================================================================ QUICK READ - START HERE ================================================================ VERDICT: CHEATS DETECTED This scan found HIGH-confidence indicators of cheat software, HWID spoofers, or DMA-cheat development artifacts on this machine. Named items (cheat-confidence): - [Prefetch] engineowning - [engineowning] ENGINEOWNING - [MUICache] rut.gg - [rut.gg] C:\Users\Marcus\Downloads\RUT V4 Launcher.exe - [DMA] pcileech - pcileech firmware build output: pcileech_top.bin - [KnownHashes] RUT V4 Launcher.exe (rut.gg) - [RUT V4 Launcher.exe (rut.gg)] hash match - confirmed cheat sample - [LOLDrivers] ? - VULNERABLE DRIVER - hash confirmed (BYOVD risk): rtcore64.sys - [UserScripts] bcdedit /set testsigning - [bcdedit /set testsigning] ~\Desktop\setup.bat - high-risk command pattern inside script - [UserScripts] MoveMouseRelative - [MoveMouseRelative] ~\Documents\macros\norecoil.lua - mouse-macro / anti-recoil script pattern - [AIVision] aimmy - [aimmy] AI-vision aimbot executable: aimmy.exe - [AIVision] ? - ONNX model co-located with AI-aimbot executable: yolov8n.onnx - [BCD] ? - TEST SIGNING ENABLED - unsigned drivers can load - [Process] engineowning - ENGINEOWNING.exe (PID 9128) Also detected (input devices - separate category): - [USB] cronus - [cronus] Cronus Zen - [AppData] cronuszen - Cronus Zen Studio - 184 files, 29 distinct days - [Service] hidhide - HidHide (Running) ---------------------------------------------------------------- HISTORICAL findings (logged, did NOT affect verdict) ---------------------------------------------------------------- 1 finding(s) older than 180 days were demoted by the recency-decay rule. These are visible below in the full report but did not count toward the verdict above. Old artifacts from games or tools the user has long since stopped using should not make a currently-clean machine look dirty. Of these, 1 were originally HIGH-severity cheat or input matches. The most-recent timestamps and AgeDays are recorded per finding. ================================================================ ================================================================ ALIBI v4.0 - CONSOLIDATED REPORT ================================================================ Generated: 2026-06-09 18:23:26 Hostname: BREAD-PC Username: BradS OS: Windows 11 (10.0.26200) Admin mode: False Verdict: CHEATS DETECTED Read-only scan. No system state was modified. One outbound network call (loldrivers.io, opt-in). ================================================================ ================================================================ SECTION 1 OF 3 - CHEAT TRACE SCAN ================================================================ Summary (recent, within last 180 days - verdict-relevant): HIGH findings : 12 MEDIUM findings : 3 INFO items : 3 WARN (access) : 2 Summary (historical, >180 days old - logged but did NOT affect verdict): Demoted historical findings : 1 (Originally HIGH-severity : 1) [HIGH/cheat] [AIVision] [aimmy] AI-vision aimbot executable: aimmy.exe Source: C:\Users\Marcus\source\aimmy\aimmy.exe Pattern: aimmy FileName: aimmy.exe FullPath: C:\Users\Marcus\source\aimmy\aimmy.exe SizeBytes: 18223104 Created: 2026-05-22T18:23:26 LastWrite: 2026-06-07T18:23:26 MostRecentTimestamp: 2026-06-07T18:23:26 AgeDays: 2 [HIGH/cheat] [AIVision] ONNX model co-located with AI-aimbot executable: yolov8n.onnx Source: C:\Users\Marcus\source\aimmy\models\yolov8n.onnx FileName: yolov8n.onnx FullPath: C:\Users\Marcus\source\aimmy\models\yolov8n.onnx SizeBytes: 12405633 CoLocated: C:\Users\Marcus\source\aimmy\aimmy.exe Created: 2026-05-22T18:23:26 LastWrite: 2026-05-22T18:23:26 MostRecentTimestamp: 2026-05-22T18:23:26 AgeDays: 18 [HIGH/input] [AppData] Cronus Zen Studio - 184 files, 29 distinct days Source: C:\Users\Marcus\AppData\Local\ConsoleTuner Pattern: cronuszen Label: Cronus Zen Studio Directory: C:\Users\Marcus\AppData\Local\ConsoleTuner FileCount: 184 DistinctActivityDays: 29 ActivitySpanDays: 92 OldestWrite: 2026-03-09T18:23:26 NewestWrite: 2026-06-08T18:23:26 