Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 2, 2021, 8:58 a.m.	April 2, 2021, 9:01 a.m.

Size	813.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`9da3ac5eeb02e9e4afd27b1744af5c67`
SHA256	`5b965759f9af66ad12e3fcbf71481799926417240c8cfbd1445d4867238631b8`
CRC32	`3510229F`
ssdeep	`12288:Rqdbh4CmnCnGeFkc0gajgAEvK9VBG6OearhLp46Y/lSRfs1q:497nXFGgiCU/oY6q`
PDB Path	c:\anyview\Thicknight\inrise\offer.pdb
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jd1262ru.zip.dll,Dangerbeauty
1116
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jd1262ru.zip.dll,Settlehear
1756
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jd1262ru.zip.dll,
2084

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\anyview\Thicknight\inrise\offer.pdb

One or more processes crashed (50 out of 70 events)

Time & API	Arguments	Status
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207292 registers.edi: 6043624 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 34801616 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 34801632 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 34801648 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 34801664 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 34801680 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 34801696 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 34801712 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 34801728 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 34801744 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 34801760 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 34801776 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 34801792 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 34801808 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 34801824 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 34801840 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207268 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 34801856 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: DllRegisterServer+0xcbc7 jd1262ru+0x16937 @ 0x72ab6937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3206472 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 3207536 registers.edx: 23 registers.ebx: 3207552 registers.esi: 23 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207520 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 34805096 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 34805120 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 34805144 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 34805168 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 34805192 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 34805216 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 34805240 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 34805264 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 34805288 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 34805312 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 34805336 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 34805360 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 34805384 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 34805408 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 34805432 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 3207496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 34805456 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552556 registers.edi: 7092200 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 39192528 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 39192544 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 39192560 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 39192576 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 39192592 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 39192608 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 39192624 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 39192640 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 39192656 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 39192672 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 39192688 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 39192704 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 39192720 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jd1262ru+0x1105c exception.address: 0x72ab105c registers.esp: 2552532 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 39192736 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 58 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72aa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d40000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72811000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72801000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72791000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72761000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72721000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72711000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72701000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b6a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 1116 region_size: 581632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72aa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d40000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72811000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72801000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72791000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72781000 process_handle: 0xffffffff	1

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

MicroWorld-eScan	Trojan.GenericKD.36522017
FireEye	Generic.mg.9da3ac5eeb02e9e4
McAfee	RDN/Dridex
Sangfor	Trojan.Win32.Dridex.PQ
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/Dridex.a0e3c453
K7GW	Trojan ( 005669021 )
K7AntiVirus	Trojan ( 005669021 )
Cyren	W32/Dridex.CK.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.36522017
ViRobot	Trojan.Win32.Z.Dridex.832512.A
Rising	Trojan.Dridex!8.33B (CLOUD)
Ad-Aware	Trojan.GenericKD.36522017
Sophos	Mal/Generic-R + Troj/Dridex-AFL
Comodo	Malware@#1gfpdu46j67by
DrWeb	Trojan.Dridex.735
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R057C0DCJ21
McAfee-GW-Edition	RDN/Dridex
Emsisoft	Trojan.Dridex (A)
MaxSecure	Trojan.Malware.1728101.susgen
Avira	TR/AD.Dridex.wmn
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Trojan.Win32.Banker.oa
Microsoft	Trojan:Win32/Dridex.PQ!MTB
AegisLab	Trojan.Win32.Dridex.4!c
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.36522017
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Dridex.R372644
VBA32	BScope.TrojanSpy.Zbot
ALYac	Spyware.Banker.Dridex
MAX	malware (ai score=80)
Malwarebytes	Trojan.Dridex
ESET-NOD32	Win32/Dridex.DD
TrendMicro-HouseCall	TROJ_GEN.R057C0DCJ21
Ikarus	Trojan.Win32.Dridex
Fortinet	W32/Dridex.DD!tr
Webroot	W32.Trojan.Gen
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/GdSda.A
Qihoo-360	Win32/Trojan.Dridex.HgkASQ4A

jd1262ru.zip

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All