Features

Everything a PC check needs, nothing it does not

34 built-in checks in 11 categories, a signature database you can extend, and a verdict engine that is honest about what it could not see.

01Checks

The built-in check catalog

27 checks run as a normal user; 7 need administrator rights and are skipped without them, which lowers coverage. “What it reads” is the exact text the player sees on the consent screen.

System Security State

Virtual machines, test signing, disabled security features and antivirus exclusions that cheats rely on.

5 checks

System Security State checks
Id	Check	What it reads	Max severity	Admin
SYS-001	System Profile Collects the OS build, uptime, administrator status and a pseudonymous hardware reference used to link scans of the same PC. False-positive notes Informational only.	Windows version, uptime, CPU/motherboard/disk identifiers (hashed on your PC, never sent in clear).	info	No
SYS-002	Virtual Machine & Sandbox Detects hypervisors, virtual hardware and sandboxes — scans run in a VM do not reflect the gaming PC. False-positive notes Hyper-V/WSL enabled on the host sets the hypervisor flag; reported as info unless virtual hardware is also present.	Hardware vendor strings, BIOS information, hypervisor flag.	medium	No
SYS-003	Test Signing & Debug Mode Windows test-signing, kernel debugging or disabled driver signature enforcement allow unsigned kernel cheats to load. False-positive notes Driver developers may legitimately enable test signing; staff should ask.	Boot configuration flags (code integrity state).	high	No
SYS-004	Security Features Disabled Memory integrity (HVCI), Secure Boot, Defender real-time protection or tamper protection turned off. False-positive notes Many users disable Defender for performance; low severity on its own.	Windows security feature states.	medium	No
SYS-005	Defender Exclusions Antivirus exclusions on folders or processes — cheat loaders routinely ask users to exclude them. False-positive notes Game and development folders are common exclusions; only matches and exclusions in user-writable temp/download folders are raised above info.	Microsoft Defender exclusion list (paths, processes, extensions).	high	Yes

Running Processes & Modules

Running programs, unsigned binaries in user folders, modules loaded into FiveM and handles opened on it.

4 checks

Running Processes & Modules checks
Id	Check	What it reads	Max severity	Admin
PRC-001	Running Processes Matches every running process (name, path, file hash, publisher, window titles) against the signature database. False-positive notes Hash matches are exact; name matches are capped at medium unless the signature says otherwise.	List of running programs, their file paths, hashes and window titles.	critical	No
PRC-002	Unsigned Processes in User Folders Unsigned executables running from Temp, Downloads, AppData or removable drives — typical of loaders. False-positive notes Many indie tools are unsigned; never raised above medium without a signature match.	Paths and signature status of running programs.	medium	No
PRC-003	FiveM Process Modules Lists DLLs loaded into FiveM/GTA processes and flags unsigned or unexpected modules (injected cheats, proxy DLLs). False-positive notes Overlays (Discord, Steam, NVIDIA, RivaTuner, OBS) are allow-listed by publisher. Skipped when FiveM is not running.	Modules loaded in FiveM processes (only if FiveM is running).	critical	No
PRC-004	Process Handles to FiveM Processes holding memory read/write handles to FiveM — external cheats need them. False-positive notes System services, anti-virus and overlays are excluded by publisher.	Which programs have open access to the FiveM process.	high	Yes

Memory String Scan

Searches the memory of selected processes for cheat strings (needs administrator rights and the memory scan feature).

1 check

Memory String Scan checks
Id	Check	What it reads	Max severity	Admin
MEM-001	Memory String Scan Searches the memory of selected processes (Explorer, FiveM, the Windows search and service hosts) for strings that cheat menus and loaders leave behind. False-positive notes Strings shorter than 6 characters are refused by the signature validator. Only the matched string and process are reported, never surrounding memory.	Text in the memory of selected Windows and FiveM processes; only matching strings are reported.	critical	Yes

FiveM & GTA V Installation

The FiveM installation, GTA V directory, modified game data, logs and crash dumps.

4 checks

FiveM & GTA V Installation checks
Id	Check	What it reads	Max severity	Admin
FIV-001	FiveM Installation Inspects FiveM.app: plugins folder, citizen and mods directories, ASI loaders and proxy DLLs (dinput8, d3d11, dxgi, version). False-positive notes ReShade and graphics mods are reported as info; the operator decides whether they are allowed.	File names, sizes and hashes inside the FiveM installation folder.	critical	No
FIV-002	GTA V Directory Script hooks, ASI loaders and trainers in the GTA V installation (ScriptHookV, dsound/dinput8 proxies, .asi files). False-positive notes Single-player mods are common; staff decide whether they matter for their server.	File names and hashes in the GTA V installation folder.	high	No
FIV-003	Modified Game Data Modified game data files in FiveM's citizen folder (weapons/visualsettings/timecycle overrides used for no-recoil or visual advantages). False-positive notes Compared against hashes of the official FiveM build; FiveM updates are tracked by the signature database.	Hashes of game data files inside FiveM.app/citizen.	high	No
FIV-004	FiveM Logs & Crash Dumps FiveM client logs for injected modules, loader messages and abnormal resource activity. False-positive notes Only lines matching signatures are reported.	FiveM log files (only matching lines are reported).	high	No

File System Artefacts

Known cheat files, freshly created executables, the recycle bin and removable or virtual drives.

