Analysis
- user interaction
yes - max time kernel
211s - max time network
211s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
09/08/2026, 14:35
General
- Target RLBotGUI.msi
- Size 22.5MB
- Sample260809-rx7mqsgn3x
- SHA256 db94135a654eb737df7e84a2c145755006859b0318f54830d155e49d7deecd8e
Malware Config
Signatures
- A potential corporate email address has been identified in the URL: [email protected]
- Executes dropped EXE 30 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 20 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 18 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Modifies registry class 26 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 40 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RLBotGUI.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0x80,0x10c,0x7ff9c43bc728,0x7ff9c43bc734,0x7ff9c43bc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,620995650092724595,9556299163912271092,262144 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1928 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,574356856601026482,1226558532370065441,524288 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2244 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,2916058864730237250,11206567059282055766,524288 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2376 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,7107200586336917026,14342981404109208344,2097152 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,12738055439514082302,12094041796407936019,2097152 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,6682159388223815701,10211581232135940304,2097152 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4312 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4520,i,8921789741899881115,5759819265676241817,2097152 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,10005506902474284354,17370880058071266553,524288 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5516 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5932,i,18186028200147429931,3400787378764277127,2097152 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5948 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4640,i,15102536566749283232,15393137657549875821,2097152 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5916 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,3681423684819595308,13467636376628332681,524288 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4664 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,12112087273756108129,2952177263582057778,524288 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4740 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,11329430197755752069,14234389106961498807,524288 --field-trial-handle=1932,i,3357129858926279385,15851434160426371884,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4712 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\AppData\Local\RLBotGUIX\rlbotguilauncher.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\rlbotguilauncher.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\.rlbotguilauncher.hbfvjbjyjsvfwvccncyjvsppnrppgpug.__selfdelete__.exe"C:\Users\Admin\AppData\Local\Temp\.rlbotguilauncher.hbfvjbjyjsvfwvccncyjvsppnrppgpug.__selfdelete__.exe" 1056 C:\Users\Admin\AppData\Local\Temp\.rlbotguilauncher.drobplnounomdidqwrqwbxubokqsuahf.__relocated__.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c exit3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\RLBotGUIX\rlbotguilauncher.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\rlbotguilauncher.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX/Python311\python.exe" -m pip install -U pip --no-warn-script-location2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX/Python311\python.exe" -m pip install uv==0.5.4 --no-warn-script-location2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX/Python311\python.exe" -m uv pip install -U setuptools wheel gevent eel rlbot_gui rlbot==1.* numpy==1.* websockets==12 setuptools==80.*2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\Scripts\uv.exeC:\Users\Admin\AppData\Local\RLBotGUIX\Python311\Scripts\uv.exe pip install -U setuptools wheel gevent eel rlbot_gui rlbot==1.* numpy==1.* websockets==12 setuptools==80.