Scan terms & privacy.

02 / IDENTITY

Accounts and history

Playforensic searches existing local Discord data for Discord user IDs. Found IDs are displayed in and uploaded with the scan result. It does not parse or extract authentication tokens, passwords, email addresses or message content from those Discord files. Your local Steam display name and Steam64 account ID are read from the same login record.

The report shows the Steam and Discord identifiers recorded by the scanner.

The scanner compares a limited portion of recorded Edge and Brave visits with a list of known website indicators. It checks recorded Discord channel links in supported Chromium browsers and guild icon keys in supported Discord desktop caches. The report includes the matching catalog label and its source as a warning. Full URLs, unrelated browser history and Discord messages stay on the PC. A cached icon can come from a preview and cannot establish a visit or membership.

03 / LOCAL CHECKS

What the scanner reads

The scanner checks selected files and hashes, digital signatures and certificate trust stores, WBEM and registry artifacts, executable metadata, loaded module file paths in readable FiveM processes, Windows event logs, Defender detections, and three Windows services. It also reads current-user Recycle Bin metadata, including original file paths and deletion times.

Additional read-only configuration checks inspect the FileInfo driver Start value, the EnablePrefetcher application-prefetch setting, bounded existing Image File Execution Options Debugger values, and one supplied Game Bar COM class registration in the current-user and machine registry views. Reports retain only the relevant registry key, fixed rule name or setting, target executable name, registry view and the observed local COM DLL path. Debugger commands and their arguments are not retained. These are configuration warnings for manual review; they do not establish that an injection, bypass or cheat ran. Missing or unsupported values are coverage limits, not detections. No registry values are changed and registered files are not loaded or executed.

The scanner checks a limited recent portion of Microsoft Defender support logs for a specific FiveM process marker. The report retains only the matching log’s filename and the fixed indicator. Raw log lines stay on the PC. The scanner also compares files in the local FiveM AI game-data folder with two exact SHA-256 references. The report retains the matching relative path and hash. Both checks produce warnings for manual review.

The scanner reads Windows-reported TPM enablement and Secure Boot status without changing either setting. A confirmed disabled TPM is shown as TPM disabled (Warning); confirmed disabled Secure Boot on UEFI is shown as Secure Boot Deactivated (Detected). Enabled settings produce no finding. Missing, unsupported or unreadable status is recorded only as limited coverage and is never treated as disabled. No TPM keys, certificates or hardware identifiers are collected. These status labels do not prove cheating.

For recently invoked and deleted BAT files, the scanner reads bounded existing Security 4688 and Sysmon 1/23/26 events from the last seven days and current-user Recycle Bin BAT metadata. Process command lines are checked locally only for a supported direct Windows cmd.exe invocation of an absolute BAT path. A warning requires a later independent deletion record for the same path. The report retains only the BAT path, launch/deletion times and event source/record IDs. Raw commands, event account fields and script contents are discarded. The scanner does not enable logging or install Sysmon. Missing logs and unsupported commands are limited coverage. The label Executed and Deleted describes recorded invocation followed by deletion; it does not prove script completion, unchanged file identity, current absence or cheating.

Windows event-log clearing: The scan reads up to 512 existing System event 104 records from the last seven days, with a short time limit. For a fixed list of standard logs it retains only the affected log name, recorded UTC time and event record ID. Account names, SIDs, computer names, backup paths and raw event XML are discarded. A Windows Event Log Cleared warning can reflect normal administration and does not prove cheating or identify the person responsible. Missing records and access limits do not prove that no log was cleared. The scanner never clears or enables a log. The retained fields are included in the uploaded report under the sharing rules above.

Selected executable files and the collected inventory are compared with deduplicated whole-file SHA-256/SHA-1 references supplied by the operator. A matching path, digest and supplied reference label are reported as a warning. These references were not independently validated against original samples and do not establish execution, injection or cheating. Duplicates and references explicitly naming ordinary software were excluded.

The inviting account and platform administrator can add hash, PCA, PE timestamp and YARA content rules. Account rules are saved with the invitation; administrator rules are refreshed when the scanner opens. Both rule sets inspect readable files within the scanner’s limits. The accepted configuration is checked again before collection begins. The scanner does not run files it finds or change checked files, services, Defender settings or registry values. A finding is a clue for review, not proof that someone cheated.

