Cheat DetectionHighPublished

Flyside FiveM cheat detection & forensic artifacts

Flyside is a FiveM cheat that masquerades as cmd.exe, drops TModule.dll directly into the root of C:\, and communicates with C2 gm07-dc04.ouiheberg.com. Its SHA-256 is 01939a2b6ac191c4afb03884c0e6f172c2332c4e4bf4f516718b585541dd31c4.

CR
Clubhouse AC Research June 2, 2026 8 min read

Summary

  • Masquerades as cmd.exe — distinguish by execution path (real cmd.exe is always in System32 or SysWOW64).
  • Drops TModule.dll to C:\TModule.dll — this path is anomalous and has no legitimate counterpart.
  • C2 domain gm07-dc04.ouiheberg.com observed in DNS cache and LSASS memory during active sessions.
  • SHA-256 01939a2b6ac191c4afb03884c0e6f172c2332c4e4bf4f516718b585541dd31c4.

Overview

Flyside is a FiveM cheat with a multi-indicator artifact footprint. It masquerades as cmd.exe — a process that is ubiquitous enough that users may not scrutinize it — but runs from a non-system path, distinguishing it from the legitimate Windows Command Prompt.

Flyside's most distinctive persistent artifact is TModule.dll dropped directly into the root of the C: drive (C:\TModule.dll). No legitimate Windows component or third-party application creates a DLL at the root of C:\ with this name. It is visible in a Journal Trace search and persists independently of the loader.

Sample metadata (IOC)

Flyside — file indicatorsIOC
Name        cmd.exe  (masquerade — real cmd.exe is in System32)
Brand       Flyside

SHA-256     01939a2b6ac191c4afb03884c0e6f172
            c2332c4e4bf4f516718b585541dd31c4

Dropped     C:\TModule.dll  (no legitimate origin at this path)

C2 domain   gm07-dc04.ouiheberg.com
  → Observed in: DNS cache, lsass.exe

Behavioral indicators

TModule.dll in C:\ root

Flyside drops a file named TModule.dll directly into C:\. This location is immediately anomalous — no legitimate Windows component or application installer places DLLs at the root of the system drive. The file persists after the cheat exits and is visible in a Journal Trace search filtered for TModule.

cmd.exe masquerade

The legitimate Windows Command Prompt executable is located at C:\Windows\System32\cmd.exe or C:\Windows\SysWOW64\cmd.exe. Flyside runs a fake cmd.exe from a non-system path. In the process list or Prefetch, confirm the execution path — any cmd.exe outside System32/SysWOW64 is suspicious.

C2: gm07-dc04.ouiheberg.com

Flyside contacts gm07-dc04.ouiheberg.com for license validation and payload delivery. This domain is observable in the DNS cache and in LSASS process memory during an active session.

Screenshare check guide

1

TModule.dll Journal Trace

  • Open a Journal Trace tool and search for TModule.
  • A creation event for C:\TModule.dll is definitively Flyside — no legitimate software creates this file.
  • Check whether the file still exists on disk at C:\TModule.dll.
2

DNS cache — gm07-dc04.ouiheberg.com

  • Run ipconfig /displaydns or check System Informer's DNS section.
  • Search for ouiheberg. A cache hit confirms an active C2 connection.
3

Process list — cmd.exe path

  • In Task Manager or System Informer, check for any cmd.exe process running from outside C:\Windows\System32 or SysWOW64.
4

LSASS memory scan

  • Scan lsass.exe memory strings for ouiheberg.
  • The C2 domain string in LSASS confirms active injection.
5

File hash verification

  • If the fake cmd.exe is present on disk, compute its SHA-256.
  • Match against 01939a2b6ac191c4afb03884c0e6f172c2332c4e4bf4f516718b585541dd31c4.
6

Browser and Discord

  • Check browser history and downloads for references to Flyside.
  • In Discord, check User Settings → Authorized Apps.

Detection summary

Artifact matrix — FlysideSummary
Artifact                              Survives cleanup?   Check location
─────────────────────────────────────────────────────────────────────────────
C:\TModule.dll                         Yes (if not deleted) C:\ root / journal
PcaSVC entry                          Yes                 AppCompat / DPS log
DNS cache (gm07-dc04.ouiheberg.com)   Session-length      ipconfig /displaydns
C2 strings in lsass.exe               Only while running  Memory string scan
SHA-256 hash match                    Yes (file on disk)  File system

The most immediately actionable indicator is C:\TModule.dll — a file that has no legitimate origin at the root of the C: drive. A Journal Trace search for this filename provides a persistent record even after the file is deleted.

Defensive material

All indicators and methodology documented here are published for server administrators, DFIR practitioners, and anti-cheat researchers. This material describes detection techniques only. For vulnerability disclosures or to contribute to the research corpus, contact security@clubhouseac.shop.