*3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -I -B -c "import sys; sys.path = [\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\.tmplvZ0i2\"] + sys.path; from python.get_interpreter_info import main; main()"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpFdgieU\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpFdgieU\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpFdgieU\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpFdgieU\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpFdgieU\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpFdgieU\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json prepare_metadata_for_build = getattr(backend, \"prepare_metadata_for_build_wheel\", None) if prepare_metadata_for_build: dirname = prepare_metadata_for_build(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpFdgieU\\metadata_directory\", {}) else: dirname = None with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpFdgieU\\prepare_metadata_for_build_wheel.txt\", \"w\") as fp: fp.write(dirname or \"\") "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json prepare_metadata_for_build = getattr(backend, \"prepare_metadata_for_build_wheel\", None) if prepare_metadata_for_build: dirname = prepare_metadata_for_build(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpFdgieU\\metadata_directory\", {}) else: dirname = None with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpFdgieU\\prepare_metadata_for_build_wheel.txt\", \"w\") as fp: fp.write(dirname or \"\") "5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmp6NwxAg\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmp6NwxAg\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp6NwxAg\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp6NwxAg\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmphOx2za\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmphOx2za\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmphOx2za\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmphOx2za\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpKQ7vm4\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpKQ7vm4\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpKQ7vm4\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpKQ7vm4\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmp1kxf2R\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmp1kxf2R\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp1kxf2R\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend import json get_requires_for_build = getattr(backend, \"get_requires_for_build_wheel\", None) if get_requires_for_build: requires = get_requires_for_build({}) else: requires = [] with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp1kxf2R\\get_requires_for_build_wheel.txt\", \"w\") as fp: json.dump(requires, fp) "5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmp6NwxAg\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmp6NwxAg\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp4xbIo7\", {}, None) with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp6NwxAg\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp4xbIo7\", {}, None) with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp6NwxAg\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpKQ7vm4\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmpKQ7vm4\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpvgRurw\", {}, None) with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpKQ7vm4\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpvgRurw\", {}, None) with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpKQ7vm4\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmphOx2za\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmphOx2za\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpCRB90Y\", {}, None) with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmphOx2za\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpCRB90Y\", {}, None) with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmphOx2za\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmp1kxf2R\Scripts\python.exe"C:\Users\Admin\AppData\Local\uv\cache\builds-v0\.tmp1kxf2R\Scripts\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpCmrWNI\", {}, None) with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp1kxf2R\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe" -c "import sys if sys.path[0] == \"\": sys.path.pop(0) sys.path = [] + sys.path from setuptools.build_meta import __legacy__ as backend wheel_filename = backend.build_wheel(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpCmrWNI\", {}, None) with open(\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\builds-v0\\.tmp1kxf2R\\build_wheel.txt\", \"w\") as fp: fp.write(wheel_filename) "5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\python.exe"C:\Users\Admin\AppData\Local\RLBotGUIX/Python311\python.exe" -c "from rlbot_gui import gui; gui.start()"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --app=http://localhost:40993/main.html --disable-http-cache3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c43bc728,0x7ff9c43bc734,0x7ff9c43bc7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,14543407476163725671,15078680368970153365,262144 --field-trial-handle=1924,i,3159084745292168789,4797109325554076837,262144 --variations-seed-version=20260809-030041.537000-production --mojo-platform-channel-handle=1920 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2096,i,7984145397408180544,10015932883084873170,524288 --field-trial-handle=1924,i,3159084745292168789,4797109325554076837,262144 --variations-seed-version=20260809-030041.537000-production --mojo-platform-channel-handle=2168 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,136588395038232045,9448526523951175011,524288 --field-trial-handle=1924,i,3159084745292168789,4797109325554076837,262144 --variations-seed-version=20260809-030041.537000-production --mojo-platform-channel-handle=2528 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,3645715130538925430,16750674103280392573,2097152 --field-trial-handle=1924,i,3159084745292168789,4797109325554076837,262144 --variations-seed-version=20260809-030041.537000-production --mojo-platform-channel-handle=3264 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,15802798683210498573,14009494253027265507,2097152 --field-trial-handle=1924,i,3159084745292168789,4797109325554076837,262144 --variations-seed-version=20260809-030041.537000-production --mojo-platform-channel-handle=3292 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5124,i,15254661555119486948,12753331898336979767,524288 --field-trial-handle=1924,i,3159084745292168789,4797109325554076837,262144 --variations-seed-version=20260809-030041.537000-production --mojo-platform-channel-handle=5160 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,46352014773163223,18017132793692982645,524288 --field-trial-handle=1924,i,3159084745292168789,4797109325554076837,262144 --variations-seed-version=20260809-030041.537000-production --mojo-platform-channel-handle=5452 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,162360306097214778,13009564871413225122,524288 --field-trial-handle=1924,i,3159084745292168789,4797109325554076837,262144 --variations-seed-version=20260809-030041.537000-production --mojo-platform-channel-handle=5472 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,5661502550171712528,12224508011786217906,524288 --field-trial-handle=1924,i,3159084745292168789,4797109325554076837,262144 --variations-seed-version=20260809-030041.537000-production --mojo-platform-channel-handle=5232 /prefetch:144⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c java -version 2> nul3⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -version4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c node --version 2> nul3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\Lib\site-packages\rlbot\dll\RLBot.exe 23233 127.0.0.1 0"3⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\RLBotGUIX\Python311\Lib\site-packages\rlbot\dll\RLBot.exeC:\Users\Admin\AppData\Local\RLBotGUIX\Python311\Lib\site-packages\rlbot\dll\RLBot.exe 23233 127.0.0.1 04⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
e58631b.rbs
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index
data_1
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58a0cf.TMP
Local State
Local State
Local State
Local State
Local State
Local State
_weakrefset.cpython-311.pyc
