{"vulnerability": "CVE-2019-16098", "sightings": [{"uuid": "0d66f302-6e1e-4162-b605-55254e641b42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "MISP/a9eb9e8e-d894-4f36-a6c2-ca8142f72d29", "content": "", "creation_timestamp": "2024-05-21T13:04:44.000000Z"}, {"uuid": "9d4ca029-fa0b-4bc8-8ba5-bf790b4bb8bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:54.000000Z"}, {"uuid": "9428fc9d-0644-453e-96ff-fd110d46785c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "MISP/a9eb9e8e-d894-4f36-a6c2-ca8142f72d29", "content": "", "creation_timestamp": "2026-02-06T21:11:55.000000Z"}, {"uuid": "5fe9a99e-39f5-4c23-83d1-81cc30d2385f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "exploited", "source": "https://t.me/true_secator/3524", "content": "BlackByte \u0432\u0437\u044f\u043b\u0438 \u043d\u0430 \u0432\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 Bring Your Own Driver (BYOVD).\n\n\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0435 \u0430\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438  \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 CVE-2019-16098 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 MSI Afterburner RTCore64.sys.\n\n\u0423\u0432\u0435\u0440\u0435\u043d\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430\u00a0BlackByte\u00a0\u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u0435 EDR, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f.\n\nBYOVD \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u0435\u043d, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 \u0432\u044b\u0441\u043e\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 Lazarus, \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044f \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u043c Dell, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0430\u043a\u0442\u043e\u0440\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u0435\u0440\u0441\u043a\u0438\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u0434\u043b\u044f \u0438\u0433\u0440\u044b Genshin Impact.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u044f\u0441\u043d\u044f\u044e\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u0435\u043c\u044b\u0439 \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 MSI \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u043a\u043e\u0434\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0432\u043e\u0434\u043e\u043c-\u0432\u044b\u0432\u043e\u0434\u043e\u043c, \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0440\u0435\u0436\u0438\u043c\u0430, \u0447\u0442\u043e \u043d\u0430\u0440\u0443\u0448\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Microsoft \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430.\n\n\u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0447\u0438\u0442\u0430\u0442\u044c, \u043f\u0438\u0441\u0430\u0442\u044c \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0431\u0435\u0437 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430.\n\n\u041d\u0430 \u043f\u0435\u0440\u0432\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u0430\u0442\u0430\u043a\u0438 BlackByte \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u044e \u044f\u0434\u0440\u0430, \u0447\u0442\u043e\u0431\u044b \u0432\u044b\u0431\u0440\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0435 \u0441\u043c\u0435\u0449\u0435\u043d\u0438\u044f, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443 \u044f\u0434\u0440\u0430. \u0417\u0430\u0442\u0435\u043c RTCore64.sys \u043f\u043e\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u00abAppData\\Roaming\u00bb \u0438 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0441\u043b\u0443\u0436\u0431\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u0435 \u0438\u043c\u044f \u0438 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u043e\u0435 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u043e\u0435 \u0438\u043c\u044f.\n\n\u0417\u0430\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u041f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0430\u0434\u0440\u0435\u0441\u0430 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043c\u0435\u043d\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0438 \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0441\u043e \u0441\u043f\u0438\u0441\u043a\u043e\u043c \u0438\u0437 1000 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 AV/EDR.\n\n\u041b\u044e\u0431\u044b\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f, \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u044d\u0442\u043e\u043c \u044d\u0442\u0430\u043f\u0435, \u0443\u0434\u0430\u043b\u044f\u044e\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0443\u043b\u044f\u043c\u0438 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f.\n\nSophos \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e BlackByte \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432 \u044d\u0442\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u043f\u043e\u0438\u0441\u043a \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0440\u0430\u0431\u043e\u0442\u044b \u043e\u0442\u043b\u0430\u0434\u0447\u0438\u043a\u0430 \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u043d\u0435\u0433\u043e.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 BlackByte \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 Avast, Sandboxie, \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Windows DbgHelp \u0438 Comodo Internet Security, \u0438 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442 \u0441\u0432\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f.\n\n\u0421\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u0438\u0435\u043c\u0430 \u043e\u0431\u0445\u043e\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 BlackByte, \u0434\u043e\u0431\u0430\u0432\u0438\u0432 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 MSI \u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u0441\u043e\u0431\u044b\u0442\u0438\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432 \u0438 \u043f\u043e\u0447\u0430\u0449\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0438\u0445, \u0447\u0442\u043e\u0431\u044b \u043d\u0430\u0439\u0442\u0438 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044e.", "creation_timestamp": "2022-10-06T17:35:04.000000Z"}, {"uuid": "13e796d8-a188-4782-99dc-76a7dfff4bea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mtjpe5xp2n2n", "content": "@talosintelligence.com\nChinese-speaking actor UAT-10147 deploys SPECTRE backdoor with Linux rootkit and BYOVD EDR evasion.\n-\nIOCs: CVE-2019-16098, CVE-2021-21551\n-\n#Rootkit #SPECTRE #ThreatIntel", "creation_timestamp": "2026-08-20T16:51:20.874654Z"}, {"uuid": "e41b72f8-0bf5-4631-8f6f-5114bb783e31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://t.me/EchelonEyes/756", "content": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c BlackByte \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Windows, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\u0411\u0440\u0438\u0442\u0430\u043d\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Sophos \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u0432\u0435\u0436\u0438\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 \u0430\u0442\u0430\u043a\u0438 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 (bring your own vulnerable driver - BYOVD). \u0414\u0430\u043d\u043d\u043e\u0439 \u0442\u0430\u043a\u0442\u0438\u043a\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f BlackByte. \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044f \u0432 Windows \u0437\u0430\u043a\u043e\u043d\u043d\u044b\u0439, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Micro-Star MSI Afterburner (RTCore64.sys), \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 (CVE-2019-16098, \u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,8) \u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u043b\u0438 \u0441\u043b\u0443\u0436\u0431\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u00ab\u0422\u0435\u0445\u043d\u0438\u043a\u0430 \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u0438\u0437 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 1000 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b\u00bb, \u2014 \u0441\u043a\u0430\u0437\u0430\u043b \u0432 \u043d\u043e\u0432\u043e\u043c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043e\u0431\u0437\u043e\u0440\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0443\u0433\u0440\u043e\u0437 Sophos \u0410\u043d\u0434\u0440\u0435\u0430\u0441 \u041a\u043b\u043e\u043f\u0448.\n\nBlackByte \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043d\u043e\u0432\u0435\u0439\u0448\u0435\u0435 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 BYOVD, \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u043c\u043e\u0434\u0435\u043b\u0438 randsom-as-a-service (Raas), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0441\u0442\u0438 \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a. \u041a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0433\u043e\u0434\u044b \u0432\u0441\u0435 \u0447\u0430\u0449\u0435 \u043f\u0440\u0438\u0431\u0435\u0433\u0430\u044e\u0442 \u043f\u0440\u043e\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Slingshot, InvisiMole, APT28 \u0438 Lazarus.\n\n\u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 BYOVD-\u0430\u0442\u0430\u043a \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0442\u044c \u0438\u0445 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0438\u043b\u0438 \u0437\u0430\u043d\u043e\u0441\u0438\u0442\u044c \u0432 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0447\u0442\u043e \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/ \n\n#BYOVD #BlackByte", "creation_timestamp": "2026-07-26T02:02:37.987641Z"}, {"uuid": "47ec7fd7-94eb-407a-8d5a-b00350387eec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "exploited", "source": "https://t.me/EchelonEyes/756", "content": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c BlackByte \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Windows, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\u0411\u0440\u0438\u0442\u0430\u043d\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Sophos \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u0432\u0435\u0436\u0438\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 \u0430\u0442\u0430\u043a\u0438 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 (bring your own vulnerable driver - BYOVD). \u0414\u0430\u043d\u043d\u043e\u0439 \u0442\u0430\u043a\u0442\u0438\u043a\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f BlackByte. \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044f \u0432 Windows \u0437\u0430\u043a\u043e\u043d\u043d\u044b\u0439, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Micro-Star MSI Afterburner (RTCore64.sys), \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 (CVE-2019-16098, \u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,8) \u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u043b\u0438 \u0441\u043b\u0443\u0436\u0431\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u00ab\u0422\u0435\u0445\u043d\u0438\u043a\u0430 \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u0438\u0437 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 1000 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b\u00bb, \u2014 \u0441\u043a\u0430\u0437\u0430\u043b \u0432 \u043d\u043e\u0432\u043e\u043c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043e\u0431\u0437\u043e\u0440\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0443\u0433\u0440\u043e\u0437 Sophos \u0410\u043d\u0434\u0440\u0435\u0430\u0441 \u041a\u043b\u043e\u043f\u0448.\n\nBlackByte \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043d\u043e\u0432\u0435\u0439\u0448\u0435\u0435 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 BYOVD, \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u043c\u043e\u0434\u0435\u043b\u0438 randsom-as-a-service (Raas), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0441\u0442\u0438 \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a. \u041a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0433\u043e\u0434\u044b \u0432\u0441\u0435 \u0447\u0430\u0449\u0435 \u043f\u0440\u0438\u0431\u0435\u0433\u0430\u044e\u0442 \u043f\u0440\u043e\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Slingshot, InvisiMole, APT28 \u0438 Lazarus.\n\n\u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 BYOVD-\u0430\u0442\u0430\u043a \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0442\u044c \u0438\u0445 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0438\u043b\u0438 \u0437\u0430\u043d\u043e\u0441\u0438\u0442\u044c \u0432 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0447\u0442\u043e \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/ \n\n#BYOVD #BlackByte", "creation_timestamp": "2026-07-28T07:00:06.540147Z"}, {"uuid": "fdce025f-2163-46bc-8f89-1fc42a533d0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://t.me/hacking_Attack/50153", "content": "KitPloit - PenTest Tools!\nEDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAMzRHxJsuayYfmlgYJ40ZPtgY0mQX_fJ-1XWkdNeiicxSAw8cPQ3Kig390B1yD2NgyUGLg6nsd-oF0MRo3JVR5j7pBbRbMB_bL7NEOi7hdPfYidDlrP7XFKEh3bkv4dbtgCSY3SSq_EN2IMa_YNmVs785PfHxb69R4MfBvxTSIJHc-WlEy6RC6lxi/w640-h314/EDRSandblast.png EDRSandBlastis a tool written in Cthat weaponize a vulnerable signed  driver to bypass EDR detections (Kernel callbacks and ETW TIprovider) and LSASSprotections. Multiple userland unhooking techniques are also  implemented to evade userland monitoring.\n\nAs of release, combination of userland (--usermode) and Kernel-land  (--kernelmode) techniques were used to dump LSASSmemory under EDR  scrutiny, without being blocked nor generating \"OS Credential Dumping\"-related  events in the product (cloud) console. The tests were performed on 3 distinct  EDR products and were successful in each case. DescriptionEDR bypass through Kernel callbacks removalEDR products use Kernel callbacks on Windows to be notified by the kernel of  system activity, such as process and thread creation and loading of images  (exe / DLL).\n\nThe Kernel callbacks are defined from user-land using a number of documented  APIs (nt!PsSetCreateProcessNotifyRoutine, nt!PsSetCreateThreadNotifyRoutine,  etc.). The user-land APIs add driver-supplied callback routines to undocumented  arrays of routines in Kernel-space:\n\n* PspCreateProcessNotifyRoutinefor process creation\n* PspCreateThreadNotifyRoutinefor thread creation\n* PspLoadImageNotifyRoutinefor image loading EDRSandBlastenumerates the routines defined in those arrays and remove any  callback routine linked to a predefined list of EDR drivers (more than 1000  thousands drivers of security products from the allocated filter altitudes).  The enumeration and removal are made possible through the exploitation of an  arbitrary Kernel memory read / write vulnerability of the Micro-Star MSI Afterburnerdriver (CVE-2019-16098). The enumeration and  removal code is largely inspired from br-sn's CheekyBlinder project.\n\nThe offsets of the aforementioned arrays are hardcoded in the NtoskrnlOffsets.csvfile for more than 350 versions of the Windows Kernel ntoskrnl.exe. The choice of going with hardcoded offsets instead of pattern  searches is justified by the fact that the undocumented APIs responsible for  Kernel callbacks addition / removal are subject to change and that any attempt  to write Kernel memory at the wrong address may (and often will) result in a Bug Check(Blue Screen of Death). For more information on how the offsets  were gathered, refer to Offsets section. EDR bypass through deactivation of the ETW Microsoft-Windows-Threat-Intelligence providerThe ETW Microsoft-Windows-Threat-Intelligenceprovider log data about the  usages of some Windows API commonly used maliciously. This include the nt!MiReadWriteVirtualMemoryAPI, called by nt!NtReadVirtualMemory(which is  used to dump LSASSmemory) and monitored by the nt!EtwTiLogReadWriteVmfunction.\n\nEDR products can consume the logs produced by the ETW TIprovider through  services or processes running as, respectively, SERVICE_LAUNCH_PROTECTED_ANTIMALWARE_LIGHTor PS_PROTECTED_ANTIMALWARE_LIGHT, and associated with an Early Launch Anti Malware (ELAM)driver.\n\nAs published by slaeryanin a CNO Development Labsblog post,  the ETW TIprovider can be disabled altogether by patching, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:43.954918Z"}, {"uuid": "25a0c01c-f3e4-4576-94e3-312050e4d895", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://t.me/hacking_Attack/50136", "content": "Detection  From the defender (EDR vendor, Microsoft, SOC analysts looking at EDR's telemetry, ...) point of view, multiple indicators can be used to detect or prevent this kind of techniques.  Driver whitelisting  Since every action performed by the tool in kernel-mode memory relies on a vulnerable driver to read/write arbitrary content, driver loading events should be heaviliy scrutinized by EDR product (or SOC analysts), and raise an alert at any uncommon driver loading, or even block known vulnerable drivers. This latter approach is even recommended by Microsoft themselves (https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules): any HVCI (Hypervisor-protected code integrity) enabled Windows device embeds a drivers blocklist, and this will be progressively become a default behaviour on Windows (it already is on Windows 11).  Kernel-memory integrity checks  Since an attacker could still use an unknown vulnerable driver to perform the same actions in memory, the EDR driver could periodically check that its kernel callbacks are still registered, directly by inspecting kernel memory (like this tool does), or simply by triggering events (process creation, thread creation, image loading, etc.) and checking the callback functions are indeed called by the executive kernel.  As a side note, this type of data structure could be protected via the recent Kernel Data Protection (KDP) (https://www.microsoft.com/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/) mechanism, which relies on Virtual Based Security, in order to make the kernel callbacks array non-writable without calling the right APIs.  The same logic could apply to sensitive ETW variables such as the ProviderEnableInfo, abused by this tool to disable the ETW Threat Intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) events generation.  User-mode detection  The first indicator that a process is actively trying to evade user-land hooking is the file accesses to each DLL corresponding to loaded modules; in a normal execution, a userland process rarely needs to read DLL files outside of a LoadLibrary call, especially ntdll.dll.  In order to protect API hooking from being bypassed, EDR products could periodically check that hooks are not altered in memory, inside each monitored process.  Finally, to detect hooking bypass (abusing a trampoline, using direct syscalls, etc.) that does not imply the hooks removal, EDR products could potentially rely on kernel callbacks associated to the abused syscalls (ex. PsCreateProcessNotifyRoutine for NtCreateProcess syscall, ObRegisterCallbacks for NtOpenProcess syscall, etc.), and perform user-mode call-stack analysis in order to determine if the syscall was triggered from a normal path (kernel32.dll -> ntdll.dll -> syscall) or an abnormal one (ex. program.exe -> direct syscall).  