One file runs on the player's computer for about a minute and reads what Windows has written down about itself. What comes back is not a screenshot and not a verdict you have to take on trust - it is the evidence, sorted, with the source named next to every line.
No call to schedule, nothing for your staff to install, and nothing that depends on a player being helpful while you watch their screen. You create the check, they run one file, and the report lands in your panel by itself.
One click gives you a short code and a link like screenshare.ac/ABC123. Send it in Discord the way you would send anything else.
The program is built for that one check. It asks for administrator rights, shows what it is about to read, and waits for the player to accept.
The panel shows which stage is running, so you can tell a slow machine from a player who closed the window halfway through.
It uploads itself the moment the scan ends, and each check accepts exactly one report. A result that could not have happened - finished before the file was downloaded, or a verdict that does not match its own evidence - is marked as such next to the report.
Deleting a file does not delete the record of it. Windows keeps its own accounting of what ran, what was downloaded, which folders were opened and what was plugged in - for its own reasons, and mostly whether the player wants it to or not. These are the sources, and what each one can answer.
Several of these are locked by Windows while it is running. The check reads them through a volume shadow copy instead of asking politely - a locked file is not a missing one.
Records tell you what happened earlier. This part looks at the machine as it is right now: what is loaded into the game, how it got there, and what was done to Windows to let it in.
The standard signature list runs on every check and you never have to maintain it. On top of that you can add what only your staff knows: the loader going around your community this week, the file somebody was caught with, a string that survives every rebuild of it. Your rules are yours - not shared, not public, not visible to anyone else.
Matched against what ran, what was downloaded, which folders were opened and what sits on disk. The right tool when a loader keeps coming back under the same name.
nrecoilThe SHA-256 of a file you already have in hand. Renaming it changes nothing, because the hash is the file and not its label.
4f3c9e...a91bUp to five strings, and you choose how many have to be found - two or more is the default, so one ordinary word does not flag an innocent program. Both text encodings a Windows program can use are searched.
2 of 3 must matchDrop the executable in and the extractor reads it the way a reverse engineer would: the imports, resources and relocations every program has are skipped, and what is left is ranked, so you choose from a short list of candidates instead of scrolling a hex dump. The file is read in memory and never written to disk on our side.
Your rules travel inside the program the player downloads, so they are matched against the real disk and the real records while the check runs. Every hit gets its own section in the report, separate from the standard findings, so it is obvious which of them came from your list.
The most useful finding is often not a cheat but a hole where the records should be. A player who wiped the machine an hour before the check comes back clean - and the report says so out loud rather than calling it innocent.
A computer in daily use keeps hundreds of entries. A months-old system holding eleven of them was cleaned, and recently.
One move erases Prefetch, Amcache, ShimCache and the journal together. The install date is checked against the clock for exactly that reason.
A deletion journal that only begins after the last boot was deleted and started again - it does not happen by itself.
A profile in daily use with an empty history database, or one that was recreated minutes before the check began.
Traces of the tools people run before a screenshare, whatever name they were going under at the time.
Another account on the machine, or a second installation next to this one - places the check was never pointed at.
None of this is proof of cheating, and the report never presents it as such. It is the context you need before deciding what a clean result is actually worth.
The report opens with a verdict, a risk score and the key facts about the machine, then every area in one view - the ones where something turned up first, the clean ones below. Five sections hold the detail, with a side menu that always shows where you are - and every finding carries the record it came from, so you can answer "how do you know" without asking anyone.
A known signature, a module mapped in by hand, a file the antivirus itself caught and named. This is the class that moves the verdict.
An unsigned program in an odd place, an antivirus exclusion added by hand, a second Windows account. Ordinary on their own, telling together - and your server decides what they are worth.
Remote desktop software, virtual machines, screen recorders. Listed because you should know they are there, and never counted as proof of anything.
One bar shows how many areas came back clean and how many need a look. Areas with findings are listed strongest first; click one and the report jumps to the evidence.
Findings link to the exact row they came from - the Amcache entry, the journal record, the download line - and the row is highlighted when you land on it.
If a stage ran out of time or failed, the report names it. A gap is never quietly presented as a clean result.
The whole report is a single HTML document that makes no outside requests. Save it, attach it to an appeal, open it again in five years.
It arrives from the player's machine, so we treat it as untrusted: it is shown sandboxed, with no network and no forms. A report is a document, never a program.
Then it is deleted automatically along with the machine details. You can also delete any check yourself, at any point before that.
Screenshares are rarely one person's job. The account is shared, the history is shared, and the next admin to look at a player starts where the last one stopped.
On every plan. You are never weighing whether a player is worth one of the scans you have left this month.
Invite the people who actually run screenshares. One account, one history, and a seat can be taken back when somebody leaves the staff.
While a player is running the check you see the stage it is on, not a spinner - so you know whether to keep waiting.
Email and a password, or Discord if you would rather not keep another one.
There are no advertising or analytics cookies anywhere on this site, so there is nothing for anyone to consent to.
A player can ask for their report to go before the 90 days are up. It takes one click, and it is gone for good.
Not a kernel-level anti-cheat, and it does not pretend to be. It reads records after the fact; it does not watch the game while it is played. Someone who wipes carefully, runs from a second machine, or never lets anything touch the disk can come back clean. That is why the report shows the evidence behind every finding instead of only a verdict - the decision stays yours to make, and yours to defend.
Create the account, pick a plan, and send the first link in a few minutes.