Analysis
-
max time kernel
128s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 21:43
Static task
static1
Behavioral task
behavioral1
Sample
5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe
Resource
win7-20220718-en
General
-
Target
5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe
-
Size
970KB
-
MD5
e6350b9f4608bae0aab1347846407674
-
SHA1
08b77622b00a125e54f2c718eacc1c8f57b40b73
-
SHA256
5e033870891778609ff43626f637530e93531956256f914396417616058f1641
-
SHA512
009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
shijumike@yandex.com - Password:
mikeaboyland
Signatures
-
NirSoft MailPassView 8 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1200-66-0x0000000000370000-0x0000000000400000-memory.dmp MailPassView behavioral1/memory/1200-69-0x0000000077A60000-0x0000000077BE0000-memory.dmp MailPassView behavioral1/memory/1924-98-0x00000000005F0000-0x0000000000680000-memory.dmp MailPassView behavioral1/memory/1668-106-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1668-107-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1668-110-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1668-113-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1668-118-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 7 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1200-66-0x0000000000370000-0x0000000000400000-memory.dmp WebBrowserPassView behavioral1/memory/1200-69-0x0000000077A60000-0x0000000077BE0000-memory.dmp WebBrowserPassView behavioral1/memory/1924-98-0x00000000005F0000-0x0000000000680000-memory.dmp WebBrowserPassView behavioral1/memory/1616-119-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1616-120-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/1616-123-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1616-126-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 12 IoCs
Processes:
resource yara_rule behavioral1/memory/1200-66-0x0000000000370000-0x0000000000400000-memory.dmp Nirsoft behavioral1/memory/1200-69-0x0000000077A60000-0x0000000077BE0000-memory.dmp Nirsoft behavioral1/memory/1924-98-0x00000000005F0000-0x0000000000680000-memory.dmp Nirsoft behavioral1/memory/1668-106-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1668-107-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1668-110-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1668-113-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1668-118-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1616-119-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1616-120-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/1616-123-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1616-126-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 2016 Windows Update.exe 1924 Windows Update.exe -
Deletes itself 1 IoCs
Processes:
Windows Update.exepid process 1924 Windows Update.exe -
Loads dropped DLL 8 IoCs
Processes:
5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exeWindows Update.exeWindows Update.exepid process 1200 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe 2016 Windows Update.exe 2016 Windows Update.exe 2016 Windows Update.exe 2016 Windows Update.exe 1924 Windows Update.exe 1924 Windows Update.exe 1924 Windows Update.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exeWindows Update.exeWindows Update.exedescription pid process target process PID 972 set thread context of 1200 972 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe PID 2016 set thread context of 1924 2016 Windows Update.exe Windows Update.exe PID 1924 set thread context of 1668 1924 Windows Update.exe vbc.exe PID 1924 set thread context of 1616 1924 Windows Update.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Windows Update.exedescription pid process Token: SeDebugPrivilege 1924 Windows Update.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exeWindows Update.exeWindows Update.exepid process 972 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe 2016 Windows Update.exe 1924 Windows Update.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exeWindows Update.exepid process 1200 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe 1924 Windows Update.