4 checks

File System Artefacts checks
Id	Check	What it reads	Max severity	Admin
FS-001	Known Cheat Files Hashes executables and archives in Downloads, Desktop, Documents, Temp and AppData and matches names, paths and hashes against signatures. False-positive notes Document and media files are never read. Paths are reported with your user name replaced by %USERPROFILE%.	Names, sizes, dates and hashes of executable/archive files in your user folders.	critical	No
FS-002	Recently Created Executables Unsigned executables and DLLs created in user folders during the lookback window. False-positive notes Reported as low unless combined with other indicators.	Executable files created recently in your user folders.	medium	No
FS-003	Recycle Bin Deleted executables still in the recycle bin, matched against signatures. False-positive notes	Original names and deletion dates of executable files in the recycle bin.	high	No
FS-004	Removable & Virtual Drives Connected USB / virtual drives and evidence of programs executed from them. False-positive notes Executing from USB is not cheating by itself.	Drive letters, types and labels; executables on removable drives are hashed.	medium	No

Execution History

What ran on the PC recently: Prefetch, BAM, user execution traces, the USN journal and autoruns.

5 checks

Execution History checks
Id	Check	What it reads	Max severity	Admin
EXE-001	Prefetch Windows Prefetch records of programs run in the lookback window, matched against signatures; programs that ran and were then deleted are flagged. False-positive notes Deleted-after-run is low severity unless the name matches a signature.	Names, run counts and last run times from C:\Windows\Prefetch.	critical	Yes
EXE-002	Background Activity Moderator BAM registry entries (full path + last execution time) matched against signatures; missing files flagged. False-positive notes	Program paths and last execution times recorded by Windows (BAM).	critical	Yes
EXE-003	User Execution Traces UserAssist, MUICache, Compatibility Assistant and recent-documents traces of executed programs. False-positive notes	Program names recorded by Windows in your user registry.	high	No
EXE-004	USN Journal NTFS change journal of the system drive: executables/DLLs created, renamed or deleted recently, matched against signatures. False-positive notes Software updates create and delete many files; only signature matches and deleted unsigned executables are reported.	File names (not contents) of recently created/deleted executable files on the system drive.	critical	Yes
EXE-005	Scheduled Tasks & Autoruns Run keys, startup folders and scheduled tasks pointing to user-writable locations or known loaders. False-positive notes	Startup entries and scheduled task commands.	high	No

Drivers & Services

Loaded kernel drivers and installed services, including vulnerable drivers used to load kernel cheats.

2 checks

Drivers & Services checks
Id	Check	What it reads	Max severity	Admin
DRV-001	Loaded Drivers Kernel drivers currently loaded, matched against known cheat drivers and vulnerable drivers abused to map cheats (kdmapper-style). False-positive notes Vulnerable drivers also ship with legitimate hardware tools; a match alone is high, not critical.	Names, paths and signers of loaded drivers.	critical	No
DRV-002	Services Installed services and kernel services with binaries in user-writable locations or matching signatures. False-positive notes	Service names and binary paths.	high	No

Hardware & DMA

Traces DMA cards and macro hardware leave behind: PCIe device ids and input-device software.

2 checks

Hardware & DMA checks
Id	Check	What it reads	Max severity	Admin
HW-001	PCIe DMA Devices PCI devices whose vendor/device ids match FPGA boards used for DMA cheats, and devices masquerading with mismatched ids. False-positive notes A well-configured DMA card can spoof ids; absence of a finding is not proof.	PCI device identifiers.	high	No
HW-002	Input Devices & Macro Software Input-injection devices (e.g. KMBox/Arduino HID spoofers) and macro tools like AutoHotkey running scripts. False-positive notes Gaming-mouse macro software is reported as info only.	USB input device identifiers, running macro tools.	medium	No

Network & Browser Traces

Cheat-seller and loader domains in the DNS cache and in browser history (domains only).

2 checks

Network & Browser Traces checks
Id	Check	What it reads	Max severity	Admin
NET-001	DNS Cache Recently resolved domains matched against known cheat sellers, loaders and auth servers. False-positive notes Visiting a cheat website is not cheating; a loader auth domain is stronger evidence.	Domains in the Windows DNS cache; only matching domains are reported.	high	No
NET-002	Browser History Domains Domains in Chrome, Edge, Brave, Opera and Firefox history matched against cheat-seller signatures. Nothing else from the history leaves the PC. False-positive notes Capped at medium.	Browser history domains; only matching domains and their last visit date are reported.	medium	No

Anti-Forensics & Cleaning

Cleared event logs, disabled activity recording, trace cleaners and clock manipulation.

