orcus | 2021b82ce02867da4644bd875006f3ed53a5778cdaf9ec928eddff1023a19108

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SKMBT-5069654-0394650039-9959594594.exe
Size 1.5MB
Sample261012-d698bsvx3q
SHA256 2021b82ce02867da4644bd875006f3ed53a5778cdaf9ec928eddff1023a19108
MD5 1d8e21cbc85bb063e1f49402fc5d5e2f
SHA1 56102e6737740291b6ba75c23ebab675a2b552ea
SHA512 e0d6f78abaf252cfcff944e2db807db739021f82b2bbf4a0fb3a2a28473552ffcf7ed8147c0ad1aa02b41dd5a4d262d3ab6697c90c472c512c02ed10b47dbb32
SSDEEP 24576:VgLVJEPkSCF0vY29Jz5+72uDZwaD/4b8a9T4RBjJoU:2YPkeY2Tz5+72QZwkU8a9T4JoU
TLSH
T15A65E1FBA09C3B82FC0C80355D7865A08B9DA9364645CD4A4568DAD8F6F2A47F32DF13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mamba discovery execution orcus persistence rat spyware stealer

Malware Config

Extracted

Family

orcus

Botnet

mamba

172.111.249.187:7077

Mutex

46bcc3fe92574f16a59dec5b735cf025

Attributes

autostart_method
Disable
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Family: Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Executes dropped EXE 4 IoCs

pid	Process
1960	notepad.exe
5796	notepad.exe
752	notepad.exe
3164	notepad.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Notepad = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder\\notepad.vbs"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Notepad = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder\\notepad.vbs"	WScript.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	notepad.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	notepad.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	notepad.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4592	WScript.exe
3308	WScript.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	notepad.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	notepad.exe
File opened for modification	C:\Windows\assembly	notepad.exe
File created	C:\Windows\assembly\Desktop.ini	notepad.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	notepad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SKMBT-5069654-0394650039-9959594594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	SKMBT-5069654-0394650039-9959594594.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3164	notepad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3164	notepad.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3164	notepad.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3164	notepad.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4368	SKMBT-5069654-0394650039-9959594594.exe
1960	notepad.exe
5796	notepad.exe
3164	notepad.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4592	4368	SKMBT-5069654-0394650039-9959594594.exe	88
PID 4592 wrote to memory of 1960	4592	WScript.exe	89
PID 3308 wrote to memory of 5796	3308	WScript.exe	92
PID 1960 wrote to memory of 752	1960	notepad.exe	93
PID 1960 wrote to memory of 752	1960	notepad.exe	93
PID 1960 wrote to memory of 752	1960	notepad.exe	93
PID 1960 wrote to memory of 752	1960	notepad.exe	93
PID 1960 wrote to memory of 752	1960	notepad.exe	93
PID 1960 wrote to memory of 752	1960	notepad.exe	93
PID 1960 wrote to memory of 752	1960	notepad.exe	93
PID 5796 wrote to memory of 3164	5796	notepad.exe	94
PID 5796 wrote to memory of 3164	5796	notepad.exe	94
PID 5796 wrote to memory of 3164	5796	notepad.exe	94
PID 5796 wrote to memory of 3164	5796	notepad.exe	94
PID 5796 wrote to memory of 3164	5796	notepad.exe	94
PID 5796 wrote to memory of 3164	5796	notepad.exe	94
PID 5796 wrote to memory of 3164	5796	notepad.exe	94
PID 752 wrote to memory of 944	752	notepad.exe	95
PID 3164 wrote to memory of 5072	3164	notepad.exe	97
PID 944 wrote to memory of 5612	944	csc.exe	99
PID 5072 wrote to memory of 5464	5072	csc.exe	100

C:\Users\Admin\AppData\Local\Temp\SKMBT-5069654-0394650039-9959594594.exe
"C:\Users\Admin\AppData\Local\Temp\SKMBT-5069654-0394650039-9959594594.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.vbs"
  2⤵
  - Adds Run key to start application
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.exe
    "C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.exe
      "C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.exe"
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:752
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jvo890pv.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:944
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD3E1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD3E0.tmp"
        6⤵
        
        PID:5612

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.vbs"
1⤵
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.exe
  "C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.exe
    "C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b1luwwdn.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD3F1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD3F0.tmp"
        5⤵
        
        PID:5464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESD3E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD3E1.tmp
Size 1KB
SHA256 162027e4c8cb9aec4471f136fdb57b802d39ad9665dde1417903116ef0706127
MD5 1691306961edd6c4a531ab9d0d3494aa
SHA1 c70d2fdc63b7bd6cd021359e00f8b43aec5753ae
SHA512 d2e050937d2c11e3d6636e3c4ae37467467c8b581ae011f447dc5b050f1148fc95da9a9c9a6ff4971de2168be5bb7643ca7e564bce09dae113ef8cb3087a0b72
TLSH
T193217D1967F84719F0B38732A8F6076B9234FEA0DAB2635F8495011D2C51510EEE0A77
MD5 SHA1 SHA512 TLSH

