> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/ida-9.5/add-ons/malware/network-and-data.md). # Network and Data Sharing This page lists each connection that the add-on makes, when it makes it, and what it sends. Use it to decide which features to turn on for your team, or to make sure that an air-gapped install stays offline. The add-on sends no telemetry, and it checks your license on your machine. It connects to an online service only when you set the API key for that service and use a feature that needs it. HCLI downloads the add-on and its Python packages when you install or update. An [offline install](/ida-9.5/add-ons/malware/getting-started.md#install-offline) uses only the bundle. ## Connections The rows follow the steps of an analysis, with the names from the **Extensions > Malware Analysis** menu. | Menu | Connects to | When | Sends | | ---------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | Triage > Services Checker, search | VirusTotal, VMRay, and MalwareBazaar, only the services that have an API key | When the panel opens, for each service with no saved result. With `run_at_startup`, also the first time you open a database. | The SHA-256 of the input file | | Triage > Services Checker, upload | The service that you upload to | When you click **Upload** and confirm | The input file and its file name | | Triage > Services Checker, links | The web page of the service, in your browser | When you click **Open in browser** or a link in the results | The SHA-256, in the URL | | Unpacking > Unpack now\... | VirusTotal or VMRay | When you select the `vt-unpack` or `vmray-unpack` heuristic | The SHA-256. The add-on downloads memory dumps of the sample. | | Emulation > Start interactive emulation | Nothing | | See [Emulated networks](#emulated-networks) | | Sandbox > Run Speakeasy sandbox | Nothing | | See [Emulated networks](#emulated-networks) | | Sandbox > Fetch VMRay results via API... | Your VMRay server | When you select it | The SHA-256. The add-on downloads the analysis archive. | | Trace view, Run capa | GitHub | When you click **Run capa** in the trace view for the first time | Nothing about the sample. The add-on downloads the capa rules. | | Data Transformation > Open CyberChef | Nothing | | | Opening the Multi-service Checker panel is a network action. There is no separate search button. A service with no API key gets no requests. With no network access, you can still unpack with Bochs or Speakeasy, use interactive emulation, and run the Speakeasy sandbox. **Run capa** must download the capa rules on first use, so it needs network access one time. {% hint style="warning" %} An upload shares the full sample, and you cannot undo it. VirusTotal shares uploads with its subscribers. MalwareBazaar makes uploads public, and `mb_anonymous` hides only your account name. VMRay uses the sharing settings of your VMRay account. Malware authors often watch these services for their samples, so an upload can tell them that someone found the sample. Do not upload samples from a confidential case. By default, the checker asks before each upload. {% endhint %} ## Emulated networks | Engine | Network | | --------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | [Speakeasy](/ida-9.5/add-ons/malware/concepts/emulators/speakeasy.md) | Simulated. The sample gets decoy replies, and nothing goes to the real network. | | [Bochs](/ida-9.5/add-ons/malware/concepts/emulators/bochs.md) | None. | The debugger connection between IDA and the emulator uses only `127.0.0.1`. {% hint style="warning" %} If you set the unpacker `default_debugger` to `win32`, or `default_remote` to `true`, the sample runs on a real system and uses its network. See [Isolation](/ida-9.5/add-ons/malware/concepts/isolated-system-emulation.md#isolation). {% endhint %} ## Air-gapped machines Install from the offline bundle, and do not set API keys. Then the add-on makes no outbound connections. **Run capa** must download the capa rules the first time, so it does not work on a machine with no internet access. If you have a question, an idea, or a problem, email . The Malware Analysis team reads every message and replies quickly. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.hex-rays.com/ida-9.5/add-ons/malware/network-and-data.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.