alibi 3.8 · python · consolidated reportscan BREAD-PC · 2026-05-25T23:48:18 · read-only · 1 outbound call to loldrivers.io (opt-in)

Verdict

CHEATS DETECTED

High-confidence indicators of cheat software, HWID spoofers, or DMA-cheat development artifacts were present on this machine within the last 180 days.

host: BREAD-PC
user: BradS
os: Windows 11 · 10.0.26200
admin: false
scan: 2026-05-25 23:48:18 · pc-mode

Recent findings · last 180d

HIGH12verdict-drivingMEDIUM4dual-use signalsWARN2access deniedINFO4scan summary

cheat-kind 12input-kind 2dual-use 6archived 2 (off-verdict)

Why this verdict · 12 named items

click an item to jump & pin its finding card ↓

Prefetchengineowning — ENGINEOWNING↗
MUICacherut.gg — C:\Users\Bob\Downloads\RUT V4 Launcher.exe↗
DMApcileech firmware build output: pcileech_top.bin↗
KnownHashesRUT AND RUAVT LAUNCHER UPDATED.exe (rut.gg) — hash match - confirmed cheat sample↗
LOLDriversVULNERABLE DRIVER - hash confirmed (BYOVD risk): rtcore64.sys↗
UserScriptsbcdedit /set testsigning — ~\Desktop\setup.bat - high-risk command pattern inside script↗
UserScriptsMoveMouseRelative — ~\Documents\macros\norecoil.lua - mouse-macro / anti-recoil script pattern↗
AIVisionaimmy — AI-vision aimbot executable: aimmy.exe↗
AIVisionONNX model co-located with AI-aimbot executable: yolov8n.onnx↗
BCDTEST SIGNING ENABLED - unsigned drivers can load↗
ProcessENGINEOWNING.exe (PID 9128) running↗
ServiceHidHide service (Running)↗

Also detected · input devices (separate category)

USBcronus — Cronus Zen
AppDataCronus / Titan - 247 files, 38 distinct days

Forensic timeline

Log-scale recency · 22 recent + 2 archived findings

8in last 7 days

12in last 30 days

14in last 180 days

Category signal · which scanners firedclick to filter findings ↓

00All indicators · score distribution

findings + processes + services · 30 indicators

HIGH12 findings · 1 process · 1 service14

MEDIUM4 findings · 1 process · 1 service6

WARN2 findings · access denied2

INFO4 scan-summary findings · informational only4

LOW / CLEAN3 LOW/CLEAN processes · 1 LOW/CLEAN services4

Each slice is one score tier across all artifact classes. 14 HIGH indicators (46.7%) drive the verdict. A clean machine would show a single solid LOW/CLEAN ring — the more red and amber present, the worse the picture.