Submit Download

RESD3F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD3F1.tmp
Size 1KB
SHA256 0e73a8268c6977dae20e450ea912fceccc51b04b70b29f8d62d3b648cc179a8f
MD5 bac234210edd000b264f0f13f4d75d74
SHA1 9bff7e6d5eae4b0f3d344cd84e3ca747b87cd584
SHA512 556bb8f2910949ebbac03394aa5707d8ddd013906ba02417abf70c358ee084d180657ab60c13577ab6b8d494c31313c25c7ea7e61452904788495a2e13ad6f24
TLSH
T18021575967E80719F0B38731B8B6136B9624FE60DAB663AE449001292C50510EFA1A77
MD5 SHA1 SHA512 TLSH

Submit Download

b1luwwdn.dll

Path C:\Users\Admin\AppData\Local\Temp\b1luwwdn.dll
Size 76KB
SHA256 fc19b65f697b2bb124eed0fa5e541885170417d5a479d05de1a26daef13b5949
MD5 d7ecd7671d449da51ef42ebd2cc431f0
SHA1 f7def42d9ceca614dd412e0ee405a12ef830bc26
SHA512 594f198176238e12aa3be527c9d2c8ca64ef6a1e36ce3b05e2a0c3197c24bddafe7e1e61ff6711dd607aadf282d9297189626d3f12c9aedfcc5bed5e3c28d976
SSDEEP 1536:3IJHW6Hua/+Izgfa8UY21vcbKCHaC/6g:IOamy+Jd21vSKCHaC/6g
TLSH
T10573300073D61F2AE3BE43F054B12A168FF2B816F85BE2D9ADC460E926E67444DC1F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvo890pv.dll

Path C:\Users\Admin\AppData\Local\Temp\jvo890pv.dll
Size 76KB
SHA256 133b4c60ced7161f60d2d54873003921ca3bc6b0004d94a99c808ee1b04952e2
MD5 9f4a3fe695212ede9c71f7e2ea427cdc
SHA1 b61b8bec7749bf7326bee94ab65c9fe895547f0c
SHA512 6ec7bf761743c839697e58680bbc86a6d74a0fb1d57b98d32edf362358202a91e8f09544c6c9d597331261e182db334bd565bf873abc9aae3a4fedc6b82b3dfb
SSDEEP 768:x1ikrq+05Awl76vJtC/cHcxHtdGaI8eO/DxET/0ktkUSUbESURcbvYfa8UwxiFF3:nic5weSS/Lbgfa8UY21vybKCH2C/6D
TLSH
T12F73200073D62F2AE3BE43F054B12A168FF2B416F85BF299ADC460E926E67444DC1F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notepad.exe

Path C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.exe
Size 1.5MB
SHA256 0909505344449d7e7c1a70888f8d40d0cf6af36625a5120992736e70e4809496
MD5 d656f40d341b179bcf7933efef8511ee
SHA1 7a2194ea0670cda94380f2a22a1fd75232ad5074
SHA512 63bb7dd5ac3013956c224eb679e854c8c14b40d4a3dc834822872f7839991f756cf2599a26879687972261516e1edcde9038d1e643933d1d2aa12256d88b4a3e
SSDEEP 24576:kgLVJEPkSCF0vY29Jz5+72uDZwaD/4b8a9T4RBjJoU:5YPkeY2Tz5+72QZwkU8a9T4JoU
TLSH
T1AE65E1FBA09C3B82FC0C80355D7865A08B9DA9364645CD4A4568DAD8F6F2A47F32DF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notepad.vbs

Path C:\Users\Admin\AppData\Local\Temp\subfolder\notepad.vbs
Size 1024B
SHA256 d3a93e342c074e3a5946b1bb46ceb70de299eac51339f366025c8c851c3ae1a4
MD5 b385b7d58ac2c0fc8d19df9f9f6dcf52
SHA1 e2d028e054cfbdf1fa6bb526c5d30dabd34f02b6
SHA512 0920737c5983be1d2d48f0b6157f9fe3a216dff883c4414effdbaa1c63cc4396e89ea79366696a15348f693afdfbc82998846ab8121c4d1406a409ac09bc7aee
TLSH
T1B811C206E90AD22BD158E2770BBF058C97E5992A35C12F310700DC44234258AEB9A2A3
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.ini

