Loading ...

Play interactive tourEdit tour

Analysis Report https://www.dropbox.com/l/AADKgDerK3lHiM3qnhW9BWh54TzEq-0iGXg

Overview

General Information

Sample URL:https://www.dropbox.com/l/AADKgDerK3lHiM3qnhW9BWh54TzEq-0iGXg
Analysis ID:288399

Most interesting Screenshot:

Detection

HTMLPhisher
Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected HtmlPhish_20
Machine Learning detection for dropped file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Found iframes

Classification

Startup

  • System is w10x64
  • iexplore.exe (PID: 6960 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)
    • iexplore.exe (PID: 6304 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6960 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
    • AcroRd32.exe (PID: 3564 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\PO-5768998.pdf' MD5: B969CF0C7B2C443A99034881E8C8740A)
      • AcroRd32.exe (PID: 6272 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\PO-5768998.pdf' MD5: B969CF0C7B2C443A99034881E8C8740A)
      • RdrCEF.exe (PID: 4756 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043 MD5: 9AEBA3BACD721484391D15478A4080C7)
        • RdrCEF.exe (PID: 576 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1676,6905499376188301876,10177320632993814160,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14463303234348024165 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14463303234348024165 --renderer-client-id=2 --mojo-platform-channel-handle=1684 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)
        • RdrCEF.exe (PID: 5944 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1676,6905499376188301876,10177320632993814160,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=15098322715590812793 --mojo-platform-channel-handle=1644 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2 MD5: 9AEBA3BACD721484391D15478A4080C7)
        • RdrCEF.exe (PID: 4856 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1676,6905499376188301876,10177320632993814160,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=1406752274300373567 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1406752274300373567 --renderer-client-id=4 --mojo-platform-channel-handle=1824 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)
        • RdrCEF.exe (PID: 6156 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1676,6905499376188301876,10177320632993814160,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=9402474987747731311 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9402474987747731311 --renderer-client-id=5 --mojo-platform-channel-handle=1820 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)
        • RdrCEF.exe (PID: 1080 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1676,6905499376188301876,10177320632993814160,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=13750737160807874874 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13750737160807874874 --renderer-client-id=6 --mojo-platform-channel-handle=2144 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)
      • iexplore.exe (PID: 4024 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' https://docs.google.com/forms/d/e/1FAIpQLSebnI6U3vuH-76yfrtz1xewplrsCORjI8_DgBB3yvXztqqUEw/viewform MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)
        • iexplore.exe (PID: 2628 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4024 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\viewform[1].htmJoeSecurity_HtmlPhish_20Yara detected HtmlPhish_20Joe Security

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Machine Learning detection for dropped fileShow sources
    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\PO-5768998[1].pdfJoe Sandbox ML: detected
    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\PO-5768998.pdf.qpdgdhf.partialJoe Sandbox ML: detected

    Phishing:

    barindex
    Yara detected HtmlPhish_20Show sources
    Source: Yara matchFile source: 035347.pages.csv, type: HTML
    Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\viewform[1].htm, type: DROPPED
    Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsHTTP Parser: Iframe src: //2542116.fls.doubleclick.net/activityi;src=2542116;type=gdrive;cat=googl004;ord=7021429979156.827?
    Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsHTTP Parser: Iframe src: //2542116.fls.doubleclick.net/activityi;src=2542116;type=gdrive;cat=googl004;ord=7021429979156.827?
    Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsHTTP Parser: No <meta name="author".. found
    Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsHTTP Parser: No <meta name="author".. found
    Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsHTTP Parser: No <meta name="copyright".. found
    Source: https://www.google.com/forms/about/?utm_source=product&utm_medium=forms_logo&utm_campaign=formsHTTP Parser: No <meta name="copyright".. found
    Source: about[1].htm.29.drString found in binary or memory: <a href="//www.facebook.com/googledocsofficial"><img alt="Facebook" data-retina="16x16" src="../../docs/about/images/footer_facebook_2x.png"/></a> <a href="//twitter.com/googledocs"><img alt="YouTube" data-retina="16x16" src="../../docs/about/images/footer_twitter_2x.png"/></a> <a href="http://googledocs.blogspot.com"><img alt="Blogger" data-retina="16x16" src="../../docs/about/images/footer_blogger_2x.jpg"/></a> <a href="https://www.youtube.com/channel/UC-VcHhNdm1soluxzo5Fm3fQ"><img alt="Youtube" class="footer-youtube" data-retina="34x16" src="../../docs/about/images/footer_youtube_2x.png"/></a></span> equals www.facebook.com (Facebook)
    Source: about[1].htm.29.drString found in binary or memory: <a href="//www.facebook.com/googledocsofficial"><img alt="Facebook" data-retina="16x16" src="../../docs/about/images/footer_facebook_2x.png"/></a> <a href="//twitter.com/googledocs"><img alt="YouTube" data-retina="16x16" src="../../docs/about/images/footer_twitter_2x.png"/></a> <a href="http://googledocs.blogspot.com"><img alt="Blogger" data-retina="16x16" src="../../docs/about/images/footer_blogger_2x.jpg"/></a> <a href="https://www.youtube.com/channel/UC-VcHhNdm1soluxzo5Fm3fQ"><img alt="Youtube" class="footer-youtube" data-retina="34x16" src="../../docs/about/images/footer_youtube_2x.png"/></a></span> equals www.twitter.com (Twitter)