01Findings · cheat trace scan

recent (≤180d) · verdict-relevant

HIGH

12 findings

HIGHcheatAIVisionlast write 2026-05-23 · 2 d ago
aimmy[aimmy] AI-vision aimbot executable: aimmy.exe
sourceC:\Users\Bob\source\aimmy\aimmy.exe
Pattern
aimmy
FileName
aimmy.exe
FullPath
C:\Users\Bob\source\aimmy\aimmy.exe
SizeBytes
18,223,104
Created
2026-05-07T23:48:18
LastWrite
2026-05-23T23:48:18
HIGHcheatAIVisionlast write 2026-05-07 · 18 d ago
ONNX model co-located with AI-aimbot executable: yolov8n.onnx
sourceC:\Users\Bob\source\aimmy\yolov8n.onnx
FileName
yolov8n.onnx
FullPath
C:\Users\Bob\source\aimmy\yolov8n.onnx
SizeBytes
12,405,633
CoLocated
C:\Users\Bob\source\aimmy\aimmy.exe
Created
2026-05-07T23:48:18
LastWrite
2026-05-07T23:48:18
HIGHinputAppDatanewest write 2026-05-24 · 1 d ago
Cronus / Titan - 247 files, 38 distinct days
sourceC:\Users\Bob\AppData\Local\ConsoleTuner
Label
Cronus / Titan
Directory
C:\Users\Bob\AppData\Local\ConsoleTuner
FileCount
247
DistinctActivityDays
38
ActivitySpanDays
95
OldestWrite
2026-02-19T23:48:18
NewestWrite
2026-05-24T23:48:18
HIGHcheatBCD
TEST SIGNING ENABLED - unsigned drivers can load
sourcetestsigning
HIGHcheatDMAcreated 2026-05-04 · 21 d ago
pcileech firmware build output: pcileech_top.bin
sourceC:\Users\Bob\source\pcileech-fpga-build\pcileech_top.bin
FileName
pcileech_top.bin
FullPath
C:\Users\Bob\source\pcileech-fpga-build\pcileech_top.bin
Created
2026-05-04T23:48:18
HIGHcheatKnownHasheslast write 2026-05-20 · 5 d ago
RUT AND RUAVT LAUNCHER UPDATED.exe (rut.gg)[RUT AND RUAVT LAUNCHER UPDATED.exe (rut.gg)] hash match - confirmed cheat sample
sourceC:\Users\Bob\Downloads\RUT AND RUAVT LAUNCHER UPDATED.exe
Pattern
RUT AND RUAVT LAUNCHER UPDATED.exe (rut.gg)
SHA256
b1b89dedcff0c502d605a707e550b1565224b5949e778168ac45f01b8171160f
FileName
RUT AND RUAVT LAUNCHER UPDATED.exe
FullPath
C:\Users\Bob\Downloads\RUT AND RUAVT LAUNCHER UPDATED.exe
SizeBytes
8,421,376
LastWrite
2026-05-20T23:48:18
KnownSampleOf
RUT AND RUAVT LAUNCHER UPDATED.exe (rut.gg)
HashSource
Hybrid Analysis sandbox report
HIGHcheatLOLDrivers
VULNERABLE DRIVER - hash confirmed (BYOVD risk): rtcore64.sys
sourceC:\Users\Bob\AppData\Local\Temp\rtcore64.sys
DeviceName
RTCore64
Manufacturer
MSI
IsSigned
True
FileName
rtcore64.sys
FilePath
C:\Users\Bob\AppData\Local\Temp\rtcore64.sys
LOLDrivers_Id
0c9b1b21-5e26-4e0e-8baa-2bbb4ce4f0bd
LOLDrivers_Category
vulnerable
LOLDrivers_Tags
rtcore64.sys,rtcore32.sys
LOLDrivers_MatchBy
SHA256
SHA256
01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd
LOLDrivers_URL
https://www.loldrivers.io/drivers/0c9b1b21-5e26-4e0e-8baa-2b…
HIGHcheatMUICachelast write 2026-05-20 · 5 d ago
rut.gg[rut.gg] C:\Users\Bob\Downloads\RUT V4 Launcher.exe
sourceHKCU\...\MuiCache
Pattern
rut.gg
Value
C:\Users\Bob\Downloads\RUT V4 Launcher.exe
Data
RUT and RUAVT
LastWrite
2026-05-20T23:48:18
HIGHcheatPrefetchlast modified 2026-05-23 · 2 d ago
engineowning[engineowning] ENGINEOWNING
sourceC:\Windows\Prefetch\ENGINEOWNING.EXE-1A2B3C4D.pf
Pattern
engineowning
FirstSeen
2026-05-11T23:48:18
LastModified
2026-05-23T23:48:18
HIGHinputUSBlast arrival 2026-05-24 · 1 d ago
cronus[cronus] Cronus Zen
sourceVID_2E24&PID_1000
Pattern
cronus
FriendlyName
Cronus Zen
VID_PID
VID_2E24&PID_1000
FirstInstall
2026-01-25T23:48:18
LastArrival
2026-05-24T23:48:18
LastRemoval
2026-05-25T19:48:18
HIGHcheatUserScriptslast write 2026-05-17 · 8 d ago
bcdedit /set testsigning[bcdedit /set testsigning] ~\Desktop\setup.bat - high-risk command pattern inside script
sourceC:\Users\Bob\Desktop\setup.bat
Pattern
bcdedit /set testsigning
MatchKind
high-risk command in script
FileName
setup.bat
FullPath
C:\Users\Bob\Desktop\setup.bat
SizeBytes
412
LastWrite
2026-05-17T23:48:18
HIGHcheatUserScriptslast write 2026-05-22 · 3 d ago
MoveMouseRelative[MoveMouseRelative] ~\Documents\macros\norecoil.lua - mouse-macro / anti-recoil script pattern
sourceC:\Users\Bob\Documents\macros\norecoil.lua
Pattern
MoveMouseRelative
MatchKind
mouse-macro / anti-recoil script
FileName
norecoil.lua
FullPath
C:\Users\Bob\Documents\macros\norecoil.lua
SizeBytes
1,847
LastWrite
2026-05-22T23:48:18

MEDIUM

4 findings

MEDIUMdual-useDLLInject2026-05-14 · 11 d ago
Injector activity: xenos64.dll @ 2026-05-14T23:48:18
sourceSysmon EID 7
Source
Sysmon EID 7
Timestamp
2026-05-14T23:48:18
ImageLoaded
C:\Users\Bob\source\xenos\xenos64.dll
TargetProcess
explorer.exe
ProcessId
4288
MEDIUMdual-useDrivers
UNSIGNED: obscure_helper
sourceobscure_helper
DeviceName
obscure_helper
Manufacturer
Unknown
IsSigned
False
FileName
obscure_helper.sys
FilePath
C:\Windows\System32\drivers\obscure_helper.sys
MEDIUMdual-useInstalledinstalled 2026-03-12 · 2 mo ago
cheatengine[cheatengine] Cheat Engine 7.5
sourceCheat Engine 7.5
Pattern
cheatengine
Name
Cheat Engine 7.5
Publisher
Dark Byte
InstallDate
2026-03-12
Version
7.5
MEDIUMdual-useObscuredNameslast write 2026-05-21 · 4 d ago
raw hex name (deadbeef12345678.exe)Obscured filename: raw hex name (deadbeef12345678.exe)
sourceC:\Users\Bob\Downloads\deadbeef12345678.exe
FileName
deadbeef12345678.exe
FullPath
C:\Users\Bob\Downloads\deadbeef12345678.exe
Pattern
raw hex name (deadbeef12345678.exe)
SizeBytes
1,204,800
LastWrite
2026-05-21T23:48:18

