Eight modules. One verdict.

Establishes who and what the machine is, and whether Windows protections have been switched off.

• Hardware ID derived from the machine
• Windows install and last boot times
• Virtual machine detection
• Test-signing and nointegritychecks boot flags
• Secure Boot state

Looks at what is running right now — including every DLL loaded inside FiveM.

• Running processes, window titles and command lines
• Unsigned binaries running from user folders
• DLLs injected into the FiveM process
• Matches against the White Light AC signature database

Inspects the game installs for loaders, proxies and mods that should not be there.

• FiveM.app/plugins and mods folders (ReShade recognised)
• Proxy DLLs placed next to the game
• CitizenFX log lines matching cheat signatures
• GTA V ASI loaders and ScriptHook

Finds cheat files by name and SHA-256 hash in the places they usually land.

• Downloads, Desktop, Temp and AppData
• Known cheat names and SHA-256 hashes
• Drivers dropped into Temp
• Recycle Bin $I records of deleted files

Reconstructs what ran on the PC — even after the executable was deleted.

• Prefetch, BAM and UserAssist (ROT13 decoded)
• MuiCache, Compatibility Assistant, RunMRU and Recent items
• Correlation of execution records with deleted executables

Flags attempts to hide evidence before a check.

• PcaSvc, DPS, SysMain or EventLog stopped — or restarted after boot
• Cleared event logs
• USN journal recreation (deep mode streams the journal)
• Defender exclusions and detections

Identifies the hardware and drivers that kernel and DMA cheats rely on.

• DMA cards (e.g. FT601-based boards)
• HID-spoofing input devices
• Vulnerable kernel drivers (kdmapper / iqvw64e, dbk64)
• Drivers loaded from user-writable paths

Records identities so alt accounts and repeat offenders surface across scans.

• Steam IDs and persona names
• Rockstar profile IDs
• Windows user accounts
• Linking by hardware ID across your scans