Acknowledgements      Kernel callbacks enumeration and removal:  https://github.com/br-sn/CheekyBlinder      Kernel memory Read / Write primitives through the vulnerable  Micro-Star MSI Afterburner driver:  https://github.com/Barakat/CVE-2019-16098/      Disabling of the ETW Threat Intelligence provider:  https://public.cnotools.studio/bring-your-own-vulnerable-kernel-driver-byovkd/exploits/data-only-attack-neutralizing-etwti-provider      Driver install / uninstall: https://github.com/gentilkiwi/mimikatz      Initial list of EDR drivers names:  https://github.com/SadProcessor/SomeStuff/blob/master/Invoke-EDRCheck.ps1      Credential Guard bypass by re-enabling Wdigest through LSASS memory  patching: https://teamhydra.blog/2020/08/25/bypassing-credential-guard/      Authors  Thomas DIOT (Qazeer) (https://github.com/Qazeer/)  Maxime MEIGNAN (themaks) (https://github.com/themaks)  Licence  CC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:44.173464Z"}, {"uuid": "4748b214-38ce-4dff-8a62-3b5461d5d874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/50136", "content": "Detection  From the defender (EDR vendor, Microsoft, SOC analysts looking at EDR's telemetry, ...) point of view, multiple indicators can be used to detect or prevent this kind of techniques.  Driver whitelisting  Since every action performed by the tool in kernel-mode memory relies on a vulnerable driver to read/write arbitrary content, driver loading events should be heaviliy scrutinized by EDR product (or SOC analysts), and raise an alert at any uncommon driver loading, or even block known vulnerable drivers. This latter approach is even recommended by Microsoft themselves (https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules): any HVCI (Hypervisor-protected code integrity) enabled Windows device embeds a drivers blocklist, and this will be progressively become a default behaviour on Windows (it already is on Windows 11).  Kernel-memory integrity checks  Since an attacker could still use an unknown vulnerable driver to perform the same actions in memory, the EDR driver could periodically check that its kernel callbacks are still registered, directly by inspecting kernel memory (like this tool does), or simply by triggering events (process creation, thread creation, image loading, etc.) and checking the callback functions are indeed called by the executive kernel.  As a side note, this type of data structure could be protected via the recent Kernel Data Protection (KDP) (https://www.microsoft.com/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/) mechanism, which relies on Virtual Based Security, in order to make the kernel callbacks array non-writable without calling the right APIs.  The same logic could apply to sensitive ETW variables such as the ProviderEnableInfo, abused by this tool to disable the ETW Threat Intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) events generation.  User-mode detection  The first indicator that a process is actively trying to evade user-land hooking is the file accesses to each DLL corresponding to loaded modules; in a normal execution, a userland process rarely needs to read DLL files outside of a LoadLibrary call, especially ntdll.dll.  In order to protect API hooking from being bypassed, EDR products could periodically check that hooks are not altered in memory, inside each monitored process.  Finally, to detect hooking bypass (abusing a trampoline, using direct syscalls, etc.) that does not imply the hooks removal, EDR products could potentially rely on kernel callbacks associated to the abused syscalls (ex. PsCreateProcessNotifyRoutine for NtCreateProcess syscall, ObRegisterCallbacks for NtOpenProcess syscall, etc.), and perform user-mode call-stack analysis in order to determine if the syscall was triggered from a normal path (kernel32.dll -> ntdll.dll -> syscall) or an abnormal one (ex. program.exe -> direct syscall).  Acknowledgements      Kernel callbacks enumeration and removal:  https://github.com/br-sn/CheekyBlinder      Kernel memory Read / Write primitives through the vulnerable  Micro-Star MSI Afterburner driver:  https://github.com/Barakat/CVE-2019-16098/      Disabling of the ETW Threat Intelligence provider:  https://public.cnotools.studio/bring-your-own-vulnerable-kernel-driver-byovkd/exploits/data-only-attack-neutralizing-etwti-provider      Driver install / uninstall: https://github.com/gentilkiwi/mimikatz      Initial list of EDR drivers names:  https://github.com/SadProcessor/SomeStuff/blob/master/Invoke-EDRCheck.ps1      Credential Guard bypass by re-enabling Wdigest through LSASS memory  patching: https://teamhydra.blog/2020/08/25/bypassing-credential-guard/      Authors  Thomas DIOT (Qazeer) (https://github.com/Qazeer/)  Maxime MEIGNAN (themaks) (https://github.com/themaks)  Licence  CC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:12.922179Z"}, {"uuid": "10c98711-c357-4899-980c-035a042bcd53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/50153", "content": "KitPloit - PenTest Tools!\nEDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAMzRHxJsuayYfmlgYJ40ZPtgY0mQX_fJ-1XWkdNeiicxSAw8cPQ3Kig390B1yD2NgyUGLg6nsd-oF0MRo3JVR5j7pBbRbMB_bL7NEOi7hdPfYidDlrP7XFKEh3bkv4dbtgCSY3SSq_EN2IMa_YNmVs785PfHxb69R4MfBvxTSIJHc-WlEy6RC6lxi/w640-h314/EDRSandblast.png EDRSandBlastis a tool written in Cthat weaponize a vulnerable signed  driver to bypass EDR detections (Kernel callbacks and ETW TIprovider) and LSASSprotections. Multiple userland unhooking techniques are also  implemented to evade userland monitoring.\n\nAs of release, combination of userland (--usermode) and Kernel-land  (--kernelmode) techniques were used to dump LSASSmemory under EDR  scrutiny, without being blocked nor generating \"OS Credential Dumping\"-related  events in the product (cloud) console. The tests were performed on 3 distinct  EDR products and were successful in each case. DescriptionEDR bypass through Kernel callbacks removalEDR products use Kernel callbacks on Windows to be notified by the kernel of  system activity, such as process and thread creation and loading of images  (exe / DLL).\n\nThe Kernel callbacks are defined from user-land using a number of documented  APIs (nt!PsSetCreateProcessNotifyRoutine, nt!PsSetCreateThreadNotifyRoutine,  etc.). The user-land APIs add driver-supplied callback routines to undocumented  arrays of routines in Kernel-space:\n\n* PspCreateProcessNotifyRoutinefor process creation\n* PspCreateThreadNotifyRoutinefor thread creation\n* PspLoadImageNotifyRoutinefor image loading EDRSandBlastenumerates the routines defined in those arrays and remove any  callback routine linked to a predefined list of EDR drivers (more than 1000  thousands drivers of security products from the allocated filter altitudes).  The enumeration and removal are made possible through the exploitation of an  arbitrary Kernel memory read / write vulnerability of the Micro-Star MSI Afterburnerdriver (CVE-2019-16098). The enumeration and  removal code is largely inspired from br-sn's CheekyBlinder project.\n\nThe offsets of the aforementioned arrays are hardcoded in the NtoskrnlOffsets.csvfile for more than 350 versions of the Windows Kernel ntoskrnl.exe. The choice of going with hardcoded offsets instead of pattern  searches is justified by the fact that the undocumented APIs responsible for  Kernel callbacks addition / removal are subject to change and that any attempt  to write Kernel memory at the wrong address may (and often will) result in a Bug Check(Blue Screen of Death). For more information on how the offsets  were gathered, refer to Offsets section. EDR bypass through deactivation of the ETW Microsoft-Windows-Threat-Intelligence providerThe ETW Microsoft-Windows-Threat-Intelligenceprovider log data about the  usages of some Windows API commonly used maliciously. This include the nt!MiReadWriteVirtualMemoryAPI, called by nt!NtReadVirtualMemory(which is  used to dump LSASSmemory) and monitored by the nt!EtwTiLogReadWriteVmfunction.\n\nEDR products can consume the logs produced by the ETW TIprovider through  services or processes running as, respectively, SERVICE_LAUNCH_PROTECTED_ANTIMALWARE_LIGHTor PS_PROTECTED_ANTIMALWARE_LIGHT, and associated with an Early Launch Anti Malware (ELAM)driver.\n\nAs published by slaeryanin a CNO Development Labsblog post,  the ETW TIprovider can be disabled altogether by patching, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:13.193080Z"}, {"uuid": "c90ea2b0-1714-4a6a-a1ad-a6d4d7df3ca1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://gist.github.com/analystdark/efed7e96c74e14fb6b7163de5d9cfa27", "content": "# ============================================================\n#  CTC by Dark (CatchTheCheat)\n#  Hardware- und Cheat-Analyse\n#  Ausfuehren als Administrator\n# ============================================================\n\n$L      = 'Microsoft-Windows-Kernel-PnP/Configuration'\n$OKVEN  = @('8086','1022','1002')\n$MUSTER = 'anydesk|rustdesk|teamviewer|parsec|dwservice|ultraviewer|ammyy'\n\n# ------------------------------------------------------------\nfunction Test-Admin {\n    $id = [Security.Principal.WindowsIdentity]::GetCurrent()\n    (New-Object Security.Principal.WindowsPrincipal $id).IsInRole(\n        [Security.Principal.WindowsBuiltInRole]::Administrator)\n}\n\n# ------------------------------------------------------------\nfunction Get-DevId {\n    param($Event)\n    $x = [xml]$Event.ToXml()\n    ($x.Event.EventData.Data | Where-Object { $_.Name -eq 'DeviceInstanceId' }).'#text'\n}\n\n# ============================================================\n#  1 - PnP-Ereignisse\n# ============================================================\nfunction Invoke-PnpEvents {\n    Write-Host \"`n=== Event-ID 411 (Startprobleme) ===\" -ForegroundColor Cyan\n    $e411 = @(Get-WinEvent -FilterHashtable @{LogName=$L;Id=411} -ErrorAction SilentlyContinue)\n    if ($e411.Count -gt 0) {\n        $e411 | Select-Object TimeCreated, Id,\n            @{n='Details';e={($_.Message -replace '\\s+',' ').Trim()}} |\n            Sort-Object TimeCreated -Descending | Format-List\n        Write-Host \"Anzahl 411: $($e411.Count)\" -ForegroundColor Red\n    } else {\n        Write-Host \"Keine 411er gefunden.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`n=== PnP-Konfigurationsereignisse (400/410/420/430) ===\" -ForegroundColor Cyan\n    $cfg = @(Get-WinEvent -FilterHashtable @{LogName=$L;Id=400,410,420,430} -ErrorAction SilentlyContinue |\n        ForEach-Object { [PSCustomObject]@{ Zeit=$_.TimeCreated; EID=$_.Id; Geraet=(Get-DevId $_) } })\n    if ($cfg.Count -gt 0) {\n        $cfg | Sort-Object Zeit | Format-Table -AutoSize -Wrap\n        Write-Host \"Gesamt: $($cfg.Count) Ereignisse\" -ForegroundColor DarkGray\n    } else {\n        Write-Host \"Keine Konfigurationsereignisse.\" -ForegroundColor Yellow\n    }\n}\n\n# ============================================================\n#  2 - Log-Integritaet und System-Eckdaten\n# ============================================================\nfunction Invoke-LogIntegrity {\n    Write-Host \"`n=== Geleerte Ereignisprotokolle (System EID 104) ===\" -ForegroundColor Cyan\n    $clr = @(Get-WinEvent -FilterHashtable @{LogName='System';Id=104} -MaxEvents 50 -ErrorAction SilentlyContinue)\n    if ($clr.Count -gt 0) {\n        $clr | ForEach-Object {\n            [PSCustomObject]@{\n                Zeit     = $_.TimeCreated\n                Benutzer = $_.Properties[0].Value\n                Computer = $_.Properties[1].Value\n                Log      = $_.Properties[2].Value\n            }\n        } | Format-Table -AutoSize -Wrap\n        Write-Host \"ACHTUNG: Protokolle wurden geleert.\" -ForegroundColor Red\n    } else {\n        Write-Host \"Keine Loeschvorgaenge protokolliert.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`n=== Security-Log geleert (EID 1102) ===\" -ForegroundColor Cyan\n    $s1102 = @(Get-WinEvent -FilterHashtable @{LogName='Security';Id=1102} -MaxEvents 20 -ErrorAction SilentlyContinue)\n    if ($s1102.Count -gt 0) {\n        $s1102 | Select-Object TimeCreated | Format-Table -AutoSize\n        Write-Host \"ACHTUNG: Security-Log wurde geleert.\" -ForegroundColor Red\n    } else {\n        Write-Host \"Keine Loeschung des Security-Logs.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`n=== System ===\" -ForegroundColor Cyan\n    $os = Get-CimInstance Win32_OperatingSystem\n    Write-Host \"Installiert:  $($os.InstallDate)\"\n    Write-Host \"Letzter Boot: $($os.LastBootUpTime)\"\n    Write-Host \"Computer:     $env:COMPUTERNAME\"\n    Write-Host \"Benutzer:     $env:USERNAME\"\n\n    Write-Host \"`n=== Log-Status ===\" -ForegroundColor Cyan\n    Get-WinEvent -ListLog $L,'System','Security','Application',\n        'Microsoft-Windows-Partition/Diagnostic' -ErrorAction SilentlyContinue |\n        Select-Object LogName, IsEnabled, RecordCount, LogMode | Format-Table -AutoSize\n\n    Write-Host \"=== Zeitaenderungen (Kernel-General EID 1) ===\" -ForegroundColor Cyan\n    $zt = @(Get-WinEvent -FilterHashtable @{LogName='System';Id=1;ProviderName='Microsoft-Windows-Kernel-General'} -MaxEvents 20 -ErrorAction SilentlyContinue)\n    if ($zt.Count -gt 0) {\n        $zt | Select-Object TimeCreated, @{n='Info';e={($_.Message -replace '\\s+',' ').Trim()}} | Format-List\n    } else {\n        Write-Host \"Keine manuellen Zeitaenderungen.\" -ForegroundColor Green\n    }\n\n    # --- Ausfuehrungsartefakte: Zustand und Auffaelligkeiten ---\n    Write-Host \"`n=== Ausfuehrungsartefakte ===\" -ForegroundColor Cyan\n    Write-Host \"(Zeigt Zustand, KEIN kryptografischer Manipulationsbeweis.\" -ForegroundColor DarkGray\n    Write-Host \" Tiefenauswertung: Zimmerman-Tools AmcacheParser / AppCompatCacheParser / MFTECmd)\" -ForegroundColor DarkGray\n\n    # Amcache.hve\n    Write-Host \"`n--- Amcache.hve ---\" -ForegroundColor DarkGray\n    $am = \"$env:SystemRoot\\AppCompat\\Programs\\Amcache.hve\"\n    if (Test-Path $am) {\n        $f = Get-Item $am -Force\n        Write-Host (\"Groesse: {0:N0} Bytes | Erstellt: {1} | Geaendert: {2}\" -f $f.Length,$f.CreationTime,$f.LastWriteTime)\n        if ($f.Length -lt 100KB) {\n            Write-Host \"AUFFAELLIG: Datei sehr klein - koennte geleert/zurueckgesetzt sein.\" -ForegroundColor Red\n        }\n        $os2 = Get-CimInstance Win32_OperatingSystem\n        if ($f.CreationTime -gt $os2.InstallDate.AddDays(1)) {\n            Write-Host \"AUFFAELLIG: Erstellt deutlich nach Windows-Installation - moeglw. neu angelegt.\" -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"FEHLT - Amcache.hve nicht vorhanden (regeneriert sich normalerweise).\" -ForegroundColor Red\n    }\n\n    # USN-Journal (NTFS-Aenderungsjournal)\n    Write-Host \"`n--- USN-Journal (Laufwerk C:) ---\" -ForegroundColor DarkGray\n    $usn = & fsutil usn queryjournal C: 2>&1\n    if ($LASTEXITCODE -eq 0 -and $usn) {\n        $usn | ForEach-Object { Write-Host \"   $_\" }\n        $first = ($usn | Select-String 'Erste USN|First USN' | Select-Object -First 1) -replace '[^0-9x]',''\n        if ($first -match '^0x0+$' -or $first -eq '0') {\n            Write-Host \"AUFFAELLIG: Erste USN = 0 - Journal wurde geloescht und neu angelegt.\" -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"Journal nicht abfragbar oder deaktiviert.\" -ForegroundColor Yellow\n        Write-Host \"Ein DEAKTIVIERTES USN-Journal ist auf einem Gaming-PC ungewoehnlich.\" -ForegroundColor Red\n    }\n\n    # ShimCache / AppCompatCache\n    Write-Host \"`n--- ShimCache (AppCompatCache) ---\" -ForegroundColor DarkGray\n    $shim = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache'\n    if (Test-Path $shim) {\n        $val = (Get-ItemProperty $shim -Name AppCompatCache -ErrorAction SilentlyContinue).AppCompatCache\n        if ($val) {\n            Write-Host (\"Vorhanden, {0:N0} Bytes. Binaer - Auswertung nur mit AppCompatCacheParser.\" -f $val.Length)\n        } else {\n            Write-Host \"AUFFAELLIG: Schluessel vorhanden, aber leer.\" -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"AUFFAELLIG: AppCompatCache nicht vorhanden.\" -ForegroundColor Red\n    }\n\n    # Prefetch\n    Write-Host \"`n--- Prefetch ---\" -ForegroundColor DarkGray\n    $pfE = (Get-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters' -Name EnablePrefetcher -ErrorAction SilentlyContinue).EnablePrefetcher\n    $pfDir = \"$env:SystemRoot\\Prefetch\"\n    $pfCount = if (Test-Path $pfDir) { @(Get-ChildItem \"$pfDir\\*.pf\" -ErrorAction SilentlyContinue).Count } else { 0 }\n    Write-Host (\"EnablePrefetcher: {0} | .pf-Dateien: {1}\" -f $pfE, $pfCount)\n    if ($pfE -eq 0) {\n        Write-Host \"AUFFAELLIG: Prefetch deaktiviert - haeufige Anti-Forensik-Massnahme.\" -ForegroundColor Red\n    } elseif ($pfCount -lt 20) {\n        Write-Host \"AUFFAELLIG: Sehr wenige .pf-Dateien - Prefetch koennte geleert worden sein.\" -ForegroundColor Red\n    }\n\n    # SRUM\n    Write-Host \"`n--- SRUM ---\" -ForegroundColor DarkGray\n    $srum = \"$env:SystemRoot\\System32\\sru\\SRUDB.dat\"\n    if (Test-Path $srum) {\n        $f = Get-Item $srum -Force\n        Write-Host (\"SRUDB.dat: {0:N0} Bytes | Geaendert: {1}\" -f $f.Length,$f.LastWriteTime)\n    } else {\n        Write-Host \"SRUDB.dat nicht vorhanden.\" -ForegroundColor Yellow\n    }\n}\n\n# ============================================================\n#  3 - PCI/PCIe-Geraete\n# ============================================================\nfunction Invoke-PciDevices {\n    Write-Host \"`n=== PCI/PCIe-Geraete (aktuell) ===\" -ForegroundColor Cyan\n    Write-Host (\"{0,-6} {1,-6} {2,-10} {3,-18} {4}\" -f 'VEN','DEV','STATUS','KLASSE','NAME') -ForegroundColor Cyan\n    Get-PnpDevice | Where-Object { $_.InstanceId -like 'PCI*' } | Sort-Object Class | ForEach-Object {\n        $v = [regex]::Match($_.InstanceId,'VEN_([0-9A-Fa-f]{4})').Groups[1].Value.ToUpper()\n        $d = [regex]::Match($_.InstanceId,'DEV_([0-9A-Fa-f]{4})').Groups[1].Value.ToUpper()\n        $c = if ($OKVEN -contains $v) { 'Green' } else { 'Red' }\n        Write-Host (\"{0,-6} {1,-6} {2,-10} {3,-18} {4}\" -f $v,$d,$_.Status,$_.Class,$_.FriendlyName) -ForegroundColor $c\n    }\n\n    Write-Host \"`n=== Nicht mehr vorhandene PCI-Geraete ===\" -ForegroundColor Cyan\n    $reg = @(Get-ChildItem 'HKLM:\\SYSTEM\\CurrentControlSet\\Enum\\PCI' -ErrorAction SilentlyContinue |\n        Select-Object -ExpandProperty PSChildName)\n    $da  = @(Get-PnpDevice -PresentOnly -ErrorAction SilentlyContinue |\n        Where-Object { $_.InstanceId -like 'PCI*' } |\n        ForEach-Object { ($_.InstanceId -split '\\\\')[1] })\n    $weg = @($reg | Where-Object { $da -notcontains $_ })\n    if ($weg.Count -gt 0) {\n        $weg | ForEach-Object { Write-Host \"FEHLT: $_\" -ForegroundColor Red }\n    } else {\n        Write-Host \"Keine Abweichung.