WARN · access denied

2 findings

WARNotherBAM
Access denied
sourceHKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings
WARNotherShimCache
Access denied
sourceHKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

INFO

4 findings · hidden by default

INFOotherAIVisionlast write 2026-04-15 · 1 mo ago
ONNX model present (no aimbot constellation): resnet50.onnx
sourceC:\Users\Bob\Documents\ml-class\resnet50.onnx
FileName
resnet50.onnx
FullPath
C:\Users\Bob\Documents\ml-class\resnet50.onnx
SizeBytes
102,400,000
Created
2026-04-13T23:48:18
LastWrite
2026-04-15T23:48:18
INFOotherKnownHashes
Hashed 312 executables, checked against 1 known-bad SHA256 sample(s)
source(scan)
Hashed
312
DatabaseSize
1
INFOotherProcessModules
Scanned 8412 DLL modules across all running processes
source(scan)
ModulesScanned
8412
INFOotherRecencyDecay
Recency analysis: 19 recent, 4 historical (>180d demoted), 2 unknown-timestamp
source(summary)
ThresholdDays
180
RecentFindings
19
HistoricalFindings
4
UnknownTimestampFindings
2

02·03Runtime · processes & services

hover a row to highlight linked findings ↑

Processes

1HIGH1MED3LOW/CLEAN

score	pid	name · path
HIGH	9128	ENGINEOWNING.exe C:\Users\Bob\AppData\Local\engineowning\EO.exe matches 'engineowning' (cheat keyword) · cmd `"C:\Users\Bob\AppData\Local\engineowning\EO.exe" --loader`
MEDIUM	7416	cheatengine-x86_64.exe C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe matches 'cheatengine' (dual-use tool) · cmd `"C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe"`
LOW	12384	chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
CLEAN	4288	explorer.exe C:\Windows\explorer.exe
CLEAN	1248	svchost.exe C:\Windows\System32\svchost.exe

3 of 5 shown · 2 CLEAN hidden

Services

1HIGH1MED1LOW/CLEAN

score	state	name · path
HIGH	Running Auto	HidHide · HidHide Service C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideClient.exe matches 'hidhide' (cheat keyword)
MEDIUM	Running Manual	ViGEmBus · Virtual Gamepad Emulation Bus C:\Windows\System32\drivers\ViGEmBus.sys matches 'vigembus' (dual-use tool)
CLEAN	Stopped	vgc · vgc "C:\Program Files\Riot Vanguard\vgc.exe"

2 of 3 shown · 1 CLEAN hidden

archived · > 180 days · did NOT affect verdict

2 finding(s) with a most-recent timestamp older than 180 days were demoted by the recency-decay rule. 1 originally HIGH-severity. They are logged here for transparency — old artifacts from games or tools the user has long since stopped using do not, on their own, make a currently-clean machine look dirty.

INFOinputInstalledorig MEDIUM · 2,750 d oldmost recent 2018-11-04
xim[xim] XIM Manager 2018
sourceOld XIM Manager
Pattern
xim
Name
XIM Manager 2018
InstallDate
2018-11-04
MostRecentTimestamp
2018-11-04T00:00:00
AgeDays
2750
OriginalSeverity
MEDIUM
MEDIUMcheatPrefetchorig HIGH · 420 d oldmost recent 2025-03-31
engineowning[engineowning] OLDCHEAT (CoD MW 2019)
sourceC:\Windows\Prefetch\OLDCHEAT.EXE-9F8E7D6C.pf
Pattern
engineowning
FirstSeen
2024-06-04T23:48:18
LastModified
2025-03-31T23:48:18
MostRecentTimestamp
2025-03-31T23:48:18
AgeDays
420
OriginalSeverity
HIGH

Coverage limitations

DMA cheats cannot be detected at runtime by design — no PC-side footprint. This scan flags DMA development artifacts only.
Input devices configured on a separate machine leave no trace on this PC.
Session duration is recorded in SRUM and requires an ESE database parser. Not extracted here.
Keyword matching only. Sophisticated cleaners can wipe most of these artifacts.
A clean result is necessary but not sufficient.

alibi 4.0 · python · read-only scan · no system state was modified1 outbound call to loldrivers.io (opt-in) · file self-contained