memory: http://recherche.tf1.fr/
Source: iexplore.exeString found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: iexplore.exeString found in binary or memory: http://rover.ebay.com
Source: iexplore.exeString found in binary or memory: http://ru.search.yahoo.com
Source: iexplore.exeString found in binary or memory: http://sads.myspace.com/
Source: iexplore.exeString found in binary or memory: http://schema.org/CreativeWork/FormObject
Source: iexplore.exeString found in binary or memory: http://search-dyn.tiscali.it/
Source: iexplore.exeString found in binary or memory: http://search.about.com/
Source: iexplore.exeString found in binary or memory: http://search.alice.it/
Source: iexplore.exeString found in binary or memory: http://search.alice.it/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.aol.co.uk/
Source: iexplore.exeString found in binary or memory: http://search.aol.com/
Source: iexplore.exeString found in binary or memory: http://search.aol.in/
Source: iexplore.exeString found in binary or memory: http://search.atlas.cz/
Source: iexplore.exeString found in binary or memory: http://search.auction.co.kr/
Source: iexplore.exeString found in binary or memory: http://search.auone.jp/
Source: iexplore.exeString found in binary or memory: http://search.books.com.tw/
Source: iexplore.exeString found in binary or memory: http://search.books.com.tw/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.centrum.cz/
Source: iexplore.exeString found in binary or memory: http://search.centrum.cz/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.chol.com/
Source: iexplore.exeString found in binary or memory: http://search.chol.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.cn.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://search.daum.net/
Source: iexplore.exeString found in binary or memory: http://search.daum.net/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.dreamwiz.com/
Source: iexplore.exeString found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.ebay.co.uk/
Source: iexplore.exeString found in binary or memory: http://search.ebay.com/
Source: iexplore.exeString found in binary or memory: http://search.ebay.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.ebay.de/
Source: iexplore.exeString found in binary or memory: http://search.ebay.es/
Source: iexplore.exeString found in binary or memory: http://search.ebay.fr/
Source: iexplore.exeString found in binary or memory: http://search.ebay.in/
Source: iexplore.exeString found in binary or memory: http://search.ebay.it/
Source: iexplore.exeString found in binary or memory: http://search.empas.com/
Source: iexplore.exeString found in binary or memory: http://search.empas.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.espn.go.com/
Source: iexplore.exeString found in binary or memory: http://search.gamer.com.tw/
Source: iexplore.exeString found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.gismeteo.ru/
Source: iexplore.exeString found in binary or memory: http://search.goo.ne.jp/
Source: iexplore.exeString found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.hanafos.com/
Source: iexplore.exeString found in binary or memory: http://search.hanafos.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.interpark.com/
Source: iexplore.exeString found in binary or memory: http://search.ipop.co.kr/
Source: iexplore.exeString found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&amp;q=
Source: iexplore.exeString found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&amp;q=
Source: iexplore.exeString found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&amp;q=
Source: iexplore.exeString found in binary or memory: http://search.live.com/results.aspx?q=
Source: iexplore.exeString found in binary or memory: http://search.livedoor.com/
Source: iexplore.exeString found in binary or memory: http://search.livedoor.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.lycos.co.uk/
Source: iexplore.exeString found in binary or memory: http://search.lycos.com/
Source: iexplore.exeString found in binary or memory: http://search.lycos.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: iexplore.exeString found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: iexplore.exeString found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: iexplore.exeString found in binary or memory: http://search.msn.com/results.aspx?q=
Source: iexplore.exeString found in binary or memory: http://search.nate.com/
Source: iexplore.exeString found in binary or memory: http://search.naver.com/
Source: iexplore.exeString found in binary or memory: http://search.naver.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.nifty.com/
Source: iexplore.exeString found in binary or memory: http://search.orange.co.uk/
Source: iexplore.exeString found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.rediff.com/
Source: iexplore.exeString found in binary or memory: http://search.rediff.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.seznam.cz/
Source: iexplore.exeString found in binary or memory: http://search.seznam.cz/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.sify.com/
Source: iexplore.exeString found in binary or memory: http://search.yahoo.co.jp
Source: iexplore.exeString found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://search.yahoo.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: iexplore.exeString found in binary or memory: http://search.yam.com/
Source: iexplore.exeString found in binary or memory: http://search1.taobao.com/
Source: iexplore.exeString found in binary or memory: http://search2.estadao.com.br/
Source: iexplore.exeString found in binary or memory: http://searchresults.news.com.au/
Source: iexplore.exeString found in binary or memory: http://service2.bfast.com/
Source: iexplore.exeString found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: iexplore.exeString found in binary or memory: http://so-net.search.goo.ne.jp/
Source: iexplore.exeString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: iexplore.exeString found in binary or memory: http://suche.aol.de/
Source: iexplore.exeString found in binary or memory: http://suche.freenet.de/
Source: iexplore.exeString found in binary or memory: http://suche.freenet.de/favicon.ico
Source: iexplore.exeString found in binary or memory: http://suche.lycos.de/
Source: iexplore.exeString found in binary or memory: http://suche.t-online.de/
Source: iexplore.exeString found in binary or memory: http://suche.web.de/
Source: iexplore.exeString found in binary or memory: http://suche.web.de/favicon.ico
Source: iexplore.exeString found in binary or memory: http://support.google.com/accounts/answer/151657?hl=en
Source: iexplore.exeString found in binary or memory: http://survey.g.doubleclick.net/static/p3p_full_policy.xml
Source: iexplore.exeString found in binary or memory: http://treyresearch.net
Source: iexplore.exeString found in binary or memory: http://tw.search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://udn.com/
Source: iexplore.exeString found in binary or memory: http://udn.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://uk.ask.com/
Source: iexplore.exeString found in binary or memory: http://uk.ask.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://uk.search.yahoo.com/
Source: iexplore.exeString found in binary or memory: http://vachercher.lycos.fr/
Source: iexplore.exeString found in binary or memory: http://video.globo.com/
Source: iexplore.exeString found in binary or memory: http://video.globo.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://web.ask.com/
Source: iexplore.exeString found in binary or memory: http://www.%s.com
Source: iexplore.exeString found in binary or memory: http://www.abril.com.br/
Source: iexplore.exeString found in binary or memory: http://www.abril.com.br/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.alarabiya.net/
Source: iexplore.exeString found in binary or memory: http://www.alarabiya.net/favicon.i
Source: iexplore.exeString found in binary or memory: http://www.amazon.co.jp/
Source: iexplore.exeString found in binary or memory: http://www.amazon.co.uk/
Source: msapplication.xml.1.drString found in binary or memory: http://www.amazon.com/