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`n=== setupapi.dev.log ===\" -ForegroundColor Cyan\n    $sp = 'C:\\Windows\\INF\\setupapi.dev.log'\n    if (Test-Path $sp) {\n        $fi = Get-Item $sp\n        Write-Host (\"Groesse: {0:N0} Bytes | Erstellt: {1} | Geaendert: {2}\" -f $fi.Length,$fi.CreationTime,$fi.LastWriteTime)\n        $ids = @(Select-String -Path $sp -Pattern 'PCI\\\\VEN_[0-9A-Fa-f]{4}&DEV_[0-9A-Fa-f]{4}' -AllMatches |\n            ForEach-Object { $_.Matches.Value } | Sort-Object -Unique)\n        if ($ids.Count -gt 0) { $ids }\n        else { Write-Host \"Keine PCI-Eintraege in der Datei.\" -ForegroundColor Yellow }\n    } else {\n        Write-Host \"Datei nicht vorhanden.\" -ForegroundColor Yellow\n    }\n}\n\n# ============================================================\n#  4 - Entfernte Geraete im Zeitfenster\n# ============================================================\nfunction Invoke-RemovedDevices {\n    param([int]$Stunden = 1)\n\n    $seit = (Get-Date).AddHours(-$Stunden)\n    Write-Host \"`n=== Entfernte Geraete seit $($seit.ToString('dd.MM.yyyy HH:mm')) ===\" -ForegroundColor Cyan\n\n    $rem = @(Get-WinEvent -FilterHashtable @{LogName=$L;Id=420;StartTime=$seit} -ErrorAction SilentlyContinue |\n        ForEach-Object { [PSCustomObject]@{ Zeit=$_.TimeCreated; Geraet=(Get-DevId $_) } })\n    if ($rem.Count -gt 0) {\n        Write-Host \"--- Abgezogen (Ereignisprotokoll) ---\" -ForegroundColor Red\n        $rem | Sort-Object Zeit | Format-Table -AutoSize -Wrap\n    } else {\n        Write-Host \"Keine 420-Ereignisse im Zeitfenster.\" -ForegroundColor Green\n    }\n\n    $sig = '[DllImport(\"advapi32.dll\")]public static extern int RegQueryInfoKey(Microsoft.Win32.SafeHandles.SafeRegistryHandle h,System.Text.StringBuilder a,ref int b,int c,ref int d,ref int e,ref int f,ref int g,ref int i,ref int j,ref int k,ref long l);'\n    Add-Type -MemberDefinition $sig -Name RK -Namespace W -ErrorAction SilentlyContinue\n\n    $da = @(Get-PnpDevice -PresentOnly -ErrorAction SilentlyContinue | ForEach-Object { $_.InstanceId })\n    $treffer = @()\n    foreach ($zweig in @('PCI','USB','USBSTOR','HID')) {\n        $pfad = \"HKLM:\\SYSTEM\\CurrentControlSet\\Enum\\$zweig\"\n        if (-not (Test-Path $pfad)) { continue }\n        Get-ChildItem $pfad -ErrorAction SilentlyContinue | ForEach-Object {\n            $el = $_\n            Get-ChildItem $el.PSPath -ErrorAction SilentlyContinue | ForEach-Object {\n                $t = 0L; $z = 0; $n = New-Object Text.StringBuilder 1024\n                [void][W.RK]::RegQueryInfoKey($_.Handle,$n,[ref]$z,0,[ref]$z,[ref]$z,[ref]$z,[ref]$z,[ref]$z,[ref]$z,[ref]$z,[ref]$t)\n                $zeit = [DateTime]::FromFileTime($t)\n                $iid  = \"$zweig\\$($el.PSChildName)\\$($_.PSChildName)\"\n                if ($zeit -ge $seit -and ($da -notcontains $iid)) {\n                    $treffer += [PSCustomObject]@{\n                        Zuletzt = $zeit\n                        Geraet  = $iid\n                        Name    = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).FriendlyName\n                    }\n                }\n            }\n        }\n    }\n    if ($treffer.Count -gt 0) {\n        Write-Host \"--- Registry frisch angefasst, Geraet nicht mehr vorhanden ---\" -ForegroundColor Red\n        $treffer | Sort-Object Zuletzt -Descending | Format-Table -AutoSize -Wrap\n    } else {\n        Write-Host \"Keine Registry-Auffaelligkeiten im Zeitfenster.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`nHinweis: Bei ausgeschaltetem Rechner entfernte Hardware\" -ForegroundColor DarkGray\n    Write-Host \"erzeugt KEINE Spur. Leeres Ergebnis ist keine Entlastung.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  5 - Datentraeger-Historie\n# ============================================================\nfunction Invoke-DiskHistory {\n    Write-Host \"`n=== Datentraeger-Historie (Partition/Diagnostic) ===\" -ForegroundColor Cyan\n\n    $plog = @(Get-WinEvent -LogName 'Microsoft-Windows-Partition/Diagnostic' -ErrorAction SilentlyContinue |\n        ForEach-Object {\n            $dat = ([xml]$_.ToXml()).Event.EventData.Data\n            [PSCustomObject]@{\n                Zeit   = $_.TimeCreated\n                EID    = $_.Id\n                Modell = ($dat | Where-Object { $_.Name -eq 'Model' }).'#text'\n                Serie  = ($dat | Where-Object { $_.Name -eq 'SerialNumber' }).'#text'\n            }\n        })\n\n    if ($plog.Count -eq 0) {\n        Write-Host \"Log leer oder nicht lesbar.\" -ForegroundColor Yellow\n        return\n    }\n\n    $s = $plog | Sort-Object Zeit\n    Write-Host (\"Zeitraum: {0} bis {1}  ({2} Eintraege)\" -f $s[0].Zeit, $s[-1].Zeit, $plog.Count) -ForegroundColor DarkGray\n\n    Write-Host \"`n--- Alle jemals erfassten Datentraeger ---\" -ForegroundColor DarkGray\n    $plog | Group-Object Serie | ForEach-Object {\n        $e = $_.Group | Sort-Object Zeit\n        [PSCustomObject]@{\n            Modell   = $e[0].Modell\n            Serie    = $_.Name\n            Erstmals = $e[0].Zeit\n            Zuletzt  = $e[-1].Zeit\n            Anzahl   = $_.Count\n        }\n    } | Sort-Object Zuletzt -Descending | Format-Table -AutoSize\n\n    Write-Host \"--- Im Log erfasst, aktuell NICHT angeschlossen ---\" -ForegroundColor DarkGray\n    $jetzt = @(Get-Disk -ErrorAction SilentlyContinue | ForEach-Object { $_.SerialNumber -replace '\\s','' })\n    $fehlt = @($plog | Group-Object Serie | Where-Object {\n        $sn = $_.Name -replace '[\\s\\.]',''\n        -not ($jetzt | Where-Object { $_ -and ($_ -replace '[\\s\\.]','') -like \"*$sn*\" })\n    })\n    if ($fehlt.Count -gt 0) {\n        $fehlt | ForEach-Object {\n            $e = $_.Group | Sort-Object Zeit\n            Write-Host (\"FEHLT: {0} | Serie {1} | zuletzt {2}\" -f $e[0].Modell, $_.Name, $e[-1].Zeit) -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"Alle erfassten Datentraeger sind angeschlossen.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`n--- Letzte 30 Ereignisse ---\" -ForegroundColor DarkGray\n    $plog | Sort-Object Zeit -Descending | Select-Object -First 30 | Format-Table -AutoSize\n}\n\n# ============================================================\n#  6 - USB-Geraetehistorie\n# ============================================================\nfunction Invoke-UsbHistory {\n    Write-Host \"`n=== USB-Geraetehistorie ===\" -ForegroundColor Cyan\n    $da = @(Get-PnpDevice -PresentOnly -ErrorAction SilentlyContinue | ForEach-Object { $_.InstanceId })\n    foreach ($zweig in @('USBSTOR','USB')) {\n        $pfad = \"HKLM:\\SYSTEM\\CurrentControlSet\\Enum\\$zweig\"\n        if (-not (Test-Path $pfad)) { continue }\n        Write-Host \"`n--- $zweig ---\" -ForegroundColor DarkGray\n        Get-ChildItem $pfad -ErrorAction SilentlyContinue | ForEach-Object {\n            $el = $_\n            Get-ChildItem $el.PSPath -ErrorAction SilentlyContinue | ForEach-Object {\n                $p = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue\n                $iid = \"$zweig\\$($el.PSChildName)\\$($_.PSChildName)\"\n                [PSCustomObject]@{\n                    Status = if ($da -contains $iid) { 'vorhanden' } else { 'FEHLT' }\n                    Name   = $p.FriendlyName\n                    Klasse = $p.Class\n                    Geraet = $el.PSChildName\n                    Serie  = $_.PSChildName\n                }\n            }\n        } | Sort-Object Status, Name | Format-Table -AutoSize -Wrap\n    }\n    Write-Host \"Hinweis: Viele FEHLT-Eintraege unter USB sind normal (Ports, Hubs, Kabel).\" -ForegroundColor DarkGray\n\n    # --- DeviceSetupManager: MAKCU / Arduino / Input-Emulator Spuren ---\n    Write-Host \"`n--- DeviceSetupManager: MAKCU / Arduino / Input-Emulator ---\" -ForegroundColor Cyan\n    Write-Host \"(CH343/CH340/CH341 = Arduino-Klon | ESP32-S3 = MAKCU | COM-Port = serielles Geraet)\" -ForegroundColor DarkGray\n\n    $dsmLog   = 'Microsoft-Windows-DeviceSetupManager/Admin'\n    $dsmOper  = 'Microsoft-Windows-DeviceSetupManager/Operational'\n    $dsmMuster = 'CH34|CH340|CH341|CH343|ESP32|ESP8266|MAKCU|Arduino|CP2102|CP210|PL2303|FT232|FTDI|silabser|usbser'\n    $comMuster = 'COM\\d+'\n\n    $dsmTreffer = @()\n    foreach ($log in @($dsmLog, $dsmOper)) {\n        $events = @(Get-WinEvent -LogName $log -MaxEvents 500 -ErrorAction SilentlyContinue)\n        foreach ($e in $events) {\n            if ($e.Message -match $dsmMuster -or $e.Message -match 'COM[3-9]|COM[1-9][0-9]') {\n                $comPort = if ($e.Message -match '(COM\\d+)') { $matches[1] } else { '' }\n                $chip    = ''\n                foreach ($m in @('CH343','CH340','CH341','CH34','ESP32-S3','ESP32','ESP8266','CP2102','CP210','PL2303','FT232','FTDI','silabser','usbser','MAKCU','Arduino')) {\n                    if ($e.Message -match [regex]::Escape($m)) { $chip = $m; break }\n                }\n                $dsmTreffer += [PSCustomObject]@{\n                    Zeit    = $e.TimeCreated\n                    EID     = $e.Id\n                    Chip    = $chip\n                    COM     = $comPort\n                    Meldung = ($e.Message -replace '\\s+',' ').Substring(0, [Math]::Min(120, $e.Message.Length))\n                }\n            }\n        }\n    }\n\n    if ($dsmTreffer.Count -gt 0) {\n        Write-Host \"`n  [!] TREFFER: Serielle/Arduino/MAKCU-Geraete im DeviceSetupManager-Log!\" -ForegroundColor Red\n        $dsmTreffer | Sort-Object Zeit -Descending | Select-Object -First 20 | ForEach-Object {\n            $col = if ($_.Chip -match 'ESP32|MAKCU') { 'Red' } else { 'Yellow' }\n            Write-Host (\"`n  [{0}] EID {1}\" -f $_.Zeit, $_.EID) -ForegroundColor $col\n            if ($_.Chip) { Write-Host (\"  Chip/Typ : {0}\" -f $_.Chip) -ForegroundColor $col }\n            if ($_.COM)  { Write-Host (\"  COM-Port : {0}\" -f $_.COM)  -ForegroundColor $col }\n            Write-Host (\"  Meldung  : {0}...\" -f $_.Meldung) -ForegroundColor DarkGray\n        }\n        Write-Host \"`n  Bedeutung: CH34x = Arduino-Klon (Input-Emulator Basis)\" -ForegroundColor DarkGray\n        Write-Host \"             ESP32-S3 = MAKCU oder aehnliches Aim-Geraet\" -ForegroundColor DarkGray\n        Write-Host \"             COM-Port-Eintrag = serielles USB-Geraet war angeschlossen\" -ForegroundColor DarkGray\n    } else {\n        Write-Host \"  Keine Arduino/MAKCU/ESP32-Spuren im DeviceSetupManager-Log.\" -ForegroundColor Green\n    }\n\n    # --- COM-Port-Registry: jemals registrierte serielle Geraete ---\n    Write-Host \"`n--- COM-Port-Historie (Registry) ---\" -ForegroundColor DarkGray\n    $comKey = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\COM Name Arbiter\\Devices'\n    if (Test-Path $comKey) {\n        $comPorts = Get-ItemProperty $comKey -ErrorAction SilentlyContinue\n        if ($comPorts) {\n            $comPorts.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {\n                Write-Host (\"  {0} = {1}\" -f $_.Name, $_.Value)\n            }\n        }\n    } else {\n        Write-Host \"  COM-Arbiter-Key nicht vorhanden.\" -ForegroundColor DarkGray\n    }\n}\n\n# ============================================================\n#  7 - Fernwartungssoftware\n# ============================================================\nfunction Invoke-RemoteTools {\n    Write-Host \"`n=== Fernwartungssoftware ===\" -ForegroundColor Cyan\n    $fund = $false\n\n    Write-Host \"`n--- Installiert (Registry) ---\" -ForegroundColor DarkGray\n    $uninst = @(\n      'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',\n      'HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',\n      'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'\n    )\n    $tr = @(Get-ItemProperty $uninst -ErrorAction SilentlyContinue |\n        Where-Object { $_.DisplayName -match $MUSTER } |\n        Select-Object DisplayName, DisplayVersion, InstallDate, InstallLocation)\n    if ($tr) { $tr | Format-Table -AutoSize -Wrap; $fund = $true }\n    else { Write-Host \"Nichts gefunden.\" -ForegroundColor Green }\n\n    Write-Host \"`n--- Prefetch (belegt AUSFUEHRUNG) ---\" -ForegroundColor DarkGray\n    $pfEnabled = (Get-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters' -Name EnablePrefetcher -ErrorAction SilentlyContinue).EnablePrefetcher\n    if ($pfEnabled -eq 0) {\n        Write-Host \"Prefetch ist DEAKTIVIERT - dieser Test ist wertlos.\" -ForegroundColor Yellow\n    }\n    $pf = @(Get-ChildItem 'C:\\Windows\\Prefetch\\*.pf' -ErrorAction SilentlyContinue |\n        Where-Object { $_.Name -match $MUSTER } |\n        Select-Object Name, CreationTime, LastWriteTime)\n    if ($pf) { $pf | Format-Table -AutoSize; $fund = $true }\n    else { Write-Host \"Kein Prefetch-Eintrag.\" -ForegroundColor Green }\n\n    Write-Host \"`n--- Dateien / Ordner ---\" -ForegroundColor DarkGray\n    $pfade = @(\"$env:ProgramFiles\",\"${env:ProgramFiles(x86)}\",\"$env:APPDATA\",\n               \"$env:LOCALAPPDATA\",\"$env:ProgramData\",\"$env:USERPROFILE\\Downloads\",\"$env:USERPROFILE\\Desktop\")\n    $df = @(foreach ($p in $pfade) {\n        if (Test-Path $p) {\n            Get-ChildItem $p -Recurse -Depth 2 -ErrorAction SilentlyContinue |\n                Where-Object { $_.Name -match $MUSTER } |\n                Select-Object FullName, Length, CreationTime, LastWriteTime\n        }\n    })\n    if ($df) { $df | Sort-Object CreationTime | Format-Table -AutoSize -Wrap; $fund = $true }\n    else { Write-Host \"Keine Dateien gefunden.\" -ForegroundColor Green }\n\n    Write-Host \"`n--- Dienste ---\" -ForegroundColor DarkGray\n    $sv = @(Get-CimInstance Win32_Service -ErrorAction SilentlyContinue |\n        Where-Object { $_.Name -match $MUSTER -or $_.DisplayName -match $MUSTER -or $_.PathName -match $MUSTER } |\n        Select-Object Name, DisplayName, State, StartMode, PathName)\n    if ($sv) { $sv | Format-Table -AutoSize -Wrap; $fund = $true }\n    else { Write-Host \"Keine Dienste.\" -ForegroundColor Green }\n\n    Write-Host \"`n--- Programmspuren in der Registry ---\" -ForegroundColor DarkGray\n    $rk = @(\n      'HKCU:\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\Shell\\MuiCache',\n      'HKCU:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Store',\n      'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Store'\n    )\n    $sp = @(foreach ($k in $rk) {\n        if (Test-Path $k) {\n            (Get-Item $k).Property | Where-Object { $_ -match $MUSTER } |\n                ForEach-Object { [PSCustomObject]@{ Quelle=(Split-Path $k -Leaf); Eintrag=$_ } }\n        }\n    })\n    if ($sp) { $sp | Format-Table -AutoSize -Wrap; $fund = $true }\n    else { Write-Host \"Keine Registry-Spuren.\" -ForegroundColor Green }\n\n    Write-Host \"`n--- Firewall-Regeln ---\" -ForegroundColor DarkGray\n    $fw = @(Get-NetFirewallRule -ErrorAction SilentlyContinue |\n        Where-Object { $_.DisplayName -match $MUSTER } |\n        Select-Object DisplayName, Enabled, Direction, Action)\n    if ($fw) { $fw | Format-Table -AutoSize; $fund = $true }\n    else { Write-Host \"Keine Firewall-Regeln.\" -ForegroundColor Green }\n\n    if ($fund) {\n        Write-Host \"`nTREFFER vorhanden - Eintraege einzeln pruefen.\" -ForegroundColor Red\n        Write-Host \"Fernwartung hat viele harmlose Gruende. Der Zeitpunkt entscheidet.\" -ForegroundColor DarkGray\n    } else {\n        Write-Host \"`nKeine Hinweise auf Fernwartungssoftware.\" -ForegroundColor Green\n    }\n}\n\n# ============================================================\n#  8 - Fernwartung: Sitzungen und Dateiuebertragungen\n# ============================================================\nfunction Invoke-RemoteSessions {\n    Write-Host \"`n=== Fernwartung: Sitzungen und Dateiuebertragungen ===\" -ForegroundColor Cyan\n\n    # Schluesselwoerter, die auf Dateiuebertragung hindeuten\n    $ftMuster = 'file transfer|filetransfer|Files\\b|Starting file|Download|Upload|transfer of|Dateiuebertragung|Datei\u00c3\u00bcbertragung'\n\n    # --- AnyDesk ---\n    Write-Host \"`n--- AnyDesk ---\" -ForegroundColor DarkGray\n    $adPfade = @(\"$env:ProgramData\\AnyDesk\", \"$env:APPDATA\\AnyDesk\")\n    $adGefunden = $false\n    foreach ($p in $adPfade) {\n        if (-not (Test-Path $p)) { continue }\n        $adGefunden = $true\n        Write-Host \"Ordner: $p\" -ForegroundColor DarkGray\n        Get-ChildItem $p -Filter '*.trace' -ErrorAction SilentlyContinue |\n            Select-Object Name, Length, CreationTime, LastWriteTime | Format-Table -AutoSize\n\n        # connection_trace.txt: eine Zeile pro Sitzung\n        $ct = Join-Path $p 'connection_trace.txt'\n        if (Test-Path $ct) {\n            Write-Host \"-- Sitzungen (connection_trace.txt) --\" -ForegroundColor Yellow\n            Get-Content $ct -ErrorAction SilentlyContinue | Where-Object { $_.Trim() } |\n                ForEach-Object { Write-Host \"   $_\" }\n        }\n\n        # Dateiuebertragungen aus den Trace-Dateien\n        $tf = @(Get-ChildItem $p -Filter '*.trace' -ErrorAction SilentlyContinue)\n        foreach ($f in $tf) {\n            $hits = @(Select-String -Path $f.FullName -Pattern $ftMuster -ErrorAction SilentlyContinue)\n            if ($hits.Count -gt 0) {\n                Write-Host \"-- Moegliche Dateiuebertragung in $($f.Name) --\" -ForegroundColor Red\n                $hits | Select-Object -Last 40 | ForEach-Object { Write-Host \"   $($_.Line.Trim())\" }\n            }\n        }\n    }\n    if (-not $adGefunden) { Write-Host \"Keine AnyDesk-Ordner vorhanden.\" -ForegroundColor Green }\n\n    # --- RustDesk ---\n    Write-Host \"`n--- RustDesk ---\" -ForegroundColor DarkGray\n    $rdPfade = @(\"$env:APPDATA\\RustDesk\", \"$env:ProgramData\\RustDesk\", \"$env:LOCALAPPDATA\\RustDesk\")\n    $rdGefunden = $false\n    foreach ($p in $rdPfade) {\n        if (-not (Test-Path $p)) { continue }\n        $rdGefunden = $true\n        Write-Host \"Ordner: $p\" -ForegroundColor DarkGray\n        Get-ChildItem $p -Recurse -Include '*.log','*.toml' -ErrorAction SilentlyContinue |\n            Select-Object FullName, Length, CreationTime, LastWriteTime | Format-Table -AutoSize -Wrap\n\n        $logs = @(Get-ChildItem $p -Recurse -Filter '*.log' -ErrorAction SilentlyContinue)\n        foreach ($f in $logs) {\n            $hits = @(Select-String -Path $f.FullName -Pattern ($ftMuster + '|remote_id|Connection from|session') -ErrorAction SilentlyContinue)\n            if ($hits.Count -gt 0) {\n                Write-Host \"-- Eintraege in $($f.Name) --\" -ForegroundColor Yellow\n                $hits | Select-Object -Last 40 | ForEach-Object { Write-Host \"   $($_.Line.Trim())\" }\n            }\n        }\n    }\n    if (-not $rdGefunden) { Write-Host \"Keine RustDesk-Ordner vorhanden.