    Source: about[1].htm.29.drString found in binary or memory: <a href="//www.facebook.com/googledocsofficial"><img alt="Facebook" data-retina="16x16" src="../../docs/about/images/footer_facebook_2x.png"/></a> <a href="//twitter.com/googledocs"><img alt="YouTube" data-retina="16x16" src="../../docs/about/images/footer_twitter_2x.png"/></a> <a href="http://googledocs.blogspot.com"><img alt="Blogger" data-retina="16x16" src="../../docs/about/images/footer_blogger_2x.jpg"/></a> <a href="https://www.youtube.com/channel/UC-VcHhNdm1soluxzo5Fm3fQ"><img alt="Youtube" class="footer-youtube" data-retina="34x16" src="../../docs/about/images/footer_youtube_2x.png"/></a></span> equals www.youtube.com (Youtube)
    Source: 48l-xdS4pXg[1].htm.29.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=48l-xdS4pXg"> equals www.youtube.com (Youtube)
    Source: YlmVKT3Zvhw[1].htm.29.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=YlmVKT3Zvhw"> equals www.youtube.com (Youtube)
    Source: ZdEIZNg3epQ[1].htm.29.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=ZdEIZNg3epQ"> equals www.youtube.com (Youtube)
    Source: ggoJFaE71W8[1].htm.29.drString found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=ggoJFaE71W8"> equals www.youtube.com (Youtube)
    Source: privacy[1].htm.29.drString found in binary or memory: like an email address to receive updates about our services.</p><p>We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos.</p><h2>Information we collect as you use our services</h2><h3>Your apps, browsers & devices</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/e79ea0ed464fc8952d5b5582f9f9ae53.svg"/></div><p>We collect information about the apps, browsers, and <a class="g1mG8c" href="privacy#footnote-devices" data-name="devices" jsaction="click:IPbaae(preventDefault=true)">devices</a> you use to access Google services, which helps us provide features like automatic product updates and dimming your screen if your battery runs low.</p><p>The information we collect includes <a class="g1mG8c" href="privacy#footnote-unique-id" data-name="unique-id" jsaction="click:IPbaae(preventDefault=true)">unique identifiers</a>, browser type and settings, device type and settings, operating system, mobile network information including carrier name and phone number, and application version number. We also collect information about the interaction of your apps, browsers, and devices with our services, including <a class="g1mG8c" href="privacy#footnote-ip" data-name="ip" jsaction="click:IPbaae(preventDefault=true)">IP address</a>, crash reports, system activity, and the date, time, and <a class="g1mG8c" href="privacy#footnote-referrer-url" data-name="referrer-url" jsaction="click:IPbaae(preventDefault=true)">referrer URL</a> of your request.</p><p>We collect this information when a Google service on your device contacts our servers equals www.youtube.com (Youtube)
    Source: FRXRJ3EQ.js.29.drString found in binary or memory: "</p><ul><li>"+(0,_.G)("Signed-out search personalization:")+" ",Ju='href="'+_.P(_.S(_.o2({url:(0,_.L)("https://www.google."+_.Jw(b.tc)+"/history/optout?utm_source=pp")},b)))+'" '+_.w3(),Ku=(0,_.M)(Ju),Lu="<a "+_.R(Ku)+">Choose</a> whether your search activity is used to offer you more relevant results and recommendations.";var wo=(0,_.G)(Lu);var Mu=Iu+wo+"</li><li>"+(0,_.G)("YouTube settings:")+" ",Nu='href="'+_.P(_.S(_.o2({url:(0,_.L)("https://www.youtube.com/feed/history/search_history?utm_source=pp")}, equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: (g.$m(b,"www.youtube.com"),c=b.toString()):c=pv(c);b=new rv(c);b.set("cmo=pf","1");d&&b.set("cmo=td","a1.googlevideo.com");return b}; equals www.youtube.com (Youtube)
    Source: www-widgetapi[1].js.29.drString found in binary or memory: ;function Y(a,b,c){this.l=this.f=this.g=null;this.j=Ra(this);this.h=0;this.s=!1;this.m=[];this.i=null;this.v=c;this.G={};c=document;if(a="string"===typeof a?c.getElementById(a):a)if(c="iframe"==a.tagName.toLowerCase(),b.host||(b.host=c?oc(a.src):"https://www.youtube.com"),this.g=new Oe(b),c||(b=ji(this,a),this.l=a,(c=a.parentNode)&&c.replaceChild(b,a),a=b),this.f=a,this.f.id||(this.f.id="widget"+Ra(this.f)),Ie[this.f.id]=this,window.postMessage){this.i=new N;ki(this);b=S(this.g,"events");for(var d in b)b.hasOwnProperty(d)&& equals www.youtube.com (Youtube)
    Source: msapplication.xml1.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x59a5f073,0x01d690d4</date><accdate>0x59a5f073,0x01d690d4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
    Source: msapplication.xml1.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x59a5f073,0x01d690d4</date><accdate>0x59a5f073,0x01d690d4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
    Source: msapplication.xml6.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x59aab529,0x01d690d4</date><accdate>0x59aab529,0x01d690d4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
    Source: msapplication.xml6.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x59aab529,0x01d690d4</date><accdate>0x59aab529,0x01d690d4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
    Source: msapplication.xml8.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x59ad17a0,0x01d690d4</date><accdate>0x59ad17a0,0x01d690d4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
    Source: msapplication.xml8.1.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x59ad17a0,0x01d690d4</date><accdate>0x59ad17a0,0x01d690d4</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
    Source: 48l-xdS4pXg[1].htm.29.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=48l-xdS4pXg" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