Source: iexplore.exeString found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&amp;keyword=
Source: iexplore.exeString found in binary or memory: http://www.amazon.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&amp;tag=ie8search-20&amp;index=blended&amp;linkCode=qs&amp;c
Source: iexplore.exeString found in binary or memory: http://www.amazon.de/
Source: iexplore.exeString found in binary or memory: http://www.aol.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: iexplore.exeString found in binary or memory: http://www.arrakis.com/
Source: iexplore.exeString found in binary or memory: http://www.arrakis.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.asharqalawsat.com/
Source: iexplore.exeString found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.ask.com/
Source: iexplore.exeString found in binary or memory: http://www.auction.co.kr/auction.ico
Source: iexplore.exeString found in binary or memory: http://www.baidu.com/
Source: iexplore.exeString found in binary or memory: http://www.baidu.com/favicon.ico
Source: qp_sprite130[1].svg.3.drString found in binary or memory: http://www.bohemiancoding.com/sketch
Source: iexplore.exe, qp_sprite130[1].svg.3.drString found in binary or memory: http://www.bohemiancoding.com/sketch/ns
Source: iexplore.exeString found in binary or memory: http://www.cdiscount.com/
Source: iexplore.exeString found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.ceneo.pl/
Source: iexplore.exeString found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: iexplore.exeString found in binary or memory: http://www.cjmall.com/
Source: iexplore.exeString found in binary or memory: http://www.cjmall.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.clarin.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.cnet.co.uk/
Source: iexplore.exeString found in binary or memory: http://www.cnet.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.dailymail.co.uk/
Source: iexplore.exeString found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.docUrl.com/bar.htm
Source: iexplore.exeString found in binary or memory: http://www.etmall.com.tw/
Source: iexplore.exeString found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.excite.co.jp/
Source: iexplore.exeString found in binary or memory: http://www.expedia.com/
Source: iexplore.exeString found in binary or memory: http://www.expedia.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.gmarket.co.kr/
Source: iexplore.exeString found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.google.co.in/
Source: iexplore.exeString found in binary or memory: http://www.google.co.jp/
Source: iexplore.exeString found in binary or memory: http://www.google.co.uk/
Source: iexplore.exeString found in binary or memory: http://www.google.com.br/
Source: iexplore.exeString found in binary or memory: http://www.google.com.sa/
Source: iexplore.exeString found in binary or memory: http://www.google.com.tw/
Source: msapplication.xml1.1.drString found in binary or memory: http://www.google.com/
Source: iexplore.exeString found in binary or memory: http://www.google.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.google.cz/
Source: iexplore.exeString found in binary or memory: http://www.google.de/
Source: iexplore.exeString found in binary or memory: http://www.google.es/
Source: iexplore.exeString found in binary or memory: http://www.google.fr/
Source: iexplore.exeString found in binary or memory: http://www.google.it/
Source: iexplore.exeString found in binary or memory: http://www.google.pl/
Source: iexplore.exeString found in binary or memory: http://www.google.ru/
Source: iexplore.exeString found in binary or memory: http://www.google.si/
Source: iexplore.exeString found in binary or memory: http://www.iask.com/
Source: iexplore.exeString found in binary or memory: http://www.iask.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.kkbox.com.tw/
Source: iexplore.exeString found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.linternaute.com/favicon.ico
Source: msapplication.xml2.1.drString found in binary or memory: http://www.live.com/
Source: iexplore.exeString found in binary or memory: http://www.maktoob.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.mercadolibre.com.mx/
Source: iexplore.exeString found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.mercadolivre.com.br/
Source: iexplore.exeString found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.merlin.com.pl/
Source: iexplore.exeString found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: iexplore.exeString found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&amp;a=
Source: iexplore.exeString found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: iexplore.exeString found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: iexplore.exeString found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: iexplore.exeString found in binary or memory: http://www.mtv.com/
Source: iexplore.exeString found in binary or memory: http://www.mtv.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.myspace.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.najdi.si/
Source: iexplore.exeString found in binary or memory: http://www.najdi.si/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.nate.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.neckermann.de/
Source: iexplore.exeString found in binary or memory: http://www.neckermann.de/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.news.com.au/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.nifty.com/favicon.ico
Source: msapplication.xml3.1.drString found in binary or memory: http://www.nytimes.com/
Source: iexplore.exeString found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.orange.fr/
Source: iexplore.exeString found in binary or memory: http://www.otto.de/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.ozon.ru/
Source: iexplore.exeString found in binary or memory: http://www.ozon.ru/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.ozu.es/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.paginasamarillas.es/
Source: iexplore.exeString found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.priceminister.com/
Source: iexplore.exeString found in binary or memory: http://www.priceminister.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.rambler.ru/
Source: iexplore.exeString found in binary or memory: http://www.rambler.ru/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.recherche.aol.fr/
Source: msapplication.xml4.1.drString found in binary or memory: http://www.reddit.com/
Source: iexplore.exeString found in binary or memory: http://www.rtl.de/
Source: iexplore.exeString found in binary or memory: http://www.rtl.de/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.servicios.clarin.com/
Source: iexplore.exeString found in binary or memory: http://www.shopzilla.com/
Source: iexplore.exeString found in binary or memory: http://www.sify.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.sogou.com/
Source: iexplore.exeString found in binary or memory: http://www.sogou.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.soso.com/
Source: iexplore.exeString found in binary or memory: http://www.soso.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.t-online.de/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.taobao.com/
Source: iexplore.exeString found in binary or memory: http://www.taobao.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.target.com/
Source: iexplore.exeString found in binary or memory: http://www.target.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.tchibo.de/
Source: iexplore.exeString found in binary or memory: http://www.tchibo.de/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.tesco.com/
Source: iexplore.exeString found in binary or memory: http://www.tesco.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.tiscali.it/favicon.ico
Source: msapplication.xml5.1.drString found in binary or memory: http://www.twitter.com/
Source: iexplore.exeString found in binary or memory: http://www.univision.com/
Source: iexplore.exeString found in binary or memory: http://www.univision.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.w3.