\" -ForegroundColor Green }\n\n    # --- TeamViewer ---\n    Write-Host \"`n--- TeamViewer ---\" -ForegroundColor DarkGray\n    $tvPfade = @(\"$env:APPDATA\\TeamViewer\", \"$env:ProgramData\\TeamViewer\",\n                 \"$env:ProgramFiles\\TeamViewer\", \"${env:ProgramFiles(x86)}\\TeamViewer\")\n    $tvGefunden = $false\n    foreach ($p in $tvPfade) {\n        if (-not (Test-Path $p)) { continue }\n        $tvGefunden = $true\n        $conn = @(Get-ChildItem $p -Recurse -Include 'Connections*.txt' -ErrorAction SilentlyContinue)\n        foreach ($f in $conn) {\n            Write-Host \"-- $($f.FullName) --\" -ForegroundColor Yellow\n            Get-Content $f.FullName -ErrorAction SilentlyContinue | Where-Object { $_.Trim() } |\n                Select-Object -Last 40 | ForEach-Object { Write-Host \"   $_\" }\n        }\n        $tvlogs = @(Get-ChildItem $p -Recurse -Filter '*Logfile*.log' -ErrorAction SilentlyContinue)\n        foreach ($f in $tvlogs) {\n            $hits = @(Select-String -Path $f.FullName -Pattern $ftMuster -ErrorAction SilentlyContinue)\n            if ($hits.Count -gt 0) {\n                Write-Host \"-- Moegliche Dateiuebertragung in $($f.Name) --\" -ForegroundColor Red\n                $hits | Select-Object -Last 30 | ForEach-Object { Write-Host \"   $($_.Line.Trim())\" }\n            }\n        }\n    }\n    if (-not $tvGefunden) { Write-Host \"Keine TeamViewer-Ordner vorhanden.\" -ForegroundColor Green }\n\n    # --- Gegenprobe: geloeschte Logs / Ordnerzeiten ---\n    Write-Host \"`n--- Gegenprobe ---\" -ForegroundColor DarkGray\n    foreach ($p in ($adPfade + $rdPfade + $tvPfade)) {\n        if (Test-Path $p) {\n            $d = Get-Item $p\n            $anz = @(Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue).Count\n            Write-Host (\"{0} | Erstellt {1} | Geaendert {2} | {3} Dateien\" -f $p, $d.CreationTime, $d.LastWriteTime, $anz)\n        }\n    }\n\n    Write-Host \"`nHinweis: Ordner vorhanden, aber Logdateien fehlen oder sind leer\" -ForegroundColor DarkGray\n    Write-Host \"= Spuren wurden geloescht. Das ist selbst ein Befund.\" -ForegroundColor DarkGray\n    Write-Host \"Zeitangaben in den Logs sind Ortszeit des Rechners.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  9 - Unsignierte Dateien (Treiber / Prozesse / Ablageorte)\n# ============================================================\nfunction Invoke-Unsigned {\n    Write-Host \"`n=== Unsignierte Dateien ===\" -ForegroundColor Cyan\n\n    # Signaturstatus, der als unauffaellig gilt\n    $okStatus = @('Valid')\n\n    # --- 9a: Geladene Kernel-Treiber (wichtigster Teil) ---\n    Write-Host \"`n--- Geladene Kernel-Treiber ---\" -ForegroundColor DarkGray\n    $drv = @(Get-CimInstance Win32_SystemDriver -ErrorAction SilentlyContinue |\n        Where-Object { $_.State -eq 'Running' -and $_.PathName })\n    $drvBad = @()\n    foreach ($d in $drv) {\n        $path = ($d.PathName -replace '\\\\SystemRoot', $env:SystemRoot) -replace '^\\\\\\?\\?\\\\',''\n        if (-not (Test-Path $path)) { continue }\n        $sig = Get-AuthenticodeSignature $path -ErrorAction SilentlyContinue\n        if ($sig.Status -notin $okStatus) {\n            $drvBad += [PSCustomObject]@{\n                Name    = $d.Name\n                Status  = $sig.Status\n                Signierer = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1' } else { '-' }\n                Pfad    = $path\n            }\n        }\n    }\n    if ($drvBad.Count -gt 0) {\n        $drvBad | Format-Table -AutoSize -Wrap\n        Write-Host \"$($drvBad.Count) nicht gueltig signierte Treiber - EINZELN pruefen.\" -ForegroundColor Red\n    } else {\n        Write-Host \"Alle geladenen Treiber gueltig signiert.\" -ForegroundColor Green\n    }\n\n    # --- 9b: Laufende Prozesse ---\n    Write-Host \"`n--- Laufende Prozesse ---\" -ForegroundColor DarkGray\n    $procBad = @()\n    Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Path } |\n        Select-Object -Property Path -Unique | ForEach-Object {\n            $sig = Get-AuthenticodeSignature $_.Path -ErrorAction SilentlyContinue\n            if ($sig.Status -notin $okStatus) {\n                $procBad += [PSCustomObject]@{\n                    Status    = $sig.Status\n                    Signierer = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1' } else { '-' }\n                    Pfad      = $_.Path\n                }\n            }\n        }\n    if ($procBad.Count -gt 0) {\n        $procBad | Sort-Object Pfad | Format-Table -AutoSize -Wrap\n        Write-Host \"$($procBad.Count) nicht gueltig signierte Prozesse.\" -ForegroundColor Red\n    } else {\n        Write-Host \"Alle laufenden Prozesse gueltig signiert.\" -ForegroundColor Green\n    }\n\n    # --- 9c: Ausfuehrbare Dateien in typischen Ablageorten ---\n    Write-Host \"`n--- .exe/.sys/.dll in Ablageorten (Temp, Downloads, AppData) ---\" -ForegroundColor DarkGray\n    $orte = @(\"$env:TEMP\",\"$env:USERPROFILE\\Downloads\",\"$env:APPDATA\",\"$env:LOCALAPPDATA\\Temp\",\"$env:ProgramData\")\n    $fileBad = @()\n    foreach ($o in $orte) {\n        if (-not (Test-Path $o)) { continue }\n        Get-ChildItem $o -Recurse -Depth 2 -Include '*.exe','*.sys','*.dll' -ErrorAction SilentlyContinue |\n            ForEach-Object {\n                $sig = Get-AuthenticodeSignature $_.FullName -ErrorAction SilentlyContinue\n                if ($sig.Status -eq 'NotSigned') {\n                    $fileBad += [PSCustomObject]@{\n                        Erstellt = $_.CreationTime\n                        Groesse  = $_.Length\n                        Pfad     = $_.FullName\n                    }\n                }\n            }\n    }\n    if ($fileBad.Count -gt 0) {\n        $fileBad | Sort-Object Erstellt -Descending | Select-Object -First 60 | Format-Table -AutoSize -Wrap\n        Write-Host \"$($fileBad.Count) unsignierte Dateien (max. 60 gezeigt).\" -ForegroundColor Yellow\n    } else {\n        Write-Host \"Keine unsignierten Dateien in den Ablageorten.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`nHinweis: 'UnknownError' heisst meist, dass die Datei nicht\" -ForegroundColor DarkGray\n    Write-Host \"signiert ist. Viele legitime Programme sind unsigniert -\" -ForegroundColor DarkGray\n    Write-Host \"ein unsignierter KERNEL-TREIBER ist der relevante Befund,\" -ForegroundColor DarkGray\n    Write-Host \"unsignierte Nutzerprogramme sind es meist nicht.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  10 - PowerShell-History und Ausfuehrungsprotokoll\n# ============================================================\nfunction Invoke-PSHistory {\n    Write-Host \"`n=== PowerShell-History ===\" -ForegroundColor Cyan\n\n    # --- 10a: PSReadline-History aller Benutzer ---\n    Write-Host \"`n--- PSReadline ConsoleHost_history.txt (alle Profile) ---\" -ForegroundColor DarkGray\n    $profile = Get-ChildItem 'C:\\Users' -Directory -ErrorAction SilentlyContinue\n    $gefunden = $false\n    foreach ($u in $profile) {\n        $hf = Join-Path $u.FullName 'AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt'\n        if (Test-Path $hf) {\n            $gefunden = $true\n            $f = Get-Item $hf -Force\n            $zeilen = @(Get-Content $hf -ErrorAction SilentlyContinue)\n            Write-Host \"`nBenutzer: $($u.Name)\" -ForegroundColor Yellow\n            Write-Host (\"  Datei: {0:N0} Bytes | Geaendert: {1} | {2} Zeilen\" -f $f.Length,$f.LastWriteTime,$zeilen.Count)\n            if ($zeilen.Count -eq 0) {\n                Write-Host \"  AUFFAELLIG: History-Datei ist LEER.\" -ForegroundColor Red\n            } else {\n                Write-Host \"  --- Inhalt ---\" -ForegroundColor DarkGray\n                $zeilen | ForEach-Object { Write-Host \"    $_\" }\n            }\n        } else {\n            # Datei fehlt, aber Profil existiert\n            $psDir = Join-Path $u.FullName 'AppData\\Roaming\\Microsoft\\Windows\\PowerShell'\n            if (Test-Path $psDir) {\n                Write-Host \"`nBenutzer: $($u.Name)\" -ForegroundColor Yellow\n                Write-Host \"  AUFFAELLIG: PowerShell genutzt, aber History-Datei fehlt.\" -ForegroundColor Red\n            }\n        }\n    }\n    if (-not $gefunden) {\n        Write-Host \"Keine PSReadline-History gefunden.\" -ForegroundColor Yellow\n    }\n\n    # --- 10b: ScriptBlock-Logging (EID 4104) - ergiebigste Quelle ---\n    Write-Host \"`n--- ScriptBlock-Logging (PowerShell/Operational EID 4104) ---\" -ForegroundColor DarkGray\n    $sb = @(Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4104} -MaxEvents 200 -ErrorAction SilentlyContinue)\n    if ($sb.Count -gt 0) {\n        Write-Host \"$($sb.Count) Ereignisse geladen. Zeige zusammengesetzte Skriptbloecke:\" -ForegroundColor Green\n        # Nur den ersten Teil jedes mehrteiligen Blocks nehmen (Teil 1 von N),\n        # damit ein Skript nicht N-fach erscheint; Windows-Eigenaufrufe filtern.\n        $sb | Sort-Object TimeCreated -Descending | ForEach-Object {\n            $x = [xml]$_.ToXml()\n            $data = $x.Event.EventData.Data\n            $teil = ($data | Where-Object { $_.Name -eq 'MessageNumber' }).'#text'\n            $code = ($data | Where-Object { $_.Name -eq 'ScriptBlockText' }).'#text'\n            [PSCustomObject]@{ Zeit=$_.TimeCreated; Teil=$teil; Code=$code }\n        } | Where-Object {\n            $_.Teil -eq '1' -and\n            $_.Code -and\n            $_.Code -notmatch 'prompt|PSConsoleHostReadLine|Set-PSReadLine|__VSCode|Get-Module|CompletionPredictor|IsAzureContextPresent'\n        } | Select-Object -First 25 | ForEach-Object {\n            $c = ($_.Code -replace '\\s+',' ').Trim()\n            if ($c.Length -gt 200) { $c = $c.Substring(0,200) + ' [...]' }\n            Write-Host (\"`n  [{0}]\" -f $_.Zeit) -ForegroundColor Yellow\n            Write-Host (\"  {0}\" -f $c)\n        }\n    } else {\n        Write-Host \"ScriptBlock-Logging nicht aktiv oder keine Eintraege.\" -ForegroundColor Yellow\n        Write-Host \"(Standardmaessig aus - Fehlen ist hier NICHT auffaellig.)\" -ForegroundColor DarkGray\n    }\n\n    # --- 10c: Modul-Logging (EID 4103) ---\n    Write-Host \"`n--- Modul-Logging (EID 4103) ---\" -ForegroundColor DarkGray\n    $ml = @(Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4103} -MaxEvents 20 -ErrorAction SilentlyContinue)\n    if ($ml.Count -gt 0) {\n        Write-Host \"$($ml.Count) Ereignisse vorhanden.\" -ForegroundColor Green\n    } else {\n        Write-Host \"Kein Modul-Logging.\" -ForegroundColor Yellow\n    }\n\n    # --- 10e: HostApplication aus Klassik-Log (EID 400/600) ---\n    # Standardmaessig AKTIV - zeigt die Startkommandozeile jeder PS-Sitzung.\n    Write-Host \"`n--- Start-Kommandozeilen (Windows PowerShell EID 400/600) ---\" -ForegroundColor DarkGray\n    $klassik = @(Get-WinEvent -FilterHashtable @{LogName='Windows PowerShell';Id=400,600} -MaxEvents 500 -ErrorAction SilentlyContinue)\n    if ($klassik.Count -gt 0) {\n        $verdacht = '-enc |-encodedcommand|-e [A-Za-z0-9+/]{20}|downloadstring|downloadfile|downloaddata|-w hidden|-windowstyle hidden|invoke-expression| iex |frombase64|webclient|start-bitstransfer|certutil.*-urlcache|bitsadmin|invoke-webrequest|invoke-restmethod|\\bcurl |\\bwget |\\birm |\\biwr |net\\.webclient|system\\.net\\.http|http://|https://'\n        $cmds = $klassik | ForEach-Object {\n            if ($_.Message -match 'HostApplication=(.+?)(\\r?\\n|$)') {\n                [PSCustomObject]@{ Zeit=$_.TimeCreated; Cmd=$matches[1].Trim() }\n            }\n        } | Where-Object { $_.Cmd } |\n            Group-Object Cmd | ForEach-Object {\n                $g = $_.Group | Sort-Object Zeit\n                [PSCustomObject]@{ Erstmals=$g[0].Zeit; Zuletzt=$g[-1].Zeit; Anzahl=$_.Count; Cmd=$_.Name }\n            } | Sort-Object Zuletzt -Descending\n\n        Write-Host \"$($cmds.Count) unterschiedliche Start-Kommandozeilen:\" -ForegroundColor Green\n        # Bekannt-gute Aufrufe, die trotz Download-Muster NICHT rot sein sollen\n        # (der Lade-Einzeiler des Pruefwerkzeugs selbst).\n        $eigenesTool = 'gist\\.githubusercontent\\.com/analystdark|pnpcheck\\.ps1'\n        foreach ($c in $cmds) {\n            $ausg = $c.Cmd\n            if ($ausg.Length -gt 200) { $ausg = $ausg.Substring(0,200) + ' [...]' }\n            if ($c.Cmd -match $verdacht -and $c.Cmd -notmatch $eigenesTool) {\n                Write-Host (\"`n  [{0}]  ({1}x)\" -f $c.Zuletzt, $c.Anzahl) -ForegroundColor Red\n                Write-Host (\"  VERDAECHTIG: {0}\" -f $ausg) -ForegroundColor Red\n            } else {\n                Write-Host (\"`n  [{0}]  ({1}x)\" -f $c.Zuletzt, $c.Anzahl) -ForegroundColor Yellow\n                Write-Host (\"  {0}\" -f $ausg)\n            }\n        }\n        Write-Host \"`nRot = Muster wie -enc, hidden, DownloadString, IEX (nicht immer boese,\" -ForegroundColor DarkGray\n        Write-Host \"aber typisch fuer verschleierte Ausfuehrung - einzeln pruefen).\" -ForegroundColor DarkGray\n    } else {\n        Write-Host \"Keine 400/600-Ereignisse - Klassik-Log leer oder geleert.\" -ForegroundColor Red\n        Write-Host \"(Dieses Log ist normal AKTIV; ein leeres ist auffaellig.)\" -ForegroundColor DarkGray\n    }\n\n    # --- 10d: Wurde das PowerShell-Log geleert? ---\n    Write-Host \"`n--- PowerShell-Log-Status ---\" -ForegroundColor DarkGray\n    Get-WinEvent -ListLog 'Microsoft-Windows-PowerShell/Operational','Windows PowerShell' -ErrorAction SilentlyContinue |\n        Select-Object LogName, IsEnabled, RecordCount | Format-Table -AutoSize\n\n    Write-Host \"Hinweis: Eine leere/fehlende History bei sonst genutztem PowerShell\" -ForegroundColor DarkGray\n    Write-Host \"deutet auf gezieltes Loeschen hin - selbst ein Befund.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  11 - Discord-Account-IDs (nur User-ID, KEINE Token)\n# ============================================================\nfunction Invoke-DiscordId {\n    Write-Host \"`n=== Discord-Account-IDs ===\" -ForegroundColor Cyan\n    Write-Host \"(Liest ausschliesslich die user_id_cache-Kennung.\" -ForegroundColor DarkGray\n    Write-Host \" Token werden NICHT gelesen oder ausgegeben.)\" -ForegroundColor DarkGray\n\n    $enc = [System.Text.Encoding]::GetEncoding('ISO-8859-1')\n    $script:treffer = @()\n\n    # Hilfsfunktion: eine Datei nach user_id_cache absuchen\n    $scan = {\n        param($file,$user,$quelle)\n        try { $raw = [System.IO.File]::ReadAllText($file, $enc) } catch { return }\n        foreach ($m in [regex]::Matches($raw, 'user_id_cache[^\\d]{0,20}(\\d{17,20})')) {\n            $script:treffer += [PSCustomObject]@{ Benutzer=$user; Quelle=$quelle; ID=$m.Groups[1].Value }\n        }\n    }\n\n    Get-ChildItem 'C:\\Users' -Directory -ErrorAction SilentlyContinue | ForEach-Object {\n        $user   = $_.Name\n        $roam   = Join-Path $_.FullName 'AppData\\Roaming'\n        $local  = Join-Path $_.FullName 'AppData\\Local'\n\n        # --- Desktop-App (alle Discord-Varianten) ---\n        foreach ($fl in @('discord','discordcanary','discordptb','discorddevelopment')) {\n            $ldb = Join-Path $roam \"$fl\\Local Storage\\leveldb\"\n            if (Test-Path $ldb) {\n                Get-ChildItem $ldb -Include '*.ldb','*.log' -Recurse -ErrorAction SilentlyContinue |\n                    ForEach-Object { & $scan $_.FullName $user \"App:$fl\" }\n            }\n        }\n\n        # --- Chromium-Browser (Profile: Default, Profile 1, ...) ---\n        $chromium = @{\n            'Chrome'  = \"$local\\Google\\Chrome\\User Data\"\n            'Edge'    = \"$local\\Microsoft\\Edge\\User Data\"\n            'Brave'   = \"$local\\BraveSoftware\\Brave-Browser\\User Data\"\n            'Vivaldi' = \"$local\\Vivaldi\\User Data\"\n            'OperaGX' = \"$roam\\Opera Software\\Opera GX Stable\"\n            'Opera'   = \"$roam\\Opera Software\\Opera Stable\"\n        }\n        foreach ($b in $chromium.Keys) {\n            $root = $chromium[$b]\n            if (-not (Test-Path $root)) { continue }\n            # Opera hat kein Profile-Unterverzeichnis, Chrome/Edge/Brave schon\n            Get-ChildItem $root -Directory -ErrorAction SilentlyContinue |\n                Where-Object { $_.Name -eq 'Default' -or $_.Name -like 'Profile *' } |\n                ForEach-Object {\n                    $ldb = Join-Path $_.FullName 'Local Storage\\leveldb'\n                    if (Test-Path $ldb) {\n                        Get-ChildItem $ldb -Include '*.ldb','*.log' -Recurse -ErrorAction SilentlyContinue |\n                            ForEach-Object { & $scan $_.FullName $user \"$b/$($_.Directory.Parent.Parent.Name)\" }\n                    }\n                }\n            # Opera-Fall (leveldb direkt unter root)\n            $ldbDirect = Join-Path $root 'Local Storage\\leveldb'\n            if (Test-Path $ldbDirect) {\n                Get-ChildItem $ldbDirect -Include '*.ldb','*.log' -Recurse -ErrorAction SilentlyContinue |\n                    ForEach-Object { & $scan $_.FullName $user $b }\n            }\n        }\n\n        # --- Firefox (localStorage in SQLite) ---\n        $ffRoot = Join-Path $roam 'Mozilla\\Firefox\\Profiles'\n        if (Test-Path $ffRoot) {\n            Get-ChildItem $ffRoot -Directory -ErrorAction SilentlyContinue | ForEach-Object {\n                $lsRoot = Join-Path $_.FullName 'storage\\default'\n                if (Test-Path $lsRoot) {\n                    Get-ChildItem $lsRoot -Directory -ErrorAction SilentlyContinue |\n                        Where-Object { $_.Name -like '*discord*' } | ForEach-Object {\n                            Get-ChildItem $_.FullName -Include '*.sqlite' -Recurse -ErrorAction SilentlyContinue |\n                                ForEach-Object { & $scan $_.FullName $user 'Firefox' }\n                        }\n                }\n            }\n        }\n    }\n\n    if ($script:treffer.Count -eq 0) {\n        Write-Host \"`nKeine Discord-User-ID gefunden.\" -ForegroundColor Yellow\n        Write-Host \"(Discord nicht installiert/eingeloggt, nur portable genutzt, oder Daten entfernt.)\" -ForegroundColor DarkGray\n        return\n    }\n\n    # Deduplizieren und Account-Alter aus der Snowflake ableiten\n    $script:treffer | Group-Object ID | ForEach-Object {\n        $id = $_.Name\n        $created = try {\n            $ms = ([int64]$id -shr 22) + 1420070400000\n            [DateTimeOffset]::FromUnixTimeMilliseconds($ms).UtcDateTime\n        } catch { $null }\n        [PSCustomObject]@{\n            DiscordID   = $id\n            Erstellt    = if ($created) { $created.ToString('dd.MM.yyyy HH:mm') + ' UTC' } else { '?' }\n            GefundenBei = (($_.Group | Select-Object -ExpandProperty Benutzer -Unique) -join ', ')\n            Quelle      = (($_.Group | Select-Object -ExpandProperty Quelle -Unique) -join ', ')\n        }\n    } | Sort-Object Erstellt | Format-Table -AutoSize -Wrap\n\n    $anz = @($script:treffer | Select-Object -ExpandProperty ID -Unique).Count\n    if ($anz -gt 1) {\n        Write-Host \"$anz unterschiedliche Discord-IDs auf diesem Rechner.\" -ForegroundColor Red\n        Write-Host \"Mehrere Accounts koennen auf geteilte Nutzung oder Ban-Ausweichen deuten - im Kontext pruefen.\" -ForegroundColor DarkGray\n    } else {\n        Write-Host \"1 Discord-ID gefunden.\" -ForegroundColor Green\n    }\n    Write-Host \"Quelle = App-Variante oder Browser/Profil, in dem die ID lag.\" -ForegroundColor DarkGray\n    Write-Host \"Erstelldatum ist aus der ID berechnet (Snowflake), kein Online-Abruf.