    Source: YlmVKT3Zvhw[1].htm.29.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=YlmVKT3Zvhw" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
    Source: ZdEIZNg3epQ[1].htm.29.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=ZdEIZNg3epQ" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
    Source: ggoJFaE71W8[1].htm.29.drString found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="http://www.youtube.com/watch?v=ggoJFaE71W8" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: Ena=function(a,b,c){Ana(a,b);if(!Bna(a,b)&&!Cna(a,b,c))if(MH(b)&&a.videoData.ya&&a.videoData.ya.u)HH(a,b.errorCode,b.details),Dna(a);else if(b.o){c=a.o?a.o.G.A:null;if(MH(b)&&c&&c.isLocked())var d="FORMAT_UNAVAILABLE";else if(!a.Da.C&&"auth"===b.errorCode&&"429"===b.details.rc){d="TOO_MANY_REQUESTS";var e="6"}a.R("playererror",b.errorCode,d,ix(b.details),e)}else d=/^pp/.test(a.videoData.clientPlaybackNonce),HH(a,b.errorCode,b.details),d&&"manifest.net.connect"===b.errorCode&&(b="https://www.youtube.com/generate_204?cpn="+ equals www.youtube.com (Youtube)
    Source: FKPF6EM5.js.29.drString found in binary or memory: _.L1=function(a,b){a=a||{};a=a.id;var c=b.Oc,d=b.pC;b=_.G;_.zw(a)&&!d?(d='<div class="'+_.P("M3GAob")+'"><div class="'+_.P("O3bgpc")+'">',a=(0,_.Aea)("https://www.youtube.com/embed/"+_.Iw(a)+"?rel=0&showinfo=0&theme=light&version=3&hl="+_.Iw(c)+"&cc_lang_pref="+_.Iw(c)+"&cc_load_policy=1&enablejsapi=1"),a=(0,_.G)('<iframe src="'+_.P(a)+'" allowfullscreen="allowfullscreen" class="'+(_.P("Ylcf5b")+'"></iframe>')),a=d+a+"</div></div>"):a="";return b(a)}; equals www.youtube.com (Youtube)
    Source: FRXRJ3EQ.js.29.drString found in binary or memory: b)))+'" '+_.w3(),ej=(0,_.M)(Nu),Ou='href="'+_.P(_.S(_.o2({url:(0,_.L)("https://www.youtube.com/feed/history?utm_source=pp")},b)))+'" '+_.w3(),Pu=(0,_.M)(Ou),Qu="Pause and delete your <a "+(_.R(ej)+">YouTube Search History</a> and your <a "+(_.R(Pu)+">YouTube Watch History</a>."));var Ru=(0,_.G)(Qu);var Su=Mu+Ru+"</li><li>"+(0,_.G)("Ad Settings:")+" ",Tu='href="'+_.P(_.S(_.o2({url:(0,_.L)("https://adssettings.google.com/?utm_source=pp")},b)))+'" '+_.w3(),Uu=(0,_.M)(Tu),Vu="<a "+_.R(Uu)+">Manage</a> your preferences about the ads shown to you on Google and on sites and apps that partner with Google to show ads."; equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: b),this.J=!1,this.videoData.da("html5_playready_enable_non_persist_license")&&(this.C.pst="0"));b=Pz(this.u)?UG(c.initData).replace("skd://","https://"):this.u.A;this.videoData.da("enable_shadow_yttv_channels")&&(b=new g.Ym(b),document.location.origin&&document.location.origin.includes("green")?g.$m(b,"web-green-qa.youtube.com"):g.$m(b,"www.youtube.com"),b=b.toString());this.baseUrl=b;this.fairplayKeyId=Nd(this.baseUrl,"ek")||"";this.T=this.videoData.da("html5_use_drm_retry");this.U=c.u;$G(this,"sessioninit."+ equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: b?b.hostLanguage||"en":Ey("en",a.host_language);this.Nj=!this.ba&&Math.random()<g.O(this.experiments,"web_player_api_logging_fraction");this.X=!this.ba;this.enabledEngageTypes=new Set;this.deviceHasDisplay=S(!0,a.deviceHasDisplay);this.ki=Dy(this.ki,a.ismb);m=a;g.dv(this.experiments,"html5_qoe_intercept")?m=g.dv(this.experiments,"html5_qoe_intercept"):this.Op?(m=m.vss_host||"s.youtube.com",this.da("www_for_videostats")&&"s.youtube.com"===m&&(m=Xy(this.G)||"www.youtube.com")):m="video.google.com"; equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: cJ=function(a,b){var c=a.provider.o,d=a.provider.videoData,e={ns:c.S,el:sC(d),eurl:c.za,fmt:d.Ba?Du(d.Ba):0,html5:1,list:d.playlistId,cpn:d.clientPlaybackNonce,ei:d.eventId,ps:c.playerStyle,noflv:1,st:a.provider.u(),video_id:d.videoId,metric:b};vC(d)&&(e.autoplay="1");"heartbeat"===b&&(e.tpmt=CI(a.o));g.Va(e,c.deviceParams);$I(a,g.Jd(g.P(c.experiments,"cardio_base_url_killswitch")?(c.o?c.protocol+"://www.youtube.com/":c.G)+"live_204":c.G+"live_204",e))}; equals www.youtube.com (Youtube)
    Source: privacy[1].htm.29.drString found in binary or memory: d like saved in your account. For example, you can turn on Location History if you want traffic predictions for your daily commute, or you can save your YouTube Watch History to get better video suggestions.</p><p class="n8ZyWe"><a href="https://myaccount.google.com/activitycontrols?utm_source=pp" class="ky8S2" data-track-as="pgc-pp-activitycontrols">Go to Activity Controls</a></p></div></div><div class="h0yEnd"><div class="IN2z4b"><img class="mZPFM uTLSAb" alt="" src="https://www.gstatic.com/policies/privacy/900a793eae04f4bddd675f8d95c4a794.svg"/></div><div class="gwGFXb"><h3 class="SWFQ9e">Ad settings</h3><p class="n8ZyWe">Manage your preferences about the ads shown to you on Google and on sites and apps that <a class="g1mG8c" href="privacy#footnote-partner" data-name="partner" jsaction="click:IPbaae(preventDefault=true)">partner with Google</a> to show ads. You can modify your interests, choose whether your personal information is used to make ads more relevant to you, and turn on or off certain advertising services.</p><p class="n8ZyWe"><a href="https://adssettings.google.com/?utm_source=pp" class="ky8S2" data-track-as="pgc-pp-adssettings">Go to Ad Settings</a></p></div></div><div class="h0yEnd"><div class="IN2z4b"><img class="mZPFM uTLSAb" alt="" src="https://www.gstatic.com/policies/privacy/c1b97d74dace7e43a9ccb26841a7cae4.svg"/></div><div class="gwGFXb"><h3 class="SWFQ9e">About you</h3><p class="n8ZyWe">Control what others see about you across Google services.</p><p class="n8ZyWe"><a href="https://aboutme.google.com/?utm_source=pp" class="ky8S2" data-track-as="pgc-pp-aboutme">Go to About You</a></p></div></div><div class="h0yEnd"><div class="IN2z4b"><img class="mZPFM uTLSAb" alt="" src="https://www.gstatic.com/policies/privacy/e28714c71f217892f72b2698ea5cefef.svg"/></div><div class="gwGFXb"><h3 class="SWFQ9e">Shared endorsements</h3><p class="n8ZyWe">Choose whether your name and photo appear next to your activity, like reviews and recommendations, that appear in ads.