SmartHawk

6.0

高危

46 个模型检测该样本为恶意！

重新分析

下载样本

ff7d114f11a411fc46d9e929af2c11e3ed8f8353fa4d49c0d2535fce8798ec6a

6844ee24000f3d76fd2a203b6a9efd8d.exe

分析耗时

86s

最近分析

文件大小

332.0KB

静态报毒动态报毒 100% AI SCORE=89 AIDETECTVM CLASSIC CONFIDENCE DZWR EMOTEPMF EMOTET GCNQ GENCIRC GENERICKDZ GENETIC HIGH CONFIDENCE HTLGSZ JZVKQ MALWARE2 MALWARE@#19QC1F5JV15K QVM41 R + TROJ R349336 S15608652 SUSGEN SUSPICIOUS PE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Alibaba	TrojanDownloader:Win32/Emotet.8a7ed597	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201023	18.4.3895.0
Kingsoft		20201023	2013.8.14.323
McAfee	Emotet-FRW!6844EE24000F	20201023	6.0.6.653
Tencent	Malware.Win32.Gencirc.10cdf572	20201023	1.0.0.1

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619622958.748751 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619622946.779751 CryptGenKey	crypto_handle: 0x00875f20 algorithm_identifier: 0x0000660e () provider_handle: 0x00875920 flags: 1 key: f1³å¯ÖøÜµ·£ãèí	success	1
1619622958.763751 CryptExportKey	crypto_handle: 0x00875f20 crypto_export_handle: 0x008758e0 buffer: f¤Îþ[8ä~õp{w<ÏyÞ·ärÛ/!@0íçÓþyw¿wF0= âoKqCu¨öàõwJú¬³½Ó)Ghw1ÃÑP©'uçïîá'ëPF blob_type: 1 flags: 64	success	1
1619622985.107751 CryptExportKey	crypto_handle: 0x00875f20 crypto_export_handle: 0x008758e0 buffer: f¤ãå[&V)¿e/:ø°I¬,9½Ý+B+^tAâ5ÏÀ·e8p¢¤¢3Nx-YA,Os¡+mÉQN%=\|¬}ð\°'õÊæêÅkÀPÊésZü×SÓ¯-¹ blob_type: 1 flags: 64	success	1

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619622946.045751 NtAllocateVirtualMemory	process_identifier: 1948 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e40000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619622959.341751 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

6844ee24000f3d76fd2a203b6a9efd8d.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619622959.045751 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	185.81.158.15
host	82.239.200.118

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619622961.904751 RegSetValueExA	key_handle: 0x000003a8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619622961.904751 RegSetValueExA	key_handle: 0x000003a8 value: ÷×-<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619622961.904751 RegSetValueExA	key_handle: 0x000003a8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619622961.904751 RegSetValueExW	key_handle: 0x000003a8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619622961.904751 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619622961.920751 RegSetValueExA	key_handle: 0x000003c0 value: ÷×-<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619622961.920751 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619622961.920751 RegSetValueExW	key_handle: 0x000003a4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69738
FireEye	Generic.mg.6844ee24000f3d76
CAT-QuickHeal	Trojan.EmotePMF.S15608652
ALYac	Trojan.Agent.Emotet
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDownloader:Win32/Emotet.8a7ed597
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Arcabit	Trojan.Generic.D1106A
Cyren	W32/Emotet.DZWR-4831
Symantec	Trojan.Emotet
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	Trojan-Banker.Win32.Emotet.gcnq
BitDefender	Trojan.GenericKDZ.69738
NANO-Antivirus	Trojan.Win32.Emotet.htlgsz
Paloalto	generic.ml
Rising	Trojan.Emotet!1.CB4A (CLASSIC)
Ad-Aware	Trojan.GenericKDZ.69738
Comodo	Malware@#19qc1f5jv15k
MaxSecure	Trojan.Malware.105981111.susgen
DrWeb	Trojan.Emotet.1005
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-R + Troj/Emotet-CLT
McAfee-GW-Edition	BehavesLike.Win32.Emotet.fh
Sophos	Troj/Emotet-CLT
SentinelOne	DFI - Suspicious PE
Jiangmin	Trojan.Banker.Emotet.ofo
Avira	W97M/Dldr.Agent.jzvkq
MAX	malware (ai score=89)
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
ViRobot	Trojan.Win32.Emotet.339968.C
ZoneAlarm	Trojan-Banker.Win32.Emotet.gcnq
GData	Trojan.GenericKDZ.69738
AhnLab-V3	Trojan/Win32.Emotet.R349336
McAfee	Emotet-FRW!6844EE24000F
TACHYON	Banker/W32.Emotet.339968.H
ESET-NOD32	DOC/TrojanDownloader.Agent.BZG
Tencent	Malware.Win32.Gencirc.10cdf572
Ikarus	Trojan-Banker.Emotet
Fortinet	W32/Emotet.6DC5!tr
AVG	Win32:Trojan-gen
Panda	Trj/Genetic.gen
Qihoo-360	Generic/HEUR/QVM41.2.6ABF.Malware.Gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	82.239.200.118:80
dead_host	185.81.158.15:8080