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  12 - PE Binary & Driver Heuristics Inspector\n# ============================================================\nfunction Invoke-PEInspector {\n    Write-Host \"`n=== PE Binary & Driver Heuristics Inspector ===\" -ForegroundColor Cyan\n    Write-Host \"(SHA256, BYOVD-Abgleich, Signatur, PE-Header, Entropie, APIs, Keywords)\" -ForegroundColor DarkGray\n    Write-Host \"Tipp: Start-Transcript (P) vorher aktivieren um Ergebnis zu sichern.\" -ForegroundColor DarkGray\n\n    $byovdHashes = @{\n        \"01ee72782b1d4182da0eef7f9859f7aa2f89cc46e9df51ef2807f43db4872121\" = \"RTCore64.sys (Micro-Star CVE-2019-16098)\"\n        \"31f4d725d8d7e01dd582120aa0f23223fa1ac3cb4414f4e5da801db9402ab490\" = \"gdrv.sys (GIGABYTE CVE-2018-19320)\"\n        \"eb601822c9a7da4175345a55018698dc54fe66d11a91d1e434f676ab65d382bb\" = \"Capcom.sys (Root-Exploit / SMEP)\"\n        \"046e8c8959d72215a774136e632831f2ff2cc0bcbc2becc278912efee7e3cf40\" = \"mhyprot2.sys (miHoYo Process/Memory Killer)\"\n        \"a66d92ff488e0402b8813c9fb60cf649372d65ab19aa67a421dff03fc29fc2a2\" = \"AsrDrv103.sys (ASRock Physical Memory R/W)\"\n        \"60c38ea120015ff363fe9d63c5a70ebfb44766b9319de8d98d248b6bb83c509a\" = \"ene.sys (ENE Technology DeviceIoControl)\"\n    }\n    $packerSections = @(\"upx0\",\"upx1\",\"upx2\",\".vmp0\",\".vmp1\",\".vmp2\",\"themida\",\".themida\",\".enigma1\",\".enigma2\",\".aspack\",\".adata\",\"pec1\",\"pec2\",\".mpress1\",\".mpress2\")\n    $dangerousAPIs = @{\n        \"Process Injection\"  = @(\"VirtualAllocEx\",\"WriteProcessMemory\",\"CreateRemoteThread\",\"NtQueueApcThread\",\"RtlCreateUserThread\",\"SetThreadContext\")\n        \"Memory Tampering\"   = @(\"NtMapViewOfSection\",\"ZwMapViewOfSection\",\"VirtualProtectEx\",\"NtWriteVirtualMemory\")\n        \"Kernel Interaction\" = @(\"ZwLoadDriver\",\"NtLoadDriver\",\"DeviceIoControl\",\"ObRegisterCallbacks\",\"MmCopyVirtualMemory\",\"MmMapIoSpace\")\n        \"Anti-Debug/Evasion\" = @(\"IsDebuggerPresent\",\"CheckRemoteDebuggerPresent\",\"NtQueryInformationProcess\",\"NtSetInformationThread\")\n    }\n    $suspiciousStrings = @(\n        # Cheat-Funktionen\n        'aimbot','wallhack','silentaim','triggerbot','cheatengine',\n        'processhacker','kdmapper','blackbone','drvload','kernelhook','minifilter',\n        # Injection-Techniken (aus realem WptsExtensions.dll Fund)\n        'manualmap','manual map','manualmapping',\n        'kernelmap','kernel manual map',\n        'injecthost','injectmonitor','injecttrigger',\n        'trigger=%s','injected ok','inject failed',\n        # Weitere Injection-Indikatoren\n        'reflectiveinject','reflective inject','shellcode',\n        'dllinjection','dll injection','remotethread',\n        'mapviewofsection inject','zwmapviewofsection'\n    )\n    # Wortgrenz-Keywords (kommen auch in legitimen Dateien vor)\n    $suspiciousStringsWB = @('hack','inject')\n\n    # Datei waehlen\n    $ziel = Read-Host \"`nPfad zur Datei (.exe/.dll/.sys) - leer lassen fuer Datei-Dialog\"\n    if ([string]::IsNullOrWhiteSpace($ziel)) {\n        Add-Type -AssemblyName System.Windows.Forms -ErrorAction SilentlyContinue\n        $dlg = New-Object System.Windows.Forms.OpenFileDialog\n        $dlg.Filter = \"Binaries & Treiber (*.exe;*.dll;*.sys)|*.exe;*.dll;*.sys|Alle (*.*)|*.*\"\n        if ($dlg.ShowDialog() -eq 'OK') { $ziel = $dlg.FileName }\n        else { Write-Host \"Abgebrochen.\" -ForegroundColor Yellow; return }\n    }\n    if (-not (Test-Path $ziel)) { Write-Host \"Datei nicht gefunden: $ziel\" -ForegroundColor Red; return }\n    if ((Get-Item $ziel).PSIsContainer) { Write-Host \"Pfad ist ein Ordner, keine Datei: $ziel\" -ForegroundColor Red; return }\n\n    $dateiname = Split-Path $ziel -Leaf\n    Write-Host \"`nZiel: $ziel\" -ForegroundColor White\n    Write-Host (\"=\" * 70) -ForegroundColor DarkGray\n\n    try { $bytes = [System.IO.File]::ReadAllBytes($ziel) }\n    catch { Write-Host \"Lesefehler: $_\" -ForegroundColor Red; return }\n\n    # Phase 1: SHA256 & BYOVD\n    Write-Host \"`n[*] Phase 1: SHA256 & BYOVD-Abgleich\" -ForegroundColor Cyan\n    $hasher = [System.Security.Cryptography.SHA256]::Create()\n    $sha256 = [BitConverter]::ToString($hasher.ComputeHash($bytes)).Replace(\"-\",\"\").ToLower()\n    Write-Host \"    SHA256 : $sha256\"\n    if ($byovdHashes.ContainsKey($sha256)) {\n        Write-Host \"    [!!!] BYOVD ERKANNT: $($byovdHashes[$sha256])\" -ForegroundColor Red\n    } else {\n        Write-Host \"    BYOVD  : Kein bekannter anfaelliger Treiber-Hash.\" -ForegroundColor Green\n    }\n\n    # Phase 2: Signatur & EKUs\n    Write-Host \"`n[*] Phase 2: Digitale Signatur & Zertifikats-EKUs\" -ForegroundColor Cyan\n    $sig = Get-AuthenticodeSignature -FilePath $ziel -ErrorAction SilentlyContinue\n    if ($sig) {\n        $sigCol = if ($sig.Status -eq 'Valid') { 'Green' } else { 'Red' }\n        Write-Host \"    Status     : $($sig.Status)\" -ForegroundColor $sigCol\n        if ($sig.SignerCertificate) {\n            Write-Host \"    Inhaber    : $($sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1')\"\n            Write-Host \"    Aussteller : $($sig.SignerCertificate.Issuer -replace '^CN=([^,]+).*','$1')\"\n            foreach ($ext in $sig.SignerCertificate.Extensions) {\n                if ($ext -is [System.Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension]) {\n                    foreach ($oid in $ext.EnhancedKeyUsages) {\n                        switch ($oid.Value) {\n                            \"1.3.6.1.4.1.311.61.1.1\" { Write-Host \"    [EKU] WHQL Hardware-Signatur\" -ForegroundColor Green }\n                            \"1.3.6.1.4.1.311.10.3.6\" { Write-Host \"    [EKU] Windows Kernel-Mode Driver Signing\" -ForegroundColor Green }\n                            \"1.3.6.1.5.5.7.3.3\"       { Write-Host \"    [EKU] Standard Code-Signing\" }\n                        }\n                    }\n                }\n            }\n        } else { Write-Host \"    [!] Nicht signiert.\" -ForegroundColor Red }\n    }\n\n    # Phase 3: PE-Header\n    Write-Host \"`n[*] Phase 3: PE-Header & Anomalien\" -ForegroundColor Cyan\n    if ($bytes.Length -lt 64) { Write-Host \"    Datei zu klein.\" -ForegroundColor Red; return }\n\n    $stream = [System.IO.FileStream]::new($ziel, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read)\n    $reader = [System.IO.BinaryReader]::new($stream)\n    $highestRawEnd = 0\n\n    try {\n        if ($reader.ReadUInt16() -ne 0x5A4D) { Write-Host \"    Kein MZ-Header.\" -ForegroundColor Red; return }\n        $null = $stream.Seek(0x3C, 0); $peOff = $reader.ReadUInt32()\n        $null = $stream.Seek($peOff, 0)\n        if ($reader.ReadUInt32() -ne 0x00004550) { Write-Host \"    Keine PE-Signatur.\" -ForegroundColor Red; return }\n\n        $null = $reader.ReadUInt16()              # Machine\n        $numSec = $reader.ReadUInt16()\n        $null = $reader.ReadUInt32()              # TimeDateStamp\n        $null = $stream.Seek(10, 1)\n        $optHdrSize = $reader.ReadUInt16()\n        $null = $reader.ReadUInt16()              # Characteristics\n        $optPos = $stream.Position\n        $optMagic = $reader.ReadUInt16()\n        $is64 = ($optMagic -eq 0x20B)\n        $null = $stream.Seek($optPos + 16, 0); $epRVA = $reader.ReadUInt32()\n        $null = $stream.Seek($optPos + 32, 0)\n        $secAlign = $reader.ReadUInt32(); $fileAlign = $reader.ReadUInt32()\n        $null = $stream.Seek(16, 1); $sizeHdr = $reader.ReadUInt32()\n        $dllCharOff = if ($is64) { $optPos + 70 } else { $optPos + 46 }\n        $null = $stream.Seek($dllCharOff, 0); $dllChar = $reader.ReadUInt16()\n        $hasASLR = ($dllChar -band 0x0040) -ne 0\n        $hasDEP  = ($dllChar -band 0x0100) -ne 0\n\n        Write-Host \"    Architektur : $(if($is64){'x64'}else{'x86'})\"\n        Write-Host (\"    ASLR        : \" + $(if($hasASLR){'An'}else{'[!] AUS'})) -ForegroundColor $(if($hasASLR){'White'}else{'Red'})\n        Write-Host (\"    DEP/NX      : \" + $(if($hasDEP){'An'}else{'[!] AUS'})) -ForegroundColor $(if($hasDEP){'White'}else{'Red'})\n        Write-Host \"    Alignments  : Sektion=0x$($secAlign.ToString('X')) | Datei=0x$($fileAlign.ToString('X'))\"\n        if ($sizeHdr -gt 4096) { Write-Host \"    [!] SizeOfHeaders ungewoehnlich gross: $sizeHdr Bytes\" -ForegroundColor Yellow }\n\n        # Sanity-Check: Werte ausserhalb realistischer Grenzen = gepackt/geschuetzt\n        $parserValid = $true\n        if ($secAlign -gt 0x200000 -or $fileAlign -gt 0x100000 -or $sizeHdr -gt 0x100000) {\n            Write-Host \"`n    [!] PARSER-WARNUNG: Header-Werte ausserhalb normaler Bereiche.\" -ForegroundColor Yellow\n            Write-Host \"        SectionAlignment=0x$($secAlign.ToString('X')) | FileAlignment=0x$($fileAlign.ToString('X')) | SizeOfHeaders=$sizeHdr\" -ForegroundColor Yellow\n            Write-Host \"        Datei ist wahrscheinlich gepackt oder geschuetzt (z.B. Electron/Chromium, VMProtect, Themida).\" -ForegroundColor Yellow\n            Write-Host \"        Phase 4 (Sektionen) wird uebersprungen - Ergebnisse waeren nicht zuverlaessig.\" -ForegroundColor Yellow\n            $parserValid = $false\n        }\n\n        # Phase 4: Sektionen\n        Write-Host \"`n[*] Phase 4: Sektionen, Entropie & Packer-Erkennung\" -ForegroundColor Cyan\n        if (-not $parserValid) {\n            Write-Host \"    Uebersprungen (siehe Warnung oben).\" -ForegroundColor Yellow\n        } else {\n        $null = $stream.Seek($peOff + 4 + 20 + $optHdrSize, 0)\n        $sectionMap = @()\n\n        for ($i = 0; $i -lt $numSec; $i++) {\n            $nameB = $reader.ReadBytes(8)\n            $sn    = [System.Text.Encoding]::ASCII.GetString($nameB).Trim([char]0)\n            $vSize = $reader.ReadUInt32(); $vAddr = $reader.ReadUInt32()\n            $rSize = $reader.ReadUInt32(); $rPtr  = $reader.ReadUInt32()\n            $null = $stream.Seek(12, 1); $sChar = $reader.ReadUInt32()\n            $isX = ($sChar -band 0x20000000) -ne 0\n            $isW = ($sChar -band 0x80000000) -ne 0\n            if (($rPtr + $rSize) -gt $highestRawEnd) { $highestRawEnd = $rPtr + $rSize }\n            $sectionMap += @{ VirtAddr=$vAddr; VirtSize=[Math]::Max($vSize,1); RawPtr=$rPtr }\n\n            # Entropie inline berechnen\n            $ent = 0.0\n            if ($rSize -gt 0 -and ($rPtr + $rSize) -le $bytes.Length) {\n                $cnt = @{}\n                for ($x = $rPtr; $x -lt ($rPtr + $rSize); $x++) { $b = $bytes[$x]; $cnt[$b] = $cnt[$b] + 1 }\n                foreach ($k in $cnt.Keys) { $p = $cnt[$k] / $rSize; $ent -= $p * [Math]::Log($p, 2) }\n                $ent = [Math]::Round($ent, 2)\n            }\n\n            $fl = \"\"\n            if ($isW -and $isX) { $fl += \" [ALERT: W+X]\" }\n            if ($packerSections -contains $sn.ToLower()) { $fl += \" [PACKER]\" }\n            $col = if ($fl) { 'Red' } elseif ($ent -gt 7.0) { 'Yellow' } else { 'White' }\n            Write-Host (\"    [{0}] Raw:{1,-8} Virt:{2,-8} Entropie:{3}{4}\" -f $sn.PadRight(8),$rSize,$vSize,$ent,$fl) -ForegroundColor $col\n            if ($rSize -eq 0 -and $vSize -gt 0) { Write-Host \"      [!] 0 Bytes auf Platte, $vSize im RAM (Loader/Unpacker)\" -ForegroundColor Yellow }\n            if ($sn -eq '.text' -and $ent -gt 7.0) { Write-Host \"      [!] .text Entropie $ent/8.0 - Code verschluesselt oder gepackt!\" -ForegroundColor Red }\n        }\n\n        # Phase 4b: Import-Tabelle & DLL-Hijacking-Kandidaten\n        Write-Host \"`n[*] Phase 4b: Import-Tabelle & DLL-Hijacking-Check\" -ForegroundColor Cyan\n        $importDirPos = if ($is64) { $optPos + 120 } else { $optPos + 104 }\n        $null = $stream.Seek($importDirPos, 0)\n        $importRVA  = $reader.ReadUInt32()\n        $importSz   = $reader.ReadUInt32()\n\n        if ($importRVA -eq 0 -or $importSz -eq 0) {\n            Write-Host \"    Keine Import-Tabelle vorhanden.\" -ForegroundColor DarkGray\n        } else {\n            # RVA -> Datei-Offset\n            $importOff = -1L\n            foreach ($s in $sectionMap) {\n                if ($importRVA -ge $s.VirtAddr -and $importRVA -lt ($s.VirtAddr + $s.VirtSize)) {\n                    $importOff = [int64]($importRVA - $s.VirtAddr + $s.RawPtr); break\n                }\n            }\n\n            if ($importOff -lt 0) {\n                Write-Host \"    Import-Tabelle nicht mappbar (gepackt?).\" -ForegroundColor Yellow\n            } else {\n                $importedDLLs = @()\n                $pos = [int64]$importOff\n                while ($pos + 20 -le $bytes.Length) {\n                    $nameRVA = [BitConverter]::ToUInt32($bytes, $pos + 12)\n                    if ($nameRVA -eq 0) { break }\n                    $nameOff = -1L\n                    foreach ($s in $sectionMap) {\n                        if ($nameRVA -ge $s.VirtAddr -and $nameRVA -lt ($s.VirtAddr + $s.VirtSize)) {\n                            $nameOff = [int64]($nameRVA - $s.VirtAddr + $s.RawPtr); break\n                        }\n                    }\n                    if ($nameOff -ge 0) {\n                        $sb = [System.Text.StringBuilder]::new()\n                        $nx = [int64]$nameOff\n                        while ($nx -lt $bytes.Length -and $bytes[$nx] -ne 0) { $null = $sb.Append([char]$bytes[$nx]); $nx++ }\n                        $dn = $sb.ToString()\n                        if ($dn -match '(?i)\\.dll$') { $importedDLLs += $dn }\n                    }\n                    $pos += 20\n                }\n\n                Write-Host \"    Importierte DLLs: $($importedDLLs.Count)\"\n                $parentDir = Split-Path $ziel -Parent\n                $hijackFound = $false\n                foreach ($dll in $importedDLLs) {\n                    $sameDir = Join-Path $parentDir $dll\n                    if (Test-Path $sameDir) {\n                        $dllSig = Get-AuthenticodeSignature $sameDir -ErrorAction SilentlyContinue\n                        $dllStatus = if ($dllSig) { $dllSig.Status } else { 'Unbekannt' }\n                        $dllColor = if ($dllStatus -eq 'Valid') { 'Yellow' } else { 'Red' }\n                        Write-Host (\"    [!] HIJACK-KANDIDAT: {0}\" -f $dll) -ForegroundColor $dllColor\n                        Write-Host (\"        Pfad: {0}\" -f $sameDir) -ForegroundColor $dllColor\n                        Write-Host (\"        Signatur: {0}\" -f $dllStatus) -ForegroundColor $dllColor\n                        $hijackFound = $true\n                    }\n                }\n                if (-not $hijackFound) {\n                    Write-Host \"    Keine gleichnamigen DLLs im selben Ordner.\" -ForegroundColor Green\n                }\n            }\n        }\n        } # Ende else parserValid\n\n        # Phase 5: Overlay & eingebettete PEs\n        Write-Host \"`n[*] Phase 5: Overlay & eingebettete PE-Dateien\" -ForegroundColor Cyan\n        if ($bytes.Length -gt $highestRawEnd -and $highestRawEnd -gt 0) {\n            $ovSize = $bytes.Length - $highestRawEnd\n            $cnt2 = @{}\n            for ($x = $highestRawEnd; $x -lt $bytes.Length; $x++) { $b=$bytes[$x]; $cnt2[$b]=$cnt2[$b]+1 }\n            $oe = 0.0\n            foreach ($k in $cnt2.Keys) { $p=$cnt2[$k]/$ovSize; $oe -= $p*[Math]::Log($p,2) }\n            Write-Host \"    [!] OVERLAY: $ovSize Bytes angehaengt (Entropie $([Math]::Round($oe,2))/8.0)\" -ForegroundColor Red\n        } else { Write-Host \"    Kein Overlay.\" -ForegroundColor Green }\n\n        $embN = 0\n        for ($j = 64; $j -lt ($bytes.Length - 1024); $j += 4) {\n            if ($bytes[$j] -eq 0x4D -and $bytes[$j+1] -eq 0x5A) {\n                $lf = [BitConverter]::ToUInt32($bytes, $j + 0x3C)\n                if ($lf -gt 0 -and ($j+$lf+4) -lt $bytes.Length -and $bytes[$j+$lf] -eq 0x50 -and $bytes[$j+$lf+1] -eq 0x45) {\n                    Write-Host \"    [!] Eingebettetes PE bei Offset 0x$($j.ToString('X')) (Dropper/Payload?)\" -ForegroundColor Red\n                    $embN++\n                }\n            }\n        }\n        if ($embN -eq 0) { Write-Host \"    Keine eingebetteten PE-Dateien.\" -ForegroundColor Green }\n\n    } finally { $reader.Close() }\n\n    # Phase 6: PDB-Pfad\n    Write-Host \"`n[*] Phase 6: Debug-Informationen (PDB-Pfad)\" -ForegroundColor Cyan\n    $pdb = $null\n    for ($i = 0; $i -lt ($bytes.Length - 28); $i++) {\n        if ($bytes[$i] -eq 0x52 -and $bytes[$i+1] -eq 0x53 -and $bytes[$i+2] -eq 0x44 -and $bytes[$i+3] -eq 0x53) {\n            $ss = $i + 24; $se = $ss\n            while ($se -lt $bytes.Length -and $bytes[$se] -ne 0) { $se++ }\n            if ($se -gt $ss) {\n                $p = [System.Text.Encoding]::UTF8.GetString($bytes, $ss, $se-$ss)\n                if ($p -match '(?i)\\.pdb$') { $pdb = $p; break }\n            }\n        }\n    }\n    if (-not $pdb) {\n        $ra = [System.Text.Encoding]::ASCII.GetString($bytes)\n        if ($ra -match '([a-zA-Z]:\\\\[^\\x00-\\x1F\\x7F-\\xFF]+\\.pdb)') { $pdb = $matches[1] }\n    }\n    if ($pdb) {\n        Write-Host \"    Build-Pfad: $pdb\"\n        if ($pdb -match '(?i)(cheat|inject|hook|hack|aim|esp|driver|bypass)') {\n            Write-Host \"    [!] ALERT: Verdaechtiges Keyword im Build-Pfad!\" -ForegroundColor Red\n        }\n    } else { Write-Host \"    PDB: Nicht gefunden oder gestrippt.\" -ForegroundColor DarkGray }\n\n    # Phase 7: High-Risk APIs & Cheat-Keywords\n    Write-Host \"`n[*] Phase 7: High-Risk APIs & Cheat-Keywords\" -ForegroundColor Cyan\n    $rawAscii = [System.Text.Encoding]::ASCII.GetString($bytes)\n    $apiTreffer = $false\n    foreach ($cat in $dangerousAPIs.Keys) {\n        $matched = @($dangerousAPIs[$cat] | Where-Object { $rawAscii -match [regex]::Escape($_) })\n        if ($matched.Count -gt 0) {\n            Write-Host \"    [!] $cat ($($matched.Count)): $($matched -join ', ')\" -ForegroundColor Red\n            $apiTreffer = $true\n        }\n    }\n    if (-not $apiTreffer) { Write-Host \"    Keine gefaehrlichen APIs im Klartext.\" -ForegroundColor Green }\n\n    $foundKW = @($suspiciousStrings | Where-Object { $rawAscii -match [regex]::Escape($_) })\n    $foundKW += @($suspiciousStringsWB | Where-Object { $rawAscii -match \"\\b$([regex]::Escape($_))\\b\" })\n    $foundKW = $foundKW | Select-Object -Unique\n    if ($foundKW.Count -gt 0) {\n        Write-Host \"    [!] Verdaechtige Keywords: $($foundKW -join ', ')\" -ForegroundColor Red\n    } else { Write-Host \"    Keine Cheat-Keywords im Klartext.\" -ForegroundColor Green }\n\n    Write-Host \"`n$('=' * 70)\" -ForegroundColor DarkGray\n    Write-Host \"Scan abgeschlossen: $dateiname\" -ForegroundColor Cyan\n    Write-Host \"Hinweis: Ergebnis wird im aktiven Transcript gesichert (Menue P).\" -ForegroundColor DarkGray\n    Write-Host \"Fuer groessere Dateien (.sys/.exe) empfiehlt sich zusaetzlich VirusTotal.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  13 - DLL Hijacking Live-Check (laufende Prozesse)\n# ============================================================\nfunction Invoke-DLLHijackCheck {\n    Write-Host \"`n=== DLL Hijacking Live-Check ===\" -ForegroundColor Cyan\n    Write-Host \"(Pr\u00c3\u00bcft laufende Prozesse auf Module aus unerwarteten Pfaden)\" -ForegroundColor DarkGray\n\n    # Pfade die als legitim gelten\n    $okPfade = @(\n        \"$env:SystemRoot\\\",\n        \"$env:ProgramFiles\\\",\n        \"${env:ProgramFiles(x86)}\\\",\n        \"$env:ProgramData\\Microsoft\\\"\n    )\n\n    Write-Host \"`n--- Module aus unerwarteten Pfaden ---\" -ForegroundColor DarkGray\n    $treffer = @()\n\n    Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Path } | ForEach-Object {\n        $proc    = $_\n        $procDir = (Split-Path $proc.Path -Parent).ToLower().TrimEnd('\\') + '\\'\n        try {\n            $proc.Modules | Where-Object { $_.FileName -and $_.FileName -notmatch '(?i)\\.