Source: iexplore.exeString found in binary or memory: http://www.w3.or
Source: iexplore.exeString found in binary or memory: http://www.walmart.com/
Source: iexplore.exeString found in binary or memory: http://www.walmart.com/favicon.ico
Source: msapplication.xml6.1.drString found in binary or memory: http://www.wikipedia.com/
Source: iexplore.exeString found in binary or memory: http://www.ya.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://www.yam.com/favicon.ico
Source: remote[1].js.3.drString found in binary or memory: http://www.youtube.com
Source: msapplication.xml7.1.drString found in binary or memory: http://www.youtube.com/
Source: www-embed-player[1].js.3.drString found in binary or memory: http://www.youtube.com/videoplayback
Source: 48l-xdS4pXg[1].htm.3.drString found in binary or memory: http://www.youtube.com/watch?v=48l-xdS4pXg
Source: YlmVKT3Zvhw[1].htm.3.drString found in binary or memory: http://www.youtube.com/watch?v=YlmVKT3Zvhw
Source: ZdEIZNg3epQ[1].htm.3.drString found in binary or memory: http://www.youtube.com/watch?v=ZdEIZNg3epQ
Source: ggoJFaE71W8[1].htm.3.drString found in binary or memory: http://www.youtube.com/watch?v=ggoJFaE71W8
Source: iexplore.exeString found in binary or memory: http://www3.fnac.com/
Source: iexplore.exeString found in binary or memory: http://www3.fnac.com/favicon.ico
Source: iexplore.exeString found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&amp;Version=2008-06-26&amp;Operation
Source: www-embed-player[1].js.3.drString found in binary or memory: http://youtube.com/drm/2012/10/10
Source: www-embed-player[1].js.3.drString found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: www-embed-player[1].js.3.drString found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: www-embed-player[1].js.3.drString found in binary or memory: http://youtube.com/yt/2012/10/10
Source: iexplore.exeString found in binary or memory: http://z.about.com/m/a08.ico
Source: iexplore.exe, {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=gdrive;cat=googl004;ord=5840484344059
Source: iexplore.exe, terms[1].htm.3.dr, privacy[1].htm.3.drString found in binary or memory: https://about.google/
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://aboutme.google.com/?utm_source=pp
Source: www-embed-player[1].js.3.drString found in binary or memory: https://admin.youtube.com
Source: www-embed-player[1].js.3.drString found in binary or memory: https://adssettings.google.com/?utm_source=pp
Source: analytics[1].js.3.drString found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: iexplore.exe, reportabuse[1].htm.3.dr, viewform[1].htm.3.drString found in binary or memory: https://apis.google.com
Source: terms[1].htm.3.drString found in binary or memory: https://apis.google.com/js/api.js
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://assistant.google.com/privacy-notice-childrens-features/
Source: iexplore.exeString found in binary or memory: https://chrome.google.com/webstore/detail/office-editing-for-docs-s/gbkeegbaiigmenfmjfclcdgdpimamgkj
Source: iexplore.exeString found in binary or memory: https://client-channel.google.com/client-channel/client
Source: iexplore.exeString found in binary or memory: https://clients4.google.com/invalidation/lcs/client
Source: m=sy2v,sy30,sy2x,A4UTCb,syq,sy1e,sy4a,cNHZjb,sy1q,sy3f,sy45,pxq3x,RGrRJf,sy2u,sy31,VXdfxd,KFVhZe,rDGJeb[1].js.3.drString found in binary or memory: https://clients6.google.com
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://contacts.google.com
Source: m=sy2v,sy30,sy2x,A4UTCb,syq,sy1e,sy4a,cNHZjb,sy1q,sy3f,sy45,pxq3x,RGrRJf,sy2u,sy31,VXdfxd,KFVhZe,rDGJeb[1].js.3.drString found in binary or memory: https://content-googleapis-staging.sandbox.google.com
Source: m=sy2v,sy30,sy2x,A4UTCb,syq,sy1e,sy4a,cNHZjb,sy1q,sy3f,sy45,pxq3x,RGrRJf,sy2u,sy31,VXdfxd,KFVhZe,rDGJeb[1].js.3.drString found in binary or memory: https://content-googleapis-test.sandbox.google.com
Source: iexplore.exeString found in binary or memory: https://csp.withgoogle.com/csp/forms/prod;script-src
Source: iexplore.exeString found in binary or memory: https://csp.withgoogle.com/csp/s
Source: recaptcha__en[1].js.3.drString found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: recaptcha__en[1].js.3.drString found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: iexplore.exeString found in binary or memory: https://docs.goog
Source: iexplore.exeString found in binary or memory: https://docs.google.
Source: iexplore.exeString found in binary or memory: https://docs.google.c
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://docs.google.co
Source: iexplore.exeString found in binary or memory: https://docs.google.com
Source: iexplore.exeString found in binary or memory: https://docs.google.com/
Source: iexplore.exeString found in binary or memory: https://docs.google.com/favicon.ico
Source: iexplore.exeString found in binary or memory: https://docs.google.com/forms/d/e/1FA
Source: iexplore.exeString found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQ
Source: iexplore.exeString found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZ
Source: iexplore.exeString found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0Zz
Source: ~DF529033CFC3E809BE.TMP.1.dr, viewform[1].htm.3.drString found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/reportabu
Source: iexplore.exeString found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/submitabu
Source: iexplore.exeString found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/view
Source: iexplore.exe, {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/viewform
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.dr, ~DF529033CFC3E809BE.TMP.1.drString found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/viewform?
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.dr, ~DF529033CFC3E809BE.TMP.1.drString found in binary or memory: https://docs.google.com/forms/d/e/1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/viewformu
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://docs.google.com/forms/d/e/1Root
Source: www-embed-player[1].js.3.drString found in binary or memory: https://docs.google.com/get_video_info
Source: iexplore.exeString found in binary or memory: https://docs.google.com/macros/scriptGalleryPanel?mid
Source: iexplore.exeString found in binary or memory: https://docs.google.com/picker
Source: iexplore.exeString found in binary or memory: https://docs.google.com/picker?protocol
Source: iexplore.exeString found in binary or memory: https://docs.google.com/relay.html
Source: iexplore.exeString found in binary or memory: https://drive.google.com
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://e.com/privacyRoot
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://e.com/terms1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/reportabuse?source=https
Source: terms[1].htm.3.drString found in binary or memory: https://ec.europa.eu/consumers/odr/main/index.cfm?event=main.home2.show
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://families.google.com/familylink/privacy/child-policy/
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://fi.google.com/about/tos/#project-fi-privacy-notice
Source: www-embed-player[1].js.3.drString found in binary or memory: https://fiber.google.com/
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://fiber.google.com/legal/privacy.html
Source: css[1].css.3.drString found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: iexplore.exeString found in binary or memory: https://fonts.googleapis.com/
Source: iexplore.exeString found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: iexplore.exeString found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/
Source: css[1].css.3.drString found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlI3K.woff)
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owpg.woff
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwA.woff
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94b
Source: css[1].css.3.drString found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94bt3.woff)
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLV154tzCwA.woff
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/materialiconsextended/v50/kJEjBvgX7BgnkSrUwT8UnLVc38YydejYY-oE_LvP.woff
Source: iexplore.exe, css[1].css.3.drString found in binary or memory: https://fonts.gstatic.com/s/productsans/v10/pxiDypQkot1TnFhsFMOfGShlEw.woff)
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eI.woff
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1Mu51xIIzQ.woff
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc-.woff
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff
Source: css[1].css.3.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu52xM.woff)