</p><p class="n8ZyWe"><a href="https://myaccount.google.com/shared-endorsements?utm_source=pp" class="ky8S2" data-track-as="pgc-pp-sharedendorsements">Go to Shared Endorsements</a></p></div></div><div class="h0yEnd"><div class="IN2z4b"><img class="mZPFM uTLSAb" alt="" src="https://www.gstatic.com/policies/privacy/9c1bd42ba6ec58ce82eef30bbb30ecc3.svg"/></div><div class="gwGFXb"><h3 class="SWFQ9e">Information you share</h3><p class="n8ZyWe">If you equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: dka=function(a,b){if(!a.o["0"]){var c=new Yv("0","fakesb",void 0,new Tv(0,0,0,void 0,void 0,"auto"),null,null,1);a.o["0"]=b?new gw(new rv("http://www.youtube.com/videoplayback"),c,"fake"):new yw(new rv("http://www.youtube.com/videoplayback"),c,new qu(0,0),new qu(0,0),0,NaN)}}; equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: g.CO.prototype.u=function(a){var b=this;$oa(this);var c=a.Hu,d=this.api.M();"GENERIC_WITHOUT_LINK"!==c||d.C?"TOO_MANY_REQUESTS"===c?(d=this.api.getVideoData(),this.Zb(FO(this,"TOO_MANY_REQUESTS_WITH_LINK",d.cj(),void 0,void 0,void 0,!1))):"HTML5_NO_AVAILABLE_FORMATS_FALLBACK"!==c||d.C?this.Zb(g.DO(a.errorMessage)):this.Zb(FO(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK","//www.youtube.com/supported_browsers")):(a=d.hostLanguage,c="//support.google.com/youtube/?p=player_error1",a&&(c=g.Jd(c, equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: g.ez=function(a){a=Xy(a.G);return"www.youtube-nocookie.com"===a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: g.k.clone=function(){var a=new dn;a.A=this.A;this.o&&(a.o=this.o.clone(),a.u=this.u);return a};var ln="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),vda=/\bocr\b/;var wda=/(?:\[|%5B)([a-zA-Z0-9_]+)(?:\]|%5D)/g;on.prototype.set=function(a,b){b=void 0===b?!0:b;0<=a&&52>a&&0===a%1&&this.u[a]!=b&&(this.u[a]=b,this.o=-1)}; equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: g.k.getVideoUrl=function(a,b,c,d,e){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=g.fz(this);d&&"www.youtube.com"===c?d="https://youtu.be/"+a:g.az(this)?(d="https://"+c+"/fire",b.v=a):(d=this.protocol+"://"+c+"/watch",b.v=a,ik&&(a=Pp())&&(b.ebc=a));return g.Jd(d,b)}; equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: g.vz=function(a){var b=g.fz(a);!a.da("yt_embeds_disable_new_error_lozenge_url")&&yka.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
    Source: {BDEFE3CF-FCC7-11EA-90E2-ECF4BB862DED}.dat.28.drString found in binary or memory: https://www.youtube.com/embed/48l-xdS4pXg?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
    Source: {BDEFE3CF-FCC7-11EA-90E2-ECF4BB862DED}.dat.28.drString found in binary or memory: https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
    Source: {BDEFE3CF-FCC7-11EA-90E2-ECF4BB862DED}.dat.28.drString found in binary or memory: https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
    Source: {BDEFE3CF-FCC7-11EA-90E2-ECF4BB862DED}.dat.28.drString found in binary or memory: https://www.youtube.com/embed/ggoJFaE71W8?rel=0&showinfo=0&theme=light&version=3&hl=en&cc_lang_pref=en&cc_load_policy=1&enablejsapi=1 equals www.youtube.com (Youtube)
    Source: iframe_api[1].js.29.drString found in binary or memory: if (!window['YT']) {var YT = {loading: 0,loaded: 0};}if (!window['YTConfig']) {var YTConfig = {'host': 'http://www.youtube.com'};}if (!YT.loading) {YT.loading = 1;(function(){var l = [];YT.ready = function(f) {if (YT.loaded) {f();} else {l.push(f);}};window.onYTReady = function() {YT.loaded = 1;for (var i = 0; i < l.length; i++) {try {l[i]();} catch (e) {}}};YT.setConfig = function(c) {for (var k in c) {if (c.hasOwnProperty(k)) {YTConfig[k] = c[k];}}};var a = document.createElement('script');a.type = 'text/javascript';a.id = 'www-widgetapi-script';a.src = 'https://s.ytimg.com/yts/jsbin/www-widgetapi-vfloQ445V/www-widgetapi.js';a.async = true;var c = document.currentScript;if (c) {var n = c.nonce || c.getAttribute('nonce');if (n) {a.setAttribute('nonce', n);}}var b = document.getElementsByTagName('script')[0];b.parentNode.insertBefore(a, b);})();} equals www.youtube.com (Youtube)
    Source: privacy[1].htm.29.drString found in binary or memory: ll keep a record of your request in order to help solve any issues you might be facing.</p><h3>Protect Google, our users, and the public</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/02f8664b95445de6f27ba682f3c5f9ab.svg"/></div><p>We use information to help improve the <a class="g1mG8c" href="privacy#footnote-safety-reliability" data-name="safety-reliability" jsaction="click:IPbaae(preventDefault=true)">safety and reliability</a> of our services. This includes detecting, preventing, and responding to fraud, abuse, security risks, and technical issues that could harm Google, our users, or the public.</p><hr/><p>We use different technologies to process your information for these purposes. We use automated systems that analyze your content to provide you with things like customized search results, personalized ads, or other features tailored to how you use our services. And we analyze your content to help us <a class="g1mG8c" href="privacy#footnote-detect-abuse" data-name="detect-abuse" jsaction="click:IPbaae(preventDefault=true)">detect abuse</a> such as spam, malware, and illegal content. We also use <a class="g1mG8c" href="privacy#footnote-algorithm" data-name="algorithm" jsaction="click:IPbaae(preventDefault=true)">algorithms</a> to recognize patterns in data. For example, Google Translate helps people communicate across languages by detecting common language patterns in phrases you ask it to translate.</p><p>We may <a class="g1mG8c" href="privacy#footnote-combine-info" data-name="combine-info" jsaction="click:IPbaae(preventDefault=true)">combine the information we collect</a> among our services and across your devices for the purposes described above. For example, if you watch videos of guitar players on YouTube, you might see an ad for guitar lessons on a site that uses our ad products. Depending on your account settings, <a class="g1mG8c" href="privacy#footnote-other-sites" data-name="other-sites" jsaction="click:IPbaae(preventDefault=true)">your activity on other sites and apps</a> may be associated with your personal information in order to improve Google equals www.youtube.com (Youtube)