contextlib.cpython-311.pyc
functools.cpython-311.pyc
keyword.cpython-311.pyc
operator.cpython-311.pyc
reprlib.cpython-311.pyc
threading.cpython-311.pyc
traceback.cpython-311.pyc
types.cpython-311.pyc
warnings.cpython-311.pyc
_weakrefset.py
__init__.py
__init__.cpython-311.pyc
abc.cpython-311.pyc
abc.py
contextlib.py
__init__.py
__init__.cpython-311.pyc
aliases.cpython-311.pyc
cp1252.cpython-311.pyc
utf_8.cpython-311.pyc
aliases.py
cp1252.py
utf_8.py
functools.py
__init__.py
__init__.cpython-311.pyc
_abc.cpython-311.pyc
_abc.py
keyword.py
operator.py
reprlib.py
__init__.py
__init__.cpython-311.pyc
distutils-precedence.pth
LICENSE.APACHE
LICENSE
__init__.py
__main__.py
__pip-runner__.py
__init__.py
__init__.py
base.py
installer.py
noop.py
venv.py
virtual.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
lock.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
release_control.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
wheel.py
wheel_editable.py
check.py
freeze.py
__init__.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
pep723.py
req_dependency_group.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
pylock.py
retry.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
compat.py
resources.py
scripts.py
util.py
__init__.py
__main__.py
distro.py
__init__.py
__main__.py
cli.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
LICENSE
LICENSE.BSD
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
dependency_groups.py
direct_url.py
errors.py
__init__.py
_spdx.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
LICENSE
__init__.py
__main__.py
_xdg.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
_types.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
providers.py
reporters.py
__init__.py
abstract.py
criterion.py
exceptions.py
resolution.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
_re.py
_types.py
py.typed
__init__.py
_writer.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
__init__.py
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.py
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
__init__.py
connection.py
probe.py
poolmanager.py
response.py
__init__.py
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
INSTALLER
LICENSE
WHEEL
__init__.py
__main__.py
_build_backend.py
_find_uv.py
threading.py
traceback.py
types.py
warnings.py
.tmps8PkD6
pip.exe
uv.exe
uvx.exe
greenlet.h
python.exe
python311.dll
vcruntime140.dll
rlbotguilauncher.exe
rlbotguilauncher.exe
uv-0.5.4-py3-none-win_amd64.whl.metadata
pip-26.2.1-py3-none-any.whl
uv-0.5.4-py3-none-win_amd64.whl
pip-26.2.1-py3-none-any.whl.metadata
a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a
a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a.body
LICENSE
LICENSE.md
__init__.py
WHEEL
entry_points.txt
debug.py
qtdeclarative_en.qm
LICENSE.txt
INSTALLER
top_level.txt
WHEEL
WHEEL
override.py
__init__.py
_log.py
_itertools.py
__init__.py
__init__.py
py38.py
Lorem ipsum.txt
__init__.py
build.py
py39.py
errors.py
logging.py
RECORD
emissive_mask.png
RadioDelegateSpecifics.qml
SwitchSpecifics.qml
WHEEL
RECORD
RECORD
WHEEL
top_level.txt
_discovery.py
_macos_compat.py
_msvccompiler.py
_framework_compat.py
bdist_dumb.py
bdist_rpm.py
build_clib.py
build_ext.py
build_scripts.py
check.py
clean.py
config.py
install.py
install_data.py
install_egg_info.py
install_headers.py
install_lib.py
install_scripts.py
cygwin.py
msvc.py
py.typed
unix.py
zos.py
cygwinccompiler.py
dep_util.py
sysconfig.py
unixccompiler.py
version.py
versionpredicate.py
zosccompiler.py
_scripts.py
LICENSE
METADATA
RECORD
WHEEL
top_level.txt
__init__.py
autoasync.py
autocommand.py
automain.py
autoparse.py
errors.py
METADATA
RECORD
top_level.txt
__main__.py
METADATA
RECORD
WHEEL
LICENSE
top_level.txt
__init__.py
_adapters.py
_collections.py
_compat.py
_functools.py
_itertools.py
_meta.py
_text.py
_typing.py
py311.py
py39.py
diagnose.py
METADATA
RECORD
WHEEL
__init__.pyi
layouts.py
show-newlines.py
strip-prefix.py
to-dvorak.py
to-qwerty.py
METADATA
RECORD
LICENSE
METADATA
RECORD
LICENSE
METADATA
RECORD
LICENSE
__init__.pyi
more.pyi
recipes.pyi
METADATA
RECORD
metadata.py
pylock.py
METADATA
RECORD
WHEEL
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
METADATA
RECORD
__init__.py
_parser.py