Source: css[1].css.3.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9vAA.woff)
Source: iexplore.exeString found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5vAA.woff
Source: css[1].css.3.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5vAA.woff)
Source: css[1].css.3.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlvAA.woff)
Source: css[1].css.3.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Me5g.woff)
Source: iexplore.exeString found in binary or memory: https://forms.gle/
Source: iexplore.exeString found in binary or memory: https://forms.gle/6ydC3USmA3Exzw5x5
Source: iexplore.exeString found in binary or memory: https://googleads.g.doubleclick.net/pagead/id
Source: iexplore.exeString found in binary or memory: https://gsuite.google.com/?utm_source=formsforwork&amp;utm_medium=et&amp;utm_content=header&amp;hl=e
Source: iexplore.exeString found in binary or memory: https://gsuite.google.com/?utm_source=formsforwork&utm_medium=et&utm_content=header&hl=en
Source: iexplore.exeString found in binary or memory: https://gsuite.google.com/features/?utm_source=formsforwork&utm_medium=et&utm_campaign=refresh&utm_c
Source: iexplore.exeString found in binary or memory: https://i.ytimg.com/vi/YlmVKT3Zvhw/sddefault.jpg
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://kids.youtube.com/privacynotice
Source: iexplore.exeString found in binary or memory: https://lh3.google.com
Source: iexplore.exeString found in binary or memory: https://lh4.googleusercontent.com/
Source: iexplore.exeString found in binary or memory: https://lh4.googleusercontent.com/7hiTqprMov0LuP5wMYAwZcGmiDTUG_LVouiry_u_9mkG8nWboJbj7BmGBq5G63v3dB
Source: iexplore.exeString found in binary or memory: https://lh4.googleusercontent.com/Bk5VD3BP_OyZr5ukNaYdEk4JLdR98p035LYFxsKK269JEb-_1BrA4RYQbbFgEvUUbz
Source: iexplore.exeString found in binary or memory: https://lh4.googleusercontent.com/RVcQV9_laAs-j4WOECU49BYPkMr3U3cUJl6U-qb6AK0kYbRIJiLX57TJFYjMvBHq4G
Source: iexplore.exeString found in binary or memory: https://lh5.googleusercontent.com/
Source: iexplore.exeString found in binary or memory: https://lh5.googleusercontent.com/3lZfuB4rrIxvDVcHeoaPMdDwjuddVy2hDZw4KdOM_mxOg6m2lOUjC6Li7GfhusyLyK
Source: iexplore.exeString found in binary or memory: https://login.live.com
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/?utm_source=pp
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/activitycontrols?utm_source=pp
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/dashboard?utm_source=pp
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/deleteaccount?utm_source=pp
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/deleteservices?utm_source=pp
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/inactive?utm_source=pp
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/preferences?utm_source=pp#deleteservices
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/privacy?utm_source=pp#personalinfo
Source: www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/privacycheckup?utm_source=pp
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/security-checkup?utm_source=pp
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myaccount.google.com/shared-endorsements?utm_source=pp
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myactivity.google.com/?utm_source=pp
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myactivity.google.com/myactivity
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://myactivity.google.com/myactivity?utm_source=pp
Source: iexplore.exe, reportabuse[1].htm.3.dr, viewform[1].htm.3.drString found in binary or memory: https://ogs.google.com/widget/app/so?hl=en-GB
Source: www-embed-player[1].js.3.drString found in binary or memory: https://payments.google.com/legaldocument?family=0.privacynotice&hl=
Source: privacy[1].htm.3.drString found in binary or memory: https://payments.google.com/legaldocument?family=0.privacynotice&hl=en
Source: iexplore.exeString found in binary or memory: https://pki.goog/repository/0
Source: iexplore.exeString found in binary or memory: https://play.google.com/
Source: www-embed-player[1].js.3.drString found in binary or memory: https://play.google.com/books/intl/
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://play.google.com/books/intl/en/privacy.html
Source: iexplore.exe, L56PLHCX.js.3.dr, m=viewer_base[1].js.3.drString found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: iexplore.exeString found in binary or memory: https://play.google.com/store/apps/details?id=com.google.android.apps.docs.editors.docs&amp;hl=en
Source: iexplore.exeString found in binary or memory: https://play.google.com/store/apps/details?id=com.google.android.apps.docs.editors.docs&hl=en
Source: iexplore.exeString found in binary or memory: https://play.google.com/store/apps/details?id=com.google.android.apps.docs.editors.sheets&hl=en
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://plus.google.com/settings?utm_source=pp
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://policies.googl
Source: iexplore.exeString found in binary or memory: https://policies.google.com
Source: iexplore.exe, m=sy2v,sy30,sy2x,A4UTCb,sy4m,EcW08c,sy2u,sy31,VXdfxd[1].js.3.dr, {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://policies.google.com/
Source: iexplore.exeString found in binary or memory: https://policies.google.com/accept-languageen-USuser-agentMozilla/5.0
Source: iexplore.exeString found in binary or memory: https://policies.google.com/favicon.ico
Source: iexplore.exe, {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.dr, ~DF529033CFC3E809BE.TMP.1.dr, recaptcha__en[1].js.3.dr, viewform[1].htm.3.drString found in binary or memory: https://policies.google.com/privacy
Source: iexplore.exeString found in binary or memory: https://policies.google.com/privacy...
Source: ~DF529033CFC3E809BE.TMP.1.drString found in binary or memory: https://policies.google.com/privacyAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/reportabus
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://policies.google.com/privacyRPrivacy
Source: ~DF529033CFC3E809BE.TMP.1.drString found in binary or memory: https://policies.google.com/privacyh
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.dr, recaptcha__en[1].js.3.dr, viewform[1].htm.3.drString found in binary or memory: https://policies.google.com/terms
Source: ~DF529033CFC3E809BE.TMP.1.drString found in binary or memory: https://policies.google.com/terms1FAIpQLSdKHRysGe3a1-48gRe9u5UHSV9jbnjvYgrZFuPbY6ayd0ZzEg/reportabus
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://policies.google.com/termsdGoogle
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://privacy.google.com/businesses/affiliates
Source: remote[1].js.3.drString found in binary or memory: https://s.ytimg.com/yts/jsbin/www-widgetapi-vfl2ZwPj7/www-widgetapi.js
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://safebrowsing.google.com/?utm_source=pp
Source: iexplore.exeString found in binary or memory: https://script.google.com
Source: iexplore.exeString found in binary or memory: https://script.google.com/macros/create?mid
Source: iexplore.exeString found in binary or memory: https://script.google.com/macros/scriptManagerPanel?mid
Source: iexplore.exeString found in binary or memory: https://script.google.com/macros/start?mid
Source: iexplore.exeString found in binary or memory: https://ssl.gstatic.com/
Source: iexplore.exeString found in binary or memory: https://ssl.gstatic.com/docs/for
Source: iexplore.exeString found in binary or memory: https://ssl.gstatic.com/docs/forms/device_home/andro
Source: iexplore.exe, ~DF529033CFC3E809BE.TMP.1.drString found in binary or memory: https://ssl.gstatic.com/docs/forms/device_home/android_192.png
Source: imagestore.dat.3.drString found in binary or memory: https://ssl.gstatic.com/docs/forms/device_home/android_192.pngJ
Source: iexplore.exe, reportabuse[1].htm.3.drString found in binary or memory: https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.png
Source: imagestore.dat.1.drString found in binary or memory: https://ssl.gstatic.com/docs/spreadsheets/forms/favicon_qp2.pngW
Source: m=sy2v,sy30,sy2x,A4UTCb,syq,sy1e,sy4a,cNHZjb,sy1q,sy3f,sy45,pxq3x,RGrRJf,sy2u,sy31,VXdfxd,KFVhZe,rDGJeb[1].js.3.drString found in binary or memory: https://ssl.gstatic.com/inproduct_help/guidedhelp/guide_inproduct.js
Source: iexplore.exe, imagestore.dat.3.dr, ~DF529033CFC3E809BE.TMP.1.drString found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico
Source: imagestore.dat.3.drString found in binary or memory: https://ssl.gstatic.com/policies/favicon.ico~
Source: iexplore.exeString found in binary or memory: https://static.doubleclick.net/instream/ad_status.js
Source: iexplore.exeString found in binary or memory: https://stats.g.doubleclick.
