ZEITGEIST PUBLIC | INTERNAL LOL SCRIPT | ORB & EVADE & PRED & VISUALS & MORE

# zeitgeist — full writeup

i paid 250 eur for this:feelsbadman:. before you send them anything, read this. everything below can be checked by:feelsbadman::feelsbadman::feelsbadman: you, on your own machine, without trusting me at all.:yes:

---

## 1. the test that needs no technical knowledge

i joined practice tool, waited ~5 seconds so the game was running, then **physically disconnected my internet**. then i hit start.

the loader said:

- `Contacting Zeitgeist auth server...`
- `License authenticated successfully.`
- `READY 100%`
- `CONNECTED`
- and bottom right: **`NETWORK ONLINE`**

with no network. league was sitting in the background saying **"Reconnecting … Please wait."** — thats the proof the connection was actually cut.

then it threw the vanguard error.

a program cannot authenticate a license against a server it cannot reach. there is no server.

---

## 2. the file

```
sha256 : 5186945971000558fe36e6b498abdb370c0dfb01e6e7ccb3e9 e6332c6122fb3b
size : 239,104 bytes
type : PE32+ GUI x86-64, 7 sections
built : 2026-06-13 08:43:59 UTC
```

put that hash into virustotal yourself. you dont need my copy of the file.

---

## 3. it has no networking. at all.

the complete import table is six dlls:

```
dwmapi.dll 1 function
ole32.dll 3 functions
USER32.dll 23 functions
GDI32.dll 1 function
ADVAPI32.dll 9 functions
KERNEL32.dll 99 functions
```

thats the whole list. no `wininet`, no `winhttp`, no `ws2_32`. no `WSAStartup`, no `InternetOpen`, no socket calls. and no strings for those dll names either, so it cant load them dynamically at runtime.

**it cannot open a network connection. the "auth server" does not exist.**

check it yourself: virustotal → Details tab → Portable Executable Info → Imports.

---

## 4. it has no injection code

not present anywhere in the file:

```
WriteProcessMemory
VirtualAllocEx
CreateRemoteThread
NtWriteVirtualMemory
QueueUserAPC
SetWindowsHookEx
```

no driver loading either. **it physically cannot inject anything into league.**

he told me in writing: *"there is nothing inside the loader besides a injector script"*. there is no injector. it isnt there.

---

## 5. the loading sequence is a hardcoded animation

every log line is a string baked into the binary, each one paired with a sleep delay. from the disassembly (function starts around `0x140005dc8`):

| log line | then sleeps |
|---|---|
| `Contacting Zeitgeist auth server...` | 800 ms |
| `License authenticated successfully.` | 600 ms |
| `Checking local hardware specifications...` | 900 ms |
| `Hardware ID (HWID) matches records.` | 500 ms |
| `Searching for League of Legends.exe...` | 800 ms |
| `Decrypting runtime signatures...` | 700 ms |
| `Injecting secure hooks into League of Legends...` | 1100 ms |
| `Client loaded successfully! Enjoy Zeitgeist.` | — |

thats it. thats the product. it prints text and waits.

the "HWID matches records" line is text followed by a 500ms sleep. there is no hwid check.

---

## 6. the license key is hardcoded in the exe

```
offset 0x1d418 : zg-30d-f2e3d4c5b6a7
```

thats the key i was given. its a string sitting inside the binary, compared locally. its not my license — its **the same key for everyone**, and it works with the internet off, which you can verify in ten seconds.

---

## 7. the VAN 1067 error is theirs, not riots

these strings are inside the loader:

```
offset 0x1d4a8 : Riot Vanguard Connection Error
offset 0x1d4f0 : VAN 1067: Vanguard has encountered a connection error.
Please restart the Riot Client to restore anti-cheat services.
```

sitting in the same block as `Injecting secure hooks into League of Legends...` and `Client loaded successfully! Enjoy Zeitgeist.`

yes, VAN 1067 is a real riot error. thats exactly why they picked it — you google it, you find its real, you conclude your pc is the problem. a fake error code would get busted instantly.

but their loader has no network stack, no driver, and no communication with vanguard. **it cannot receive an error from vanguard.** that popup is a plain windows messagebox their own program draws, with their own icon on it. real vanguard errors come from the riot client.

thats the whole scam in one line: it fakes success, then blames riot for the failure. and it gives them a permanent excuse to say theyre "working on a fix".

---

## 8. the only real code in it

one loop:

```
CreateToolhelp32Snapshot → Process32FirstW → Process32NextW
→ compare each process name against "League of Legends.exe"
```

if league is running, the fake sequence plays. if it isnt, you get "League of Legends.exe not found". **checking whether a process exists is the entire functionality.**

it also checks for VirtualBox and VMware registry keys and calls `IsDebuggerPresent` / `CheckRemoteDebuggerPresent`, so it behaves differently if youre analysing it.

