Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
27/08/2023, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe
-
Size
308KB
-
MD5
b3f87812875a019cb59febb9b04b0f0f
-
SHA1
3139495d838dd4c217ce170cbaee2494e1c35e74
-
SHA256
f2966de2c3c2ca539250cfed1008c7594b4066611425a05a51cd2784a336103c
-
SHA512
4b367cd48c92d663479602df129d7949323422fc09438e92fbef16e75a72824d22db4553c026819a6b67dc1b255789324640e1194cfa5f1df815028f394a69e7
-
SSDEEP
3072:QmBr3balBclw29DXaPB2J9ot3nPIGX30caGhDgGCcc4Go0ER5IY0ms4/:QmBrrDDX0tXT30vzHF4Go0+Fs4/
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/2076-3-0x0000000000400000-0x0000000000E86000-memory.dmp family_gandcrab behavioral1/memory/2076-4-0x0000000000230000-0x0000000000246000-memory.dmp family_gandcrab behavioral1/memory/2076-11-0x0000000000400000-0x0000000000E86000-memory.dmp family_gandcrab behavioral1/memory/2076-13-0x0000000000230000-0x0000000000246000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qpeatvsrqkc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe" b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\I: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\M: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\Y: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\E: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\J: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\K: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\O: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\U: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\B: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\L: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\N: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\R: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\Z: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\T: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\V: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\W: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\G: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\H: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\P: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\Q: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\S: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe File opened (read-only) \??\X: b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2840 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 28 PID 2076 wrote to memory of 2840 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 28 PID 2076 wrote to memory of 2840 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 28 PID 2076 wrote to memory of 2840 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 28 PID 2076 wrote to memory of 2488 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 30 PID 2076 wrote to memory of 2488 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 30 PID 2076 wrote to memory of 2488 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 30 PID 2076 wrote to memory of 2488 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 30 PID 2076 wrote to memory of 2784 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 33 PID 2076 wrote to memory of 2784 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 33 PID 2076 wrote to memory of 2784 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 33 PID 2076 wrote to memory of 2784 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 33 PID 2076 wrote to memory of 2108 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 35 PID 2076 wrote to memory of 2108 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 35 PID 2076 wrote to memory of 2108 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 35 PID 2076 wrote to memory of 2108 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 35 PID 2076 wrote to memory of 2696 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 37 PID 2076 wrote to memory of 2696 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 37 PID 2076 wrote to memory of 2696 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 37 PID 2076 wrote to memory of 2696 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 37 PID 2076 wrote to memory of 2852 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 39 PID 2076 wrote to memory of 2852 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 39 PID 2076 wrote to memory of 2852 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 39 PID 2076 wrote to memory of 2852 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 39 PID 2076 wrote to memory of 2940 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 41 PID 2076 wrote to memory of 2940 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 41 PID 2076 wrote to memory of 2940 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 41 PID 2076 wrote to memory of 2940 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 41 PID 2076 wrote to memory of 2704 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 43 PID 2076 wrote to memory of 2704 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 43 PID 2076 wrote to memory of 2704 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 43 PID 2076 wrote to memory of 2704 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 43 PID 2076 wrote to memory of 2204 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 45 PID 2076 wrote to memory of 2204 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 45 PID 2076 wrote to memory of 2204 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 45 PID 2076 wrote to memory of 2204 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 45 PID 2076 wrote to memory of 568 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 49 PID 2076 wrote to memory of 568 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 49 PID 2076 wrote to memory of 568 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 49 PID 2076 wrote to memory of 568 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 49 PID 2076 wrote to memory of 1028 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 51 PID 2076 wrote to memory of 1028 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 51 PID 2076 wrote to memory of 1028 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 51 PID 2076 wrote to memory of 1028 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 51 PID 2076 wrote to memory of 628 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 53 PID 2076 wrote to memory of 628 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 53 PID 2076 wrote to memory of 628 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 53 PID 2076 wrote to memory of 628 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 53 PID 2076 wrote to memory of 3044 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 55 PID 2076 wrote to memory of 3044 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 55 PID 2076 wrote to memory of 3044 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 55 PID 2076 wrote to memory of 3044 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 55 PID 2076 wrote to memory of 2272 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 57 PID 2076 wrote to memory of 2272 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 57 PID 2076 wrote to memory of 2272 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 57 PID 2076 wrote to memory of 2272 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 57 PID 2076 wrote to memory of 1064 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 59 PID 2076 wrote to memory of 1064 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 59 PID 2076 wrote to memory of 1064 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 59 PID 2076 wrote to memory of 1064 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 59 PID 2076 wrote to memory of 2836 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 61 PID 2076 wrote to memory of 2836 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 61 PID 2076 wrote to memory of 2836 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 61 PID 2076 wrote to memory of 2836 2076 b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe 61
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe"C:\Users\Admin\AppData\Local\Temp\b3f87812875a019cb59febb9b04b0f0f_mafia_magniber_JC.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2840
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2488
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2784
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2108
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2696
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2852
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2940
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2704
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2204
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:568
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:1028
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:628
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:3044
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2272
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:1064
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2836
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:1908
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2044
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:3004
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:1416
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:392
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:1012
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2408
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2700
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1428
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:1276
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2028
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:660
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:1888
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2460
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1592
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:1804
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:1236
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:932
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:664
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2892
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1484
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:1320
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:1588
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:1364
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:1920
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:1296
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:872
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:1528
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:1572
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2464
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2312
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2808
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2792
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2956
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2636
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2872
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2684
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2708
-