Operational Manual

3.1 Historical Game Logs (.log and .log.gz)

Official and custom clients log every account switch and login session.

Procedure: in Everything, search for latest.log, open it with Notepad++, and search with Ctrl+F for:

LwjglWindow: Title: Minecraft
Logging in as
Connecting to
[Client thread/INFO]: Setting user:
[Client thread/INFO]: (Session ID is

Record every nickname found. Cross-reference it against the ban database. A match with a banned account = BAN FOR SANCTION EVASION.

3.2 Launcher Configuration Files (.json)

Launchers store account history, tokens, and profiles locally.

Search for: "displayName" "username" "localId" "name". Every name found is an account associated with this machine.

3.3 IAS Mod — In-Game Account Switcher

This mod allows switching accounts without restarting the game. Its configuration file contains the full list of stored accounts.

In Everything, search for ias.json or ias-accounts.json. The file contains: nickname, UUID, and authentication type (Mojang / Microsoft / Cracked).

3.4 Discord and Telegram Cache

Messaging apps can contain traces of account trading, shared credentials, or purchases of alt Minecraft accounts.

Discord path: %appdata%\Discord\Cache\Cache_Data\. Search for: alts, account, mojang, mail:pass, token.

4.1 Inspecting the Version .json File

Ghost Clients replace Minecraft's launch classes by modifying the installed version's .json file.

Path: %appdata%\.minecraft\versions\[version]\[version].json

Find the "mainClass" line and compare it against:

4.2 RAM Dump — Modules Removed While Running (Unload)

Some cheats delete themselves from disk while the game is running (unload), but remain mapped in RAM until the process is closed.

1. Launch System Informer as Administrator.
2. Find the javaw.exe process, right-click, Properties, Memory tab.
3. Disable "Hide free regions", set minimum size to 4, and enable the Image and Mapped filters.
4. In the Filter field — Contains (case insensitive): .minecraft\mods
5. If a .jar appears in the list (e.g. LiquidBounce.jar) that is NOT physically present in the mods folder on disk: BAN FOR UNLOAD CHEAT / EVIDENCE DESTRUCTION.

4.3 Ghost Client Forensic Strings in RAM

In the Memory tab of javaw.exe, open "Strings" (minimum length: 4).

5.1 Detecting JNativeHook (Java Autoclickers)

The JNativeHook library is used by Java autoclickers to intercept mouse clicks outside the game window.

1. In System Informer, open the explorer.exe process — Properties — Memory.
2. Filter for: JNativeHook
3. If you find a DLL like JNativeHook-[string].dll mapped in memory, search Everything for JNativeHook.
4. If the file is in %temp% but already deleted, and the DLL is still in RAM: IMMEDIATE BAN FOR ACTIVE AUTOCLICKER.

5.2 Autoclicker Forensic Strings in RAM

5.3 Prefetch Analysis: conhost.exe and javaw.exe

Script-based autoclickers spawn hidden instances of the Windows console (conhost.exe), which leave traces in Prefetch.

1. Open WinPrefetchView as Administrator.
2. Search for Conhost.exe.pf and check its referenced files. The presence of .bat, .cmd, or files in %temp%: HIGH SUSPICION.
3. Search for Javaw.exe.pf and check whether its loaded files include unrelated executables or foreign DLLs.

Combat / Aim / Reach

combat/Reach, combat/Killaura, combat/Aimbot, combat/Triggerbot, combat/Velocity, combat/AntiKnockback, Hitbox/Expand, Reach/Distance, TargetHUD, KeepSprint, Criticals, AutoWeapon, net/minecraft/client/entity/EntityPlayerSP/motionX, net/minecraft/client/entity/EntityPlayerSP/motionZ

Generic Autoclicker

AutoClicker, ClickAssist, LeftClicker, RightClicker, JitterClick, BurstClick, CPSCounter, MinCPS, MaxCPS, RandomizationDelay, BlockBreakDelay, InventoryFillClick, RightClickBlatant, LegitimateClicker

Self-Destruct Mechanisms

SelfDestruct, DestructModule, CleanTracks, WipeLogs, DeleteEvidence, AntiForensic, UnloadModule, DisableLoader, StealthMode, HiddenProcess, DeleteOnClose, ExitClean, SecureDelete, WipeOnExit, ClearHistory