Source: iexplore.exeString found in binary or memory: https://stats.g.doubleclick.net/
Source: analytics[1].js.3.drString found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: analytics[1].js.3.drString found in binary or memory: https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&
Source: iexplore.exeString found in binary or memory: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-28138501-1&cid=2094740509.15753
Source: www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/a?p=privpol_admin
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/accounts/answer/465?authuser=0#auto-delete
Source: terms[1].htm.3.drString found in binary or memory: https://support.google.com/accounts/bin/answer.py?hl=en&answer=58585
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/accounts?p=autocontacts&amp;hl=en_US
Source: iexplore.exeString found in binary or memory: https://support.google.com/accounts?p=autocontacts&hl=en_US
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/accounts?p=privpol_agereq&amp;hl=en_US
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/accounts?p=privpol_androidloc&amp;hl=en_US
Source: iexplore.exeString found in binary or memory: https://support.google.com/accounts?p=privpol_androidloc&hl=en_US
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/accounts?p=privpol_controlads&amp;hl=en_US
Source: iexplore.exeString found in binary or memory: https://support.google.com/accounts?p=privpol_controlads&hl=en_US
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/accounts?p=privpol_endorse
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/accounts?p=privpol_location
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/accounts?p=privpol_lochistory
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/accounts?p=privpol_phone&amp;hl=en_US
Source: www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/accounts?p=privpol_whyad
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/accounts?p=privpol_whyad&amp;hl=en_US
Source: iexplore.exeString found in binary or memory: https://support.google.com/accounts?p=privpol_whyad&hl=en_US
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/adwordspolicy?p=privpol_p13nad
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/analytics?p=privpol_data&amp;hl=en_US
Source: iexplore.exeString found in binary or memory: https://support.google.com/analytics?p=privpol_data&hl=en_US
Source: iexplore.exeString found in binary or memory: https://support.google.com/b
Source: terms[1].htm.3.drString found in binary or memory: https://support.google.com/bin/static.py?hl=en&ts=1114905&page=ts.cs
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/blogger?p=privpol_blog
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/chrome?p=privpol_chrsync
Source: iexplore.exeString found in binary or memory: https://support.google.com/docs?hl=en&amp;p=about_forms#topic=1360904
Source: iexplore.exeString found in binary or memory: https://support.google.com/docs?hl=en&p=about_forms#topic=1360904
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/googlehome?p=privpol_actions&amp;hl=en_US
Source: iexplore.exeString found in binary or memory: https://support.google.com/googlehome?p=privpol_actions&hl=en_US
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/googlehome?p=privpol_homedata
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/googleplay?p=privpol_review
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/legal?p=privpol_remove
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/mail?p=privpol_signinactivity&amp;hl=en_US
Source: iexplore.exeString found in binary or memory: https://support.google.com/mail?p=privpol_signinactivity&hl=en_US
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/photos?p=privpol_manage
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/policies/troubleshooter/7575787
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/policies?p=privpol_privts
Source: recaptcha__en[1].js.3.drString found in binary or memory: https://support.google.com/recaptcha
Source: recaptcha__en[1].js.3.drString found in binary or memory: https://support.google.com/recaptcha#6262736
Source: recaptcha__en[1].js.3.drString found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: recaptcha__en[1].js.3.drString found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/sites?p=privpol_delete
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/trends?p=privpol_about
Source: iexplore.exeString found in binary or memory: https://support.google.com/websearch?p=privpol_f
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/websearch?p=privpol_feed&amp;hl=en_US
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/websearch?p=privpol_incognito
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/websearch?p=privpol_locserp
Source: privacy[1].htm.3.drString found in binary or memory: https://support.google.com/websearch?p=privpol_privresults&amp;hl=en_US
Source: iexplore.exeString found in binary or memory: https://support.google.com/websearch?p=privpol_privresults&hl=en_US
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://support.google.com/websearch?p=privpol_searchactivity
Source: www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/youtube/?p=missing_quality
Source: www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/youtube/?p=noaudio
Source: www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/youtube/?p=report_playback
Source: www-embed-player[1].js.3.drString found in binary or memory: https://support.google.com/youtube/answer/6276924
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://takeout.google.com/?utm_source=pp
Source: www-embed-player[1].js.3.drString found in binary or memory: https://transparencyreport.google.com/user-data/overview
Source: terms[1].htm.3.dr, m=viewer_base[1].js.3.drString found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: www-embed-player[1].js.3.drString found in binary or memory: https://viacon.corp.google.com
Source: iexplore.exeString found in binary or memory: https://www.google-analytics.com/
Source: iexplore.exe, L56PLHCX.js.3.drString found in binary or memory: https://www.google-analytics.com/analytics.js
Source: iexplore.exeString found in binary or memory: https://www.google-analytics.com/collect?v=1&_v=j79&a=2015788900&t=pageview&_s=1&dl=https%3A%2F%2Fpo
Source: iexplore.exeString found in binary or memory: https://www.google-analytics.com/cx/api.js?experiment=5v_emUBMSAWeh0ciEkJCnQ
Source: analytics[1].js.3.drString found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: www-embed-player[1].js.3.drString found in binary or memory: https://www.google.