    Source: privacy[1].htm.29.drString found in binary or memory: ll provide a more prominent notice (including, for certain services, email notification of Privacy Policy changes).</p></div></div><div class="m9JGT xXnO1d"><div class="nrAB0c"><div id="products" class="ahbJ5"></div><h1>Related privacy practices</h1><h2>Specific Google services</h2><p>The following privacy notices provide additional information about some Google services:</p><ul><li><a href="https://www.google.com/chrome/intl/en/privacy.html" class="XddVQ" target="_blank">Chrome & the Chrome Operating System</a></li><li><a href="https://payments.google.com/legaldocument?family=0.privacynotice&hl=en" class="XddVQ" target="_blank">Payments</a></li><li><a href="https://fiber.google.com/legal/privacy.html" class="XddVQ" target="_blank">Fiber</a></li><li><a href="https://fi.google.com/about/tos/#project-fi-privacy-notice" class="XddVQ" target="_blank">Google Fi</a></li><li><a href="https://www.google.com/work/apps/terms/education_privacy.html" class="XddVQ" target="_blank">G Suite for Education</a></li><li><a href="https://readalong.google/intl/en_GB/privacy" class="XddVQ" target="_blank">Read Along</a></li><li><a href="https://kids.youtube.com/privacynotice" class="XddVQ" target="_blank">YouTube Kids</a></li><li><a href="https://families.google.com/familylink/privacy/child-policy/" class="XddVQ" target="_blank">Google Accounts Managed with Family Link, for Children under 13 (or applicable age in your country)</a></li><li><a href="https://assistant.google.com/privacy-notice-childrens-features/" class="XddVQ" target="_blank">Voice and Audio Collection from Children equals www.youtube.com (Youtube)
    Source: privacy[1].htm.29.drString found in binary or memory: re signed in to a Google Account, including:</p><ul><li>Browser settings: For example, you can configure your browser to indicate when Google has set a <a class="g1mG8c" href="privacy#footnote-cookies" data-name="cookies" jsaction="click:IPbaae(preventDefault=true)">cookie</a> in your browser. You can also configure your browser to block all cookies from a specific domain or all domains. But remember that our services <a class="g1mG8c" href="privacy#footnote-rely-on-cookies" data-name="rely-on-cookies" jsaction="click:IPbaae(preventDefault=true)">rely on cookies to function properly</a>, for things like remembering your language preferences.</li><li>Device-level settings: Your device may have controls that determine what information we collect. For example, you can <a href="https://support.google.com/websearch?p=privpol_locserp" class="XddVQ" target="_blank">modify location settings</a> on your Android device.</li></ul></div></div><div class=" xXnO1d"><div class="nrAB0c"><div id="infosharing" class="ahbJ5"></div><div class="pjyxF m2dIJf"><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/fa9e0e90d1e7ec399dad9f3257a9bb63.svg"/></div><h1>Sharing your information</h1><h2>When you share your information</h2><p>Many of our services let you share information with other people, and you have control over how you share. For example, you can share videos on YouTube publicly or you can decide to keep your videos private. Remember, when you share information publicly, your content may become accessible through search engines, including Google Search.</p><p>When you equals www.youtube.com (Youtube)
    Source: privacy[1].htm.29.drString found in binary or memory: re signed out, you can manage information associated with your browser or device, including:</p><ul><li>Signed-out search personalization: <a href="https://www.google.com/history/optout?utm_source=pp" class="XddVQ" target="_blank">Choose</a> whether your search activity is used to offer you more relevant results and recommendations.</li><li>YouTube settings: Pause and delete your <a href="https://www.youtube.com/feed/history/search_history?utm_source=pp" class="XddVQ" target="_blank">YouTube Search History</a> and your <a href="https://www.youtube.com/feed/history?utm_source=pp" class="XddVQ" target="_blank">YouTube Watch History</a>.</li><li>Ad Settings: <a href="https://adssettings.google.com/?utm_source=pp" class="XddVQ" target="_blank">Manage</a> your preferences about the ads shown to you on Google and on sites and apps that partner with Google to show ads.</li></ul><h2>Exporting, removing & deleting your information</h2><p>You can export a copy of content in your Google Account if you want to back it up or use it with a service outside of Google.</p><div class="h0yEnd"><div class="IN2z4b"><img class="mZPFM " alt="" src="https://www.gstatic.com/policies/privacy/5959e84c2197c8a27da0a717f1cd47d5.svg"/></div><div class="gwGFXb"><p class="n8ZyWe"><a href="https://takeout.google.com/?utm_source=pp" class="ky8S2" data-track-as="pgc-pp-takeout">Export your data</a></p></div></div><p>You can also <a href="https://support.google.com/legal?p=privpol_remove" class="XddVQ" target="_blank">request to remove content</a> from specific Google services based on applicable law.</p><p>To delete your information, you can:</p><ul><li>Delete your content from <a class="g1mG8c" href="privacy#footnote-delete-specific" data-name="delete-specific" jsaction="click:IPbaae(preventDefault=true)">specific Google services</a></li><li>Search for and then delete specific items from your account using <a href="https://myactivity.google.com/?utm_source=pp" class="XddVQ" target="_blank">My Activity</a></li><li><a href="https://myaccount.google.com/deleteservices?utm_source=pp" class="XddVQ" target="_blank">Delete specific Google products</a>, including your information associated with those products</li><li><a href="https://myaccount.google.com/deleteaccount?utm_source=pp" class="XddVQ" target="_blank">Delete your entire Google Account</a></li></ul><div class="h0yEnd"><div class="IN2z4b"><img class="mZPFM " alt="" src="https://www.gstatic.com/policies/privacy/1fa3e4ce8ac456f39ed02a6f9eb49b14.svg"/></div><div class="gwGFXb"><p class="n8ZyWe"><a href="https://myaccount.google.com/delete-services-or-account?utm_source=pp" class="ky8S2" data-track-as="pgc-pp-delete">Delete your information</a></p></div></div><p>And finally, <a href="https://myaccount.google.com/inactive?utm_source=pp" class="XddVQ" target="_blank">Inactive Account Manager</a> allows you to give someone else access to parts of your Google Account in case you equals www.youtube.com (Youtube)