Movement / Speed / Fly

Speed/Boost, Fly/NoFall, Sprint/HumanSprint, Step, Jesus, BoatFly, ElytraFly, Spider, NoSlow, FastPlace, FastBreak, Scaffold, Tower, Speed/Bhop, Timer

Render / ESP / Visuals

ESP/PlayerESP, ESP/ChestESP, ESP/BlockESP, ESP/ItemESP, XRay, Nametags, Tracers, StorageESP, ItemESP, MobESP, AntiOverlay, FullBright, Chams, ItemPhysics, Tomograph, NewChunks, OldChunks

HUD / Overlay / UI

ClickGUI, ArrayList, Watermark, TabGUI, InvViewer, ArmorHUD, CrosshairMod, Coords, Coordinates, ServerIP, MemoryDisplay, FPSDisplay, CPSDisplay, Keystrokes

Misc / Utility

AutoEat, ChestStealer, InventoryManager, AutoArmor, AutoTool, AutoPot, AutoSnowball, Spammer, AntiAFK, FakePlayer, Step, FastUse, RightClickRefresh, MiddleClick, FastBridge

Packet / Network

PacketFly, PacketElytra, Velocity, AntiVelocity, Bypass, Flag, Check, Disabler, PacketCancel, SendInterval, Limbo

Ghost Client-Specific

Do0mClient, MoonClient, Tenacity, Astolfo, Kami, Phobos, SalHack, Seppuku, Flux, Snow, Rise, Rusher, Sigma, Vape, LiquidBounce, Wurst, FDP, RISE, Future, Impact, Aristois, Inertia

Doomsday / Auto-Destruct

doomsday, doomsday.client, doomsday.Main, doomsday.unload, doomsday.clean, doomsday.selfdestruct, doomsday.delete, doomsday.wipe, doomsday.stealth, doomsday.hidden, doomsday.remove, doomsday.forge, Class.forName, ClassLoader, defineClass, loadClass, getDeclaredMethod

Anti-Cheat Bypass

AntiCheat, Bypass, Vanilla, Watchdog, Grim, Vulcan, Matrix, Intave, Rewind, Polar, Aac, NCP, Spigot, Paper

Obfuscation

obfuscate, deobfuscate, remap, unmap, mapping, srg, notch, mojang, yarn, intermediary

Mod Loader / Forge

FMLCommonHandler, FMLPreInitializationEvent, FMLPostInitializationEvent, ForgeModLoader, net.minecraftforge, MixinBootstrap, org.spongepowered.asm.mixin, @Mixin, @Inject, @Overwrite, @Shadow

Java Runtime

ClassLoader, defineClass, loadClass, forName, getRuntime, ProcessBuilder, Runtime.exec, Process, Reflection, setAccessible, getDeclaredField, getDeclaredMethod

File System

File.delete, File.deleteOnExit, Runtime.exec(rm), Runtime.exec(del), Files.delete, Files.deleteIfExists, NIO, Path.delete

Network Connections

ServerSocket, Socket, connect, bind, InetSocketAddress, Channel, Selector, DatagramSocket, loopback, 127.0.0.1, localhost, ws://, wss://

Memory / Process

VirtualAlloc, VirtualProtect, WriteProcessMemory, ReadProcessMemory, OpenProcess, CreateRemoteThread, NtMapViewOfSection, Inject, DLL, LoadLibrary, GetProcAddress

VPN / Tunnel

Hamachi, ZeroTier, Tailscale, Radmin, ngrok, Cloudflare, WARP, WireGuard, OpenVPN, NordVPN, ExpressVPN, ProtonVPN, Mullvad

Hidden / Stealth Software

HiddenMouse, HID, USB Rubber Ducky, Teensy, Arduino, BadUSB, Keylogger, KeySpy, ActivityMonitor, Spyrix, Refog, Agent, HiddenWindow, WindowHider

When NOT to Ban

Procedure in Case of Doubt

1. Do NOT issue a ban on your own. Contact a senior inspector with screenshots of the anomalies.
2. Document the machine's state with detailed screenshots and save them.
3. The player can be placed "Under observation" for a period defined by the team.
4. If evidence was destroyed but there's no direct proof of a cheat, consider "Screen Share Refusal" — a ban for refusing or obstructing the screen share.