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-26 14:29:02

Imports

Library KERNEL32.dll:

• 0x42c0a0 WriteFile

• 0x42c0a4 SetFilePointer

• 0x42c0a8 FlushFileBuffers

• 0x42c0ac GetCurrentProcess

• 0x42c0b0 SetErrorMode

• 0x42c0b4 RtlUnwind

• 0x42c0b8 HeapAlloc

• 0x42c0bc HeapFree

• 0x42c0c0 HeapReAlloc

• 0x42c0c4 VirtualAlloc

• 0x42c0c8 GetSystemTimeAsFileTime

• 0x42c0cc GetCommandLineA

• 0x42c0d0 GetProcessHeap

• 0x42c0d4 GetStartupInfoA

• 0x42c0d8 RaiseException

• 0x42c0dc HeapSize

• 0x42c0e0 TerminateProcess

• 0x42c0e4 ReadFile

• 0x42c0e8 SetUnhandledExceptionFilter

• 0x42c0ec IsDebuggerPresent

• 0x42c0f0 VirtualFree

• 0x42c0f4 HeapDestroy

• 0x42c0f8 HeapCreate

• 0x42c0fc GetStdHandle

• 0x42c100 GetACP

• 0x42c104 LCMapStringA

• 0x42c108 LCMapStringW

• 0x42c10c FreeEnvironmentStringsA

• 0x42c110 GetEnvironmentStrings

• 0x42c114 FreeEnvironmentStringsW

• 0x42c118 GetEnvironmentStringsW

• 0x42c11c SetHandleCount

• 0x42c120 GetFileType

• 0x42c124 QueryPerformanceCounter

• 0x42c128 GetTickCount

• 0x42c12c GetStringTypeA

• 0x42c130 GetStringTypeW

• 0x42c134 GetConsoleCP

• 0x42c138 GetConsoleMode

• 0x42c13c SetStdHandle

• 0x42c140 WriteConsoleA

• 0x42c144 GetConsoleOutputCP

• 0x42c148 WriteConsoleW

• 0x42c14c WritePrivateProfileStringA

• 0x42c150 GetThreadLocale

• 0x42c154 GetOEMCP

• 0x42c158 GetCPInfo

• 0x42c15c InterlockedIncrement

• 0x42c160 TlsFree

• 0x42c164 DeleteCriticalSection

• 0x42c168 LocalReAlloc

• 0x42c16c TlsSetValue

• 0x42c170 TlsAlloc

• 0x42c174 InitializeCriticalSection

• 0x42c178 GlobalHandle

• 0x42c17c GlobalReAlloc

• 0x42c180 EnterCriticalSection

• 0x42c184 TlsGetValue

• 0x42c188 LeaveCriticalSection

• 0x42c18c LocalAlloc

• 0x42c190 GlobalFlags

• 0x42c194 GetCurrentProcessId

• 0x42c198 GetCurrentThread

• 0x42c19c ConvertDefaultLocale

• 0x42c1a0 GetModuleFileNameA

• 0x42c1a4 EnumResourceLanguagesA

• 0x42c1a8 GetLocaleInfoA

• 0x42c1ac lstrcmpA

• 0x42c1b0 InterlockedDecrement

• 0x42c1b4 GetModuleFileNameW

• 0x42c1b8 FormatMessageA

• 0x42c1bc LocalFree

• 0x42c1c0 MulDiv

• 0x42c1c4 GlobalGetAtomNameA

• 0x42c1c8 GlobalAddAtomA

• 0x42c1cc GlobalFindAtomA

• 0x42c1d0 GlobalDeleteAtom

• 0x42c1d4 SetLastError

• 0x42c1d8 lstrcmpW

• 0x42c1dc GetModuleHandleA

• 0x42c1e0 GetProcAddress

• 0x42c1e4 GetVersionExA

• 0x42c1e8 GlobalFree

• 0x42c1ec FreeResource

• 0x42c1f0 ExitProcess

• 0x42c1f4 OpenMutexA

• 0x42c1f8 OpenEventA

• 0x42c1fc SetEvent

• 0x42c200 ReleaseMutex

• 0x42c204 WaitForSingleObject

• 0x42c208 IsBadReadPtr

• 0x42c20c GetCurrentThreadId

• 0x42c210 OpenFileMappingA

• 0x42c214 CreateFileA

• 0x42c218 MapViewOfFile

• 0x42c21c UnmapViewOfFile

• 0x42c220 CloseHandle

• 0x42c224 FlushViewOfFile

• 0x42c228 GetWindowsDirectoryA

• 0x42c22c LoadLibraryA

• 0x42c230 FreeLibrary

• 0x42c234 WinExec

• 0x42c238 lstrlenA

• 0x42c23c CompareStringA

• 0x42c240 GetVersion

• 0x42c244 GetLastError

• 0x42c248 MultiByteToWideChar

• 0x42c24c InterlockedExchange

• 0x42c250 Sleep

• 0x42c254 GlobalAlloc

• 0x42c258 GlobalLock

• 0x42c25c GlobalUnlock

• 0x42c260 WideCharToMultiByte

• 0x42c264 FindResourceA

• 0x42c268 LoadResource

• 0x42c26c LockResource

• 0x42c270 UnhandledExceptionFilter

• 0x42c274 SizeofResource

Library USER32.dll:

