Step 02 · Mandatory

The manual sweep.

The auto-scan does not find everything. Many cheats leave no automatic trace. Custos opens each location below with a single click — work top to bottom, every check.

01System Tools

Data Usage
Which apps used the internet — online-activated cheats leave traffic.
Windows Defender
Threat history; cheats flagged as malware may have been allowed.

02Folders

Videos
Screen recordings of cheats, tutorials, demonstrations.
Downloads
Cheat archives/installers and suspicious .exe/.dll/.rar.
AppData / LocalAppData
Configs, logs and oddly-named folders.
Prefetch
.pf files named after executed programs.
OneDrive
Cheats stashed in the cloud for quick restore.

03Games

Unturned
Foreign .dll files, injectors, modified game files.
Steam
Suspicious programs in the Steam root, modified client.

04Registry Keys

UserAssist
ROT13 log of every program run, with counts & timestamps.
AppLaunch
Direct application launch history — one of the most useful.
RunMRU
Win+R command history; cheats launched manually show here.
AppCompatFlags
Compatibility-mode programs — cheats often need it.
MuiCache · AppSwitched · ShowJumpView
Names, switches and taskbar history of used apps.

Telegram cheat-bots

Custos opens these in-browser — check the user's machine for chat history.

@undeadsellerbot
@MelonySolutionBot

Marketplaces to cross-check

Look for these in browser history — where accounts and cheats change hands.

Oplata.info
FunPay.com