Emotet Drops Trickbot (25-Jun-18) | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: win7_64_sp1-mso2007 | ms_office
Classification: Exploit, Dropper, Downloader

3985bc09caa13dadf70187a20d271303c272a41404beb497ac6116a5722a05d1 (SHA256)

022543.doc

Word Document

Created at 2018-06-25 14:51:00

...

Notifications (1/1)

The operating system was rebooted during the analysis.

Indicators

File (93)
»
Filename Hash Operations
C:\ - Access
C:\Program Files (x86)\Mozilla Firefox\mozsqlite3.dll - Access
C:\Program Files (x86)\Mozilla Firefox\nss3.dll - Access
C:\Program Files (x86)\Mozilla Firefox\sqlite3.dll - Access
C:\Program Files (x86)\Mozilla Thunderbird - Access
C:\Program Files (x86)\Sea Monkey\nss3.dll - Access
C:\ProgramData\FAQ - Access
C:\ProgramData\oyvGkGw.exe MD5: cbe11e9a9e71737f15e8f1c606ad8d8c
SHA1: 2d4575457d337753a57b7941d13ac9665342641a
SHA256: 6e143481553f9ae7566d2245450f6fe65734b465df03e43905f0fb19f812b343 		Access, Write
C:\Users - Access
C:\Users\kFT6uTQW - Access
C:\Users\kFT6uTQW\AppData\ - Access
C:\Users\kFT6uTQW\AppData\Local\ - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Crashpad\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\Default\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\EVWhitelist\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\EVWhitelist\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\OriginTrials\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\PepperFlash\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\PepperFlash\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\pnacl\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\pnacl\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\SwReporter\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\SwReporter\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\WidevineCdm\Login Data - Access
C:\Users\kFT6uTQW\AppData\Local\Google\Chrome\User Data\WidevineCdm\Web Data - Access
C:\Users\kFT6uTQW\AppData\Local\Microsoft\ - Access
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\ - Access
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount - Access, Read
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount - Access, Read
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount - Access, Read
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - Access, Read
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018062620180627\index.dat - Access, Read
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat - Access, Read
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017071220170713\index.dat - Access, Read
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\syncpack.exe MD5: bc1a4dc38f3236982d47496a1151f33f
SHA1: d112719238664d7996048614d75db8a67fc50fc5
SHA256: 85f328a811ca9f10ad82bc3c68d3c348cb069d8378400bf191bb515a6aa63473 		Access
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\syncpack.exe:Zone.Identifier - Access
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\syncpack_.exe MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\syncpack_lng.ini - Access
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat - Access
C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\WebCache\WebCacheV24.dat - Access
C:\Users\kFT6uTQW\AppData\Local\Temp\280.exe MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access, Write
C:\Users\kFT6uTQW\AppData\Local\Temp\D3A3.tmp MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access, Write
C:\Users\kFT6uTQW\AppData\Local\Temp\D3D3.tmp MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access, Write
C:\Users\kFT6uTQW\AppData\Local\Temp\D3D4.tmp MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access
C:\Users\kFT6uTQW\AppData\Local\Temp\VBE - Access
C:\Users\kFT6uTQW\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data - Access
C:\Users\kFT6uTQW\AppData\Roaming\Apple Computer\Preferences\keychain.plist - Access
C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\profiles.ini - Access
C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\history.dat - Access
C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\logins.json - Access
C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\places.sqlite - Access
C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Firefox\Profiles\p7ap74gw.default\signons.sqlite - Access
C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\Profiles - Access
C:\Users\kFT6uTQW\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini - Access
C:\Users\kFT6uTQW\AppData\Roaming\Opera Software\Opera Stable\Login Data - Access
C:\Users\kFT6uTQW\AppData\Roaming\Opera\Opera7\profile\wand.dat - Access
C:\Users\kFT6uTQW\AppData\Roaming\Opera\Opera\wand.dat - Access
C:\Users\kFT6uTQW\AppData\Roaming\tarutils - Access
C:\Users\kFT6uTQW\AppData\Roaming\tarutils\oyvHkHw.exe MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access
C:\Users\kFT6uTQW\AppData\Roaming\Thunderbird\Profiles - Access
C:\Users\kFT6uTQW\Desktop - Access
C:\Users\kFT6uTQW\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 - Access
C:\Users\kFT6uTQW\Documents\WindowsPowerShell\profile.ps1 - Access
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll - Access
C:\Windows\Help\.HLP - Access
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config - Access, Read
C:\Windows\system32 - Access
C:\Windows\system32\.HLP - Access
C:\Windows\system32\alg.exe - Access
C:\Windows\SysWOW64\WindowsPowerShell\v1.0 - Access
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Certificate.format.ps1xml - Access, Read
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml - Access, Read
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml - Access, Read
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FileSystem.format.ps1xml - Access, Read
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\GetEvent.types.ps1xml - Access, Read
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Help.format.ps1xml - Access, Read
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 - Access
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowersHell.config - Access
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml - Access, Read
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml - Access, Read
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\profile.ps1 - Access
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Registry.format.ps1xml - Access, Read
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\types.ps1xml - Access, Read
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.format.ps1xml - Access, Read
Registry (85)
»
Registry Key Name Operations
8804558B-B773-11d1-BC3E-0000F87552E7 Read
HKEY_CURRENT_USER Access
HKEY_CURRENT_USER\Environment Access, Read
HKEY_CURRENT_USER\Identities Access
HKEY_CURRENT_USER\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38} Access, Read
HKEY_CURRENT_USER\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\Software\Microsoft\Internet Account Manager\Accounts Access
HKEY_CURRENT_USER\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_CURRENT_USER\Software\Google\Google Desktop\Mailboxes Access
HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts Access
HKEY_CURRENT_USER\Software\IncrediMail\Identities Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts Access
HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger Access
HKEY_CURRENT_USER\Software\Microsoft\MessengerService Access
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles Access
HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Access
HKEY_CURRENT_USER\Software\Microsoft\Visual Basic\6.0 Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\29091b5932ee0f48aec4673270b08577 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\349c13b2d278c3458833b7862c0157f4 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\882b4247eb9feb478bcaf90664ec624c Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\dfc6f427732b824da2ca53fc3cafb157 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Reminders Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine Access
HKEY_CURRENT_USER\Software\Yahoo\Pager Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications Access, Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Access, Write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ODiag Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\ODiag\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Classes\Software\Qualcomm\Eudora\CommandLine\current Access
HKEY_LOCAL_MACHINE\Software\Clients\Mail\Microsoft Outlook Access, Read
HKEY_LOCAL_MACHINE\Software\Group Mail Access
HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access, Read
HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment Access, Read
Mozilla Firefox 25.0\bin Access, Read
Mozilla Firefox\bin Access
Mutex (8)
»
Mutex Name Operations
Global\.net clr networking Access, Delete
Global\I78B0A7D7 Access, Delete
Global\M78B0A7D7 Access
Global\Nx357ECDE7 Access
PEMA08 Access
PEMB40 Access
PEMB50 Access
PEMB64 Access
URL (5)
»
URL Operations
www.icb.cl/ZxavoDe/ GET
197.245.46.11 POST
216.46.44.93 POST
http://94.70.244.227:80/whoami.php GET
94.70.244.227 POST
IP (6)
»
IP Protocols
184.168.46.18 DNS
190.196.2.210 HTTP, DNS, TCP
197.245.46.11 HTTP, TCP
216.46.44.93 HTTP, TCP
94.70.244.227 HTTP, TCP
190.213.248.219 TCP
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image