    Source: privacy[1].htm.29.drString found in binary or memory: re using an <a class="g1mG8c" href="privacy#footnote-android-device" data-name="android-device" jsaction="click:IPbaae(preventDefault=true)">Android device with Google apps</a>, your device periodically contacts Google servers to provide information about your device and connection to our services. This information includes things like your device type, carrier name, crash reports, and which apps you've installed.</p><h3>Your activity</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/39b031d352a2e1586cf50ac7f2bbc18b.svg"/></div><p>We collect information about your activity in our services, which we use to do things like recommend a YouTube video you might like. The activity information we collect may include:</p><ul><li>Terms you search for</li><li>Videos you watch</li><li><a class="g1mG8c" href="privacy#footnote-content-views" data-name="content-views" jsaction="click:IPbaae(preventDefault=true)">Views and interactions with content and ads</a></li><li>Voice and audio information when you use audio features</li><li>Purchase activity</li><li>People with whom you communicate or share content</li><li>Activity on third-party sites and apps that use our services</li><li>Chrome browsing history you equals www.youtube.com (Youtube)
    Source: privacy[1].htm.29.drString found in binary or memory: s Search engine may index that article and display it to other people if they search for your name. We may also collect information about you from trusted partners, including marketing partners who provide us with information about potential customers of our business services, and security partners who provide us with information to <a class="g1mG8c" href="privacy#footnote-against-abuse" data-name="against-abuse" jsaction="click:IPbaae(preventDefault=true)">protect against abuse</a>. We also receive information from advertisers to provide <a class="g1mG8c" href="privacy#footnote-ad-services" data-name="ad-services" jsaction="click:IPbaae(preventDefault=true)">advertising and research services on their behalf</a>.</p><p>We use various technologies to collect and store information, including <a class="g1mG8c" href="privacy#footnote-cookies" data-name="cookies" jsaction="click:IPbaae(preventDefault=true)">cookies</a>, <a class="g1mG8c" href="privacy#footnote-pixel" data-name="pixel" jsaction="click:IPbaae(preventDefault=true)">pixel tags</a>, local storage, such as <a class="g1mG8c" href="privacy#footnote-browser-storage" data-name="browser-storage" jsaction="click:IPbaae(preventDefault=true)">browser web storage</a> or <a class="g1mG8c" href="privacy#footnote-application-data-cache" data-name="application-data-cache" jsaction="click:IPbaae(preventDefault=true)">application data caches</a>, databases, and <a class="g1mG8c" href="privacy#footnote-server-logs" data-name="server-logs" jsaction="click:IPbaae(preventDefault=true)">server logs</a>.</p></div></div><div class=" xXnO1d"><div class="nrAB0c"><div id="whycollect" class="ahbJ5"></div><div class="pTrV6d"><div class="M3GAob"><div class="O3bgpc"><iframe src="https://www.youtube.com/embed/48l-xdS4pXg?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=en&amp;cc_lang_pref=en&amp;cc_load_policy=1&amp;enablejsapi=1" allowfullscreen="allowfullscreen" class="Ylcf5b"></iframe></div></div></div><h1>Why Google collects data</h1><p class="vxK8q">We use data to build better services</p><p>We use the information we collect from all our services for the following purposes:</p><h3>Provide our services</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/b18d13e9ea8a362642b7d25bce665039.svg"/></div><p>We use your information to <a class="g1mG8c" href="privacy#footnote-deliver-services" data-name="deliver-services" jsaction="click:IPbaae(preventDefault=true)">deliver our services</a>, like processing the terms you search for in order to return results or helping you share content by suggesting recipients from your contacts.<h3>Maintain & improve our services</h3><div class="pjyxF "><img class="zZLvvc" alt="" src="https://www.gstatic.com/policies/privacy/4165cd3aa643abb80fe1953668f67551.svg"/></div><p>We also use your information to <a class="g1mG8c" href="privacy#footnote-ensure-working" data-name="ensure-working" jsaction="click:IPbaae(preventDefault=true)">ensure
    Source: privacy[1].htm.29.drString found in binary or memory: t covered in this Privacy Policy.</p></div></div><div class=" xXnO1d"><div class="nrAB0c"><div id="infochoices" class="ahbJ5"></div><div class="pTrV6d"><div class="M3GAob"><div class="O3bgpc"><iframe src="https://www.youtube.com/embed/ZdEIZNg3epQ?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=en&amp;cc_lang_pref=en&amp;cc_load_policy=1&amp;enablejsapi=1" allowfullscreen="allowfullscreen" class="Ylcf5b"></iframe></div></div></div><h1>Your privacy controls</h1><p class="vxK8q">You have choices regarding the information we collect and how it's used</p><p>This section describes key controls for managing your privacy across our services. You can also visit the <a href="https://myaccount.google.com/privacycheckup?utm_source=pp&amp;utm_medium=Promo-in-product&amp;utm_campaign=pp_body" class="XddVQ" target="_blank">Privacy Checkup</a>, which provides an opportunity to review and adjust important privacy settings. In addition to these tools, we also offer specific privacy settings in our products equals www.youtube.com (Youtube)