The scan also reads UAC policy, bounded application hang/crash events, selected BAM and UserAssist execution metadata, and supported Prefetch metadata and referenced paths for the named programs. Normal execution or a path reference alone is context, not proof of cheating. It checks specific Kdex source fingerprints and current-user configuration artifacts; the trusted-device authentication file is checked by path and metadata only, never its token contents. Configuration content is compared locally with a specific schema; only matched paths and finding names enter the report.

Additional supplied checks inspect the first readable FiveM game process and up to 256 of its loaded module files, using fixed module-name and YARA rules. Module file reads are bounded to 64 MiB per file and a 12-second collection budget. If those module checks find no match, a fixed FiveM string is checked in the readable Diagnostic Policy Service (DPS) process; an absence finding requires a complete bounded read. Reports retain only trigger and rule names, paths, process IDs and read counts. A named module, a YARA match or an absent string is an indicator classification and does not by itself establish cheating.

When SysMain has a recorded process ID, a supplied timing check compares the newest readable file-write time in the Prefetch directory with 15 minutes. Separate bounded, read-only checks inspect supported Prefetch file headers and compressed structure. Empty or structurally inconsistent files produce a warning; supported uncompressed files and duplicate valid hashes alone do not. Incomplete directory metadata cannot establish the timing condition. These findings do not establish that a cleaner or bypass ran. The report retains only the relevant path or latest write time, process ID, elapsed seconds and fixed anomaly description.

The scanner also reads a bounded recent portion of existing NTFS change journals for DLL deletion followed by recreation at the same resolved path within five seconds. It reports the matched DLL path, deletion and recreation times, elapsed time and observed change types. It does not read DLL contents for this check or create, enable or modify a journal. Missing journals, access restrictions and read limits are shown as limited coverage. A possible file replacement is a finding for review: installers and updates can produce the same sequence, and a Close record alone is not deletion or evidence of cheating.

04 / PROCESS MEMORY

Limited string checks

The scan reads bounded current-user AnyDesk transfer logs and reports filenames from explicit finished transfers, the source log path and an available transfer timestamp. It checks whether current-user PowerShell PSReadLine history contains non-empty entries and reports only the history file path; command contents are never included. It checks accessible Amcache application/file entry metadata. Missing or empty entries produce a warning; unreadable or unsupported data is marked as limited coverage. These findings appear in the report.

The scan performs bounded, read-only live process-memory string checks in SndVol.exe, Steam.exe, RuntimeBroker.exe, Editor.exe, OptionalFeatures.exe, svchost.exe, Userinit.exe, rundll32.exe, ctfmon.exe, dxdiag.exe, SearchProtocolHost.exe, winver.exe, MsMpEng.exe, SecurityHealthSystray.exe and lsass.exe, plus the matching DPS service process for its fixed-marker check.

The existing host-boundary checks compare predefined hostnames and fixed file-name indicators, including in LSASS, without collecting credentials or bypassing protected-process security. Those checks use host boundaries to exclude unrelated lookalike domains. Fixed TRASH hostname checks use a subset of the same named readable processes and selected native PE files. They retain only the matching fixed hostname and minimal file or process metadata, without surrounding content. They do not collect DNS, sockets, packets, TLS SNI or HTTP headers. The additional supplied substring checks have the separate scope described below. The data read and retained is described on this page, linked from the scanner before acceptance; executable detection rules are not published here.

For a match, the report includes only the matched indicator, process ID, executable path, match address, memory-region type/protection and text encoding, alongside coverage and limits. Surrounding memory bytes, authentication data and unrelated strings do not enter the report. The scanner does not contact these hosts or upload a memory dump.

The scanner also requests bounded read-only access to up to two MsMpEng.exe processes for four seconds. It compares readable content with three fixed payload-URL or command markers and reports matches as warnings with process metadata. Defender may retain content from files it inspected. Windows access restrictions and protected-process failures are recorded as limited coverage.

Selected executable files are compared with exact official Xenos release fingerprints. Standard user and Windows Temp folders are searched within fixed limits for files whose complete size and SHA-256 match the supplied payload sample. Renamed copies can match. The same selected-file and Temp scope also checks an additional supplied PE DLL by its complete SHA-256 and 224320-byte length, regardless of filename or extension, including renamed .db files. Reports include only the matching filename, path, digest and reference metadata. File contents stay on the PC. The TRASH reference match is classified as Detected; its domain-only content matches are Warnings. These labels identify matching content and do not establish execution, a network connection or cheating.