4 checks

Anti-Forensics & Cleaning checks
Id	Check	What it reads	Max severity	Admin
AF-001	Event Log Clearing Security/System event logs cleared recently (events 1102 / 104). False-positive notes Some optimisation tools clear logs; staff should ask.	Timestamps of log-clearing events.	high	Yes
AF-002	Disabled Forensic Features Prefetch disabled, UserAssist logging disabled, USN journal recently recreated or BAM entries wiped. False-positive notes SSD 'optimisation' guides sometimes disable Prefetch.	Registry settings controlling Windows activity recording.	high	No
AF-003	Cleaners & Timestamp Tools Trace cleaners (and their recent runs), timestamp-changing tools and file shredders. False-positive notes CCleaner use is common; reported higher only if run shortly before the scan.	Execution traces of cleaning tools.	medium	No
AF-004	System Time Manipulation Local clock differs from the DUXAC server clock or was changed recently (used to fake artefact timestamps). False-positive notes Time-zone changes are excluded.	Your PC clock and recent time-change events.	medium	No

Scanner Integrity

Debuggers, hooks and unofficial builds of the scanner itself, checked against published release hashes.

1 check

Scanner Integrity checks
Id	Check	What it reads	Max severity	Admin
INT-001	Scanner Tampering Debuggers attached to the scanner, hooks in its process, or a scanner binary whose hash does not match an official release. False-positive notes The hash check is done by the server against published release hashes.	State of the DUXAC scanner process itself.	critical	No

02Signatures

The indicator database: global, plus your own.

15 signature types: file sha-256, file name, file path, process name, module name, window title, memory string, file string, code-signing subject, driver name, service name, registry key, pci/usb device id, domain, browser download filename.
Match modes are exact, contains and glob. There is no regex: no ReDoS and identical behaviour in the scanner's C# matcher and the TypeScript reference.
Validation before anything is stored: hashes must be SHA-256, string patterns need ≥ 6 characters, globs ≤ 4 wildcards and ≥ 3 literal characters.
Every edit is a new version: publish, roll back, disable. Each signature's severity is capped at the highest severity its check allows.
Hit counts and false-positive marks per signature show which indicators are worth keeping.

03DUXAC Intelligence

A verdict computed by the API, never by the scanner.

Clean
No significant indicators, and enough of the checks completed to trust that.
Suspicious
A high-severity indicator or enough combined risk that staff should look closely.
Detected
A strong critical indicator or very high combined risk. Still a recommendation: staff confirm it.
Inconclusive
Nothing significant found, but too many checks were skipped (often: no administrator rights) or scanner integrity failed.

Each finding scores severity weight × confidence. Duplicate indicators count once; independent categories add a corroboration bonus.
Coverage measures how much of the enabled checks actually completed. A scan below 80% coverage with no findings is “inconclusive”, not “clean”.
Detected: a critical indicator at ≥ 85% confidence or risk ≥ 80. Suspicious: risk ≥ 35 or any high indicator.
A tampered scanner can hide findings, but it cannot declare itself clean: its hash is checked against published releases and integrity problems keep the verdict from being “clean”.
The verdict is a recommendation. Staff set the review status: cheating confirmed, cleared or inconclusive.

04Live progress

Watch a scan while the player runs it.

The dashboard shows when the PIN is claimed, when consent is given or declined, each check as it runs, and findings as they are uploaded.
Time limits keep scans honest: 15 minutes to enter the PIN, 10 minutes to answer the consent screen, 30 minutes to finish.
Status changes are always live; per-check progress is a plan feature.

05Player history

Recognise the same PC, only inside your community.

The scanner computes a hardware reference as an HMAC of hardware identifiers with a key specific to your workspace, on the player's PC. The identifiers themselves are never sent.
All scans of the same reference are linked: earlier verdicts, review decisions and notes are on the report.
Mark a PC as watched or blacklisted; a new scan from a blacklisted PC says so on the report.
Another community gets a different reference for the same PC, so players cannot be tracked across communities.

06Privacy & consent

Players see exactly what will be checked before anything is.

The consent screen shows the community name, your request note, your consent text and every check with the data it reads. Declining ends the scan and notifies the staff member who created it.
Only findings and minimal system information leave the PC. Paths are reported with the Windows user name replaced by %USERPROFILE%.
The scanner does not install anything, does not stay running and removes its temporary files.
Reports are deleted when your plan's retention period ends.

07Workspaces & staff seats

One workspace per community, with roles that match how staff teams work.

A workspace is a license issued by the DUXAC team. Attach it with its license key and you become its owner.
Owners can do everything, including license management (8 capabilities). Managers handle members, settings and signatures. Staff create and review scans and mark players.
Invite existing DUXAC accounts by email up to your plan's seat limit; everyone works on the same scans and players.
Every action in a workspace is written to its audit log.