I've made a scanner that checks the diagtrack process for executables files that were ran AND unsigned.
- Open cmd as admin
- cd into the folder where diagtrack.exe is located
- Type "diagtrack.exe" and hit enter
- For every unsigned exe, inspect it using die to determine if it is a cheat.