(node|ocx|cpl|ax)$' } | ForEach-Object {\n                $modPath = $_.FileName\n                $modPathL = $modPath.ToLower()\n                $istOK = ($okPfade | Where-Object { $modPathL.StartsWith($_.ToLower()) }) -or\n                         $modPathL.StartsWith($procDir)\n                if (-not $istOK) {\n                    $sig = Get-AuthenticodeSignature $modPath -ErrorAction SilentlyContinue\n                    $status = if ($sig) { $sig.Status } else { 'Unbekannt' }\n                    $treffer += [PSCustomObject]@{\n                        Prozess  = $proc.Name\n                        PID      = $proc.Id\n                        Modul    = $_.ModuleName\n                        Pfad     = $modPath\n                        Signatur = $status\n                    }\n                }\n            }\n        } catch {}\n    }\n\n    if ($treffer.Count -gt 0) {\n        # Unsignierte zuerst\n        $treffer | Sort-Object Signatur, Prozess | ForEach-Object {\n            $col = if ($_.Signatur -eq 'Valid') { 'Yellow' } else { 'Red' }\n            Write-Host (\"`n  [{0}] PID {1}\" -f $_.Prozess, $_.PID) -ForegroundColor $col\n            Write-Host (\"  Modul : {0}\" -f $_.Modul) -ForegroundColor $col\n            Write-Host (\"  Pfad  : {0}\" -f $_.Pfad) -ForegroundColor $col\n            Write-Host (\"  Sig   : {0}\" -f $_.Signatur) -ForegroundColor $col\n        }\n        $unsigned = @($treffer | Where-Object { $_.Signatur -ne 'Valid' })\n        Write-Host \"`n$($treffer.Count) Treffer gesamt, davon $($unsigned.Count) nicht gueltig signiert.\" -ForegroundColor $(if($unsigned.Count -gt 0){'Red'}else{'Yellow'})\n    } else {\n        Write-Host \"Keine auffaelligen Module gefunden.\" -ForegroundColor Green\n    }\n\n    # Spielprozesse gezielt pruefen\n    Write-Host \"`n--- Spielprozesse gezielt pruefen ---\" -ForegroundColor DarkGray\n    $spielNamen = @('FiveM','FiveM_GTAProcess','GTA5','RageMP','altv','RedM','cfx')\n    $spielProcs = @(Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -match ($spielNamen -join '|') })\n    if ($spielProcs.Count -gt 0) {\n        foreach ($sp in $spielProcs) {\n            Write-Host \"`n  Prozess: $($sp.Name) (PID $($sp.Id))\" -ForegroundColor Yellow\n            try {\n                $sp.Modules | Where-Object { $_.FileName } | ForEach-Object {\n                    $sig = Get-AuthenticodeSignature $_.FileName -ErrorAction SilentlyContinue\n                    $status = if ($sig) { $sig.Status } else { 'Unbekannt' }\n                    if ($status -ne 'Valid') {\n                        Write-Host (\"  [!] Unsigniert: {0}\" -f $_.FileName) -ForegroundColor Red\n                    }\n                }\n            } catch {\n                Write-Host \"  Zugriff auf Module verweigert (Adminrechte noetig).\" -ForegroundColor Yellow\n            }\n        }\n    } else {\n        Write-Host \"Keine FiveM/GTA-Prozesse laufend.\" -ForegroundColor DarkGray\n    }\n\n    Write-Host \"`nHinweis: Gelb = signiert aber ungewoehnlicher Pfad.\" -ForegroundColor DarkGray\n    Write-Host \"         Rot  = unsigniert oder Signatur ungueltig = Befund pruefen.\" -ForegroundColor DarkGray\n    Write-Host \"Fuer Live-Analyse laufender Injektion: Sysinternals Process Monitor empfohlen.\" -ForegroundColor DarkGray\n\n    # --- Bekannte DLL-Hijacking-Zielordner ---\n    Write-Host \"`n--- Bekannte Hijacking-Zielordner (wbem, Tasks, Sysprep...) ---\" -ForegroundColor DarkGray\n\n    # Bekannte Ziel-DLLs fuer wbem-Hijacking (aus realen Faellen)\n    # PHANTOM = diese Dateien existieren auf normalem Windows NICHT in wbem\n    # Ihr blo\u00c3\u0178es Vorhandensein ist bereits verdaechtig - Signatur egal\n    $wbemPhantom = @(\n        'WptsExtensions.dll',   # Phantom-DLL - existiert nie in wbem (Trojan.Yogi u.a.)\n        'WaasMedicSvc.dll',     # Phantom-DLL - gehoert nicht in wbem\n        'wlbsctrl.dll'          # Phantom-DLL - IKEEXT-Hijacking-Ziel\n    )\n    $wbemTargets = @(\n        'msdtcprx.dll',\n        'wmicmiplugin.dll',\n        'wbemcomn.dll'\n    )\n\n    $hijackOrdner = @{\n        'wbem'    = 'C:\\Windows\\System32\\wbem'\n        'Tasks'   = 'C:\\Windows\\System32\\Tasks'\n        'Sysprep' = 'C:\\Windows\\System32\\Sysprep'\n        'Spool'   = 'C:\\Windows\\System32\\spool\\drivers\\x64\\3'\n    }\n\n    $hijackFund = $false\n    foreach ($name in $hijackOrdner.Keys) {\n        $ordner = $hijackOrdner[$name]\n        if (-not (Test-Path $ordner)) { continue }\n\n        $dlls = @(Get-ChildItem $ordner -Filter '*.dll' -ErrorAction SilentlyContinue)\n        if ($dlls.Count -eq 0) { continue }\n\n        Write-Host \"`n  [$name] $ordner\" -ForegroundColor DarkGray\n        foreach ($f in $dlls) {\n            $sig = Get-AuthenticodeSignature $f.FullName -ErrorAction SilentlyContinue\n            $status = if ($sig) { $sig.Status } else { 'Unbekannt' }\n            $signierer = if ($sig -and $sig.SignerCertificate) {\n                $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1'\n            } else { '-' }\n\n            $istMS      = $signierer -match '(?i)Microsoft'\n            $istPhantom = $wbemPhantom -contains $f.Name\n            $istTarget  = $wbemTargets -contains $f.Name\n            $istVerd    = (-not $istMS) -or ($status -ne 'Valid')\n\n            if ($istPhantom) {\n                # Phantom-DLLs sind immer ein Befund - egal ob signiert\n                $col = 'Red'\n                Write-Host (\"    [!!!] PHANTOM-DLL: {0} | Sig: {1} | {2}\" -f $f.Name, $status, $signierer) -ForegroundColor $col\n                Write-Host (\"          Diese Datei gehoert NICHT in diesen Ordner - Hijacking-Beweis!\" ) -ForegroundColor $col\n                $hijackFound = $true\n            } elseif ($istVerd -or $istTarget) {\n                $col = if ($status -ne 'Valid' -or -not $istMS) { 'Red' } else { 'Yellow' }\n                $hinweis = if ($istTarget -and -not $istMS) { ' [BEKANNTES HIJACK-ZIEL + FREMD]' } elseif ($istTarget) { ' [BEKANNTES HIJACK-ZIEL]' } else { '' }\n                Write-Host (\"    [!] {0} | Sig: {1} | {2}{3}\" -f $f.Name, $status, $signierer, $hinweis) -ForegroundColor $col\n                $hijackFund = $true\n            }\n        }\n    }\n\n    if (-not $hijackFund) {\n        Write-Host \"  Keine auffaelligen DLLs in Hijacking-Zielordnern.\" -ForegroundColor Green\n    }\n\n    # --- setupapi.dev.log auf USB-Spuren pruefen ---\n    Write-Host \"`n--- SetupAPI: USB-Cheat-Lader-Spuren ---\" -ForegroundColor DarkGray\n    $setupLog = 'C:\\Windows\\INF\\setupapi.dev.log'\n    if (Test-Path $setupLog) {\n        $hits = @(Select-String -Path $setupLog -Pattern 'setupplatform|cheat|hack|bypass|inject|loader|DMASetup|dma_setup' -ErrorAction SilentlyContinue)\n        if ($hits.Count -gt 0) {\n            Write-Host \"  [!] Verdaechtige Begriffe in setupapi.dev.log:\" -ForegroundColor Red\n            $hits | Select-Object -First 20 | ForEach-Object { Write-Host \"    $($_.Line.Trim())\" -ForegroundColor Red }\n        } else {\n            Write-Host \"  Keine verdaechtigen Cheat-Begriffe in setupapi.dev.log.\" -ForegroundColor Green\n        }\n        # Datei-Zeitstempel: frisch erstellt nach Windows-Installation?\n        $f = Get-Item $setupLog\n        $os2 = Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue\n        if ($os2 -and $f.CreationTime -gt $os2.InstallDate.AddDays(7)) {\n            Write-Host \"  [!] setupapi.dev.log wurde deutlich nach Windows-Installation erstellt - moeglicherweise neu angelegt (Spurverwischung).\" -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"  setupapi.dev.log fehlt - Datei koennte geloescht worden sein.\" -ForegroundColor Red\n    }\n}\n\n# ============================================================\n#  14 - Systemprozesse & Registry-Injection-Vektoren\n# ============================================================\nfunction Invoke-SystemProcessCheck {\n    Write-Host \"`n=== Systemprozesse & Injection-Vektoren ===\" -ForegroundColor Cyan\n    Write-Host \"(Pr\u00c3\u00bcft kritische Prozesse auf fremde Module + Registry-Einstiegspunkte)\" -ForegroundColor DarkGray\n\n    # --- 14a: Kritische Systemprozesse auf nicht-Microsoft-Module ---\n    Write-Host \"`n--- Fremde Module in Systemprozessen ---\" -ForegroundColor DarkGray\n    $kritisch = @('svchost','lsass','winlogon','services','spoolsv','wininit',\n                  'csrss','explorer','lsm','dllhost','dwm','ctfmon','taskhostw',\n                  'msdtc','audiodg','SearchIndexer','WmiPrvSE')\n\n    # Bekannte legitime Dritt-Hersteller die in Systemprozesse laden duerfen\n    $vertrauenswuerdig = @(\n        'Malwarebytes','NVIDIA','Adobe','Intel Corporation','Advanced Micro Devices',\n        'Logitech','Razer','SteelSeries','Corsair','ASUS','MSI','Gigabyte',\n        'Realtek','Qualcomm','Broadcom','Apple','Google','Dropbox','OneDrive'\n    )\n    # Geschuetzte Prozesse bei denen leere Module normal sind (PPL)\n    $geschuetzt = @('lsass','csrss','wininit','services','smss','MsMpEng')\n\n    $systemFund = $false\n    foreach ($pName in $kritisch) {\n        $procs = @(Get-Process -Name $pName -ErrorAction SilentlyContinue)\n        foreach ($proc in $procs) {\n            try {\n                $fremd   = @()\n                $pathlos = @()\n                $proc.Modules | ForEach-Object {\n                    # Nur Module MIT Namen aber OHNE Pfad = Reflective Injection Kandidat\n                    # Leere Eintraege ohne Namen = Enumerierungs-Artefakt, kein Fund\n                    if ($_.ModuleName -and -not $_.FileName) {\n                        if ($geschuetzt -notcontains $pName) {\n                            $pathlos += $_.ModuleName\n                        }\n                        return\n                    }\n                    if (-not $_.FileName) { return }\n\n                    $sig = Get-AuthenticodeSignature $_.FileName -ErrorAction SilentlyContinue\n                    $istMS = $sig -and $sig.Status -eq 'Valid' -and\n                             $sig.SignerCertificate -and\n                             $sig.SignerCertificate.Subject -match '(?i)Microsoft'\n                    if (-not $istMS) {\n                        $status = if ($sig) { $sig.Status } else { 'Unbekannt' }\n                        $sign   = if ($sig -and $sig.SignerCertificate) {\n                            $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1'\n                        } else { 'Nicht signiert' }\n                        # Bekannte legitime Hersteller: grau, nicht rot\n                        $istBekannt = $vertrauenswuerdig | Where-Object { $sign -match [regex]::Escape($_) }\n                        $fremd += [PSCustomObject]@{\n                            Modul    = $_.ModuleName\n                            Pfad     = $_.FileName\n                            Sig      = $status\n                            Signierer= $sign\n                            Bekannt  = [bool]$istBekannt\n                        }\n                    }\n                }\n\n                # Nur ausgeben wenn wirklich verdaechtig (unbekannt/unsigniert ODER pathlos)\n                $echteWarnungen = @($fremd | Where-Object { -not $_.Bekannt -or $_.Sig -ne 'Valid' })\n                $bekannteListe  = @($fremd | Where-Object { $_.Bekannt -and $_.Sig -eq 'Valid' })\n\n                if ($echteWarnungen.Count -gt 0 -or $pathlos.Count -gt 0) {\n                    Write-Host (\"`n  [{0}] PID {1}\" -f $proc.Name, $proc.Id) -ForegroundColor Red\n                    $systemFund = $true\n                    foreach ($m in $echteWarnungen) {\n                        $col = if ($m.Sig -ne 'Valid') { 'Red' } else { 'Yellow' }\n                        Write-Host (\"    [!] {0}\" -f $m.Modul) -ForegroundColor $col\n                        Write-Host (\"        Pfad     : {0}\" -f $m.Pfad) -ForegroundColor $col\n                        Write-Host (\"        Sig      : {0} | {1}\" -f $m.Sig, $m.Signierer) -ForegroundColor $col\n                    }\n                    foreach ($m in $pathlos) {\n                        Write-Host (\"    [!!!] Modul ohne Dateipfad: $m (Reflective Injection?)\" ) -ForegroundColor Red\n                    }\n                }\n                if ($bekannteListe.Count -gt 0) {\n                    Write-Host (\"`n  [{0}] PID {1} - bekannte Dritt-Software ({2} Module):\" -f $proc.Name, $proc.Id, $bekannteListe.Count) -ForegroundColor DarkGray\n                    $bekannteListe | ForEach-Object { Write-Host (\"    $($_.Modul) | $($_.Signierer)\") -ForegroundColor DarkGray }\n                }\n            } catch {\n                if ($geschuetzt -notcontains $pName) {\n                    Write-Host (\"  [{0}] PID {1} - Zugriff verweigert\" -f $pName, $proc.Id) -ForegroundColor DarkGray\n                }\n            }\n        }\n    }\n    if (-not $systemFund) {\n        Write-Host \"Alle geprueften Systemprozesse: nur Microsoft-signierte Module.\" -ForegroundColor Green\n    }\n\n    # --- 14b: AppInit_DLLs ---\n    Write-Host \"`n--- AppInit_DLLs (laedt in JEDEN Prozess mit user32.dll) ---\" -ForegroundColor DarkGray\n    $appInitKeys = @(\n        'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows',\n        'HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows'\n    )\n    foreach ($k in $appInitKeys) {\n        if (Test-Path $k) {\n            $val = (Get-ItemProperty $k -ErrorAction SilentlyContinue).AppInit_DLLs\n            $load = (Get-ItemProperty $k -ErrorAction SilentlyContinue).LoadAppInit_DLLs\n            if ($val -and $val.Trim()) {\n                Write-Host \"  [!!!] AppInit_DLLs GESETZT: $val\" -ForegroundColor Red\n                Write-Host \"        LoadAppInit_DLLs: $load\" -ForegroundColor Red\n            } else {\n                Write-Host \"  $k : Leer (gut).\" -ForegroundColor Green\n            }\n        }\n    }\n\n    # --- 14c: Winlogon Injection (Shell, Userinit, Notify) ---\n    Write-Host \"`n--- Winlogon Injection-Vektoren ---\" -ForegroundColor DarkGray\n    $wlKey = 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon'\n    if (Test-Path $wlKey) {\n        $wl = Get-ItemProperty $wlKey -ErrorAction SilentlyContinue\n        # Shell sollte nur explorer.exe sein\n        if ($wl.Shell -and $wl.Shell -notmatch '^explorer\\.exe$') {\n            Write-Host \"  [!] Shell != explorer.exe: $($wl.Shell)\" -ForegroundColor Red\n        } else { Write-Host \"  Shell     : $($wl.Shell) (OK)\" -ForegroundColor Green }\n        # Userinit\n        if ($wl.Userinit -and $wl.Userinit -notmatch 'userinit\\.exe') {\n            Write-Host \"  [!] Userinit auffaellig: $($wl.Userinit)\" -ForegroundColor Red\n        } else { Write-Host \"  Userinit  : $($wl.Userinit) (OK)\" -ForegroundColor Green }\n    }\n\n    # --- 14d: LSA Security Packages ---\n    Write-Host \"`n--- LSA Authentication & Security Packages ---\" -ForegroundColor DarkGray\n    $lsaKey = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa'\n    if (Test-Path $lsaKey) {\n        $lsa = Get-ItemProperty $lsaKey -ErrorAction SilentlyContinue\n        $authPkg = $lsa.'Authentication Packages'\n        $secPkg  = $lsa.'Security Packages'\n        $notifPkg= $lsa.'Notification Packages'\n        $standard = @('msv1_0','','scecli')\n        foreach ($pkg in $authPkg) {\n            if ($pkg -and $standard -notcontains $pkg.ToLower()) {\n                Write-Host \"  [!] Unbekanntes Auth-Package: $pkg\" -ForegroundColor Red\n            }\n        }\n        Write-Host \"  Auth-Packages  : $($authPkg -join ', ')\"\n        Write-Host \"  Sec-Packages   : $($secPkg -join ', ')\"\n        Write-Host \"  Notify-Packages: $($notifPkg -join ', ')\"\n    }\n\n    # --- 14e: Dienste mit DLL in ungewoehnlichem Pfad ---\n    Write-Host \"`n--- Dienst-DLLs ausserhalb von System32/SysWOW64 ---\" -ForegroundColor DarkGray\n    $dienste = Get-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\*' -ErrorAction SilentlyContinue |\n        Where-Object { $_.ImagePath -like '*svchost*' }\n    $fremdDienst = $false\n    foreach ($svc in $dienste) {\n        $param = $svc.PSPath -replace 'Registry::',''\n        $paramKey = $param + '\\Parameters'\n        if (Test-Path \"Registry::$paramKey\") {\n            $dll = (Get-ItemProperty \"Registry::$paramKey\" -ErrorAction SilentlyContinue).ServiceDll\n            if ($dll -and $dll -notmatch '(?i)^(%SystemRoot%|C:\\\\Windows)\\\\(System32|SysWOW64)\\\\') {\n                Write-Host (\"  [!] Dienst '{0}' laedt DLL aus ungewoehnlichem Pfad:\" -f $svc.PSChildName) -ForegroundColor Red\n                Write-Host (\"      $dll\") -ForegroundColor Red\n                $sig = Get-AuthenticodeSignature ($dll -replace '%SystemRoot%',$env:SystemRoot) -ErrorAction SilentlyContinue\n                if ($sig) { Write-Host (\"      Sig: {0}\" -f $sig.Status) -ForegroundColor Red }\n                $fremdDienst = $true\n            }\n        }\n    }\n    if (-not $fremdDienst) { Write-Host \"  Alle Dienst-DLLs in erwarteten Systempfaden.\" -ForegroundColor Green }\n\n    Write-Host \"`nHinweis: lsass-Module sind ohne SeDebugPrivilege oft nicht lesbar.\" -ForegroundColor DarkGray\n    Write-Host \"Fuer Kernel-Level-Injection (DKOM, direkte Speichermanipulation):\" -ForegroundColor DarkGray\n    Write-Host \"PowerShell reicht nicht aus - da braucht es WinPmem oder Volatility.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  15 - HVCI / Memory Integrity & Code Integrity Treiber-Check\n# ============================================================\nfunction Invoke-HVCICheck {\n    Write-Host \"`n=== HVCI / Memory Integrity & Inkompatible Treiber ===\" -ForegroundColor Cyan\n    Write-Host \"(Deaktivierte Speicherintegritaet + geblockte Kernel-Treiber = DMA-Indiz)\" -ForegroundColor DarkGray\n\n    # --- 15a: HVCI-Status ---\n    Write-Host \"`n--- Memory Integrity (HVCI) Status ---\" -ForegroundColor DarkGray\n    $hvciKey = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity'\n    $vbsKey  = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard'\n    $hvciAktiv = $false\n\n    if (Test-Path $hvciKey) {\n        $hvci = Get-ItemProperty $hvciKey -ErrorAction SilentlyContinue\n        $hvciAktiv = $hvci.Enabled -eq 1\n        $col = if ($hvciAktiv) { 'Green' } else { 'Red' }\n        Write-Host (\"  HVCI (Speicherintegritaet) : {0}\" -f $(if($hvciAktiv){'AKTIV'}else{'DEAKTIVIERT [!]'})) -ForegroundColor $col\n        if (-not $hvciAktiv) {\n            Write-Host \"  --> Inkompatible Treiber koennen in den Kernel geladen werden.\" -ForegroundColor Yellow\n            Write-Host \"      DMA-Karten mit schwach signierten Treibern nutzen genau das.