Cheat DetectionHighPublished

Seryx FiveM cheat detection & forensic artifacts

Seryx is a FiveM cheat loader distributed as Loader.exe. It is identified by SHA-256 01a27b1ce601280792941524b4b108330eb2ffe3e0a0151e3ba44257c3585476 and a PcaSVC offset of 0x1c86000. Because the filename is generic, hash and PcaSVC confirmation are required for attribution.

CR
Clubhouse AC Research June 2, 2026 6 min read

Summary

  • Distributed as generic Loader.exe — attribution requires hash confirmation or PcaSVC offset match.
  • SHA-256 01a27b1ce601280792941524b4b108330eb2ffe3e0a0151e3ba44257c3585476.
  • PcaSVC offset 0x1c86000 observed in memory forensics.
  • Prefetch and AppCompat records persist after execution.

Overview

Seryx is a FiveM cheat loader. Like several other cheats in the FiveM ecosystem, it distributes its primary executable under the generic name Loader.exe. This means the filename alone is insufficient for attribution — hash verification and PcaSVC offset matching are the primary identification methods.

The PcaSVC offset 0x1c86000 is a memory forensic indicator observed during active Seryx sessions, providing a complementary identification pathway alongside the SHA-256 hash.

Sample metadata (IOC)

Loader.exe (Seryx) — file indicatorsIOC
Name        Loader.exe
Brand       Seryx

SHA-256     01a27b1ce601280792941524b4b10833
            0eb2ffe3e0a0151e3ba44257c3585476

PcaSVC      0x1c86000

Behavioral indicators

Generic filename — attribution by hash

The executable name Loader.exe is shared by many FiveM cheats. When investigating a suspect Loader.exe, always confirm attribution by computing the SHA-256 hash and matching it against the known Seryx value. Alternatively, the PcaSVC offset 0x1c86000 provides a memory-side confirmation.

PcaSVC memory offset

During memory forensic analysis of a system running Seryx, the PcaSVC offset 0x1c86000 has been consistently observed. This offset combined with the executable name allows attribution even when the file has been deleted.

Screenshare check guide

1

File hash verification

  • If Loader.exe is present on disk, compute its SHA-256.
  • Match against 01a27b1ce601280792941524b4b108330eb2ffe3e0a0151e3ba44257c3585476.
2

PcaSVC offset check

  • In memory forensic tools, search for PcaSVC entries at offset 0x1c86000.
  • This offset combined with a Loader.exe entry confirms Seryx.
3

Process list — Loader.exe

  • Check for a running Loader.exe process. Note the full executable path — non-system paths are suspicious.
4

AppCompat / PcaSVC log

  • Inspect the AppCompat database for a Loader.exe entry. Cross-reference the path and timestamp with other indicators.
5

Browser and Discord

  • Check browser history and downloads for references to Seryx.
  • In Discord, check User Settings → Authorized Apps.

Detection summary

Artifact matrix — Seryx / Loader.exeSummary
Artifact                      Survives cleanup?   Check location
──────────────────────────────────────────────────────────────────────
PcaSVC entry (0x1c86000)      Yes                 AppCompat / DPS log
SHA-256 hash match            Yes (file on disk)  File system
Prefetch (Loader.exe)         Usually             C:\Windows\Prefetch

Defensive material

All indicators and methodology documented here are published for server administrators, DFIR practitioners, and anti-cheat researchers. This material describes detection techniques only. For vulnerability disclosures or to contribute to the research corpus, contact security@clubhouseac.shop.