The predefined memory indicators appear as Detected findings, including the Process Hollowing label. This classification identifies a matching indicator; a text match alone does not prove process hollowing, injection or cheating. Additional fixed markers check a specific Steam payload URL or a payload name combined with its download host in the same verified process. LSASS matches use the Generic Bypass Methode label and other process matches use Process Hollowing. These are indicator classifications, not proof that the named technique occurred. Unreadable or partially read processes are reported as limited coverage.

The additional supplied named-process rules preserve their fixed, case-sensitive substring matches in ASCII and UTF-16LE. They retain only the fixed indicator, executable path, process ID, match address and encoding; a broad substring match can also occur in benign context. A separate quiet pass checks the same fixed markers in a bounded set of other readable processes but creates no match findings, uploaded hit counts or hit logs. A correlated SATOR check can report combinations of fixed cheat-specific, feature and library markers in other readable processes. Generic ImGui text or a debugger name alone does not trigger that check. The strict LSASS Splasher check requires its fixed base URL with a valid boundary. No protected-process access controls are bypassed.

Readable Temp directories on fixed local drives are searched within file, byte and time limits: Windows\Temp, drive-root Temp and Tmp, and Temp or Tmp directories under Users. The supplied checks compare file bytes locally with fixed indicators, a large escaped-byte-buffer pattern, or a PE header in an unusual file extension. A match reports only the filename, full path, fixed rule names and file length. These classifications can identify a candidate without establishing that it ran. The scanner does not execute discovered programs or payloads. File contents, surrounding memory, passwords, authentication tokens and unrelated text are not retained or uploaded by these checks.

05 / RESULTS

Report visibility and retention

The report includes findings, full file paths, the account IDs described above, Windows and service details, limited process-memory matches, and an executable inventory with SHA-1 and SHA-256 hashes. It also includes a timestamped FiveM module-path comparison: in instance, out of instance, unknown, or no active instance.

Private by default. Only the inviting account and administrators can open a private report. The inviting account or an administrator may deliberately switch a scan accepted under these terms to public. Then anyone with its link can view the complete report without signing in: findings and full file paths, recorded Steam and Discord identities, Windows and service details, process indicators, hashes, file inventory and PC logs. Public access does not permit editing settings, reporting findings as the owner or viewing other scans. Do not proceed with a scan if you do not accept this possibility.

Switching a public scan back to private stops new anonymous requests immediately. It cannot recall copies or screenshots someone already saved. Reports are marked no-index and are not publicly listed; this does not prevent a recipient from sharing the link. Reports accepted before public sharing was introduced in consent 2.9 remain private and cannot be published. Consent 2.9 reports retain their existing visibility options.

For DiagTrack, PcaSvc and SysMain, service details include the matching running process ID, parent process ID, executable path and start arguments when readable, alongside the associated process start time and whether the host is dedicated or shared. Start arguments are read only from those matching service hosts. Missing values stay unavailable. A process start time is not an exact service start time; a shared host may already have been running before its services started.

The report is automatically uploaded over HTTPS to the service configured in the scanner and belongs to the account that created the invitation. The operator can review it in the Playforensic workspace. Reports are available for seven days and expired records are removed by the daily cleanup.

06 / GETTING STARTED

Your invitation and consent

A valid scan invitation is required; the PIN alone cannot start or upload a scan. The invitation and its configuration are checked online before any PC data is scanned.

Keep the downloaded filename unchanged until you open it because your short-lived invitation is part of that filename. The scanner first opens Terms & Privacy with a link to this page. Choosing Accept agrees to the scan, upload, and the sharing described above. After acceptance, the invitation code is filled in automatically and the scan starts without another confirmation. A website visit, download or filled-in PIN does not replace this acceptance.

07 / AFTER THE SCAN

Stopping and cleanup

You can cancel the scan at any time. The scanner saves no local scan report. It writes extracted program components and a small WBEM comparison snapshot under your local app-data folder, plus temporary file lists and custom YARA rules during the scan.

After the website confirms upload, or if an already consented and started scan fails before upload, the scanner closes automatically after three seconds and attempts to delete only its own downloaded EXE. Download the scanner again to retry a failed scan. If upload fails, the scanner stays open for a retry. If the scan is canceled or cleanup cannot complete, the EXE remains for manual removal.

Scanned files, the WBEM snapshot and program components are not deleted. This cleanup does not prevent anyone from copying the EXE.