\" -ForegroundColor Yellow\n            Write-Host \"  Manuell pruefen: Windows-Sicherheit \u00e2\u2020\u2019 Geraetesicherheit \u00e2\u2020\u2019 Kernisolierung\" -ForegroundColor DarkGray\n        }\n    } else {\n        Write-Host \"  HVCI-Key nicht gefunden - VBS moeglicherweise nicht konfiguriert.\" -ForegroundColor Yellow\n    }\n\n    if (Test-Path $vbsKey) {\n        $vbs = Get-ItemProperty $vbsKey -ErrorAction SilentlyContinue\n        $vbsAktiv = $vbs.EnableVirtualizationBasedSecurity -eq 1\n        Write-Host (\"  VBS (Virt. Based Security)  : {0}\" -f $(if($vbsAktiv){'AKTIV'}else{'DEAKTIVIERT'})) -ForegroundColor $(if($vbsAktiv){'Green'}else{'Yellow'})\n    }\n\n    # Secure Boot\n    try {\n        $sb = Confirm-SecureBootUEFI -ErrorAction Stop\n        Write-Host (\"  Secure Boot                 : {0}\" -f $(if($sb){'AKTIV'}else{'DEAKTIVIERT [!]'})) -ForegroundColor $(if($sb){'Green'}else{'Red'})\n    } catch {\n        Write-Host \"  Secure Boot                 : Nicht abfragbar (Legacy BIOS oder kein UEFI)\" -ForegroundColor Yellow\n    }\n\n    # --- 15b: Code Integrity Log - geblockte Treiber ---\n    Write-Host \"`n--- Code Integrity: geblockte / abgelehnte Treiber ---\" -ForegroundColor DarkGray\n    Write-Host \"(Event 3033 = geblockt | 3034 = Boot-Treiber | 3076 = Audit | 3077 = Prozess)\" -ForegroundColor DarkGray\n\n    $ciEvents = @(Get-WinEvent -FilterHashtable @{\n        LogName = 'Microsoft-Windows-CodeIntegrity/Operational'\n        Id      = 3033, 3034, 3076, 3077\n    } -MaxEvents 100 -ErrorAction SilentlyContinue)\n\n    # Bekannte legitime Security-DLLs die bei HVCI haeufig 3033 ausloesen\n    $ciWhitelist = @('mbae64\\.dll','mbae\\.dll','mbamswissarmy','MBAMSwissArmy',\n                     'mbamsi64\\.dll','mbamsi\\.dll','mbamupdatetool',\n                     'hmpalert','hmpalert64','CrExigency','sophos','mbae')\n\n    if ($ciEvents.Count -gt 0) {\n        $ciGefiltert = @($ciEvents | Where-Object {\n            $msg = $_.Message\n            -not ($ciWhitelist | Where-Object { $msg -match $_ })\n        })\n        $ciGefiltert_kurz = @($ciEvents | Where-Object {\n            $msg = $_.Message\n            ($ciWhitelist | Where-Object { $msg -match $_ })\n        })\n\n        if ($ciGefiltert_kurz.Count -gt 0) {\n            Write-Host \"  (Herausgefiltert: $($ciGefiltert_kurz.Count)x bekannte Security-Software wie Malwarebytes Anti-Exploit)\" -ForegroundColor DarkGray\n        }\n\n        if ($ciGefiltert.Count -gt 0) {\n            Write-Host \"  $($ciGefiltert.Count) relevante Ereignisse:\" -ForegroundColor Red\n            $ciGefiltert | Sort-Object TimeCreated -Descending | Select-Object -First 20 | ForEach-Object {\n                $eid = $_.Id\n                $col = if ($eid -in @(3033,3034)) { 'Red' } else { 'Yellow' }\n                $msg = ($_.Message -replace '\\s+',' ')\n                $datei = if ($msg -match '\\\\([^\\\\]+\\.sys|[^\\\\]+\\.dll)') { $matches[1] } else { '' }\n                Write-Host (\"`n  [{0}] EID {1}\" -f $_.TimeCreated, $eid) -ForegroundColor $col\n                if ($datei) { Write-Host (\"  Treiber : {0}\" -f $datei) -ForegroundColor $col }\n                Write-Host (\"  Details : {0}...\" -f $msg.Substring(0, [Math]::Min(160, $msg.Length))) -ForegroundColor DarkGray\n            }\n        } else {\n            Write-Host \"  Keine unbekannten geblockten Treiber - nur bekannte Security-Software.\" -ForegroundColor Green\n        }\n    } else {\n        Write-Host \"  Keine geblockten Treiber im Code Integrity Log.\" -ForegroundColor Green\n        if ($hvciAktiv) {\n            Write-Host \"  (HVCI aktiv = Treiber werden gar nicht erst geladen - das ist gut)\" -ForegroundColor DarkGray\n        }\n    }\n\n    # --- 15c: bcdedit - Testsigning und Integritaets-Bypass ---\n    Write-Host \"`n--- Boot-Konfiguration: Testsigning & Integrity-Checks ---\" -ForegroundColor DarkGray\n    $bcd = & bcdedit /enum 2>&1 | Out-String\n    $testsigning = $bcd -match 'testsigning\\s+yes'\n    $nointegrity = $bcd -match 'nointegritychecks\\s+yes'\n    $dbgmode     = $bcd -match 'debug\\s+yes'\n\n    Write-Host (\"  Testsigning        : {0}\" -f $(if($testsigning){'[!!!] AKTIV - unsignierte Treiber erlaubt!'}else{'Deaktiviert (OK)'})) -ForegroundColor $(if($testsigning){'Red'}else{'Green'})\n    Write-Host (\"  NoIntegrityChecks  : {0}\" -f $(if($nointegrity){'[!!!] AKTIV - Integritaetspruefung umgangen!'}else{'Deaktiviert (OK)'})) -ForegroundColor $(if($nointegrity){'Red'}else{'Green'})\n    Write-Host (\"  Debug-Modus        : {0}\" -f $(if($dbgmode){'[!] Aktiv'}else{'Deaktiviert (OK)'})) -ForegroundColor $(if($dbgmode){'Yellow'}else{'Green'})\n\n    if ($testsigning -or $nointegrity) {\n        Write-Host \"`n  [!!!] Treibersignaturen sind aktiv umgangen.\" -ForegroundColor Red\n        Write-Host \"        Jeder beliebige unsignierte Kernel-Treiber kann geladen werden.\" -ForegroundColor Red\n        Write-Host \"        Das ist eine Grundvoraussetzung vieler DMA- und Cheat-Treiber.\" -ForegroundColor Red\n    }\n\n    # --- 15d: Inkompatible Treiber aus pnputil (ergaenzt HVCI-Liste) ---\n    Write-Host \"`n--- Installierte Treiber ohne gueltige WHQL-Signatur ---\" -ForegroundColor DarkGray\n    Write-Host \"(Diese wuerden die HVCI-Aktivierung verhindern)\" -ForegroundColor DarkGray\n    try {\n        $pnpOut = & pnputil /enum-drivers 2>&1 | Out-String\n        $bloecke = $pnpOut -split '(?=Veroeffentlichter Name|Published Name)'\n        $verdaechtig = @($bloecke | Where-Object {\n            $_ -match 'Nicht signiert|Not Signed|Unsigned' -or\n            ($_ -match '(Signierer|Signer)\\s*:' -and $_ -notmatch '(?i)Microsoft|WHQL')\n        })\n        if ($verdaechtig.Count -gt 0) {\n            Write-Host \"  [!] $($verdaechtig.Count) potenziell inkompatible Treiber:\" -ForegroundColor Red\n            $verdaechtig | Select-Object -First 10 | ForEach-Object {\n                $name = if ($_ -match 'oem\\d+\\.inf') { $matches[0] } else { '' }\n                $pub  = if ($_ -match '(?:Herausgeber|Publisher)\\s*:\\s*(.+)') { $matches[1].Trim() } else { '' }\n                if ($name) { Write-Host (\"  {0} | {1}\" -f $name, $pub) -ForegroundColor Yellow }\n            }\n        } else {\n            Write-Host \"  Keine offensichtlich unsignierten Treiber gefunden.\" -ForegroundColor Green\n        }\n    } catch {\n        Write-Host \"  pnputil nicht verfuegbar.\" -ForegroundColor DarkGray\n    }\n\n    Write-Host \"`nFazit-Hilfe:\" -ForegroundColor DarkGray\n    Write-Host \"  Testsigning=Ja + unbekannter Treiber = starker DMA-Hinweis\" -ForegroundColor DarkGray\n    Write-Host \"  HVCI deaktiviert + CI-Events = Treiber wurde installiert und verweigert\" -ForegroundColor DarkGray\n    Write-Host \"  Gut konfigurierte DMA-Karten (echt signiert) erscheinen NICHT im CI-Log\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  16 - System32 Fremdkoerper & Typosquatting-Check\n# ============================================================\nfunction Invoke-System32Check {\n    Write-Host \"`n=== System32 Fremdkoerper & Typosquatting ===\" -ForegroundColor Cyan\n    Write-Host \"(Nicht-Microsoft DLLs + verdaechtige Namen + frische Dateien in System32)\" -ForegroundColor DarkGray\n\n    $sys32 = \"$env:SystemRoot\\System32\"\n    $osInstall = (Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue).InstallDate\n\n    # Bekannte kritische DLL-Namen fuer Typosquatting-Pruefung\n    # Angreifer ersetzen gerne l\u00e2\u2020\u20191, o\u00e2\u2020\u20190, I\u00e2\u2020\u2019l usw.\n    $kritischeDLLs = @(\n        'ntdll','kernel32','kernelbase','user32','advapi32','rpcrt4',\n        'msvcrt','sechost','combase','ucrtbase','win32u','gdi32',\n        'ole32','oleaut32','shell32','shlwapi','wininet','ws2_32',\n        'crypt32','bcrypt','ncrypt','lsasrv','wintrust','wldp'\n    )\n\n    # Bekannte Phantom-DLLs die NIE in System32 gehoeren\n    $system32Phantom = @(\n        'WptsExtensions.dll','WaasMedicSvc.dll','wlbsctrl.dll',\n        'cryptbase2.dll','version2.dll','cryptsp2.dll'\n    )\n\n    Write-Host \"`n--- Nicht-Microsoft DLLs in System32 ---\" -ForegroundColor DarkGray\n    Write-Host \"Scanne... (kann 30-60 Sekunden dauern)\" -ForegroundColor DarkGray\n\n    $fremd   = @()\n    $phantom = @()\n    $frisch  = @()\n    $typo    = @()\n\n    $dlls = @(Get-ChildItem $sys32 -Filter '*.dll' -ErrorAction SilentlyContinue)\n    $total = $dlls.Count\n    $i = 0\n\n    foreach ($f in $dlls) {\n        $i++\n        if ($i % 200 -eq 0) { Write-Host \"  ... $i / $total gepr\u00c3\u00bcft\" -ForegroundColor DarkGray }\n\n        # Phantom-DLL Direkttreffer\n        if ($system32Phantom -contains $f.Name) {\n            $phantom += $f\n            continue\n        }\n\n        # Signaturpruefung - bei gueltigem MS-Zertifikat sofort weiter\n        $sig = Get-AuthenticodeSignature $f.FullName -ErrorAction SilentlyContinue\n        $istMS = $sig -and $sig.Status -eq 'Valid' -and\n                 $sig.SignerCertificate -and\n                 $sig.SignerCertificate.Subject -match '(?i)Microsoft'\n        if ($istMS) { continue }\n\n        $status   = if ($sig) { $sig.Status } else { 'Unbekannt' }\n        $signierer = if ($sig -and $sig.SignerCertificate) {\n            $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1'\n        } else { 'Nicht signiert' }\n\n        $fremd += [PSCustomObject]@{\n            Name      = $f.Name\n            Sig       = $status\n            Signierer = $signierer\n            Erstellt  = $f.CreationTime\n            Groesse   = $f.Length\n        }\n\n        # Frisch nach Windows-Installation erstellt?\n        if ($osInstall -and $f.CreationTime -gt $osInstall.AddDays(30)) {\n            $frisch += $f.Name\n        }\n\n        # Typosquatting-Pruefung\n        $nameBasis = [System.IO.Path]::GetFileNameWithoutExtension($f.Name).ToLower()\n        foreach ($legit in $kritischeDLLs) {\n            if ($nameBasis -ne $legit) {\n                # Levenshtein-Distanz 1 = ein Zeichen anders\n                $dist = 0\n                $a = $nameBasis.ToCharArray()\n                $b = $legit.ToCharArray()\n                if ([Math]::Abs($a.Length - $b.Length) -le 1) {\n                    $diff = 0\n                    $minLen = [Math]::Min($a.Length, $b.Length)\n                    for ($x = 0; $x -lt $minLen; $x++) {\n                        if ($a[$x] -ne $b[$x]) { $diff++ }\n                    }\n                    $diff += [Math]::Abs($a.Length - $b.Length)\n                    if ($diff -le 1) {\n                        $typo += [PSCustomObject]@{ Datei=$f.Name; AehnlichWie=\"$legit.dll\" }\n                    }\n                }\n            }\n        }\n    }\n\n    # --- Ausgabe Phantom ---\n    if ($phantom.Count -gt 0) {\n        Write-Host \"`n  [!!!] PHANTOM-DLLs in System32 (gehoeren NICHT hierher):\" -ForegroundColor Red\n        $phantom | ForEach-Object {\n            $sig2 = Get-AuthenticodeSignature $_.FullName -ErrorAction SilentlyContinue\n            Write-Host (\"  {0} | Sig: {1} | Erstellt: {2}\" -f $_.Name, $(if($sig2){$sig2.Status}else{'Unbekannt'}), $_.CreationTime) -ForegroundColor Red\n        }\n    }\n\n    # --- Ausgabe Fremd ---\n    if ($fremd.Count -gt 0) {\n        Write-Host (\"`n  {0} nicht-Microsoft DLLs in System32:\" -f $fremd.Count) -ForegroundColor Red\n        $fremd | Sort-Object Erstellt -Descending | ForEach-Object {\n            $col = if ($_.Sig -ne 'Valid') { 'Red' } else { 'Yellow' }\n            Write-Host (\"  [!] {0,-35} Sig: {1,-12} Erstellt: {2}\" -f $_.Name, $_.Sig, $_.Erstellt) -ForegroundColor $col\n            if ($_.Signierer -ne 'Nicht signiert') {\n                Write-Host (\"      Signierer: {0}\" -f $_.Signierer) -ForegroundColor DarkGray\n            }\n        }\n    } else {\n        Write-Host \"`n  Alle DLLs in System32 sind Microsoft-signiert.\" -ForegroundColor Green\n    }\n\n    # --- Ausgabe Frisch ---\n    if ($frisch.Count -gt 0) {\n        Write-Host (\"`n  [!] {0} DLLs nach Windows-Installation erstellt/geaendert:\" -f $frisch.Count) -ForegroundColor Yellow\n        $frisch | ForEach-Object { Write-Host \"  $_\" -ForegroundColor Yellow }\n    }\n\n    # --- Ausgabe Typosquatting ---\n    if ($typo.Count -gt 0) {\n        Write-Host \"`n  [!!!] Moegliches Typosquatting:\" -ForegroundColor Red\n        $typo | ForEach-Object {\n            Write-Host (\"  {0} sieht aus wie {1}\" -f $_.Datei, $_.AehnlichWie) -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"`n  Kein Typosquatting bekannter System-DLLs gefunden.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`nHinweis: Nicht-MS-signierte DLLs koennen legitim sein (z.B. AV-Software).\" -ForegroundColor DarkGray\n    Write-Host \"Rot + frisches Erstelldatum + unbekannter Signierer = hoechste Prioritaet.\" -ForegroundColor DarkGray\n    Write-Host \"Typosquatting-Treffer immer manuell pruefen.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  17 - DMA Fuser & Zweiter-PC-Verbindungen\n# ============================================================\nfunction Invoke-FuserCheck {\n    Write-Host \"`n=== DMA Fuser & Zweiter-PC-Verbindungen ===\" -ForegroundColor Cyan\n    Write-Host \"(Netzwerkverbindungen, windowlose Prozesse, Named Pipes, bekannte Fuser)\" -ForegroundColor DarkGray\n\n    # --- 17a: Bekannte Fuser-Prozessnamen ---\n    Write-Host \"`n--- Bekannte DMA-Fuser Prozesse ---\" -ForegroundColor DarkGray\n    $fuserNamen = @(\n        'pcileech','memflow','memprocfs','dmaclient','dmaservice',\n        'easymapi','leechcore','leechagent','fpga','dma_client',\n        'scatterclient','scatter','vmmdll','vmmsharp',\n        'winpmem','rekall','volatility','dumpit'\n    )\n    $fuserGefunden = $false\n    foreach ($n in $fuserNamen) {\n        $p = @(Get-Process -Name $n -ErrorAction SilentlyContinue)\n        if ($p.Count -gt 0) {\n            $p | ForEach-Object {\n                Write-Host (\"  [!!!] {0} (PID {1}) - {2}\" -f $_.Name, $_.Id, $_.Path) -ForegroundColor Red\n            }\n            $fuserGefunden = $true\n        }\n    }\n    if (-not $fuserGefunden) {\n        Write-Host \"  Keine bekannten Fuser-Prozesse gefunden.\" -ForegroundColor Green\n    }\n\n    # --- 17b: Netzwerkverbindungen zu lokalen IPs (PC2-Verbindung) ---\n    Write-Host \"`n--- Netzwerkverbindungen zu lokalen IPs (DMA PC2) ---\" -ForegroundColor DarkGray\n    Write-Host \"(192.168.x.x / 10.x.x.x / 172.16-31.x.x auf ungewoehnlichen Ports)\" -ForegroundColor DarkGray\n\n    $bekanntePortsOK = @(80,443,8080,8443,3389,5985,5986,53,67,68,123,137,138,139,445,1900,5353)\n    $lokaleVerbindungen = @()\n\n    Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {\n        $remIP = $_.RemoteAddress\n        $remPort = $_.RemotePort\n        $istLokal = $remIP -match '^192\\.168\\.|^10\\.|^172\\.(1[6-9]|2[0-9]|3[01])\\.'\n        $portUngewoehnlich = $bekanntePortsOK -notcontains $remPort\n\n        if ($istLokal -and $portUngewoehnlich) {\n            $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue\n            $lokaleVerbindungen += [PSCustomObject]@{\n                Prozess  = if ($proc) { $proc.Name } else { 'Unbekannt' }\n                PID      = $_.OwningProcess\n                LokPort  = $_.LocalPort\n                RemoteIP = $remIP\n                RemPort  = $remPort\n                Pfad     = if ($proc) { $proc.Path } else { '-' }\n            }\n        }\n    }\n\n    if ($lokaleVerbindungen.Count -gt 0) {\n        Write-Host \"  [!] $($lokaleVerbindungen.Count) Verbindungen zu lokalen IPs auf ungewoehnlichen Ports:\" -ForegroundColor Red\n        $lokaleVerbindungen | Sort-Object RemoteIP | ForEach-Object {\n            Write-Host (\"`n  [{0}] PID {1}\" -f $_.Prozess, $_.PID) -ForegroundColor Red\n            Write-Host (\"  Remote: {0}:{1}  (lokal Port {2})\" -f $_.RemoteIP, $_.RemPort, $_.LokPort) -ForegroundColor Red\n            Write-Host (\"  Pfad  : {0}\" -f $_.Pfad) -ForegroundColor DarkGray\n        }\n    } else {\n        Write-Host \"  Keine auffaelligen lokalen Netzwerkverbindungen.\" -ForegroundColor Green\n    }\n\n    # --- 17c: Windowlose Prozesse ohne bekanntes Elternteil ---\n    Write-Host \"`n--- Windowlose Hintergrundprozesse (moegliche versteckte Fuser) ---\" -ForegroundColor DarkGray\n    $systemProz = @('svchost','services','lsass','csrss','wininit','smss','System',\n                    'Registry','fontdrvhost','dwm','WmiPrvSE','spoolsv','SearchIndexer',\n                    'RuntimeBroker','ShellExperienceHost','StartMenuExperienceHost',\n                    'sihost','taskhostw','ctfmon','conhost','dllhost','audiodg',\n                    'MsMpEng','NisSrv','SecurityHealthService','TextInputHost')\n\n    $verdaechtigeProz = @()\n    Add-Type @\"\nusing System;\nusing System.Runtime.InteropServices;\npublic class WinAPI {\n    [DllImport(\"user32.dll\")]\n    public static extern bool IsWindowVisible(IntPtr hWnd);\n    [DllImport(\"user32.dll\")]\n    public static extern IntPtr GetForegroundWindow();\n}\n\"@ -ErrorAction SilentlyContinue\n\n    Get-Process -ErrorAction SilentlyContinue | Where-Object {\n        $_.Name -notin $systemProz -and\n        $_.MainWindowHandle -eq [IntPtr]::Zero -and\n        $_.SessionId -eq (Get-Process -PID $PID).SessionId\n    } | ForEach-Object {\n        $p = $_\n        # Nur Prozesse mit Pfad und ohne Fenster die nicht bekannte Apps sind\n        if ($p.Path -and $p.Path -notmatch '(?i)\\\\Windows\\\\|\\\\Program Files\\\\|\\\\Program Files \\(x86\\)\\\\') {\n            $sig = Get-AuthenticodeSignature $p.Path -ErrorAction SilentlyContinue\n            $istMS = $sig -and $sig.Status -eq 'Valid' -and $sig.SignerCertificate -and $sig.SignerCertificate.Subject -match '(?i)Microsoft'\n            if (-not $istMS) {\n                $verdaechtigeProz += [PSCustomObject]@{\n                    Name     = $p.Name\n                    PID      = $p.Id\n                    Pfad     = $p.Path\n                    Sig      = if ($sig) { $sig.Status } else { 'Unbekannt' }\n                    Signierer= if ($sig -and $sig.SignerCertificate) { $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1' } else { '-' }\n                }\n            }\n        }\n    }\n\n    if ($verdaechtigeProz.Count -gt 0) {\n        Write-Host \"  $($verdaechtigeProz.Count) windowlose, nicht-MS-signierte Prozesse ausserhalb Systemordner:\" -ForegroundColor Yellow\n        $verdaechtigeProz | ForEach-Object {\n            $col = if ($_.Sig -ne 'Valid') { 'Red' } else { 'Yellow' }\n            Write-Host (\"`n  [{0}] PID {1}\" -f $_.Name, $_.PID) -ForegroundColor $col\n            Write-Host (\"  Pfad : {0}\" -f $_.Pfad) -ForegroundColor $col\n            Write-Host (\"  Sig  : {0} | {1}\" -f $_.Sig, $_.Signierer) -ForegroundColor DarkGray\n        }\n    } else {\n        Write-Host \"  Keine auffaelligen windowlosen Prozesse.\" -ForegroundColor Green\n    }\n\n    # --- 17d: Named Pipes mit DMA-typischen Namen ---\n    Write-Host \"`n--- Named Pipes (DMA/Fuser-Kommunikation) ---\" -ForegroundColor DarkGray\n    $dmaPipeMuster = 'dma|fuser|pcileech|memflow|leech|scatter|fpga|cheat|inject|overlay|radar'\n    try {\n        $pipes = @([System.IO.Directory]::GetFiles('\\\\.