    Source: privacy[1].htm.29.drString found in binary or memory: t want this level of search customization, you can <a href="https://support.google.com/websearch?p=privpol_incognito">search and browse privately</a> or turn off <a href="https://www.google.com/history/optout?utm_source=pp">signed-out search personalization</a>.</p><h3 id="footnote-customizing">Customizing our services</h3><p>For example, we may display a Google Doodle on the Search homepage to celebrate an event specific to your country.</p><h3 id="footnote-deliver-services">deliver our services</h3><p>Examples of how we use your information to deliver our services include:</p><ul><li>We use the IP address assigned to your device to send you the data you requested, such as loading a YouTube video</li><li>We use unique identifiers stored in cookies on your device to help us authenticate you as the person who should have access to your Google Account</li><li>Photos and videos you upload to Google Photos are used to help you create albums, animations, and other creations that you can share. <a href="https://support.google.com/photos?p=privpol_manage">Learn more</a></li><li>A flight confirmation email you receive may be used to create a equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: this.u||"TVHTML5_SIMPLY_EMBEDDED_PLAYER"===this.deviceParams.c&&a.loaderUrl?Ey("",a.loaderUrl):this.dd;this.A=iv(this.loaderUrl,uka);d=this.loaderUrl;var e=void 0===e?!1:e;this.Pp=hv(iv(d,vka),d,e,"Trusted Ad Domain URL");this.ba=S(!1,a.privembed);this.protocol=0===this.dd.indexOf("http:")?"http":"https";this.G=kv((b?b.customBaseYoutubeUrl:a.BASE_YT_URL)||"")||kv(this.dd)||this.protocol+"://www.youtube.com/";e=b?b.eventLabel:a.el;d="detailpage";"adunit"===e?d=this.u?"embedded":"detailpage":"embedded"=== equals www.youtube.com (Youtube)
    Source: FRXRJ3EQ.js.29.drString found in binary or memory: var Soa=function(a){var b=_.Ps("HEAD",a);return b&&0!=b.length?b[0]:a.documentElement},Toa=function(){var a=_.ab(_.Lc(new _.Kc(_.Ic,"https://www.youtube.com/iframe_api"))),b={},c=b.document||document,d=_.Qc(a),e=_.Wd(document,"SCRIPT"),f={Uu:e,il:void 0},g=new _.pf(Roa,f),k=null,m=null!=b.timeout?b.timeout:5E3;0<m&&(k=window.setTimeout(function(){A6(e,!0);g.hd(new B6(1,"Timeout reached for loading script "+d))},m),f.il=k);e.onload=e.onreadystatechange=function(){e.readyState&&"loaded"!=e.readyState&& equals www.youtube.com (Youtube)
    Source: base[1].js.29.drString found in binary or memory: var g2={};var Nra=/[&\?]action_proxy=1/,Mra=/[&\?]token=([\w-]*)/,Ora=/[&\?]video_id=([\w-]*)/,Pra=/[&\?]index=([\d-]*)/,Qra=/[&\?]m_pos_ms=([\d-]*)/,Tra=/[&\?]vvt=([\w-]*)/,Ura=/[&\?]mt=([\d-]*)/,Hra="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),Rra="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "), equals www.youtube.com (Youtube)
    Source: privacy[1].htm.29.drString found in binary or memory: ve added examples, explanatory videos, and definitions for <a href="privacy/key-terms#key-terms">key terms</a>. And if you have any questions about this Privacy Policy, you can <a href="https://support.google.com/policies?p=privpol_privts" class="XddVQ" target="_blank">contact us</a>.</p></div></div><div class=" xXnO1d"><div class="nrAB0c"><div id="infocollect" class="ahbJ5"></div><div class="pTrV6d"><div class="M3GAob"><div class="O3bgpc"><iframe src="https://www.youtube.com/embed/YlmVKT3Zvhw?rel=0&amp;showinfo=0&amp;theme=light&amp;version=3&amp;hl=en&amp;cc_lang_pref=en&amp;cc_load_policy=1&amp;enablejsapi=1" allowfullscreen="allowfullscreen" class="Ylcf5b"></iframe></div></div></div><h1>Information Google collects</h1><p class="vxK8q">We want you to understand the types of information we collect as you use our services</p><p>We collect information to provide better services to all our users equals www.youtube.com (Youtube)
    Source: unknownDNS traffic detected: queries for: www.dropbox.com
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
    Source: AcroRd32.exe, 0000000E.00000002.614479935.000000000B12B000.00000004.00000001.sdmpString found in binary or memory: http://cipa.jp/exif/1.0/
    Source: AcroRd32.exe, 0000000E.00000002.614479935.000000000B12B000.00000004.00000001.sdmpString found in binary or memory: http://cipa.jp/exif/1.0/1.0/
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
    Source: morlock.min[1].js.29.drString found in binary or memory: http://github.com/jrburke/almond
    Source: about[1].htm.29.drString found in binary or memory: http://googledocs.blogspot.com
    Source: AcroRd32.exe, 0000000E.00000002.614348358.000000000B0CB000.00000004.00000001.sdmpString found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
    Source: AcroRd32.exe, 0000000E.00000002.614348358.000000000B0CB000.00000004.00000001.sdmpString found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/pl
    Source: AcroRd32.exe, 0000000E.00000002.614348358.000000000B0CB000.00000004.00000001.sdmpString found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
    Source: AcroRd32.exe, 0000000E.00000002.614348358.000000000B0CB000.00000004.00000001.sdmpString found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/(l
    Source: jquery_bundle.min-vflgLbCiP[1].js.2.drString found in binary or memory: http://jquery.com/
    Source: jquery_bundle.min-vflgLbCiP[1].js.2.drString found in binary or memory: http://jquery.org/license
    Source: modernizr[1].js.29.drString found in binary or memory: http://modernizr.com/download/#-fontface-backgroundsize-borderimage-borderradius-boxshadow-flexbox-f
    Source: AcroRd32.exe, 0000000E.00000002.614348358.000000000B0CB000.00000004.00000001.sdmpString found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0C
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0H
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0I