METADATA
RECORD
LICENSE.txt
__main__.py
_bdist_wheel.py
__init__.py
convert.py
pack.py
tags.py
unpack.py
_metadata.py
_setuptools_logging.py
bdist_wheel.py
macosx_libfile.py
metadata.py
METADATA
RECORD
top_level.txt
__init__.py
_functools.py
overlay.py
py310.py
py313.py
glob.py
archive_util.py
cli-64.exe
cli-arm64.exe
cli.exe
alias.py
bdist_rpm.py
build_clib.py
build_ext.py
develop.py
easy_install.py
editable_wheel.py
install.py
install_egg_info.py
install_lib.py
install_scripts.py
rotate.py
saveopts.py
test.py
py310.py
py312.py
NOTICE
NOTICE
__init__.py
error_reporting.py
extra_validations.py
fastjsonschema_exceptions.py
fastjsonschema_validations.py
formats.py
distutils.schema.json
setuptools.schema.json
gui-32.exe
gui-64.exe
gui-arm64.exe
installer.py
launch.py
launcher manifest.xml
modified.py
msvc.py
namespaces.py
script (dev).tmpl
script.tmpl
wheel.py
windows_support.py
WHEEL
__init__.py
__init__.py
WHEEL
RECORD
__init__.py
WHEEL
entry_points.txt
WHEEL
cacert.pem
RECORD
accessibility.py
animation.py
audits.py
autofill.py
background_service.py
bluetooth_emulation.py
browser.py
cache_storage.py
cast.py
console.py
crash_report_context.py
css.py
debugger.py
device_access.py
device_orientation.py
dom_debugger.py
dom_snapshot.py
dom_storage.py
emulation.py
event_breakpoints.py
fed_cm.py
fetch.py
file_system.py
headless_experimental.py
heap_profiler.py
indexed_db.py
input_.py
inspector.py
io.py
layer_tree.py
log.py
media.py
memory.py
network.py
overlay.py
page.py
performance.py
performance_timeline.py
preload.py
profiler.py
pwa.py
runtime.py
schema.py
security.py
service_worker.py
smart_card_emulation.py
storage.py
system_info.py
tethering.py
tracing.py
util.py
web_audio.py
web_authn.py
__init__.py
__init__.pyi
text_file.cpython-311.pyc.2871340615408
python.exe
pyvenv.cfg
SOURCES.txt
.gitignore
CACHEDIR.TAG
_spdx.cpython-311.pyc.2418323618480
pythonw.exe
_virtualenv.pth
_virtualenv.py
RECORD
more.cpython-311.pyc.2505195868720
activate.ps1
activate_this.py
deactivate.bat
pydoc.bat
dependency_links.txt
PKG-INFO
requires.txt
top_level.txt
SOURCES.txt
__init__.py
plugin.py
server.py
revision.http
revision.http
.tmpkeWAJj
LICENSE-MIT
docopt.py
PKG-INFO
SOURCES.txt
top_level.txt
PKG-INFO
requires.txt
top_level.txt
SOURCES.txt
LICENSE
__init__.py
__main__.py
browsers.py
chrome.py
edge.py
eel.js
electron.py
msIE.py
types.py
revision.http
SOURCES.txt
LICENSE.txt
__init__.py
base_agent.py
base_dotnet_agent.py
base_independent_agent.py
base_java_agent.py
base_loadout_generator.py
base_scratch_agent.py
base_script.py
base_subprocess_agent.py
executable_with_socket_agent.py
drone_agent.py
python_hivemind.py
subprocess_hivemind.py
controller_input.py
human_bot.py
rlbot_runnable.py
executable_with_socket_standalone_bot.py
standalone_bot.py
standalone_bot_config.py
test_spawner.py
base_extension.py
agent_metadata.py
bot_helper_process.py
bot_manager.py
bot_manager_independent.py
bot_manager_struct.py
helper_process_manager.py
helper_process_request.py
scratch_manager.py
items.csv
items.py
RLBot
RLBot.exe
RLBot_Core_Interface.dll
RLBot_Core_Interface_32.dll
RLBot_mac
dropshot_ids.bin
dropshot_vertices.bin
hoops_corner_ids.bin
hoops_corner_vertices.bin
hoops_net_ids.bin
hoops_net_vertices.bin
hoops_ramps_1_ids.bin
hoops_ramps_1_vertices.bin
hoops_ramps_2_ids.bin
hoops_ramps_2_vertices.bin
hoops_rim_ids.bin
hoops_rim_vertices.bin
soccar_corner_ids.bin
soccar_corner_vertices.bin
soccar_goal_ids.bin
soccar_goal_vertices.bin
soccar_ramps_1_ids.bin
soccar_ramps_1_vertices.bin
soccar_ramps_2_ids.bin
soccar_ramps_2_vertices.bin
libRLBotInterface.dylib
libRLBotInterface.so
epic_launch.py
gateway_util.py
rlbot_icon.png
client.py
README.md
common_keys.py
reply.py
set_attributes_message.py
server.py
shared.py
conversions.py
loadout_config.py
match_config.py
psyonix_config.py
bombers_casper_appearance.cfg
bombers_marley_appearance.cfg
bombers_myrtle_appearance.cfg
bombers_samara_appearance.cfg
cyclones_fury_appearance.cfg
cyclones_rainmaker_appearance.cfg
cyclones_squall_appearance.cfg
cyclones_storm_appearance.cfg
dragons_hound_appearance.cfg
dragons_imp_appearance.cfg
dragons_mountain_appearance.cfg
dragons_viper_appearance.cfg
express_beast_appearance.cfg
express_roundhouse_appearance.cfg
