alibi 3.8 · python · consolidated reportscan BREAD-PC · 2026-05-25T23:48:18 · read-only · no network calls

Verdict

CAPTURE STACK PRESENT

No cheats or adapter software detected. Capture-card and/or HID-emulation drivers were found — legitimate for streaming and controller remapping, but also a component of console-MITM stacks.

host: BREAD-PC
user: BradS
os: Windows 11 · 10.0.26200
admin: false
scan: 2026-05-25 23:48:18 · console-rig

Recent findings · last 180d

HIGH0verdict-drivingMEDIUM4dual-use signalsWARN0access deniedINFO2scan summary

cheat-kind 0input-kind 0dual-use 7archived 0 (off-verdict)

Forensic timeline

Log-scale recency · 6 recent + 0 archived findings

0in last 7 days

0in last 30 days

3in last 180 days

Category signal · which scanners firedclick to filter findings ↓

00All indicators · score distribution

findings + processes + services · 10 indicators

MEDIUM4 findings · 2 process · 1 service7

INFO2 scan-summary findings · informational only2

LOW / CLEAN1 LOW/CLEAN processes · 0 LOW/CLEAN services1

Each slice is one score tier across all artifact classes. 0 HIGH indicators (0.0%) drive the verdict. A clean machine would show a single solid LOW/CLEAN ring — the more red and amber present, the worse the picture.

01Findings · cheat trace scan

recent (≤180d) · verdict-relevant

MEDIUM

4 findings

MEDIUMdual-useInstalledinstalled 2026-01-15 · 4 mo ago
ds4windows[ds4windows] DS4Windows
sourceDS4Windows
Pattern
ds4windows
Name
DS4Windows
Publisher
Ryochan7
InstallDate
2026-01-15
Version
3.3.3
MEDIUMdual-useInstalledinstalled 2026-04-19 · 1 mo ago
elgato[elgato] Elgato 4K Capture Utility
sourceElgato 4K Capture Utility
Pattern
elgato
Name
Elgato 4K Capture Utility
Publisher
Corsair Memory, Inc.
InstallDate
2026-04-19
Version
1.6.0
MEDIUMdual-useInstalledinstalled 2026-02-08 · 3 mo ago
obs studio[obs studio] OBS Studio
sourceOBS Studio
Pattern
obs studio
Name
OBS Studio
Publisher
OBS Project
InstallDate
2026-02-08
Version
30.1.2
MEDIUMdual-useServices
vigembus[vigembus] ViGEmBus | Virtual Gamepad Emulation Bus | C:\Windows\System32\drivers\ViGEmBus.sys
sourceViGEmBus
Pattern
vigembus
ServiceName
ViGEmBus
DisplayName
Virtual Gamepad Emulation Bus
ImagePath
C:\Windows\System32\drivers\ViGEmBus.sys

INFO

2 findings · hidden by default

INFOotherProcessModules
Scanned 6122 DLL modules across all running processes
source(scan)
ModulesScanned
6122
INFOotherRecencyDecay
Recency analysis: 4 recent, 0 historical (>180d demoted), 1 unknown-timestamp
source(summary)
ThresholdDays
180
RecentFindings
4
HistoricalFindings
0
UnknownTimestampFindings
1

02·03Runtime · processes & services

hover a row to highlight linked findings ↑

Processes

0HIGH2MED1LOW/CLEAN

score	pid	name · path
MEDIUM	10428	DS4Windows.exe C:\Program Files\DS4Windows\DS4Windows.exe matches 'ds4windows' (dual-use tool) · cmd `"C:\Program Files\DS4Windows\DS4Windows.exe"`
MEDIUM	8120	obs64.exe C:\Program Files\obs-studio\bin\64bit\obs64.exe matches 'obs' (dual-use tool) · cmd `"C:\Program Files\obs-studio\bin\64bit\obs64.exe"`
CLEAN	4288	explorer.exe C:\Windows\explorer.exe

2 of 3 shown · 1 CLEAN hidden

Services

0HIGH1MED0LOW/CLEAN

score	state	name · path
MEDIUM	Running Manual	ViGEmBus · Virtual Gamepad Emulation Bus C:\Windows\System32\drivers\ViGEmBus.sys matches 'vigembus' (dual-use tool)

1 of 1 shown · 0 CLEAN hidden

Coverage limitations

DMA cheats cannot be detected at runtime by design — no PC-side footprint. This scan flags DMA development artifacts only.
Input devices configured on a separate machine leave no trace on this PC.
Session duration is recorded in SRUM and requires an ESE database parser. Not extracted here.
Keyword matching only. Sophisticated cleaners can wipe most of these artifacts.
A clean result is necessary but not sufficient.

alibi 4.0 · python · read-only scan · no system state was modifiedno network calls · file self-contained