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0O
    Source: jquery_bundle.min-vflgLbCiP[1].js.2.drString found in binary or memory: http://sizzlejs.com/
    Source: AcroRd32.exe, 0000000E.00000002.614348358.000000000B0CB000.00000004.00000001.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
    Source: AcroRd32.exe, 0000000E.00000002.614348358.000000000B0CB000.00000004.00000001.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/field#
    Source: AcroRd32.exe, 0000000E.00000002.614479935.000000000B12B000.00000004.00000001.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/id/
    Source: AcroRd32.exe, 0000000E.00000002.614479935.000000000B12B000.00000004.00000001.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/id/A
    Source: AcroRd32.exe, 0000000E.00000002.614479935.000000000B12B000.00000004.00000001.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/id/i
    Source: AcroRd32.exe, 0000000E.00000002.614348358.000000000B0CB000.00000004.00000001.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/property#
    Source: AcroRd32.exe, 0000000E.00000002.614348358.000000000B0CB000.00000004.00000001.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
    Source: AcroRd32.exe, 0000000E.00000002.614348358.000000000B0CB000.00000004.00000001.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/type#
    Source: AcroRd32.exe, 0000000E.00000002.614479935.000000000B12B000.00000004.00000001.sdmpString found in binary or memory: http://www.aiim.org/pdfe/ns/id/
    Source: msapplication.xml.1.drString found in binary or memory: http://www.amazon.com/
    Source: AAAAAK2z4iviy6AovGKQyJj2RcFD-GSUTgFT_Ee-mZ_XyfIsQDJ_NgQ[1].htm.2.dr, hats-integration-release[1].js.29.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
    Source: qp_sprite134[1].svg.29.drString found in binary or memory: http://www.bohemiancoding.com/sketch
    Source: qp_sprite134[1].svg.29.drString found in binary or memory: http://www.bohemiancoding.com/sketch/ns
    Source: m=_b,_tp[1].js0.29.drString found in binary or memory: http://www.broofa.com
    Source: AcroRd32.exe, 0000000E.00000002.596889625.000000000885D000.00000002.00000001.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
    Source: api[1].js.29.drString found in binary or memory: http://www.google-analytics.com/cx/api.js
    Source: msapplication.xml2.1.drString found in binary or memory: http://www.google.com/
    Source: TweenMax.min[1].js.29.drString found in binary or memory: http://www.greensock.com
    Source: TweenMax.min[1].js.29.drString found in binary or memory: http://www.greensock.com/terms_of_use.html
    Source: msapplication.xml3.1.drString found in binary or memory: http://www.live.com/
    Source: AcroRd32.exe, 0000000E.00000002.614479935.000000000B12B000.00000004.00000001.sdmpString found in binary or memory: http://www.npes.org/pdfx/ns/id/
    Source: msapplication.xml4.1.drString found in binary or memory: http://www.nytimes.com/
    Source: AcroRd32.exe, 0000000E.00000002.592693029.00000000079A0000.00000002.00000001.sdmpString found in binary or memory: http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default
    Source: AcroRd32.exe, 0000000E.00000002.592693029.00000000079A0000.00000002.00000001.sdmpString found in binary or memory: http://www.osmf.org/drm/default
    Source: AcroRd32.exe, 0000000E.00000002.592693029.00000000079A0000.00000002.00000001.sdmpString found in binary or memory: http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn
    Source: AcroRd32.exe, 0000000E.00000002.592693029.00000000079A0000.00000002.00000001.sdmpString found in binary or memory: http://www.osmf.org/layout/anchor
    Source: AcroRd32.exe, 0000000E.00000002.592693029.00000000079A0000.00000002.00000001.sdmpString found in binary or memory: http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes
    Source: AcroRd32.exe, 0000000E.00000002.592693029.00000000079A0000.00000002.00000001.sdmpString found in binary or memory: http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs
    Source: AcroRd32.exe, 0000000E.00000002.592693029.00000000079A0000.00000002.00000001.sdmpString found in binary or memory: http://www.osmf.org/subclip/1.0
    Source: AcroRd32.exe, 0000000E.00000002.592693029.00000000079A0000.00000002.00000001.sdmpString found in binary or memory: http://www.quicktime.com.Acrobat
    Source: msapplication.xml5.1.drString found in binary or memory: http://www.reddit.com/
    Source: msapplication.xml6.1.drString found in binary or memory: http://www.twitter.com/
    Source: msapplication.xml7.1.drString found in binary or memory: http://www.wikipedia.com/
    Source: iframe_api[1].js.29.drString found in binary or memory: http://www.youtube.com
    Source: msapplication.xml8.1.drString found in binary or memory: http://www.youtube.com/
    Source: base[1].js.29.drString found in binary or memory: http://www.youtube.com/videoplayback
    Source: 48l-xdS4pXg[1].htm.29.drString found in binary or memory: http://www.youtube.com/watch?v=48l-xdS4pXg
    Source: YlmVKT3Zvhw[1].htm.29.drString found in binary or memory: http://www.youtube.com/watch?v=YlmVKT3Zvhw
    Source: ZdEIZNg3epQ[1].htm.29.drString found in binary or memory: http://www.youtube.com/watch?v=ZdEIZNg3epQ
    Source: ggoJFaE71W8[1].htm.29.drString found in binary or memory: http://www.youtube.com/watch?v=ggoJFaE71W8
    Source: base[1].js.29.drString found in binary or memory: http://youtube.com/drm/2012/10/10
    Source: base[1].js.29.drString found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
    Source: base[1].js.29.drString found in binary or memory: http://youtube.com/streaming/otf/durations/112015
    Source: base[1].js.29.drString found in binary or memory: http://youtube.com/yt/2012/10/10
    Source: AcroRd32.exe, 0000000E.00000002.616003660.000000000CC64000.00000004.00000001.sdmpString found in binary or memory: https://.OKCancelEdit
    Source: AcroRd32.exe, 0000000E.00000003.589616750.000000000AFCE000.00000004.00000001.sdmp