FIVEM FORENSIC SCANNER · V1

Find the traces.
See the evidence.

Scan-Ware turns hidden FiveM system activity into clear forensic evidence for moderation teams.

Start Scan Explore Scan-Ware

FiveM forensic scanner Fast evidence review Windows artifact analysis

scan-ware.app/dashboard/scans/SW-AF82KOpen dashboard →

Dashboard

Scanner

Scan History

Detections

Players

Settings

Scan Results

7KM2F91AReview required

GAME

FiveM

DURATION

1m 02s

RISK

67%

Detections

Warnings

Integrity

Suspicious

PC: Windows 11 Pro·Boot 4h ago·VPN No·FiveM Running

Scan-Ware V1 · FiveM first

FiveMSupported

RedMComing soon

RAGE MPComing soon

alt:VComing soon

GTA OnlineComing soon

FortniteComing soon

ValorantComing soon

RustComing soon

Workflow

One scan.
The full picture.

From PIN creation to readable evidence in about a minute. No client installation drama, no guesswork.

Create Scan

Moderator creates a new scan from the dashboard.

Share PIN

A temporary scan PIN is generated.

Run Scan-Ware

The player launches Scan-Ware and enters the PIN.

Analyze

Scan-Ware inspects relevant FiveM and Windows forensic artifacts.

Review

Results appear inside the moderator dashboard.

Temporary scan PIN

7KM2F91A

expires in 59:12 · single use · bound to player

Forensic depth

Eleven sources. One coherent story.

Scan-Ware correlates execution history, file artifacts and process activity instead of showing you isolated hits.

Prefetch

Execution history

1,284 traces

Amcache

Inventory + first execution

3,912 traces

ShimCache

Image load records

1,024 traces

ActivitiesCache

User activity timeline

486 traces

Registry

Persistence + config

212 traces

Filesystem

Create / modify / delete

8,431 traces

Processes

Live process tree

96 traces

Loaded Modules

DLLs per process

1,540 traces

PE Metadata

Sections, imports, entropy

322 traces

Authenticode

Signature validation

322 traces

SHA-256

File reputation

322 traces

+ Correlator

Chains traces into timelines

6 events linked

Capabilities

Built for the details.

Everything a moderation team needs to go from suspicion to decision — without drowning in raw logs.

Forensic Depth

Connect execution history, file artifacts and process activity into a single narrative.

Custom Detection Rules

Define organization-specific signatures and suspicious patterns with a visual builder.

Fast Scan Review

Put findings, timestamps and sources in one report. Triage in minutes, not hours.

FiveM Analysis

Analyze relevant game processes, modules and artifacts — purpose-built for FiveM.

Integrity Checks

Surface deleted and modified execution traces that cheats try to clean up.

File Reputation

Correlate SHA-256 and executable information against community hash intelligence.

Discord Integration

Bring scan results into moderation workflows with rich result embeds.

API Access

Connect Scan-Ware to external community tools with a clean REST API.

Severity model

Five severities. Zero ambiguity.

Every finding lands in exactly one category, so reviewers know what kind of decision each row needs.

DETECTION

Direct evidence matching a configured detection.

WARNING

Something requiring moderator attention.

SUSPICIOUS

Unusual executable characteristics.

INTEGRITY

Execution / deletion / modification correlation.

UNTRUSTED

Unknown or reputation-related files.

Interactive demo

Click a finding. Read the evidence.

This is a live slice of the real report UI — select any row to inspect what a moderator sees.

F-1042

Possible loaded module

detection

Process: FiveM_GTAProcess.exe · PID 14284
Module: unknown.dll
Path: C:\Users\Player\AppData\Local\Temp\unknown.dll
Signature: Unsigned
SHA256: 9cf21a4e7b8d3c2a1f...

Evidence sources

Module analysisPE metadataHash database

Moderator note: Needs review — matches temp-loader staging pattern.

View Timeline View File Mark Reviewed

Timeline

Follow the evidence.

Scan-Ware connects individual traces into a readable sequence of events — download, execution, injection, cleanup.

Correlation6 events · 1 chain · 5m 27s window