\\pipe\\') 2>$null)\n        $verdPipes = @($pipes | Where-Object { $_ -match $dmaPipeMuster })\n        if ($verdPipes.Count -gt 0) {\n            Write-Host \"  [!] Verdaechtige Named Pipes:\" -ForegroundColor Red\n            $verdPipes | ForEach-Object { Write-Host \"  $_\" -ForegroundColor Red }\n        } else {\n            Write-Host \"  Keine DMA-typischen Named Pipes.\" -ForegroundColor Green\n        }\n        Write-Host \"  (Alle Pipes: $($pipes.Count) vorhanden)\" -ForegroundColor DarkGray\n    } catch {\n        # Alternativer Weg ueber Sysinternals wenn verfuegbar\n        Write-Host \"  Direkter Pipe-Zugriff nicht moeglich. Alternativ:\" -ForegroundColor DarkGray\n        Write-Host \"  handle.exe -a | findstr '\\pipe' (Sysinternals)\" -ForegroundColor DarkGray\n    }\n\n    # --- 17e: Autostart-Eintraege fuer Fuser ---\n    Write-Host \"`n--- Autostart-Eintraege (Fuser beim Boot) ---\" -ForegroundColor DarkGray\n    $autoKeys = @(\n        'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run',\n        'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run',\n        'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce',\n        'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce'\n    )\n    foreach ($k in $autoKeys) {\n        if (-not (Test-Path $k)) { continue }\n        $vals = Get-ItemProperty $k -ErrorAction SilentlyContinue\n        $vals.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {\n            $pfad = $_.Value -replace '\"','' -replace ' .*$',''\n            if (Test-Path $pfad -ErrorAction SilentlyContinue) {\n                $sig = Get-AuthenticodeSignature $pfad -ErrorAction SilentlyContinue\n                $istMS = $sig -and $sig.Status -eq 'Valid' -and $sig.SignerCertificate -and $sig.SignerCertificate.Subject -match '(?i)Microsoft'\n                if (-not $istMS) {\n                    $col = if ($sig -and $sig.Status -ne 'Valid') { 'Red' } else { 'Yellow' }\n                    Write-Host (\"  [!] {0} = {1}\" -f $_.Name, $_.Value) -ForegroundColor $col\n                    Write-Host (\"      Sig: {0}\" -f $(if($sig){$sig.Status}else{'Unbekannt'})) -ForegroundColor $col\n                }\n            }\n        }\n    }\n    Write-Host \"  Autostart-Check abgeschlossen.\" -ForegroundColor DarkGray\n\n    Write-Host \"`nFuser-Erkennungs-Tipp:\" -ForegroundColor DarkGray\n    Write-Host \"  Netzwerkverbindung zu 192.168.x.x auf Port >10000 + windowloser Prozess = starkes Indiz.\" -ForegroundColor DarkGray\n    Write-Host \"  Fuser laufen oft nur waehrend des Spiels - deshalb Pruefung waehrend aktiver Session.\" -ForegroundColor DarkGray\n\n    # --- 17f: Display-Analyse (HDMI-Splitter / Capture-Setup) ---\n    Write-Host \"`n--- Display-Analyse (HDMI-Splitter / gespiegeltes Bild) ---\" -ForegroundColor DarkGray\n    Write-Host \"(Mehr Displays als Monitore sichtbar = moeglicher Splitter oder Capture-Input)\" -ForegroundColor DarkGray\n\n    try {\n        $monitors = @(Get-CimInstance -Namespace root\\wmi -ClassName WmiMonitorID -ErrorAction SilentlyContinue)\n        Write-Host (\"  Erkannte Displays: {0}\" -f $monitors.Count)\n        foreach ($m in $monitors) {\n            $hersteller = try { [System.Text.Encoding]::ASCII.GetString(($m.ManufacturerName | Where-Object {$_ -ne 0})) } catch { '?' }\n            $modell     = try { [System.Text.Encoding]::ASCII.GetString(($m.UserFriendlyName  | Where-Object {$_ -ne 0})) } catch { '?' }\n            $serial     = try { [System.Text.Encoding]::ASCII.GetString(($m.SerialNumberID    | Where-Object {$_ -ne 0})) } catch { '' }\n            $col = 'White'\n            $hinweis = ''\n            # Typische Capture-Card oder Virtual-Display Hersteller\n            if ($hersteller -match '(?i)AVerMedia|Elgato|Magewell|Blackmagic|Datapath|DisplayLink|ITE|GENERIC|VirtualDisplay|Parsec|NoMachine') {\n                $col = 'Red'\n                $hinweis = ' [!] CAPTURE/VIRTUAL DISPLAY'\n            }\n            Write-Host (\"  {0,-8} {1,-25} Serial: {2}{3}\" -f $hersteller.Trim(), $modell.Trim(), $serial.Trim(), $hinweis) -ForegroundColor $col\n        }\n\n        if ($monitors.Count -gt 2) {\n            Write-Host (\"  [!] {0} Displays erkannt - mehr als 2 ist ungewoehnlich fuer einen Gaming-PC.\" -f $monitors.Count) -ForegroundColor Yellow\n            Write-Host \"      Moeglicher HDMI-Splitter oder Capture-Eingang aktiv.\" -ForegroundColor Yellow\n        }\n    } catch {\n        Write-Host \"  Display-Abfrage fehlgeschlagen.\" -ForegroundColor DarkGray\n    }\n\n    # --- 17g: Capture-Cards und Video-Devices auf PC1 ---\n    Write-Host \"`n--- Capture-Cards & Video-Geraete auf diesem PC ---\" -ForegroundColor DarkGray\n    $captureGeraete = @(Get-PnpDevice -ErrorAction SilentlyContinue | Where-Object {\n        $_.Class -match '(?i)Media|Image|Camera' -and $_.Status -eq 'OK'\n    })\n    if ($captureGeraete.Count -gt 0) {\n        foreach ($g in $captureGeraete) {\n            $istVerd = $g.FriendlyName -match '(?i)capture|hdmi|video|grabber|avermedia|elgato|magewell|blackmagic|hauppauge'\n            $col = if ($istVerd) { 'Yellow' } else { 'DarkGray' }\n            Write-Host (\"  [{0}] {1}\" -f $g.Class, $g.FriendlyName) -ForegroundColor $col\n            if ($istVerd) {\n                Write-Host (\"  --> Capture-Device: {0}\" -f $g.InstanceId) -ForegroundColor Yellow\n                Write-Host \"      Pruefe ob das Geraet fuer Cheat-Capture oder legitimes Streaming genutzt wird.\" -ForegroundColor DarkGray\n            }\n        }\n    } else {\n        Write-Host \"  Keine Video/Capture-Geraete gefunden.\" -ForegroundColor Green\n    }\n\n    # --- 17h: Aktive GPU-Ausgaenge (mehr als physische Monitore) ---\n    Write-Host \"`n--- GPU: aktive Video-Ausgaenge ---\" -ForegroundColor DarkGray\n    Get-CimInstance Win32_VideoController -ErrorAction SilentlyContinue | ForEach-Object {\n        Write-Host (\"  GPU       : {0}\" -f $_.Name)\n        Write-Host (\"  Adapter   : {0}\" -f $_.AdapterCompatibility)\n        Write-Host (\"  Aufloesung: {0}x{1}\" -f $_.CurrentHorizontalResolution, $_.CurrentVerticalResolution)\n    }\n\n    Write-Host \"`nHDMI-Splitter-Tipp:\" -ForegroundColor DarkGray\n    Write-Host \"  Physische Pruefung: 2 HDMI-Kabel am Monitor (Input 1 + Input 2) ist verdaechtig.\" -ForegroundColor DarkGray\n    Write-Host \"  Ein zweiter laufender PC ohne sichtbare Aktivitaet = moeglicher Cheat-PC.\" -ForegroundColor DarkGray\n    Write-Host \"  Netzwerk (Punkt 17b) findet die DMA-Verbindung zwischen PC1 und PC2.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  18 - Forensische Tools herunterladen\n# ============================================================\nfunction Invoke-ToolDownload {\n    Write-Host \"`n=== Forensische Tools - Download ===\" -ForegroundColor Cyan\n    Write-Host \"(Alle Tools sind kostenlos und Open Source / Freeware)\" -ForegroundColor DarkGray\n\n    $zielOrdner = \"$env:USERPROFILE\\Desktop\\CTC_Tools\"\n    if (-not (Test-Path $zielOrdner)) {\n        New-Item -ItemType Directory -Path $zielOrdner | Out-Null\n        Write-Host \"Ordner erstellt: $zielOrdner\" -ForegroundColor Green\n    } else {\n        Write-Host \"Zielordner: $zielOrdner\" -ForegroundColor DarkGray\n    }\n\n    $tools = [ordered]@{\n        '1' = @{\n            Name   = 'Everything 1.4 (Blitzschnelle Dateisuche)'\n            URL    = 'https://www.voidtools.com/Everything-1.4.1.1024.x64.zip'\n            Zip    = $true\n            Tipp   = 'Findet DLLs, .sys-Dateien und Cheat-Dateien sofort'\n        }\n        '2' = @{\n            Name   = 'System Informer (Prozesse, Handles, Netzwerk)'\n            URL    = 'github_latest'\n            Repo   = 'winsiderss/systeminformer'\n            Zip    = $true\n            Tipp   = 'Zeigt geladene DLLs, Named Pipes und versteckte Prozesse'\n        }\n        '3' = @{\n            Name   = 'Autoruns (Alle Autostart-Eintraege)'\n            URL    = 'https://download.sysinternals.com/files/Autoruns.zip'\n            Zip    = $true\n            Tipp   = 'Zeigt JEDEN Autostart-Eintrag - Fuser-Erkennung'\n        }\n        '4' = @{\n            Name   = 'Process Monitor (Live Datei/Registry/Netzwerk)'\n            URL    = 'https://download.sysinternals.com/files/ProcessMonitor.zip'\n            Zip    = $true\n            Tipp   = 'Zeigt phantom DLL-Suchen in Echtzeit (DLL Hijacking live)'\n        }\n        '5' = @{\n            Name   = 'TCPView (Netzwerkverbindungen live)'\n            URL    = 'https://download.sysinternals.com/files/TCPView.zip'\n            Zip    = $true\n            Tipp   = 'Fuser-Verbindungen zu PC2 in Echtzeit sehen'\n        }\n        '6' = @{\n            Name   = 'Handle (Named Pipes & Handles)'\n            URL    = 'https://download.sysinternals.com/files/Handle.zip'\n            Zip    = $true\n            Tipp   = 'Zeigt alle Named Pipes - DMA Fuser Kommunikation'\n        }\n        '7' = @{\n            Name   = 'Strings (Strings aus Binaerdateien extrahieren)'\n            URL    = 'https://download.sysinternals.com/files/Strings.zip'\n            Zip    = $true\n            Tipp   = 'Wie im WptsExtensions.dll Fund - inject/manualmap Strings sehen'\n        }\n        '8' = @{\n            Name   = 'Hollows Hunter (Injizierte Module finden)'\n            URL    = 'github_latest'\n            Repo   = 'hasherezade/hollows_hunter'\n            Zip    = $false\n            Tipp   = 'Findet reflective injection und manual mapped Code in Prozessen'\n        }\n        'A' = @{ Name = 'Alle Tools herunterladen'; URL = ''; Zip = $false; Tipp = '' }\n    }\n\n    Write-Host \"`n  Verfuegbare Tools:\" -ForegroundColor Cyan\n    foreach ($k in $tools.Keys) {\n        if ($k -eq 'A') {\n            Write-Host \"`n  [A] Alle herunterladen\" -ForegroundColor Yellow\n        } else {\n            $t = $tools[$k]\n            Write-Host (\"  [{0}] {1}\" -f $k, $t.Name) -ForegroundColor White\n            Write-Host (\"      --> {0}\" -f $t.Tipp) -ForegroundColor DarkGray\n        }\n    }\n    Write-Host \"  [Q] Abbrechen\" -ForegroundColor DarkGray\n\n    $wahl = (Read-Host \"`nAuswahl\").Trim().ToUpper()\n    if ($wahl -eq 'Q') { return }\n\n    $zuLaden = if ($wahl -eq 'A') { $tools.Keys | Where-Object { $_ -ne 'A' } } else { @($wahl) }\n\n    foreach ($k in $zuLaden) {\n        if (-not $tools.ContainsKey($k)) { Write-Host \"Unbekannte Auswahl: $k\" -ForegroundColor Red; continue }\n        $tool = $tools[$k]\n        Write-Host (\"`n[{0}] Lade {1}...\" -f $k, $tool.Name) -ForegroundColor Cyan\n\n        $url = $tool.URL\n\n        # GitHub Latest Release URL holen\n        if ($url -eq 'github_latest') {\n            try {\n                Write-Host \"  GitHub Release API abfragen...\" -ForegroundColor DarkGray\n                $apiUrl = \"https://api.github.com/repos/$($tool.Repo)/releases/latest\"\n                $release = Invoke-RestMethod $apiUrl -Headers @{'User-Agent'='CTC-by-Dark'} -ErrorAction Stop\n                # Passende Asset-URL finden (x64, Windows)\n                $asset = $release.assets | Where-Object {\n                    $_.name -match '(?i)x64|amd64|win64' -and\n                    $_.name -match '(?i)\\.zip$|\\.exe$' -and\n                    $_.name -notmatch '(?i)debug|pdb|symbols'\n                } | Select-Object -First 1\n\n                if ($asset) {\n                    $url = $asset.browser_download_url\n                    Write-Host (\"  Version: {0} | Asset: {1}\" -f $release.tag_name, $asset.name) -ForegroundColor DarkGray\n                } else {\n                    Write-Host \"  Kein passendes Asset gefunden. Bitte manuell herunterladen:\" -ForegroundColor Yellow\n                    Write-Host (\"  https://github.com/{0}/releases\" -f $tool.Repo) -ForegroundColor Yellow\n                    continue\n                }\n            } catch {\n                Write-Host (\"  GitHub-Abfrage fehlgeschlagen: {0}\" -f $_) -ForegroundColor Red\n                Write-Host (\"  Manuell: https://github.com/{0}/releases\" -f $tool.Repo) -ForegroundColor Yellow\n                continue\n            }\n        }\n\n        # Dateiname aus URL\n        $dateiName = [System.IO.Path]::GetFileName($url)\n        $zielPfad  = Join-Path $zielOrdner $dateiName\n\n        try {\n            Write-Host (\"  Download: {0}\" -f $url) -ForegroundColor DarkGray\n            Invoke-WebRequest -Uri $url -OutFile $zielPfad -UseBasicParsing -ErrorAction Stop\n            Write-Host (\"  Gespeichert: {0}\" -f $zielPfad) -ForegroundColor Green\n\n            # ZIP entpacken\n            if ($tool.Zip -and $dateiName -match '\\.zip$') {\n                $extraktOrdner = Join-Path $zielOrdner ([System.IO.Path]::GetFileNameWithoutExtension($dateiName))\n                if (-not (Test-Path $extraktOrdner)) { New-Item -ItemType Directory -Path $extraktOrdner | Out-Null }\n                Expand-Archive -Path $zielPfad -DestinationPath $extraktOrdner -Force\n                Remove-Item $zielPfad -Force\n                Write-Host (\"  Entpackt: {0}\" -f $extraktOrdner) -ForegroundColor Green\n            }\n        } catch {\n            Write-Host (\"  Fehler: {0}\" -f $_) -ForegroundColor Red\n            Write-Host (\"  Manuell herunterladen: {0}\" -f $url) -ForegroundColor Yellow\n        }\n    }\n\n    Write-Host \"`n======================================\" -ForegroundColor Cyan\n    Write-Host \"  Tools gespeichert in:\" -ForegroundColor Cyan\n    Write-Host \"  $zielOrdner\" -ForegroundColor Yellow\n    Write-Host \"======================================\" -ForegroundColor Cyan\n    Write-Host \"Empfohlene Reihenfolge fuer eine Analyse:\" -ForegroundColor DarkGray\n    Write-Host \"  1. Autoruns    - Was startet beim Boot?\" -ForegroundColor DarkGray\n    Write-Host \"  2. TCPView     - Welche Verbindungen laufen?\" -ForegroundColor DarkGray\n    Write-Host \"  3. ProcMon     - Welche DLLs werden gesucht?\" -ForegroundColor DarkGray\n    Write-Host \"  4. SysInformer - Was ist in den Prozessen geladen?\" -ForegroundColor DarkGray\n    Write-Host \"  5. Everything  - Verdaechtige Dateien suchen\" -ForegroundColor DarkGray\n    Write-Host \"  6. HollowsHunter - Injizierte Module aufdecken\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  Menue\n# ============================================================\nfunction Show-Menu {\n    Write-Host \"\"\n    Write-Host \"============================================\" -ForegroundColor Cyan\n    Write-Host \"  CTC by Dark - CatchTheCheat               \" -ForegroundColor Cyan\n    Write-Host \"============================================\" -ForegroundColor Cyan\n    Write-Host \"  1  PnP-Ereignisse (411 / 400 / 410 / 420)\"\n    Write-Host \"  2  Log-Integritaet, System, Ausfuehrungsartefakte\"\n    Write-Host \"  3  PCI/PCIe-Geraete\"\n    Write-Host \"  4  Entfernte Geraete (Zeitfenster)\"\n    Write-Host \"  5  Datentraeger-Historie\"\n    Write-Host \"  6  USB-Geraetehistorie\"\n    Write-Host \"  7  Fernwartungssoftware (installiert / ausgefuehrt)\"\n    Write-Host \"  8  Fernwartung: Sitzungen und Dateiuebertragungen\"\n    Write-Host \"  9  Unsignierte Dateien (Treiber / Prozesse)\"\n    Write-Host \" 10  PowerShell-History und -Protokoll\"\n    Write-Host \" 11  Discord-Account-IDs (nur ID, keine Token)\"\n    Write-Host \" 12  PE Binary & Driver Heuristics Inspector\"\n    Write-Host \" 13  DLL Hijacking Live-Check (laufende Prozesse)\"\n    Write-Host \" 14  Systemprozesse & Registry-Injection-Vektoren\"\n    Write-Host \" 15  HVCI / Memory Integrity & Inkompatible Treiber\"\n    Write-Host \" 16  System32 Fremdkoerper & Typosquatting\"\n    Write-Host \" 17  DMA Fuser & Zweiter-PC-Verbindungen\"\n    Write-Host \" 18  Forensische Tools herunterladen\"\n    Write-Host \"\"\n    Write-Host \"  A  Alles nacheinander\"\n    Write-Host \"  P  Protokoll auf Desktop starten/stoppen\"\n    Write-Host \"  Q  Beenden\"\n    Write-Host \"============================================\" -ForegroundColor Cyan\n}\n\n# ------------------------------------------------------------\nif (-not (Test-Admin)) {\n    Write-Host \"WARNUNG: Nicht als Administrator gestartet.\" -ForegroundColor Red\n    Write-Host \"Das Kernel-PnP-Log ist so nicht lesbar.\" -ForegroundColor Red\n    Write-Host \"\"\n}\n\n$protokoll = $false\n\ndo {\n    Show-Menu\n    $wahl = (Read-Host \"Auswahl\").Trim().ToUpper()\n\n    switch ($wahl) {\n        '1' { Invoke-PnpEvents }\n        '2' { Invoke-LogIntegrity }\n        '3' { Invoke-PciDevices }\n        '4' {\n              $h = Read-Host \"Zeitfenster in Stunden (Enter = 1)\"\n              if ([string]::IsNullOrWhiteSpace($h)) { $h = 1 }\n              Invoke-RemovedDevices -Stunden ([int]$h)\n            }\n        '5' { Invoke-DiskHistory }\n        '6' { Invoke-UsbHistory }\n        '7' { Invoke-RemoteTools }\n        '8' { Invoke-RemoteSessions }\n        '9' { Invoke-Unsigned }\n        '10' { Invoke-PSHistory }\n        '11' { Invoke-DiscordId }\n        '12' { Invoke-PEInspector }\n        '13' { Invoke-DLLHijackCheck }\n        '14' { Invoke-SystemProcessCheck }\n        '15' { Invoke-HVCICheck }\n        '16' { Invoke-System32Check }\n        '17' { Invoke-FuserCheck }\n        '18' { Invoke-ToolDownload }\n        'A' {\n              Invoke-LogIntegrity\n              Invoke-PnpEvents\n              Invoke-PciDevices\n              Invoke-RemovedDevices -Stunden 24\n              Invoke-DiskHistory\n              Invoke-UsbHistory\n              Invoke-RemoteTools\n              Invoke-RemoteSessions\n              Invoke-Unsigned\n              Invoke-PSHistory\n              Invoke-DiscordId\n              Invoke-DLLHijackCheck\n              Invoke-SystemProcessCheck\n              Invoke-HVCICheck\n              Invoke-FuserCheck\n              Write-Host \"`n[Punkt 16 wird im A-Durchlauf uebersprungen - manuell starten wegen Laufzeit]\" -ForegroundColor DarkGray\n            }\n        'P' {\n              if ($protokoll) {\n                  try { Stop-Transcript | Out-Null } catch {}\n                  $protokoll = $false\n                  Write-Host \"Protokoll gestoppt.\" -ForegroundColor Yellow\n              } else {\n                  $pfad = \"$env:USERPROFILE\\Desktop\\ctc_by_dark_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt\"\n                  try {\n                      Start-Transcript -Path $pfad | Out-Null\n                      $protokoll = $true\n                      Write-Host \"Protokoll laeuft: $pfad\" -ForegroundColor Green\n                  } catch {\n                      Write-Host \"Protokoll konnte nicht gestartet werden.\" -ForegroundColor Red\n                  }\n              }\n            }\n        'Q' { }\n        default { Write-Host \"Ungueltige Eingabe.\" -ForegroundColor Yellow }\n    }\n\n    if ($wahl -ne 'Q') {\n        Write-Host \"\"\n        Read-Host \"Enter fuer Menue\"\n        Clear-Host\n    }\n\n} while ($wahl -ne 'Q')\n\nif ($protokoll) { try { Stop-Transcript | Out-Null } catch {} }\nWrite-Host \"Beendet.\" -ForegroundColor Cyan\n", "creation_timestamp": "2026-09-23T13:02:51.818793Z"}]}