---

## 9. the build i got predates their own updates

my binary was compiled **13 june 2026**. from their own #updates channel:

```
10.06.2026 patch 26.12 "loader updated :: no bugs or issues"
13.06.2026 ← my file was compiled
25.06.2026 patch 26.13
30.08.2026 patch 26.17
```

i was sold this at the end of august. its the june build. and he told me *"been working all day yesterday"* and *"i was working in your file today"*.

**and the 30.08 post says:** *"all updates are done in the loader, so it auto-updates every time there's a new league patch"*

the loader has zero networking functions. it cannot download anything. it cannot auto-update. that is a public, dated, written claim that their own file disproves.

---

## 10. "riot vanguard sensing improved"

that exact phrase appears in 7 of their ~12 update posts. "sensing" is not a feature, a subsystem, or a term anyone in anti-cheat uses. its filler that cant be checked and can be posted forever.

the patch numbers in the changelog are real, but riot publishes the patch schedule publicly. posting "updated for patch 26.x ✓" every two weeks costs one minute and proves nothing.

---

## 11. the vanguard claim itself

their PSA says: *"We took sometime off to bypass RIOT new anti-cheat Vanguard. All our tests went great."*

vanguard shipped to league on **1 may 2024** (patch 14.9). its ring-0 — a kernel-mode driver, `vgk.sys`, loading at system boot.

you cannot bypass a kernel-mode anti-cheat with a WebView2 window. the loader they actually deliver has no driver, no injection, no network. they claim to have solved one of the hardest problems in the space, and shipped a program whose maximum capability is reading the process list.

---

## 12. the branding is recycled

"zeitgeist" was a real scripting platform advertised on elitepvpers from **april 2021**, active through mid-2022. that thread is closed.

its pricing then: **$275 for the first patch, $75 for subsequent patches.**

i was charged **250, with 80 outstanding.**

same structure, lifted.

---

## 13. the vouches

a rank screenshot proves someone hit that rank. it doesnt prove who posted it, or what software they used. names in images are trivially edited, and the seller controls who can post in that channel.

i looked up the challenger riot id posted a few hours before i wrote this — `Ascend#king` — on op.gg across euw, eune, na, kr, tr, ru and br. **404 on all seven.** i verified the method first by pulling a known euw challenger through the identical url, which loaded fine.

caveat, being honest: riot ids can be renamed, and i didnt check all 16 regions. so thats suggestive, not conclusive. it doesnt need to be conclusive — the software doesnt work, so the vouches cant be true regardless of who posted them.

also worth thinking about: someone actually scripting to challenger does not post their riot id publicly next to an advert for the script. riot bans scripters. real ones hide.

---

## 14. read the rules as a system

from the PSA and the server:

| what it says | what it does |
|---|---|
| "there will be no free trial" (framed as being serious) | you cant test before paying. a trial exposes it in 6 seconds |
| "do not leak any kind of content of the platform" | buyers cant compare notes or upload the loader |
| "the most private way possible" | same thing, sold as exclusivity |
| proton email for payment confirmation | free, anonymous, no business identity |
| "take screenshot to the payment and forward it" | payment is manual and irreversible |
| discount, expiring | urgency |
| "every single RIOT server, CN, KR/JP" | costs nothing to promise when nothing exists |
| "open a ticket" for all issues | complaints go private, one at a time, where they can be stalled |
| every public post is "no issues ✓" | you never see another buyers problem |

one or two of those is sloppiness. all of them together is a design. every single one removes a way you could check beforehand or recover afterward.

---

## 15. what im NOT claiming

so you know im being straight with you:

- **it is not a stealer.** despite the vs code window titled `magnum_opus_stealer` that he screenshotted by accident, the file has no `CryptUnprotectData`, doesnt touch browser profiles, cookies or discord tokens, and sets up no persistence. my accounts were fine. it steals money, not passwords.
- i did not execute it in a lab. this is static analysis plus the offline test on my own pc.
- pe compile timestamps can be forged in theory. this one lands 3 days after their own "loader updated" post, which is what a real build looks like.
- the sleep timings and the local license comparison are my reading of the disassembly. everything else is directly readable.
- this covers this file at this hash only.

---

## 16. how to check it yourself in 2 minutes

no tools needed:

1. paste the sha256 into virustotal
2. Details tab → Portable Executable Info → **Imports**
3. count the dlls. six. none of them can open a socket.

or with sysinternals `strings64.exe`:

```
strings64.exe loader.exe | findstr /i "VAN 1067 wininet winhttp ws2_32 WriteProcessMemory"
```

you should get the vanguard line and nothing else.

or just do what i did: get the loader, unplug your internet, and watch it tell you youre connected.

---

## 17. the cheapest test of all, before you pay anything

ask them for a two minute live screenshare of the platform running in an actual game. not a screenshot, not a clip — live, right now, with your name typed in their chat visible on screen.

any real seller does that in thirty seconds.

watch what happens instead.