Execution artifacts
BAM, Amcache, ShimCache, UserAssist and SRUM record what ran — and when — long after the executable is gone. GORE reads them all and cross-references them into a single timeline. Prefetch is read on top wherever Windows leaves it readable, and named as a gap where it doesn't.
Known-cheat signatures
Execution records matched against a live list of cheat brands and marketplace domains, refreshed from our servers on every scan.
Deleted-file traces
The USN change journal and the MFT keep their own record. A binary wiped from \Temp\ or Downloads leaves the deletion behind.
Anti-forensic detection
Cleared event logs, a USN journal deleted or shrunk, timestamps back-dated, Prefetch switched off in the registry — the cover-up leaves its own fingerprints. GORE treats evasion as a threat in its own right.
Cross-source correlation
BAM, Amcache, ShimCache, the USN journal and the event logs checked against each other, and the silent windows between them — plus a plain statement of anything the scan could not read.