Overview
overview
3Static
static
dhl/dhl/an...hp.ps1
windows7_x64
1dhl/dhl/an...hp.ps1
windows10_x64
1dhl/dhl/co...hp.ps1
windows7_x64
1dhl/dhl/co...hp.ps1
windows10_x64
1dhl/dhl/co...hp.vbs
windows7_x64
1dhl/dhl/co...hp.vbs
windows10_x64
1dhl/dhl/fo...vg.xml
windows7_x64
1dhl/dhl/fo...vg.xml
windows10_x64
1dhl/dhl/im...vg.xml
windows7_x64
1dhl/dhl/im...vg.xml
windows10_x64
1dhl/dhl/index.php.js
windows7_x64
1dhl/dhl/index.php.js
windows10_x64
1dhl/dhl/js/fa.js
windows7_x64
1dhl/dhl/js/fa.js
windows10_x64
1dhl/dhl/js...min.js
windows7_x64
1dhl/dhl/js...min.js
windows10_x64
1dhl/dhl/js...min.js
windows7_x64
1dhl/dhl/js...min.js
windows10_x64
1dhl/dhl/js...eps.js
windows7_x64
1dhl/dhl/js...eps.js
windows10_x64
1dhl/dhl/js/main.js
windows7_x64
dhl/dhl/js/main.js
windows10_x64
1dhl/dhl/logs.html
windows7_x64
1dhl/dhl/logs.html
windows10_x64
1dhl/dhl/ve...min.js
windows7_x64
1dhl/dhl/ve...min.js
windows10_x64
1dhl/dhl/ve...hp.ps1
windows7_x64
1dhl/dhl/ve...hp.ps1
windows10_x64
3dhl/dhl/ve...hp.ps1
windows7_x64
1dhl/dhl/ve...hp.ps1
windows10_x64
1dhl/dhl/ve...php.js
windows7_x64
1dhl/dhl/ve...php.js
windows10_x64
1Analysis
-
max time kernel
136s -
max time network
162s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-08-2021 05:57
Static task
static1
Behavioral task
behavioral1
Sample
dhl/dhl/antibot.php.ps1
Resource
win7v20210408
Behavioral task
behavioral2
Sample
dhl/dhl/antibot.php.ps1
Resource
win10v20210408
Behavioral task
behavioral3
Sample
dhl/dhl/core/autoload.php.ps1
Resource
win7v20210408
Behavioral task
behavioral4
Sample
dhl/dhl/core/autoload.php.ps1
Resource
win10v20210408
Behavioral task
behavioral5
Sample
dhl/dhl/core/user_agent.php.vbs
Resource
win7v20210408
Behavioral task
behavioral6
Sample
dhl/dhl/core/user_agent.php.vbs
Resource
win10v20210408
Behavioral task
behavioral7
Sample
dhl/dhl/fonts/material-design-iconic-font/fonts/Material-Design-Iconic-Font.svg.xml
Resource
win7v20210408
Behavioral task
behavioral8
Sample
dhl/dhl/fonts/material-design-iconic-font/fonts/Material-Design-Iconic-Font.svg.xml
Resource
win10v20210408
Behavioral task
behavioral9
Sample
dhl/dhl/images/img.svg.xml
Resource
win7v20210408
Behavioral task
behavioral10
Sample
dhl/dhl/images/img.svg.xml
Resource
win10v20210408
Behavioral task
behavioral11
Sample
dhl/dhl/index.php.js
Resource
win7v20210408
Behavioral task
behavioral12
Sample
dhl/dhl/index.php.js
Resource
win10v20210408
Behavioral task
behavioral13
Sample
dhl/dhl/js/fa.js
Resource
win7v20210408
Behavioral task
behavioral14
Sample
dhl/dhl/js/fa.js
Resource
win10v20210408
Behavioral task
behavioral15
Sample
dhl/dhl/js/jquery-3.3.1.min.js
Resource
win7v20210408
Behavioral task
behavioral16
Sample
dhl/dhl/js/jquery-3.3.1.min.js
Resource
win10v20210408
Behavioral task
behavioral17
Sample
dhl/dhl/js/jquery-ui.min.js
Resource
win7v20210408
Behavioral task
behavioral18
Sample
dhl/dhl/js/jquery-ui.min.js
Resource
win10v20210408
Behavioral task
behavioral19
Sample
dhl/dhl/js/jquery.steps.js
Resource
win7v20210408
Behavioral task
behavioral20
Sample
dhl/dhl/js/jquery.steps.js
Resource
win10v20210408
Behavioral task
behavioral21
Sample
dhl/dhl/js/main.js
Resource
win7v20210408
Behavioral task
behavioral22
Sample
dhl/dhl/js/main.js
Resource
win10v20210408
Behavioral task
behavioral23
Sample
dhl/dhl/logs.html
Resource
win7v20210408
Behavioral task
behavioral24
Sample
dhl/dhl/logs.html
Resource
win10v20210408
Behavioral task
behavioral25
Sample
dhl/dhl/vendor/bootrap/js/bootstrap.min.js
Resource
win7v20210408
Behavioral task
behavioral26
Sample
dhl/dhl/vendor/bootrap/js/bootstrap.min.js
Resource
win10v20210408
Behavioral task
behavioral27
Sample
dhl/dhl/vendor/composer/ClassLoader.php.ps1
Resource
win7v20210408
Behavioral task
behavioral28
Sample
dhl/dhl/vendor/composer/ClassLoader.php.ps1
Resource
win10v20210408
Behavioral task
behavioral29
Sample
dhl/dhl/vendor/composer/autoload_real.php.ps1
Resource
win7v20210408
Behavioral task
behavioral30
Sample
dhl/dhl/vendor/composer/autoload_real.php.ps1
Resource
win10v20210408
Behavioral task
behavioral31
Sample
dhl/dhl/vendor/guzzlehttp/guzzle/src/Client.php.js
Resource
win7v20210408
Behavioral task
behavioral32
Sample
dhl/dhl/vendor/guzzlehttp/guzzle/src/Client.php.js
Resource
win10v20210408
General
-
Target
dhl/dhl/fonts/material-design-iconic-font/fonts/Material-Design-Iconic-Font.svg.xml
-
Size
233KB
-
MD5
381f7754080ed2299a7c66a2504dff02
-
SHA1
8557b1551b91a0dba3ea6273b4aad98885ae77ac
-
SHA256
dcb3de1ca419903bcee5322ca91f2895b9c6482919423e0cce263d62bbe171ea
-
SHA512
fc49ac4e9712f3aa53d177af4db6b5a913193ecc8887850c08856a01d684ad96612f11f814b908a1aac296f0675949e2a80ae9f90bba91fad354a544bce06875