Source: analytics[1].js.3.drString found in binary or memory: https://www.google.%/ads/ga-audiences
Source: iexplore.exe, reportabuse[1].htm.3.dr, viewform[1].htm.3.drString found in binary or memory: https://www.google.co.uk/intl/en-GB/about/products
Source: reportabuse[1].htm.3.dr, {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://www.google.com
Source: privacy[1].htm.3.drString found in binary or memory: https://www.google.com/
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://www.google.com/about/datacenters/inside/locations
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.google.com/chrome/intl/en/privacy.html
Source: terms[1].htm.3.drString found in binary or memory: https://www.google.com/contact/
Source: iexplore.exeString found in binary or memory: https://www.google.com/docs/about/images/footer_blogger_2x.jpg
Source: iexplore.exeString found in binary or memory: https://www.google.com/docs/about/images/footer_twitter_2x.png
Source: iexplore.exeString found in binary or memory: https://www.google.com/docs/about/images/footer_youtube_2x.png
Source: iexplore.exeString found in binary or memory: https://www.google.com/favicon.ico
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/abou
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/about/
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/about/?utm_source=product&u
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&ut
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaig
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.dr, ~DF529033CFC3E809BE.TMP.1.drString found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=forms#star
Source: ~DF529033CFC3E809BE.TMP.1.drString found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsB
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsaccep
Source: {8BD3F2DA-15ED-11EA-AADB-C25F135D3C65}.dat.1.drString found in binary or memory: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsdGoog
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/about/css/forms.en.min.css
Source: iexplore.exeString found in binary or memory: https://www.google.com/forms/about/images/icons.png
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://www.google.com/history/optout
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.google.com/history/optout?utm_source=pp
Source: iexplore.exeString found in binary or memory: https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_74
Source: privacy[1].htm.3.drString found in binary or memory: https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_74x24dp.png
Source: privacy[1].htm.3.drString found in binary or memory: https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
Source: iexplore.exeString found in binary or memory: https://www.google.com/insights/consumersurveys/async_survey?site=o2wf7v7b3vtysenpfxlgwdgxiy
Source: iexplore.exeString found in binary or memory: https://www.google.com/insights/consumersurveys/gk/prompt?site=o2wf7v7b3vtysenpfxlgwdgxiy&lang=en-US
Source: iexplore.exeString found in binary or memory: https://www.google.com/insights/consumersurveys/gk/static/hats-integration-release.js
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.google.com/intl/en/safetycenter/
Source: iexplore.exeString found in binary or memory: https://www.google.com/js/google.js
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.google.com/landing/2step/?utm_source=pp
Source: L56PLHCX.js.3.dr, m=viewer_base[1].js.3.drString found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: recaptcha__en[1].js.3.drString found in binary or memory: https://www.google.com/recaptcha/
Source: privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://www.google.com/work/apps/terms/education_privacy.html
Source: www-embed-player[1].js.3.drString found in binary or memory: https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2i
Source: www-embed-player[1].js.3.drString found in binary or memory: https://www.gstatic.
Source: iexplore.exeString found in binary or memory: https://www.gstatic.com/
Source: viewform[1].htm.3.drString found in binary or memory: https://www.gstatic.com/_/freebird/_/js/k=freebird.v.en_GB.ATjH2S8Jjs8.O/d=1/ct=zgms/rs=AMjVe6j_n5cC
Source: iexplore.exe, terms[1].htm.3.dr, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdentityPoliciesUi.en_US.xz6sbJOovvw.
Source: remote[1].js.3.drString found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: iexplore.exeString found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: viewform[1].htm.3.drString found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_dark_clr_74x24px.svg
Source: iexplore.exeString found in binary or memory: https://www.gstatic.com/images/icons/material/system/svg/keyboard_arrow_up_24px.svg
Source: iexplore.exe, reportabuse[1].htm.3.dr, viewform[1].htm.3.drString found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.FuPHTLYtkKo.O/rt=j/m=qabr
Source: iexplore.exe, reportabuse[1].htm.3.dr, viewform[1].htm.3.drString found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.FuPHTLYtkKo.O/rt=j/m=qdsh/d=1/ed=1/rs=AA2YrTviBaLQX4o
Source: iexplore.exeString found in binary or memory: https://www.gstatic.com/policies/p
Source: iexplore.exeString found in binary or memory: https://www.gstatic.com/policies/privacy
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/02698a3383765bd3c250471c53a86c5a.svg
Source: privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/02f8664b95445de6f27ba682f3c5f9ab.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/0d6da8d8c44e7e3ee95c4d56c19f04e1.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/13062c65605335a46d14656c46af3868.svg
Source: privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/1fa3e4ce8ac456f39ed02a6f9eb49b14.svg
Source: privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/2951277d4c35389d7d304ed78d4fb6f6.svg
Source: privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/3394102be0315326fd760e503b31c7b6.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/39b031d352a2e1586cf50ac7f2bbc18b.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/4165cd3aa643abb80fe1953668f67551.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/4c5ee41d52605ff6f43538d46a1c0d35.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/4f19891c43001db11efc8048f9bc7cdb.svg
Source: privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/51cd09d6239edc9652bc05ad1d149a5c.svg
Source: privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/546f2b674b407304a2570e71a216e509.svg
Source: privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/5959e84c2197c8a27da0a717f1cd47d5.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/5e7cd445f8861a262a3da876f855a4cc.svg
Source: privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/900a793eae04f4bddd675f8d95c4a794.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/9c1bd42ba6ec58ce82eef30bbb30ecc3.svg
Source: privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/a8e78fa7fa279aa946fe1a9d6a0508f2.svg
Source: privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/acad335ad7ba163209d8c3e671b2c445.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/b18d13e9ea8a362642b7d25bce665039.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/c1b97d74dace7e43a9ccb26841a7cae4.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/d1b68e2cd423aba52d74f02573df2d2d.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/e28714c71f217892f72b2698ea5cefef.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/e60586c0029adec0bacd3e48470ca6c6.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/e79ea0ed464fc8952d5b5582f9f9ae53.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/fa9e0e90d1e7ec399dad9f3257a9bb63.svg
Source: iexplore.exe, privacy[1].htm.3.drString found in binary or memory: https://www.gstatic.com/policies/privacy/fb61fc4bfc85ad86f11342e699d685e9.svg
Source: recaptcha__en[1].js.3.drString found in binary or memory: https://www.gstatic.com/recaptcha/api2/logo_48.png
Source: m=viewer_base[1].js.3.dr, api[1].js.3.drString found in binary or memory: https://www.gstatic.com/recaptcha/releases/75nbHAdFrusJCwoMVGTXoHoM/recaptcha__en.js
Source: iexplore.exeString found in binary or memory: https://www.gstatic.com/youtube/img/originals/ckee/crane-kick
Source: iexplore.exeString found in binary or memory: https://www.gstatic.com/youtube/img/originals/ckee/crane-kick.png
Source: iexplore.exeString found in binary or memory: https://www.msn.com/spartan/ientp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&NTLogo=1
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/channel/UC-VcHhNdm1soluxzo5Fm3fQ
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/channel/UCK8sQmJBp8GCxrOtXWBpyEA
Source: www-embed-player[1].js.3.drString found in binary or memory: https://www.youtube.com/embed/
Source: privacy[1].htm.3.drString found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: privacy[1].htm.3.drString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_p
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: privacy[1].htm.3.drString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&show
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=l
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ggoJFaE71W8?rel=0&showinfo=0&theme=light&ve
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/embed/ggoJFaE71W8?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://www.youtube.com/feed/history/search_history?utm_source=pp
Source: iexplore.exe, privacy[1].htm.3.dr, www-embed-player[1].js.3.drString found in binary or memory: https://www.youtube.com/feed/history?utm_source=pp
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/generate_204?OmtfVA
Source: www-embed-player[1].js.3.drString found in binary or memory: https://www.youtube.com/generate_204?cpn=
Source: www-embed-player[1].js.3.drString found in binary or memory: https://www.youtube.com/iframe_api
Source: 48l-xdS4pXg[1].htm.3.drString found in binary or memory: https://www.youtube.com/watch?v=48l-xdS4pXg
Source: YlmVKT3Zvhw[1].htm.3.drString found in binary or memory: https://www.youtube.com/watch?v=YlmVKT3Zvhw
Source: ZdEIZNg3epQ[1].htm.3.drString found in binary or memory: https://www.youtube.com/watch?v=ZdEIZNg3epQ