• 0x42c2a0 TranslateMessage

• 0x42c2a4 GetMessageA

• 0x42c2a8 GetWindowThreadProcessId

• 0x42c2ac GetSysColorBrush

• 0x42c2b0 UnregisterClassA

• 0x42c2b4 DrawTextA

• 0x42c2b8 TabbedTextOutA

• 0x42c2bc ShowWindow

• 0x42c2c0 MoveWindow

• 0x42c2c4 SetWindowTextA

• 0x42c2c8 IsDialogMessageA

• 0x42c2cc SetMenuItemBitmaps

• 0x42c2d0 GetMenuCheckMarkDimensions

• 0x42c2d4 LoadBitmapA

• 0x42c2d8 ModifyMenuA

• 0x42c2dc GetMenuState

• 0x42c2e0 EnableMenuItem

• 0x42c2e4 CheckMenuItem

• 0x42c2e8 SendDlgItemMessageA

• 0x42c2ec WinHelpA

• 0x42c2f0 GetCapture

• 0x42c2f4 SetWindowsHookExA

• 0x42c2f8 CallNextHookEx

• 0x42c2fc GetClassLongA

• 0x42c300 GetClassNameA

• 0x42c304 SetPropA

• 0x42c308 GetPropA

• 0x42c30c RemovePropA

• 0x42c310 GetFocus

• 0x42c314 SetFocus

• 0x42c318 ValidateRect

• 0x42c31c GetWindowTextA

• 0x42c320 GetForegroundWindow

• 0x42c324 GetLastActivePopup

• 0x42c328 DispatchMessageA

• 0x42c32c GetTopWindow

• 0x42c330 UnhookWindowsHookEx

• 0x42c334 GetMessageTime

• 0x42c338 PeekMessageA

• 0x42c33c TrackPopupMenu

• 0x42c340 GetKeyState

• 0x42c344 SetForegroundWindow

• 0x42c348 IsWindowVisible

• 0x42c34c UpdateWindow

• 0x42c350 GetMenu

• 0x42c354 PostMessageA

• 0x42c358 GetMenuItemID

• 0x42c35c GetMenuItemCount

• 0x42c360 MessageBoxA

• 0x42c364 GetClassInfoExA

• 0x42c368 GetClassInfoA

• 0x42c36c RegisterClassA

• 0x42c370 AdjustWindowRectEx

• 0x42c374 CopyRect

• 0x42c378 GetDlgCtrlID

• 0x42c37c DefWindowProcA

• 0x42c380 CallWindowProcA

• 0x42c384 SetWindowPos

• 0x42c388 SystemParametersInfoA

• 0x42c38c GetWindowPlacement

• 0x42c390 GetWindow

• 0x42c394 GetDesktopWindow

• 0x42c398 GetActiveWindow

• 0x42c39c SetActiveWindow

• 0x42c3a0 CreateDialogIndirectParamA

• 0x42c3a4 EnableWindow

• 0x42c3a8 CloseClipboard

• 0x42c3ac OpenClipboard

• 0x42c3b0 SetClipboardData

• 0x42c3b4 EmptyClipboard

• 0x42c3b8 DestroyWindow

• 0x42c3bc GetWindowLongA

• 0x42c3c0 GetDlgItem

• 0x42c3c4 IsWindowEnabled

• 0x42c3c8 GetNextDlgTabItem

• 0x42c3cc EndDialog

• 0x42c3d0 LoadIconA

• 0x42c3d4 IsIconic

• 0x42c3d8 GetSystemMenu

• 0x42c3dc AppendMenuA

• 0x42c3e0 DrawIcon

• 0x42c3e4 CreateWindowExA

• 0x42c3e8 InSendMessage

• 0x42c3ec PostQuitMessage

• 0x42c3f0 DestroyMenu

• 0x42c3f4 GetCursorPos