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exeWindows Update.exeWindows Update.exedescription pid process target process PID 972 wrote to memory of 1200 972 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe PID 972 wrote to memory of 1200 972 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe PID 972 wrote to memory of 1200 972 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe PID 972 wrote to memory of 1200 972 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe PID 1200 wrote to memory of 2016 1200 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe Windows Update.exe PID 1200 wrote to memory of 2016 1200 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe Windows Update.exe PID 1200 wrote to memory of 2016 1200 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe Windows Update.exe PID 1200 wrote to memory of 2016 1200 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe Windows Update.exe PID 1200 wrote to memory of 2016 1200 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe Windows Update.exe PID 1200 wrote to memory of 2016 1200 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe Windows Update.exe PID 1200 wrote to memory of 2016 1200 5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe Windows Update.exe PID 2016 wrote to memory of 1924 2016 Windows Update.exe Windows Update.exe PID 2016 wrote to memory of 1924 2016 Windows Update.exe Windows Update.exe PID 2016 wrote to memory of 1924 2016 Windows Update.exe Windows Update.exe PID 2016 wrote to memory of 1924 2016 Windows Update.exe Windows Update.exe PID 2016 wrote to memory of 1924 2016 Windows Update.exe Windows Update.exe PID 2016 wrote to memory of 1924 2016 Windows Update.exe Windows Update.exe PID 2016 wrote to memory of 1924 2016 Windows Update.exe Windows Update.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1668 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe PID 1924 wrote to memory of 1616 1924 Windows Update.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe"C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exeC:\Users\Admin\AppData\Local\Temp\5e033870891778609ff43626f637530e93531956256f914396417616058f1641.exe"2⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeC:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
102B
MD525cdf976d80f34323c6a3bf8da3a2615
SHA1c98ea23df04334af9967bcae6a82128c70538da6
SHA2567dd8663d42227c110aea7418a5a8c5dd91904aacb18ab19151020dc396d0f848
SHA5120c0acc0902d2584f96f771456964359fe0bb40810c1dabb1c5f2f33bff83d49101c4d88445ec5496aad7c40d1e172c6f79549a9183268bb383ca3ad90e27cfdd
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
970KB
MD5e6350b9f4608bae0aab1347846407674
SHA108b77622b00a125e54f2c718eacc1c8f57b40b73
SHA2565e033870891778609ff43626f637530e93531956256f914396417616058f1641
SHA512009ec32793d3a7b3849f5b3e4da7e0343a3350cf83a79bd4d388e22d0f37fb3793734fb6d0ec6f2406ef1e2b823c5a353c09ae53ac05f3ac943236e577bc215a
-
memory/972-59-0x0000000077A60000-0x0000000077BE0000-memory.dmpFilesize
1.5MB
-
memory/972-56-0x0000000000280000-0x0000000000287000-memory.dmpFilesize
28KB
-
memory/972-57-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB
-
memory/1200-69-0x0000000077A60000-0x0000000077BE0000-memory.dmpFilesize
1.5MB
-
memory/1200-71-0x0000000074C30000-0x00000000751DB000-memory.dmpFilesize
5.7MB
-
memory/1200-63-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1200-58-0x00000000004D605F-mapping.dmp
-
memory/1200-66-0x0000000000370000-0x0000000000400000-memory.dmpFilesize
576KB
-
memory/1200-70-0x0000000077A60000-0x0000000077BE0000-memory.dmpFilesize
1.5MB
-
memory/1200-78-0x0000000074C30000-0x00000000751DB000-memory.dmpFilesize
5.7MB
-
memory/1200-76-0x0000000077A60000-0x0000000077BE0000-memory.dmpFilesize
1.5MB
-
memory/1616-123-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1616-120-0x0000000000442628-mapping.dmp
-
memory/1616-119-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1616-126-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1668-107-0x0000000000411654-mapping.dmp
-
memory/1668-118-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1668-113-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1668-110-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1668-106-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1924-103-0x0000000077A60000-0x0000000077BE0000-memory.dmpFilesize
1.5MB
-
memory/1924-117-0x0000000074550000-0x0000000074AFB000-memory.dmpFilesize
5.7MB
-
memory/1924-112-0x0000000006AC5000-0x0000000006AD6000-memory.dmpFilesize
68KB
-
memory/1924-127-0x0000000006AC5000-0x0000000006AD6000-memory.dmpFilesize
68KB
-
memory/1924-114-0x0000000077A60000-0x0000000077BE0000-memory.dmpFilesize
1.5MB
-
memory/1924-115-0x0000000077A60000-0x0000000077BE0000-memory.dmpFilesize
1.5MB
-
memory/1924-116-0x0000000074550000-0x0000000074AFB000-memory.dmpFilesize
5.7MB
-
memory/1924-104-0x0000000074550000-0x0000000074AFB000-memory.dmpFilesize
5.7MB
-
memory/1924-102-0x0000000077A60000-0x0000000077BE0000-memory.dmpFilesize
1.5MB
-
memory/1924-101-0x0000000008DA0000-0x0000000009898000-memory.dmpFilesize
11.0MB
-
memory/1924-98-0x00000000005F0000-0x0000000000680000-memory.dmpFilesize
576KB
-
memory/1924-94-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1924-85-0x00000000004D605F-mapping.dmp
-
memory/2016-88-0x0000000077A60000-0x0000000077BE0000-memory.dmpFilesize
1.5MB
-
memory/2016-73-0x0000000000000000-mapping.dmp