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30907847" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50835f16c79dd701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000030e63b2da9aecf4b9038e2b18429f3210000000002000000000010660000000100002000000014cf16f50dba3f997f1d1eb8f42ae34fa0039e647b1c159cc72e93f1ffdc432a000000000e800000000200002000000052c4ada83e06cdbd30c5e908462d4ad44287d13d2466682e9f0ad26e3a31e75820000000323c9c480bddc61189551c1c8047fdc5d49c9c955874b1520e10897a3df7066d4000000043b3bc23dee96d0c56a5ab656578aa67b78c6a2dabdf0844dca8fcc465203a0843d589a6541ea44374d6b252042539c6e85aaf692b061322f0512ea6593edc87 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "266145532" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30907847" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "337127176" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000030e63b2da9aecf4b9038e2b18429f32100000000020000000000106600000001000020000000eca8a6070d03ea540454788548163a9de4669cbcd047ac19272977637b750870000000000e80000000020000200000006915719e08077f7ae98de9aeeda60cca31e60b42fe1b10911ff2b1b491af9df820000000d35d1a145c7a05ca63674aa15ad5a03a9e77e84ad166f2e47ca14bb5e777f5b540000000b5bb0fb05e26c684dead4e6d15a0bbed91c074143c7824a9e02e395ba1e05be1edd91c88a2fffa3b368a2a1fa1d84fa16bb66890361ca64dc0ee31d3da71e5ef iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "266145532" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "337110581" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f4d116c79dd701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "333020616" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B05D700-09BA-11EC-B2DB-FA5C9235AE05} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30907847" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "337159167" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3048 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3048 iexplore.exe 3048 iexplore.exe 192 IEXPLORE.EXE 192 IEXPLORE.EXE 192 IEXPLORE.EXE 192 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 648 wrote to memory of 3048 648 MSOXMLED.EXE iexplore.exe PID 648 wrote to memory of 3048 648 MSOXMLED.EXE iexplore.exe PID 3048 wrote to memory of 192 3048 iexplore.exe IEXPLORE.EXE PID 3048 wrote to memory of 192 3048 iexplore.exe IEXPLORE.EXE PID 3048 wrote to memory of 192 3048 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\dhl\dhl\fonts\material-design-iconic-font\fonts\Material-Design-Iconic-Font.svg.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dhl\dhl\fonts\material-design-iconic-font\fonts\Material-Design-Iconic-Font.svg.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
fb9ed523ba700d7bd169da09f80f35cb
SHA152b48d4ab50a3d34f15054c485215ad78b84a020
SHA2569ad885119fb1556ae1f94eeb9a78709bc300c956d5de41ec19a84cdbc0ac7411
SHA51244f3cc19d96e765a719d89273f1f2ff3d26eea5a274af97e136764fe63c0aaf72b343c6e6ce271e49d167f8c875566259d9b12245c7b05f69bd3bc17dc624ad9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
9c66dcf9d2deaa1bf154d8990a9588da
SHA1eb437d1a1199cbe01a054d02f2ce71c1252983d2
SHA25698b6ecd38ff382d41dc90e7a987a29b565e70c69e18e86787a3be4846b65341c
SHA5129f724a6abae29187a7a59f91baa492b2f0ddf6cdb30e815a338ddc3e16f28db62aba739092b61b7a784de53f37780c154aee6058a66693e7f3bd99b8448eaa7d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\PWP73LED.cookieMD5
7d54e7f4f9e2c4dd69c757ba6b751a5f
SHA1f5da2d558b598eba51daade91f19af4d67bae917
SHA25655dd1655e2a3e8adeeaf3f9d7fc6a74d85f709332d79ca3ae072e1749b073289
SHA5123df2714034513d611bf660e61d57abae1d66b473dab52d087d3226d0851dfee078a1f7a418f6df26f4808806bd4127f675556d4ed41b404c6af350e4c30461ec
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\X0KDQ8ZN.cookieMD5
e5940043d055ac91f92c555dc4f734ef
SHA11d8481fbc55457119f34417db10dc05b6330dd8a
SHA2564c7167d7ca3c93b8cdb6b4672a6c8715fd069b0008c2c2dc509845df42e9c37d
SHA512b0982e7772c3282f7e16cd3a009f9797e0e46f70698ea659907eac5a3ee0f0643d877a5501c50f60cf6163c3f4e19f1e067ade966152162ee7223f768b7c7742
-
memory/192-125-0x0000000000000000-mapping.dmp
-
memory/648-122-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-120-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-121-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-114-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-123-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-119-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-117-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-116-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-115-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/3048-124-0x00007FFAEE1E0000-0x00007FFAEE24B000-memory.dmpFilesize
428KB
-
memory/3048-118-0x0000000000000000-mapping.dmp