MostRecentTimestamp: 2026-06-08T18:23:26 AgeDays: 1 [HIGH/cheat] [BCD] TEST SIGNING ENABLED - unsigned drivers can load Source: testsigning [HIGH/cheat] [DMA] pcileech firmware build output: pcileech_top.bin Source: C:\Users\Marcus\source\pcileech-fpga-build\pcileech_top.bin Pattern: pcileech FileName: pcileech_top.bin FullPath: C:\Users\Marcus\source\pcileech-fpga-build\pcileech_top.bin SizeBytes: 4194304 Created: 2026-05-23T18:23:26 LastWrite: 2026-06-03T18:23:26 MostRecentTimestamp: 2026-06-03T18:23:26 AgeDays: 6 [HIGH/cheat] [KnownHashes] [RUT V4 Launcher.exe (rut.gg)] hash match - confirmed cheat sample Source: C:\Users\Marcus\Downloads\RUT V4 Launcher.exe Pattern: RUT V4 Launcher.exe (rut.gg) SHA256: b1b89dedcff0c502d605a707e550b1565224b5949e778168ac45f01b8171160f FileName: RUT V4 Launcher.exe FullPath: C:\Users\Marcus\Downloads\RUT V4 Launcher.exe SizeBytes: 8421376 LastWrite: 2026-06-05T18:23:26 MostRecentTimestamp: 2026-06-05T18:23:26 AgeDays: 4 KnownSampleOf: RUT V4 Launcher.exe (rut.gg) HashSource: Hybrid Analysis sandbox report [HIGH/cheat] [LOLDrivers] VULNERABLE DRIVER - hash confirmed (BYOVD risk): rtcore64.sys Source: C:\Users\Marcus\AppData\Local\Temp\rtcore64.sys DeviceName: RTCore64 Manufacturer: MSI IsSigned: True FileName: rtcore64.sys FilePath: C:\Users\Marcus\AppData\Local\Temp\rtcore64.sys LOLDrivers_Id: 0c9b1b21-5e26-4e0e-8baa-2bbb4ce4f0bd LOLDrivers_Category: vulnerable LOLDrivers_Tags: rtcore64.sys,rtcore32.sys LOLDrivers_MatchBy: SHA256 SHA256: 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd LOLDrivers_URL: https://www.loldrivers.io/drivers/0c9b1b21-5e26-4e0e-8baa-2bbb4ce4f0bd/ MostRecentTimestamp: 2026-06-02T18:23:26 AgeDays: 7 [HIGH/cheat] [MUICache] [rut.gg] C:\Users\Marcus\Downloads\RUT V4 Launcher.exe Source: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache Pattern: rut.gg Value: C:\Users\Marcus\Downloads\RUT V4 Launcher.exe Data: RUT and RUAVT LastWrite: 2026-06-05T18:23:26 MostRecentTimestamp: 2026-06-05T18:23:26 AgeDays: 4 [HIGH/cheat] [Prefetch] [engineowning] ENGINEOWNING Source: C:\Windows\Prefetch\ENGINEOWNING.EXE-7A4C2E91.pf Pattern: engineowning FirstSeen: 2026-05-29T18:23:26 LastModified: 2026-06-07T18:23:26 MostRecentTimestamp: 2026-06-07T18:23:26 AgeDays: 2 [HIGH/input] [USB] [cronus] Cronus Zen Source: VID_2E24&PID_1000 Pattern: cronus FriendlyName: Cronus Zen VID_PID: VID_2E24&PID_1000 FirstInstall: 2026-03-14T18:23:26 LastArrival: 2026-06-08T18:23:26 LastRemoval: 2026-06-09T12:23:26 MostRecentTimestamp: 2026-06-08T18:23:26 AgeDays: 1 [HIGH/cheat] [UserScripts] [bcdedit /set testsigning] ~\Desktop\setup.bat - high-risk command pattern inside script Source: C:\Users\Marcus\Desktop\setup.bat Pattern: bcdedit /set testsigning MatchKind: high-risk command in script FileName: setup.bat FullPath: C:\Users\Marcus\Desktop\setup.bat SizeBytes: 412 LastWrite: 2026-06-01T18:23:26 MostRecentTimestamp: 2026-06-01T18:23:26 AgeDays: 8 [HIGH/cheat] [UserScripts] [MoveMouseRelative] ~\Documents\macros\norecoil.lua - mouse-macro / anti-recoil script pattern Source: C:\Users\Marcus\Documents\macros\norecoil.lua Pattern: MoveMouseRelative MatchKind: mouse-macro / anti-recoil script FileName: norecoil.lua FullPath: C:\Users\Marcus\Documents\macros\norecoil.lua SizeBytes: 2104 LastWrite: 2026-06-06T18:23:26 MostRecentTimestamp: 2026-06-06T18:23:26 AgeDays: 3 [MEDIUM/dual-use] [DLLInject] Injector activity: xenos64.dll @ 2026-05-29T18:23:26 Source: Sysmon EID 7 Source: Sysmon EID 7 Timestamp: 2026-05-29T18:23:26 ImageLoaded: C:\Users\Marcus\source\xenos\xenos64.dll TargetProcess: explorer.exe ProcessId: 4288 MostRecentTimestamp: 2026-05-29T18:23:26 AgeDays: 11 [MEDIUM/dual-use] [Installed] [cheatengine] Cheat Engine 7.5 Source: Cheat Engine 7.5 Pattern: cheatengine Name: Cheat Engine 7.5 Publisher: Dark Byte InstallDate: 2026-03-12 Version: 7.5 MostRecentTimestamp: 2026-03-12T00:00:00 AgeDays: 75 [MEDIUM/dual-use] [ObscuredNames] Obscured filename: raw hex name (3a7b9c1e2d4f6018.exe) Source: C:\Users\Marcus\Downloads\3a7b9c1e2d4f6018.exe FileName: 3a7b9c1e2d4f6018.exe FullPath: C:\Users\Marcus\Downloads\3a7b9c1e2d4f6018.exe Pattern: raw hex name (3a7b9c1e2d4f6018.exe) SizeBytes: 1204800 LastWrite: 2026-06-05T18:23:26 MostRecentTimestamp: 2026-06-05T18:23:26 AgeDays: 4 [WARN/other] [BAM] Access denied Source: HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings [WARN/other] [ShimCache] Access denied Source: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache [INFO/other] [KnownHashes] Hashed 312 executables, checked against 1 known-bad SHA256 sample(s) Source: (scan) Hashed: 312 DatabaseSize: 1 [INFO/other] [ProcessModules] Scanned 8412 DLL modules across all running processes Source: (scan) ModulesScanned: 8412 [INFO/other] [RecencyDecay] Recency analysis: 19 recent, 3 historical (>180d demoted), 2 unknown-timestamp Source: (summary) ThresholdDays: 180 RecentFindings: 19 HistoricalFindings: 3 UnknownTimestampFindings: 2 ------------------------------------------------------------ HISTORICAL FINDINGS (>180 days old, did NOT affect verdict) ------------------------------------------------------------ [MEDIUM/cheat] [Prefetch] [HISTORICAL was HIGH, 420d old] [engineowning] OLDCHEAT (CoD MW 2019) Source: C:\Windows\Prefetch\OLDCHEAT.EXE-9F8E7D6C.pf Pattern: engineowning FirstSeen: 2024-06-19T18:23:26 LastModified: 2025-04-15T18:23:26 MostRecentTimestamp: 2025-04-15T18:23:26 AgeDays: 420 RecencyClass: historical OriginalSeverity: HIGH ================================================================ SECTION 2 OF 3 - RUNNING PROCESSES (scored) ================================================================ Total processes captured: 5 HIGH: 1 MEDIUM: 1 LOW: 1 CLEAN: 2 HIGH and MEDIUM processes (full detail): [HIGH/cheat] ENGINEOWNING.exe (PID 9128) Path: C:\Users\Marcus\AppData\Local\engineowning\EO.exe Cmd: "C:\Users\Marcus\AppData\Local\engineowning\EO.exe" --loader Reason: matches 'engineowning' (cheat keyword) Pattern: engineowning [MEDIUM/dual-use] cheatengine-x86_64.exe (PID 7416) Path: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe Cmd: "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe" Reason: matches 'cheatengine' (dual-use tool) Pattern: cheatengine Full processes table (sorted by suspicion score): HIGH PID 9128 ENGINEOWNING.exe C:\Users\Marcus\AppData\Local\engineowning\EO.exe MEDIUM PID 7416 cheatengine-x86_64.exe C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe CLEAN PID 4288 explorer.exe C:\Windows\explorer.exe CLEAN PID 1248 svchost.exe C:\Windows\System32\svchost.exe LOW PID 12384 chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe ================================================================ SECTION 3 OF 3 - SERVICES (scored) ================================================================ Total services captured: 3 HIGH: 1 MEDIUM: 1 LOW: 0 CLEAN: 1 HIGH and MEDIUM services (full detail): [HIGH/input] HidHide (Running) Display: HidHide Service Path: C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideClient.exe Mode: Auto Reason: matches 'hidhide' (input-device keyword) Pattern: hidhide [MEDIUM/dual-use] ViGEmBus (Running) Display: Virtual Gamepad Emulation Bus Path: C:\Windows\System32\drivers\ViGEmBus.sys Mode: Manual Reason: matches 'vigembus' (dual-use tool) Pattern: vigembus Full services table (sorted by suspicion score): HIGH Running HidHide C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideClient.exe CLEAN Stopped vgc "C:\Program Files\Riot Vanguard\vgc.exe" MEDIUM Running ViGEmBus C:\Windows\System32\drivers\ViGEmBus.sys ================================================================ COVERAGE LIMITATIONS ================================================================ - DMA cheats cannot be detected at runtime by design (no PC-side footprint). This scan flags DMA development artifacts only. - Input devices configured on a separate machine leave no trace on this PC. - Session duration is recorded in SRUM and requires an ESE database parser. Not extracted here. - Keyword matching only. Sophisticated cleaners can wipe most of these artifacts. - A clean result is necessary but not sufficient. Report generated: 2026-06-09 18:23:26