Source: ggoJFaE71W8[1].htm.3.drString found in binary or memory: https://www.youtube.com/watch?v=ggoJFaE71W8
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/yts/cssbin/www-player-vfl-sWJSq.css
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/yts/jsbin/player_ias-vflVQDSr2/en_US/remote.js
Source: iexplore.exeString found in binary or memory: https://www.youtube.com/yts/jsbin/www-embed-player-vfl16YY-w/www-embed-player.js
Source: www-embed-player[1].js.3.drString found in binary or memory: https://youtu.be/
Source: www-embed-player[1].js.3.drString found in binary or memory: https://youtube.com/api/drm/fps?ek=uninitialized
Source: iexplore.exeString found in binary or memory: https://yt3.ggpht.com/-v0soe-ievYE/AAAAAAAAAAI/AAAAAAAAAAA/OixOH_h84Po/s68-c-k-no-mo-rj-c0xffffff/ph

System Summary:

barindex
Classification labelShow sources
Source: classification engineClassification label: clean1.win@3/64@0/15
Creates files inside the user directoryShow sources
Source: C:\Program Files\internet explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\HighJump to behavior
Creates temporary filesShow sources
Source: C:\Program Files\internet explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Temp\~DFA77275FAC469BC18.TMPJump to behavior
Reads ini filesShow sources
Source: C:\Program Files\internet explorer\iexplore.exeFile read: C:\Users\desktop.iniJump to behavior
Sample might require command line argumentsShow sources
Source: iexplore.exeString found in binary or memory: api-ms-win-stateseparation-helpers-l1-1-0
Source: iexplore.exeString found in binary or memory: "Opens the Favorites folder.-Adds the current page to your Favorites list.-Displays more items in your Favorites folder.)Opens this item in your Favorites folder."
Source: iexplore.exeString found in binary or memory: "Show blocked pop-ups.4Remove the current site from the allowed sites list./Add the current site to the allowed sites list."
Source: iexplore.exeString found in binary or memory: "%Opens a new Internet Explorer window./Adds the current page to your Favorites folder.&Previews how this document will print.*Prints the document in the selected frame."
Source: iexplore.exeString found in binary or memory: "6This is the full list of %s. No filters are available. Sho&w: %s0Add-ons that have been used by Internet Explorer-Add-ons that run without requiring permission$Downloaded ActiveX Controls (32-bit)-Add-ons currently loaded in Internet Explorer"
Source: iexplore.exeString found in binary or memory: "Add-on encountered a problem-Add-ons currently loaded in Internet Explorer)The attempt to update this add-on failed.[The add-on was installed successfully. Please restart your computer to complete the update.:There is no update available for this add-on at this time.$The add-on was updated successfully."
Source: iexplore.exeString found in binary or memory: "// Get the auto-launch preference from registry"
Source: iexplore.exeString found in binary or memory: "// Set the auto-launch preference from registry"
Source: iexplore.exeString found in binary or memory: "The device has succeeded a query-stop and its resource requirements have changed."
Source: iexplore.exeString found in binary or memory: "The components threading model has changed after install into a COM+ Application. Please re-install component."
Source: iexplore.exeString found in binary or memory: "The device's co-installer has additional work to perform after installation is complete."
Source: iexplore.exeString found in binary or memory: "The device's co-installer is invalid."
Source: iexplore.exeString found in binary or memory: "BitLocker Drive Encryption can only be used for limited provisioning or recovery purposes when the computer is running in pre-installation or recovery environments."
Source: iexplore.exeString found in binary or memory: =*.audiobook-additional-material-staging.googleusercontent.com
Source: iexplore.exeString found in binary or memory: 5*.audiobook-additional-material.googleusercontent.com
Source: iexplore.exeString found in binary or memory: "Google'><meta name='apple-mobile-web-app-status-bar-style' content='black'><meta name='msapplication-tap-highlight' content='no'><link rel='manifest' crossorigin='use-credentials' href='_/IdentityPoliciesUi/manifest.json'><link rel='home' href='/?lfhs=2'><link rel='msapplication-starturl' href='/?lfhs=2'><link rel='icon' href='//ssl.gstatic.com/policies/favicon.ico' sizes='32x32'><link rel='apple-touch-icon-precomposed' href='//ssl.gstatic.com/policies/favicon.ico' sizes='32x32'><link rel='msapplication-square32x32l"
Source: iexplore.exeString found in binary or memory: ytp-clip-start-exclude
Source: iexplore.exeString found in binary or memory: "function p(a,c,b){b&&(c=m(c,b));if(document.addEventListener)try{q(document,'DOMContentLoaded',c,a)}catch(d){q(window,'load',c,a)}else if(!document.uniqueID&&document.expando)var e=document.createElement('tempnode'),k=window.setInterval(function(){try{e.doScroll('left')}catch(a){return}window.clearInterval(k);k=e=null;b&&(c=m(c,b));c()},50);else'readyState'in document?k=window.setInterval(function(){/loaded|complete/.test(document.readyState)&&(window.clearInterval(k),k=null,b&&(c=m(c,b)),c())},50):"
Source: iexplore.exeString found in binary or memory: ytp-clip-start-enabled
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-scale-m2
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-header-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-scale-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-person-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-time-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-scale-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-grid-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-person-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-header
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-grid-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-header-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-radio-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-radio-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-radio-m2
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-circle-outline
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-checkbox-grid-m2
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-checkbox-grid-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-checkbox-grid-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-checkbox-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-checkbox-m2
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-file-upload-m2
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-short-text-m2
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-file-upload-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-collaborators-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-file-upload-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-collaborators-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-circle-outline-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-time-m2
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-time-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-to-drive
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-help-outline-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-help-outline-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-group-add-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-group-add
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-group-add-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-help-outline
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-circle-outline-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-collaborators-m2-blue
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-multiple-choice-grid-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-multiple-choice-grid-m2
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-multiple-choice-grid-w
Source: iexplore.exeString found in binary or memory: msapplication-starturl
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-help-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-help-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-collaborators-m2-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-collaborators-m2-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-short-text-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-long-text-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-dropdown-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-checkbox-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-short-text-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-long-text-m2
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-to-drive-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-question-b
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-dropdown-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-dropdown-m2
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-long-text-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-to-drive-w
Source: iexplore.exeString found in binary or memory: freebird-qp-icon-add-question-w
Source: iexplore.exeString found in binary or memory: "<section class='section-text-right section-addons light-gray js-vertical-wrapper' id='section-organized'>"
Spawns processesShow sources
Source: unknownProcess created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknownProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1472 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1472 CREDAT:17410 /prefetch:2
Found graphical window changes (likely an installer)Show sources
Source: Window RecorderWindow detected: More than 3 window changes detected
Uses new MSVCR DllsShow sources
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile opened: C:\Program Files (x86)\Java\jre1.8.0_171\bin\msvcr100.dll

Malware Analysis System Evasion:

barindex
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)Show sources
Source: iexplore.exeBinary or memory string: "The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported."
