Scan terms & privacy.

02 / IDENTITY

Accounts and history

Screenshare Scanner searches existing local Discord data for Discord user IDs. Found IDs are displayed in and uploaded with the scan result. It does not parse or extract authentication tokens, passwords, email addresses or message content from those Discord files. Your local Steam display name and Steam64 account ID are read from the same login record.

When Accounts is opened, the website can send the recorded IDs to Steam and Discord to retrieve public display names and profile pictures. Images load from those providers’ official image servers, which receive the viewer’s IP address when the image loads. Unavailable profiles keep a placeholder. No additional local account data is read for these lookups.

The website compares found Discord user IDs with imported third-party records of servers, roles, bans, blacklists and vouches. Exact ID matches appear in History for the authorized scan owner and staff, and for anyone with the link if the scan is made public. A historical server ID may also be marked as appearing on the operator’s supplied server list.

These records are unverified and may be outdated. A match does not prove current server membership, server access or cheating. This comparison happens on the website and collects no additional local Discord data.

03 / LOCAL CHECKS

What the scanner reads

The scanner checks selected files and hashes, digital signatures and certificate trust stores, WBEM and registry artifacts, executable metadata, loaded module file paths in readable FiveM processes, Windows event logs, Defender detections, and three Windows services. It also reads current-user Recycle Bin metadata, including original file paths and deletion times.

The scanner reads Windows-reported TPM enablement and Secure Boot status without changing either setting. A confirmed disabled TPM is shown as TPM disabled (Warning); confirmed disabled Secure Boot on UEFI is shown as Secure Boot Deactivated (Detected). Enabled settings produce no finding. Missing, unsupported or unreadable status is recorded only as limited coverage and is never treated as disabled. No TPM keys, certificates or hardware identifiers are collected. These status labels do not prove cheating.

For recently invoked and deleted BAT files, the scanner reads bounded existing Security 4688 and Sysmon 1/23/26 events from the last seven days and current-user Recycle Bin BAT metadata. Process command lines are checked locally only for a supported direct Windows cmd.exe invocation of an absolute BAT path. A warning requires a later independent deletion record for the same path. The report and Discord card retain only the BAT path, launch/deletion times and event source/record IDs. Raw commands, event account fields and script contents are discarded. The scanner does not enable logging or install Sysmon. Missing logs and unsupported commands are limited coverage. The label Executed and Deleted describes recorded invocation followed by deletion; it does not prove script completion, unchanged file identity, current absence or cheating.

Windows event-log clearing: The scan reads up to 512 existing System event 104 records from the last seven days, with a short time limit. For a fixed list of standard logs it retains only the affected log name, recorded UTC time and event record ID. Account names, SIDs, computer names, backup paths and raw event XML are discarded. A Windows Event Log Cleared warning can reflect normal administration and does not prove cheating or identify the person responsible. Missing records and access limits do not prove that no log was cleared. The scanner never clears or enables a log. The retained fields are included in the uploaded report under the sharing rules above.

Selected executable files and the collected inventory are compared with deduplicated whole-file SHA-256/SHA-1 references supplied by the operator. A matching path, digest and supplied reference label are reported as a warning. These references were not independently validated against original samples and do not establish execution, injection or cheating. Duplicates and references explicitly naming ordinary software were excluded.

The inviting account and platform administrator can add hash, PCA, PE timestamp and YARA content rules. Account rules are saved with the invitation; administrator rules are refreshed when the scanner opens. Both rule sets inspect readable files within the scanner’s limits. The accepted configuration is checked again before collection begins. The scanner does not run files it finds or change checked files, services, Defender settings or registry values. A finding is a clue for review, not proof that someone cheated.

The scan also reads UAC policy, bounded application hang/crash events, selected BAM and UserAssist execution metadata, and supported Prefetch metadata and referenced paths for the named programs. Normal execution or a path reference alone is context, not proof of cheating. It checks specific Kdex source fingerprints and current-user configuration artifacts; the trusted-device authentication file is checked by path and metadata only, never its token contents. Configuration content is compared locally with a specific schema; only matched paths and finding names enter the report and Discord card.

The scanner also reads a bounded recent portion of existing NTFS change journals for DLL deletion followed by recreation at the same resolved path within five seconds. It reports the matched DLL path, deletion and recreation times, elapsed time and observed change types. It does not read DLL contents for this check or create, enable or modify a journal. Missing journals, access restrictions and read limits are shown as limited coverage. A possible file replacement is a finding for review: installers and updates can produce the same sequence, and a Close record alone is not deletion or evidence of cheating.