express_sabertooth_appearance.cfg
express_tusk_appearance.cfg
guardians_c-block_appearance.cfg
guardians_centice_appearance.cfg
guardians_gerwin_appearance.cfg
guardians_junker_appearance.cfg
mammoths_boomer_appearance.cfg
mammoths_caveman_appearance.cfg
mammoths_foamer_appearance.cfg
mammoths_sticks_appearance.cfg
monarchs_khan_appearance.cfg
monarchs_raja_appearance.cfg
monarchs_rex_appearance.cfg
monarchs_sultan_appearance.cfg
rebels_bandit_appearance.cfg
rebels_dude_appearance.cfg
rebels_outlaw_appearance.cfg
rebels_poncho_appearance.cfg
rovers_armstrong_appearance.cfg
rovers_buzz_appearance.cfg
rovers_shepard_appearance.cfg
rovers_yuri_appearance.cfg
seekers_middy_appearance.cfg
seekers_saltie_appearance.cfg
seekers_scout_appearance.cfg
seekers_swabbie_appearance.cfg
skyhawks_cougar_appearance.cfg
skyhawks_goose_appearance.cfg
skyhawks_iceman_appearance.cfg
skyhawks_maverick_appearance.cfg
teammates_chipper_appearance.cfg
teammates_heater_appearance.cfg
teammates_hollywood_appearance.cfg
teammates_jester_appearance.cfg
teammates_merlin_appearance.cfg
teammates_slider_appearance.cfg
teammates_stinger_appearance.cfg
teammates_sundown_appearance.cfg
teammates_tex_appearance.cfg
teammates_wolfman_appearance.cfg
BallBouncinessOption.py
BallInfo.py
BallMaxSpeedOption.py
BallPrediction.py
BallRigidBodyState.py
BallSizeOption.py
BallTypeOption.py
BallWeightOption.py
Bool.py
BoostOption.py
BoostPad.py
BoostPadState.py
BoostStrengthOption.py
BoxShape.py
CollisionShape.py
Color.py
ConsoleCommand.py
ControllerState.py
CylinderShape.py
DemolishOption.py
DesiredBallState.py
DesiredBoostState.py
DesiredCarState.py
DesiredGameInfoState.py
DesiredGameState.py
DesiredPhysics.py
DropShotBallInfo.py
DropshotTile.py
ExistingMatchBehavior.py
FieldInfo.py
Float.py
GameInfo.py
GameMap.py
GameMessage.py
GameMessageWrapper.py
GameMode.py
GameSpeedOption.py
GameTickPacket.py
GoalInfo.py
GravityOption.py
HumanPlayer.py
LoadoutPaint.py
MatchLength.py
MatchSettings.py
MaxScore.py
MessagePacket.py
MutatorSettings.py
OvertimeOption.py
PartyMemberBotPlayer.py
Physics.py
PlayerClass.py
PlayerConfiguration.py
PlayerInfo.py
PlayerInput.py
PlayerInputChange.py
PlayerLoadout.py
PlayerRigidBodyState.py
PlayerSpectate.py
PlayerStatEvent.py
PredictionSlice.py
PsyonixBotPlayer.py
Quaternion.py
QuickChat.py
QuickChatMessages.py
QuickChatSelection.py
RLBotPlayer.py
ReadyMessage.py
RenderGroup.py
RenderMessage.py
RenderType.py
RespawnTimeOption.py
RigidBodyState.py
RigidBodyTick.py
Rotator.py
RotatorPartial.py
RumbleOption.py
ScoreInfo.py
SeriesLengthOption.py
SphereShape.py
TeamInfo.py
TileState.py
TinyBall.py
TinyPacket.py
TinyPlayer.py
Touch.py
Vector3.py
Vector3Partial.py
agent_config_parser.py
bot_config_bundle.py
custom_config.py
directory_scanner.py
incrementing_integer.py
match_settings_config_parser.py
rlbot_config_parser.py
runner.py
setup_manager.py
socket_data_reporter.py
socket_manager.py
socket_manager_asyncio.py
status_rendering.py
training.py
class_importer.py
config_parser.py
file_util.py
game_state_util.py
item_id_parser.py
logging_utils.py
valid_packet_detector.py
process_configuration.py
public_utils.py
python_version_check.py
rate_limiter.py
rendering_manager.py
requirements_management.py
rlbot_exception.py
ball_prediction_struct.py
ball_prediction_struct.pyi
bot_input_struct.py
game_data_struct.py
game_data_struct.pyi
game_interface.py
game_status.py
legacy_data_v3.py
quick_chats.py
rigid_body_struct.py
start_match_structures.py
struct.py
utils.py
virtual_environment_management.py
version.py
PKG-INFO
requires.txt
top_level.txt
revision.http
e58631a.msi
_3D1A2D39C948DEE132EB16.exe
metadata-2
{cc5a1eff-81dc-4ddc-95c5-adf7f3a7ee2d}_OnDiskSnapshotProp
memory/2832-366-0x00007FF6DF9E0000-0x00007FF6E1319000-memory.dmp
memory/3816-36289-0x0000028A2BC00000-0x0000028A2BC01000-memory.dmp
memory/4004-365-0x00007FF61E680000-0x00007FF61FFB9000-memory.dmp
memory/7672-36306-0x000001CAC6380000-0x000001CAC686C000-memory.dmp
memory/7672-35527-0x00007FF9C2400000-0x00007FF9C2941000-memory.dmp
memory/7672-35526-0x000001CAC6380000-0x000001CAC686C000-memory.dmp
memory/7672-35525-0x00007FF9C3410000-0x00007FF9C3673000-memory.dmp
memory/7672-36473-0x000001CAC6380000-0x000001CAC686C000-memory.dmp