Source: iexplore.exeBinary or memory string: "Hyper-V RAW"
Source: iexplore.exeBinary or memory string: "A Virtual Machine could not be started because Hyper-V is not installed."
Source: iexplore.exeBinary or memory string: "An unknown internal message was received by the Hyper-V Compute Service."
Source: iexplore.exeBinary or memory string: "A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service."

HIPS / PFW / Operating System Protection Evasion:

barindex
May try to detect the Windows Explorer process (often used for injection)Show sources
Source: iexplore.exeBinary or memory string: Shell_TrayWnd
Source: iexplore.exeBinary or memory string: Progman
Source: iexplore.exeBinary or memory string: "Program Manager"

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Simulations

Behavior and APIs

No simulations

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.mercadolivre.com.br/0%VirustotalBrowse
http://www.mercadolivre.com.br/0%Avira URL Cloudsafe
http://www.merlin.com.pl/favicon.ico0%VirustotalBrowse
http://www.merlin.com.pl/favicon.ico0%URL Reputationsafe
http://www.dailymail.co.uk/0%VirustotalBrowse
http://www.dailymail.co.uk/0%URL Reputationsafe
http://busca.igbusca.com.br//app/static/images/favicon.ico0%VirustotalBrowse
http://busca.igbusca.com.br//app/static/images/favicon.ico0%URL Reputationsafe
http://www.etmall.com.tw/favicon.ico0%VirustotalBrowse
http://www.etmall.com.tw/favicon.ico0%URL Reputationsafe
http://it.search.dada.net/favicon.ico0%VirustotalBrowse
http://it.search.dada.net/favicon.ico0%URL Reputationsafe
http://cps.letsencrypt.org00%URL Reputationsafe
http://search.hanafos.com/favicon.ico0%VirustotalBrowse
http://search.hanafos.com/favicon.ico0%URL Reputationsafe
http://cgi.search.biglobe.ne.jp/favicon.ico0%VirustotalBrowse
http://cgi.search.biglobe.ne.jp/favicon.ico0%Avira URL Cloudsafe
http://ocsp.pki.goog/gts1o100%VirustotalBrowse
http://ocsp.pki.goog/gts1o100%URL Reputationsafe
http://search.msn.co.jp/results.aspx?q=0%VirustotalBrowse
http://search.msn.co.jp/results.aspx?q=0%URL Reputationsafe
http://buscar.ozu.es/0%VirustotalBrowse
http://buscar.ozu.es/0%Avira URL Cloudsafe
http://ocsp.pki.goog/gsr2020%VirustotalBrowse
http://ocsp.pki.goog/gsr2020%URL Reputationsafe
https://pki.goog/repository/00%VirustotalBrowse
https://pki.goog/repository/00%URL Reputationsafe
http://search.auction.co.kr/0%VirustotalBrowse
http://search.auction.co.kr/0%URL Reputationsafe
http://www.pchome.com.tw/favicon.ico0%VirustotalBrowse
http://www.pchome.com.tw/favicon.ico0%Avira URL Cloudsafe
http://browse.guardian.co.uk/favicon.ico0%VirustotalBrowse
http://browse.guardian.co.uk/favicon.ico0%URL Reputationsafe
http://crl.pki.goog/gsr2/gsr2.crl0?0%VirustotalBrowse
http://crl.pki.goog/gsr2/gsr2.crl0?0%URL Reputationsafe
http://google.pchome.com.tw/0%VirustotalBrowse
http://google.pchome.com.tw/0%Avira URL Cloudsafe
http://www.ozu.es/favicon.ico0%VirustotalBrowse
http://www.ozu.es/favicon.ico0%Avira URL Cloudsafe
http://search.yahoo.co.jp/favicon.ico0%VirustotalBrowse
http://search.yahoo.co.jp/favicon.ico0%URL Reputationsafe
http://www.gmarket.co.kr/0%VirustotalBrowse
http://www.gmarket.co.kr/0%URL Reputationsafe
http://search.orange.co.uk/favicon.ico0%VirustotalBrowse
http://search.orange.co.uk/favicon.ico0%Avira URL Cloudsafe
http://www.iask.com/0%VirustotalBrowse
http://www.iask.com/0%Avira URL Cloudsafe
http://service2.bfast.com/0%VirustotalBrowse
http://service2.bfast.com/0%URL Reputationsafe
http://www.news.com.au/favicon.ico0%VirustotalBrowse
http://www.news.com.au/favicon.ico0%Avira URL Cloudsafe
http://www.kkbox.com.tw/0%VirustotalBrowse
http://www.kkbox.com.tw/0%URL Reputationsafe
http://search.goo.ne.jp/favicon.ico0%VirustotalBrowse
http://search.goo.ne.jp/favicon.ico0%URL Reputationsafe
http://www.etmall.com.tw/0%VirustotalBrowse
http://www.etmall.com.tw/0%URL Reputationsafe
http://busca.u0%URL Reputationsafe
http://www.amazon.co.uk/0%VirustotalBrowse
http://www.amazon.co.uk/0%URL Reputationsafe
http://www.asharqalawsat.com/favicon.ico0%VirustotalBrowse
http://www.asharqalawsat.com/favicon.ico0%URL Reputationsafe
http://www.bohemiancoding.com/sketch/ns0%VirustotalBrowse
http://www.bohemiancoding.com/sketch/ns0%URL Reputationsafe
http://search.ipop.co.kr/0%VirustotalBrowse
http://search.ipop.co.kr/0%Avira URL Cloudsafe
http://www.auction.co.kr/auction.ico0%VirustotalBrowse
http://www.auction.co.kr/auction.ico0%URL Reputationsafe
http://www.google.co.uk/0%VirustotalBrowse
http://www.google.co.uk/0%URL Reputationsafe
http://buscador.terra.com/favicon.ico0%VirustotalBrowse
http://buscador.terra.com/favicon.ico0%URL Reputationsafe
http://search.aol.co.uk/0%VirustotalBrowse
http://search.aol.co.uk/0%URL Reputationsafe

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Sigma Overview

No Sigma rule has matched

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.