04 / PROCESS MEMORY

Limited string checks

The scan reads bounded current-user AnyDesk transfer logs and reports filenames from explicit finished transfers, the source log path and an available transfer timestamp. It checks whether current-user PowerShell PSReadLine history contains non-empty entries and reports only the history file path; command contents are never included. It checks accessible Amcache application/file entry metadata. Missing or empty entries produce a warning; unreadable or unsupported data is marked as limited coverage. These findings appear in the report and the Discord result card described above.

The scan performs bounded, read-only live process-memory string checks in SndVol.exe, Steam.exe, Discord.exe, RuntimeBroker.exe, Editor.exe, OptionalFeatures.exe svchost.exe, Userinit.exe, rundll32.exe, ctfmon.exe and lsass.exe.

LSASS is checked only for predefined exact hostnames and one fixed file-name indicator, without collecting credentials or bypassing protected-process security. The other named processes are checked for a limited set of predefined file-name and host-name indicators. Exact host boundaries are checked to exclude unrelated lookalike domains. The data read and retained is described on this page, linked from the scanner before acceptance. This public page does not publish detection rules.

For a match, the report includes only the matched indicator, process ID, executable path, match address, memory-region type/protection and text encoding, alongside coverage and limits. Surrounding memory bytes, authentication data and unrelated strings do not enter the report. The scanner does not contact these hosts or upload a memory dump.

The predefined memory indicators appear as Detected findings, including the Process Hollowing label. This classification identifies a matching indicator; a text match alone does not prove process hollowing, injection or cheating. Additional fixed markers check a specific Steam payload URL or a payload name combined with its download host in the same verified process. LSASS matches use the Generic Bypass Methode label and other process matches use Process Hollowing. These are indicator classifications, not proof that the named technique occurred. Unreadable or partially read processes are reported as limited coverage.

05 / RESULTS

Report visibility and retention

The report includes findings, full file paths, the account IDs described above, Windows and service details, limited process-memory matches, and an executable inventory with SHA-1 and SHA-256 hashes. It also includes a timestamped FiveM module-path comparison: in instance, out of instance, unknown, or no active instance.

Private by default. Only the inviting account and administrators can open a private report. The inviting account or an administrator may deliberately switch a scan accepted under these terms to public. Then anyone with its link can view the complete report without signing in: findings and full file paths, Steam and Discord identities and profiles, matched server/role/ban/blacklist/vouch history, Windows and service details, process indicators, hashes, file inventory and PC logs. Public access does not permit editing settings, reporting findings as the owner or viewing other scans. Do not proceed with a scan if you do not accept this possibility.

Switching a public scan back to private stops new anonymous requests immediately. It cannot recall copies or screenshots someone already saved. Reports are marked no-index and are not publicly listed; this does not prevent a recipient from sharing the link. Reports accepted before public sharing was introduced in consent 2.9 remain private and cannot be published. Consent 2.9 reports retain their existing visibility options.

Service details include associated process start times where readable and whether the process is dedicated or shared. A process start time is not an exact service start time; a shared host may already have been running before its services started.

The report is automatically uploaded over HTTPS to screenshareac.org and belongs to the account that created the invitation. The operator can review it on the website or through their Discord bot using the API. Website reports are available for seven days; expired records are removed by the daily cleanup. Discord copies can remain after the website report expires.

06 / GETTING STARTED

Your invitation and consent

A valid scan invitation is required; the PIN alone cannot start or upload a scan. The invitation and its configuration are checked online before any PC data is scanned.

Keep the downloaded filename unchanged until you open it: your short-lived invitation is part of that filename. The scanner first opens Terms & Privacy with a link to this page. Choosing Accept agrees to the scan, upload, disclosed Discord notification and possible public sharing. After acceptance, the invitation code is filled in automatically and the scan starts without another confirmation. A website visit, download or filled-in PIN does not replace this acceptance.

07 / AFTER THE SCAN

Stopping and cleanup

You can cancel the scan at any time. The scanner saves no local scan report. It writes extracted program components and a small WBEM comparison snapshot under your local app-data folder, plus temporary file lists and custom YARA rules during the scan.

After the website confirms upload, or if an already consented and started scan fails before upload, the scanner closes automatically after three seconds and attempts to delete only its own downloaded EXE. Download the scanner again to retry a failed scan. If upload fails, the scanner stays open for a retry. If the scan is canceled or cleanup cannot complete, the EXE remains for manual removal.

Scanned files, the WBEM snapshot and program components are not deleted. This cleanup does not prevent anyone from copying the EXE.