• 0x42c3f8 WindowFromPoint

• 0x42c3fc EndPaint

• 0x42c400 BeginPaint

• 0x42c404 ClientToScreen

• 0x42c408 GrayStringA

• 0x42c40c GetWindowTextLengthA

• 0x42c410 DrawTextExA

• 0x42c414 SetCursor

• 0x42c418 PtInRect

• 0x42c41c InflateRect

• 0x42c420 SendMessageA

• 0x42c424 GetWindowRect

• 0x42c428 GetClientRect

• 0x42c42c ScreenToClient

• 0x42c430 GetDC

• 0x42c434 ReleaseDC

• 0x42c438 InvalidateRect

• 0x42c43c RedrawWindow

• 0x42c440 SetTimer

• 0x42c444 KillTimer

• 0x42c448 GetParent

• 0x42c44c GetSystemMetrics

• 0x42c450 LoadMenuA

• 0x42c454 GetSubMenu

• 0x42c458 DrawFocusRect

• 0x42c45c RegisterWindowMessageA

• 0x42c460 SetWindowLongA

• 0x42c464 CopyIcon

• 0x42c468 DestroyCursor

• 0x42c46c MessageBeep

• 0x42c470 IsWindow

• 0x42c474 GetSysColor

• 0x42c478 GetMessagePos

• 0x42c47c LoadCursorA

• 0x42c480 MapWindowPoints

Library GDI32.dll:

• 0x42c028 SelectObject

• 0x42c02c SetViewportOrgEx

• 0x42c030 OffsetViewportOrgEx

• 0x42c034 SetViewportExtEx

• 0x42c038 ScaleViewportExtEx

• 0x42c03c SetWindowExtEx

• 0x42c040 ScaleWindowExtEx

• 0x42c044 DeleteDC

• 0x42c048 Escape

• 0x42c04c ExtTextOutA

• 0x42c050 TextOutA

• 0x42c054 RectVisible

• 0x42c058 PtVisible

• 0x42c05c DeleteObject

• 0x42c060 SetMapMode

• 0x42c064 SetBkMode

• 0x42c068 RestoreDC

• 0x42c06c SaveDC

• 0x42c070 GetDeviceCaps

• 0x42c074 CreateBitmap

• 0x42c078 SetBkColor

• 0x42c07c SetTextColor

• 0x42c080 GetClipBox

• 0x42c084 GetCharWidthA

• 0x42c088 GetTextMetricsA

• 0x42c08c GetTextExtentPoint32A

• 0x42c090 GetStockObject

• 0x42c094 GetObjectA

• 0x42c098 CreateFontIndirectA

Library WINSPOOL.DRV:

• 0x42c488 ClosePrinter

• 0x42c48c DocumentPropertiesA

• 0x42c490 OpenPrinterA

Library ADVAPI32.dll:

• 0x42c000 RegSetValueExA

• 0x42c004 RegCreateKeyExA

• 0x42c008 RegEnumKeyA

• 0x42c00c RegDeleteKeyA

• 0x42c010 RegQueryValueExA

• 0x42c014 RegOpenKeyA

• 0x42c018 RegOpenKeyExA

• 0x42c01c RegQueryValueA

• 0x42c020 RegCloseKey

Library SHELL32.dll:

• 0x42c28c ShellExecuteA

Library SHLWAPI.dll:

• 0x42c294 PathFindFileNameA

• 0x42c298 PathFindExtensionA

Library OLEAUT32.dll:

• 0x42c27c VariantClear

• 0x42c280 VariantChangeType

• 0x42c284 VariantInit

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.