Path C:\Windows\assembly\Desktop.ini
Size 227B
SHA256 a709c2551b8818d7849d31a65446dc2f8c4cca2dcbbc5385604286f49cfdaf1c
MD5 f7f759a5cd40bc52172e83486b6de404
SHA1 d74930f354a56cfd03dc91aa96d8ae9657b1ee54
SHA512 a50b7826bfe72506019e4b1148a214c71c6f4743c09e809ef15cd0e0223f3078b683d203200910b07b5e1e34b94f0fe516ac53527311e2943654bfceade53298
TLSH
T1E0D0A7EAC14895CB623AA05B40584845B1288E053A57AE014963C754155FB688795429
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD3E0.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCD3E0.tmp
Size 676B
SHA256 1b8621c83c0ff775efd4d6004ae84508418b2b72f112a5d9c0a8a0280e370795
MD5 81efdc2aa74eba49a9e6c31d7c3212f0
SHA1 dbdd94e72cf0d1d2df358a0f0dc44b014027c708
SHA512 6d9897d17fdd9ec46ed0c4bcb1119668da8c44c626c2a1844c522213085f3d9301bce135cf081da4daf00239888f00951364359c995bcf5c5b9a9d7e83cd3ff8
TLSH
T18001965867F80329F0F38B31BDF643939178BCA0DD3263AD5495075A2C705119695B7B
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD3F0.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCD3F0.tmp
Size 676B
SHA256 427ab7ea678fb2431b0f62c225018f58ffcd802a13dc7373aecdd11cc5db655c
MD5 9353552675b423a7119816bd98931649
SHA1 6754cb7ed269546bf5f2c87025821631e4082e8a
SHA512 1e60bda797d8a577af3043799c80d7fd942be782bd702e120baa4190fbda068a8e52c82be8907d168e3abb2b3f3e9c53f5e31f268a76246d9c292554a3484fd0
TLSH
T19801F65867F80229F0F38B30BCF103939168BC50DDB263EC1494061A6C606109661F7B
MD5 SHA1 SHA512 TLSH

Submit Download

b1luwwdn.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\b1luwwdn.0.cs
Size 208KB
SHA256 61c1a89bfe6f3776b408f25f9e6328d293aefdd0d426672462b6d7a417dbb8a7
MD5 90cbb760ff6b2a517bb1e9d10dac4015
SHA1 418275ec1d72e51ac724d93a00f48651f78e46b3
SHA512 3458280d055444511136083cb706f6082da8e8c16a7c7019a036b5ebed368d2a76626cacf15498a0d5b878c8ad74d88df667e30d88eda5abe301a54f99a5aca7
SSDEEP 6144:1I0a6774VkFGAuVtAoBEI0a6774VpQU1tQBmh5flJEDWz15PgPMTufsWY5/m:ukn4WFGAuVtAoBbkn4TQU1tQBmh5flJo
TLSH
T1042463387100AB1201B763FAD791C987F9768527052EA530BACCC59AEFB84128775F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1luwwdn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\b1luwwdn.cmdline
Size 347B
SHA256 ba967bdae90a81cc401f34ca6557d0567f9bd1ee2579e59d3bd293dbd8d706a2
MD5 e2bf4096b070ff624a9849de3f80a4e7
SHA1 ae6c169bf28ce3bfeb3841b6a3b3b0255832d57a
SHA512 61792e857aab55d185ee77cb239647d8f0e7ce9998dd5eb02452a94417e9a990ce110e467f21bf06c6aca4b25fa2e5e84f32e10ebf8bc92a2dbd82ee5436eb95
TLSH
T104E0C00D475AC13715B1311225886F4C4292490F3D017F3C8600454D201342926817D6
MD5 SHA1 SHA512 TLSH

Submit Download

jvo890pv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jvo890pv.0.cs
Size 208KB
SHA256 c3b0abee83148ee7aaf4697292ce8b2c2594ffa850f57c46439f04f7b84679b3
MD5 ca49b64f1855af787ec0ae17493f55aa
SHA1 0a48ad43c77305aa3d6849a27ab530f88fce7d73
SHA512 972861f8e4e3d37998e33f457d4a478f75a909ab6264f1cc7e87049dacfc4023081b72bdf80b3fa9b8de55043ad7d43c0e4702a2e83fcb7876d43975e0ba6915
SSDEEP 6144:1bbP+75LqVFGAtttAIyebbP+75LqCHW5sHtm65fgJFDQu65P1PfTufsWY5/m:R+dLgFGAtttAIy2+dLhHW5sHtm65fgJt
TLSH
T1952463387100AB1201B763FAE791C987F9768527052EA530BACCC59AEFB84128775F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvo890pv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jvo890pv.cmdline
Size 347B
SHA256 24cc85992d61a49f08c3a7ef15c76c67ad5b66c5b0260fc85d7b023b0e0fef5c
MD5 40523b3dbafbca013bd14079a83e5a8d
SHA1 c85458e0b9001554e0ebe774d55a0422a297c65f
SHA512 da33cc0b871a3dc282cad83360f978ace1a2eb70e1d6edc4ff3e9db9cab69745c01ce08570b2c67d3ef24bcfa0bc553c612c268925d9e71d4fa40040a06815a7
TLSH
T1D1E0C00D175AC23202B5311225C86B4C4292455F3E027F28C600848D301342D26C17C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/752-50-0x0000000000400000-0x00000000004E8000-memory.dmp

Download

memory/1960-20-0x0000000002260000-0x0000000002266000-memory.dmp

Download

memory/4368-2-0x0000000002370000-0x0000000002376000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads