{"vulnerability": "CVE-2018-19320", "sightings": [{"uuid": "a4905cb5-e0f6-4e28-9ceb-81c03e184172", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "seen", "source": "MISP/5e3d62c3-cc10-494e-b305-4c270a3b4631", "content": "", "creation_timestamp": "2020-02-07T13:20:11.000000Z"}, {"uuid": "a13c6867-ecb5-4cb0-8ada-422b23ffd3e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:03.000000Z"}, {"uuid": "2dc4a7a2-9ef2-4a31-a839-0bea20c0f9ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971726", "content": "", "creation_timestamp": "2024-12-24T20:33:18.476139Z"}, {"uuid": "7b4e30c6-19a4-4bfa-a920-5dc9dafd8584", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:19.000000Z"}, {"uuid": "ecc8d4e3-38cf-4a1d-9d82-6fa1b84ce8fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2018-19320", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0089d730-00bc-4874-afa3-7c50456fc4a0", "content": "", "creation_timestamp": "2026-02-02T12:27:11.253864Z"}, {"uuid": "6c70236c-6749-4ef1-b75b-55cc0fbe0fcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "seen", "source": "https://t.me/arpsyndicate/1033", "content": "#ExploitObserverAlert\n\nCVE-2018-19320\n\nDESCRIPTION: Exploit Observer has 21 entries related to CVE-2018-19320. The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.\n\nFIRST-EPSS: 0.001850000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-03T21:29:24.000000Z"}, {"uuid": "c8375f2c-4e60-4a8b-a8e4-6c8b952feeaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/15405", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2018-19320-LPE*\nGithub: https://github.com/hmnthabit/CVE-2018-19320-LPE", "creation_timestamp": "2026-07-31T00:00:33.436115Z"}, {"uuid": "6cf7ea1d-68b2-459a-9c0d-33d96f27b6d5", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8b7ece74-cdab-4c8c-aec7-5e063783a81b", "content": "", "creation_timestamp": "2026-06-19T12:47:02.181451Z"}, {"uuid": "0e785f96-f040-41cd-b5fa-b493e2d7c654", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1f24029b-7e6c-4260-be82-6898381b25ad", "content": "", "creation_timestamp": "2026-06-23T14:05:34.176998Z"}, {"uuid": "0dbb9325-8d3c-46df-93c6-ba1a1786abd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3msx3lxluyp25", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2018-19320: The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING E\u2026\nCVSS 7.8 \u00b7 EPSS 3.6% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2018-19320\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-13T07:09:51.766980Z"}, {"uuid": "64a2dc40-2037-49fa-9d18-a1166d6905d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "seen", "source": "https://t.me/CVEhub/15405", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2018-19320-LPE*\nGithub: https://github.com/hmnthabit/CVE-2018-19320-LPE", "creation_timestamp": "2026-07-29T12:00:21.950013Z"}, {"uuid": "12e8f850-ea2e-4343-8ff8-2353e8f449b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "seen", "source": "https://t.me/CVEhub/15405", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2018-19320-LPE*\nGithub: https://github.com/hmnthabit/CVE-2018-19320-LPE", "creation_timestamp": "2026-07-30T00:00:43.019446Z"}, {"uuid": "bdefc65f-4b7f-47b9-a836-c61eb6ca6abd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19320", "type": "seen", "source": "https://gist.github.com/analystdark/efed7e96c74e14fb6b7163de5d9cfa27", "content": "# ============================================================\n#  CTC by Dark (CatchTheCheat)\n#  Hardware- und Cheat-Analyse\n#  Ausfuehren als Administrator\n# ============================================================\n\n$L      = 'Microsoft-Windows-Kernel-PnP/Configuration'\n$OKVEN  = @('8086','1022','1002')\n$MUSTER = 'anydesk|rustdesk|teamviewer|parsec|dwservice|ultraviewer|ammyy'\n\n# ------------------------------------------------------------\nfunction Test-Admin {\n    $id = [Security.Principal.WindowsIdentity]::GetCurrent()\n    (New-Object Security.Principal.WindowsPrincipal $id).IsInRole(\n        [Security.Principal.WindowsBuiltInRole]::Administrator)\n}\n\n# ------------------------------------------------------------\nfunction Get-DevId {\n    param($Event)\n    $x = [xml]$Event.ToXml()\n    ($x.Event.EventData.Data | Where-Object { $_.Name -eq 'DeviceInstanceId' }).'#text'\n}\n\n# ============================================================\n#  1 - PnP-Ereignisse\n# ============================================================\nfunction Invoke-PnpEvents {\n    Write-Host \"`n=== Event-ID 411 (Startprobleme) ===\" -ForegroundColor Cyan\n    $e411 = @(Get-WinEvent -FilterHashtable @{LogName=$L;Id=411} -ErrorAction SilentlyContinue)\n    if ($e411.Count -gt 0) {\n        $e411 | Select-Object TimeCreated, Id,\n            @{n='Details';e={($_.Message -replace '\\s+',' ').Trim()}} |\n            Sort-Object TimeCreated -Descending | Format-List\n        Write-Host \"Anzahl 411: $($e411.Count)\" -ForegroundColor Red\n    } else {\n        Write-Host \"Keine 411er gefunden.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`n=== PnP-Konfigurationsereignisse (400/410/420/430) ===\" -ForegroundColor Cyan\n    $cfg = @(Get-WinEvent -FilterHashtable @{LogName=$L;Id=400,410,420,430} -ErrorAction SilentlyContinue |\n        ForEach-Object { [PSCustomObject]@{ Zeit=$_.TimeCreated; EID=$_.Id; Geraet=(Get-DevId $_) } })\n    if ($cfg.Count -gt 0) {\n        $cfg | Sort-Object Zeit | Format-Table -AutoSize -Wrap\n        Write-Host \"Gesamt: $($cfg.Count) Ereignisse\" -ForegroundColor DarkGray\n    } else {\n        Write-Host \"Keine Konfigurationsereignisse.\" -ForegroundColor Yellow\n    }\n}\n\n# ============================================================\n#  2 - Log-Integritaet und System-Eckdaten\n# ============================================================\nfunction Invoke-LogIntegrity {\n    Write-Host \"`n=== Geleerte Ereignisprotokolle (System EID 104) ===\" -ForegroundColor Cyan\n    $clr = @(Get-WinEvent -FilterHashtable @{LogName='System';Id=104} -MaxEvents 50 -ErrorAction SilentlyContinue)\n    if ($clr.Count -gt 0) {\n        $clr | ForEach-Object {\n            [PSCustomObject]@{\n                Zeit     = $_.TimeCreated\n                Benutzer = $_.Properties[0].Value\n                Computer = $_.Properties[1].Value\n                Log      = $_.Properties[2].Value\n            }\n        } | Format-Table -AutoSize -Wrap\n        Write-Host \"ACHTUNG: Protokolle wurden geleert.\" -ForegroundColor Red\n    } else {\n        Write-Host \"Keine Loeschvorgaenge protokolliert.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`n=== Security-Log geleert (EID 1102) ===\" -ForegroundColor Cyan\n    $s1102 = @(Get-WinEvent -FilterHashtable @{LogName='Security';Id=1102} -MaxEvents 20 -ErrorAction SilentlyContinue)\n    if ($s1102.Count -gt 0) {\n        $s1102 | Select-Object TimeCreated | Format-Table -AutoSize\n        Write-Host \"ACHTUNG: Security-Log wurde geleert.\" -ForegroundColor Red\n    } else {\n        Write-Host \"Keine Loeschung des Security-Logs.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`n=== System ===\" -ForegroundColor Cyan\n    $os = Get-CimInstance Win32_OperatingSystem\n    Write-Host \"Installiert:  $($os.InstallDate)\"\n    Write-Host \"Letzter Boot: $($os.LastBootUpTime)\"\n    Write-Host \"Computer:     $env:COMPUTERNAME\"\n    Write-Host \"Benutzer:     $env:USERNAME\"\n\n    Write-Host \"`n=== Log-Status ===\" -ForegroundColor Cyan\n    Get-WinEvent -ListLog $L,'System','Security','Application',\n        'Microsoft-Windows-Partition/Diagnostic' -ErrorAction SilentlyContinue |\n        Select-Object LogName, IsEnabled, RecordCount, LogMode | Format-Table -AutoSize\n\n    Write-Host \"=== Zeitaenderungen (Kernel-General EID 1) ===\" -ForegroundColor Cyan\n    $zt = @(Get-WinEvent -FilterHashtable @{LogName='System';Id=1;ProviderName='Microsoft-Windows-Kernel-General'} -MaxEvents 20 -ErrorAction SilentlyContinue)\n    if ($zt.Count -gt 0) {\n        $zt | Select-Object TimeCreated, @{n='Info';e={($_.Message -replace '\\s+',' ').Trim()}} | Format-List\n    } else {\n        Write-Host \"Keine manuellen Zeitaenderungen.\" -ForegroundColor Green\n    }\n\n    # --- Ausfuehrungsartefakte: Zustand und Auffaelligkeiten ---\n    Write-Host \"`n=== Ausfuehrungsartefakte ===\" -ForegroundColor Cyan\n    Write-Host \"(Zeigt Zustand, KEIN kryptografischer Manipulationsbeweis.\" -ForegroundColor DarkGray\n    Write-Host \" Tiefenauswertung: Zimmerman-Tools AmcacheParser / AppCompatCacheParser / MFTECmd)\" -ForegroundColor DarkGray\n\n    # Amcache.hve\n    Write-Host \"`n--- Amcache.hve ---\" -ForegroundColor DarkGray\n    $am = \"$env:SystemRoot\\AppCompat\\Programs\\Amcache.hve\"\n    if (Test-Path $am) {\n        $f = Get-Item $am -Force\n        Write-Host (\"Groesse: {0:N0} Bytes | Erstellt: {1} | Geaendert: {2}\" -f $f.Length,$f.CreationTime,$f.LastWriteTime)\n        if ($f.Length -lt 100KB) {\n            Write-Host \"AUFFAELLIG: Datei sehr klein - koennte geleert/zurueckgesetzt sein.\" -ForegroundColor Red\n        }\n        $os2 = Get-CimInstance Win32_OperatingSystem\n        if ($f.CreationTime -gt $os2.InstallDate.AddDays(1)) {\n            Write-Host \"AUFFAELLIG: Erstellt deutlich nach Windows-Installation - moeglw. neu angelegt.\" -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"FEHLT - Amcache.hve nicht vorhanden (regeneriert sich normalerweise).\" -ForegroundColor Red\n    }\n\n    # USN-Journal (NTFS-Aenderungsjournal)\n    Write-Host \"`n--- USN-Journal (Laufwerk C:) ---\" -ForegroundColor DarkGray\n    $usn = & fsutil usn queryjournal C: 2>&1\n    if ($LASTEXITCODE -eq 0 -and $usn) {\n        $usn | ForEach-Object { Write-Host \"   $_\" }\n        $first = ($usn | Select-String 'Erste USN|First USN' | Select-Object -First 1) -replace '[^0-9x]',''\n        if ($first -match '^0x0+$' -or $first -eq '0') {\n            Write-Host \"AUFFAELLIG: Erste USN = 0 - Journal wurde geloescht und neu angelegt.\" -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"Journal nicht abfragbar oder deaktiviert.\" -ForegroundColor Yellow\n        Write-Host \"Ein DEAKTIVIERTES USN-Journal ist auf einem Gaming-PC ungewoehnlich.\" -ForegroundColor Red\n    }\n\n    # ShimCache / AppCompatCache\n    Write-Host \"`n--- ShimCache (AppCompatCache) ---\" -ForegroundColor DarkGray\n    $shim = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache'\n    if (Test-Path $shim) {\n        $val = (Get-ItemProperty $shim -Name AppCompatCache -ErrorAction SilentlyContinue).AppCompatCache\n        if ($val) {\n            Write-Host (\"Vorhanden, {0:N0} Bytes. Binaer - Auswertung nur mit AppCompatCacheParser.\" -f $val.Length)\n        } else {\n            Write-Host \"AUFFAELLIG: Schluessel vorhanden, aber leer.\" -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"AUFFAELLIG: AppCompatCache nicht vorhanden.\" -ForegroundColor Red\n    }\n\n    # Prefetch\n    Write-Host \"`n--- Prefetch ---\" -ForegroundColor DarkGray\n    $pfE = (Get-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters' -Name EnablePrefetcher -ErrorAction SilentlyContinue).EnablePrefetcher\n    $pfDir = \"$env:SystemRoot\\Prefetch\"\n    $pfCount = if (Test-Path $pfDir) { @(Get-ChildItem \"$pfDir\\*.pf\" -ErrorAction SilentlyContinue).Count } else { 0 }\n    Write-Host (\"EnablePrefetcher: {0} | .pf-Dateien: {1}\" -f $pfE, $pfCount)\n    if ($pfE -eq 0) {\n        Write-Host \"AUFFAELLIG: Prefetch deaktiviert - haeufige Anti-Forensik-Massnahme.\" -ForegroundColor Red\n    } elseif ($pfCount -lt 20) {\n        Write-Host \"AUFFAELLIG: Sehr wenige .pf-Dateien - Prefetch koennte geleert worden sein.\" -ForegroundColor Red\n    }\n\n    # SRUM\n    Write-Host \"`n--- SRUM ---\" -ForegroundColor DarkGray\n    $srum = \"$env:SystemRoot\\System32\\sru\\SRUDB.dat\"\n    if (Test-Path $srum) {\n        $f = Get-Item $srum -Force\n        Write-Host (\"SRUDB.dat: {0:N0} Bytes | Geaendert: {1}\" -f $f.Length,$f.LastWriteTime)\n    } else {\n        Write-Host \"SRUDB.dat nicht vorhanden.\" -ForegroundColor Yellow\n    }\n}\n\n# ============================================================\n#  3 - PCI/PCIe-Geraete\n# ============================================================\nfunction Invoke-PciDevices {\n    Write-Host \"`n=== PCI/PCIe-Geraete (aktuell) ===\" -ForegroundColor Cyan\n    Write-Host (\"{0,-6} {1,-6} {2,-10} {3,-18} {4}\" -f 'VEN','DEV','STATUS','KLASSE','NAME') -ForegroundColor Cyan\n    Get-PnpDevice | Where-Object { $_.InstanceId -like 'PCI*' } | Sort-Object Class | ForEach-Object {\n        $v = [regex]::Match($_.InstanceId,'VEN_([0-9A-Fa-f]{4})').Groups[1].Value.ToUpper()\n        $d = [regex]::Match($_.InstanceId,'DEV_([0-9A-Fa-f]{4})').Groups[1].Value.ToUpper()\n        $c = if ($OKVEN -contains $v) { 'Green' } else { 'Red' }\n        Write-Host (\"{0,-6} {1,-6} {2,-10} {3,-18} {4}\" -f $v,$d,$_.Status,$_.Class,$_.FriendlyName) -ForegroundColor $c\n    }\n\n    Write-Host \"`n=== Nicht mehr vorhandene PCI-Geraete ===\" -ForegroundColor Cyan\n    $reg = @(Get-ChildItem 'HKLM:\\SYSTEM\\CurrentControlSet\\Enum\\PCI' -ErrorAction SilentlyContinue |\n        Select-Object -ExpandProperty PSChildName)\n    $da  = @(Get-PnpDevice -PresentOnly -ErrorAction SilentlyContinue |\n        Where-Object { $_.InstanceId -like 'PCI*' } |\n        ForEach-Object { ($_.InstanceId -split '\\\\')[1] })\n    $weg = @($reg | Where-Object { $da -notcontains $_ })\n    if ($weg.Count -gt 0) {\n        $weg | ForEach-Object { Write-Host \"FEHLT: $_\" -ForegroundColor Red }\n    } else {\n        Write-Host \"Keine Abweichung.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`n=== setupapi.dev.log ===\" -ForegroundColor Cyan\n    $sp = 'C:\\Windows\\INF\\setupapi.dev.log'\n    if (Test-Path $sp) {\n        $fi = Get-Item $sp\n        Write-Host (\"Groesse: {0:N0} Bytes | Erstellt: {1} | Geaendert: {2}\" -f $fi.Length,$fi.CreationTime,$fi.LastWriteTime)\n        $ids = @(Select-String -Path $sp -Pattern 'PCI\\\\VEN_[0-9A-Fa-f]{4}&DEV_[0-9A-Fa-f]{4}' -AllMatches |\n            ForEach-Object { $_.Matches.Value } | Sort-Object -Unique)\n        if ($ids.Count -gt 0) { $ids }\n        else { Write-Host \"Keine PCI-Eintraege in der Datei.\" -ForegroundColor Yellow }\n    } else {\n        Write-Host \"Datei nicht vorhanden.\" -ForegroundColor Yellow\n    }\n}\n\n# ============================================================\n#  4 - Entfernte Geraete im Zeitfenster\n# ============================================================\nfunction Invoke-RemovedDevices {\n    param([int]$Stunden = 1)\n\n    $seit = (Get-Date).AddHours(-$Stunden)\n    Write-Host \"`n=== Entfernte Geraete seit $($seit.ToString('dd.MM.yyyy HH:mm')) ===\" -ForegroundColor Cyan\n\n    $rem = @(Get-WinEvent -FilterHashtable @{LogName=$L;Id=420;StartTime=$seit} -ErrorAction SilentlyContinue |\n        ForEach-Object { [PSCustomObject]@{ Zeit=$_.TimeCreated; Geraet=(Get-DevId $_) } })\n    if ($rem.Count -gt 0) {\n        Write-Host \"--- Abgezogen (Ereignisprotokoll) ---\" -ForegroundColor Red\n        $rem | Sort-Object Zeit | Format-Table -AutoSize -Wrap\n    } else {\n        Write-Host \"Keine 420-Ereignisse im Zeitfenster.\" -ForegroundColor Green\n    }\n\n    $sig = '[DllImport(\"advapi32.dll\")]public static extern int RegQueryInfoKey(Microsoft.Win32.SafeHandles.SafeRegistryHandle h,System.Text.StringBuilder a,ref int b,int c,ref int d,ref int e,ref int f,ref int g,ref int i,ref int j,ref int k,ref long l);'\n    Add-Type -MemberDefinition $sig -Name RK -Namespace W -ErrorAction SilentlyContinue\n\n    $da = @(Get-PnpDevice -PresentOnly -ErrorAction SilentlyContinue | ForEach-Object { $_.InstanceId })\n    $treffer = @()\n    foreach ($zweig in @('PCI','USB','USBSTOR','HID')) {\n        $pfad = \"HKLM:\\SYSTEM\\CurrentControlSet\\Enum\\$zweig\"\n        if (-not (Test-Path $pfad)) { continue }\n        Get-ChildItem $pfad -ErrorAction SilentlyContinue | ForEach-Object {\n            $el = $_\n            Get-ChildItem $el.PSPath -ErrorAction SilentlyContinue | ForEach-Object {\n                $t = 0L; $z = 0; $n = New-Object Text.StringBuilder 1024\n                [void][W.RK]::RegQueryInfoKey($_.Handle,$n,[ref]$z,0,[ref]$z,[ref]$z,[ref]$z,[ref]$z,[ref]$z,[ref]$z,[ref]$z,[ref]$t)\n                $zeit = [DateTime]::FromFileTime($t)\n                $iid  = \"$zweig\\$($el.PSChildName)\\$($_.PSChildName)\"\n                if ($zeit -ge $seit -and ($da -notcontains $iid)) {\n                    $treffer += [PSCustomObject]@{\n                        Zuletzt = $zeit\n                        Geraet  = $iid\n                        Name    = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).FriendlyName\n                    }\n                }\n            }\n        }\n    }\n    if ($treffer.Count -gt 0) {\n        Write-Host \"--- Registry frisch angefasst, Geraet nicht mehr vorhanden ---\" -ForegroundColor Red\n        $treffer | Sort-Object Zuletzt -Descending | Format-Table -AutoSize -Wrap\n    } else {\n        Write-Host \"Keine Registry-Auffaelligkeiten im Zeitfenster.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`nHinweis: Bei ausgeschaltetem Rechner entfernte Hardware\" -ForegroundColor DarkGray\n    Write-Host \"erzeugt KEINE Spur. Leeres Ergebnis ist keine Entlastung.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  5 - Datentraeger-Historie\n# ============================================================\nfunction Invoke-DiskHistory {\n    Write-Host \"`n=== Datentraeger-Historie (Partition/Diagnostic) ===\" -ForegroundColor Cyan\n\n    $plog = @(Get-WinEvent -LogName 'Microsoft-Windows-Partition/Diagnostic' -ErrorAction SilentlyContinue |\n        ForEach-Object {\n            $dat = ([xml]$_.ToXml()).Event.EventData.Data\n            [PSCustomObject]@{\n                Zeit   = $_.TimeCreated\n                EID    = $_.Id\n                Modell = ($dat | Where-Object { $_.Name -eq 'Model' }).'#text'\n                Serie  = ($dat | Where-Object { $_.Name -eq 'SerialNumber' }).'#text'\n            }\n        })\n\n    if ($plog.Count -eq 0) {\n        Write-Host \"Log leer oder nicht lesbar.\" -ForegroundColor Yellow\n        return\n    }\n\n    $s = $plog | Sort-Object Zeit\n    Write-Host (\"Zeitraum: {0} bis {1}  ({2} Eintraege)\" -f $s[0].Zeit, $s[-1].Zeit, $plog.Count) -ForegroundColor DarkGray\n\n    Write-Host \"`n--- Alle jemals erfassten Datentraeger ---\" -ForegroundColor DarkGray\n    $plog | Group-Object Serie | ForEach-Object {\n        $e = $_.Group | Sort-Object Zeit\n        [PSCustomObject]@{\n            Modell   = $e[0].Modell\n            Serie    = $_.Name\n            Erstmals = $e[0].Zeit\n            Zuletzt  = $e[-1].Zeit\n            Anzahl   = $_.Count\n        }\n    } | Sort-Object Zuletzt -Descending | Format-Table -AutoSize\n\n    Write-Host \"--- Im Log erfasst, aktuell NICHT angeschlossen ---\" -ForegroundColor DarkGray\n    $jetzt = @(Get-Disk -ErrorAction SilentlyContinue | ForEach-Object { $_.SerialNumber -replace '\\s','' })\n    $fehlt = @($plog | Group-Object Serie | Where-Object {\n        $sn = $_.Name -replace '[\\s\\.]',''\n        -not ($jetzt | Where-Object { $_ -and ($_ -replace '[\\s\\.]','') -like \"*$sn*\" })\n    })\n    if ($fehlt.Count -gt 0) {\n        $fehlt | ForEach-Object {\n            $e = $_.Group | Sort-Object Zeit\n            Write-Host (\"FEHLT: {0} | Serie {1} | zuletzt {2}\" -f $e[0].Modell, $_.Name, $e[-1].Zeit) -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"Alle erfassten Datentraeger sind angeschlossen.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`n--- Letzte 30 Ereignisse ---\" -ForegroundColor DarkGray\n    $plog | Sort-Object Zeit -Descending | Select-Object -First 30 | Format-Table -AutoSize\n}\n\n# ============================================================\n#  6 - USB-Geraetehistorie\n# ============================================================\nfunction Invoke-UsbHistory {\n    Write-Host \"`n=== USB-Geraetehistorie ===\" -ForegroundColor Cyan\n    $da = @(Get-PnpDevice -PresentOnly -ErrorAction SilentlyContinue | ForEach-Object { $_.InstanceId })\n    foreach ($zweig in @('USBSTOR','USB')) {\n        $pfad = \"HKLM:\\SYSTEM\\CurrentControlSet\\Enum\\$zweig\"\n        if (-not (Test-Path $pfad)) { continue }\n        Write-Host \"`n--- $zweig ---\" -ForegroundColor DarkGray\n        Get-ChildItem $pfad -ErrorAction SilentlyContinue | ForEach-Object {\n            $el = $_\n            Get-ChildItem $el.PSPath -ErrorAction SilentlyContinue | ForEach-Object {\n                $p = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue\n                $iid = \"$zweig\\$($el.PSChildName)\\$($_.PSChildName)\"\n                [PSCustomObject]@{\n                    Status = if ($da -contains $iid) { 'vorhanden' } else { 'FEHLT' }\n                    Name   = $p.FriendlyName\n                    Klasse = $p.Class\n                    Geraet = $el.PSChildName\n                    Serie  = $_.PSChildName\n                }\n            }\n        } | Sort-Object Status, Name | Format-Table -AutoSize -Wrap\n    }\n    Write-Host \"Hinweis: Viele FEHLT-Eintraege unter USB sind normal (Ports, Hubs, Kabel).\" -ForegroundColor DarkGray\n\n    # --- DeviceSetupManager: MAKCU / Arduino / Input-Emulator Spuren ---\n    Write-Host \"`n--- DeviceSetupManager: MAKCU / Arduino / Input-Emulator ---\" -ForegroundColor Cyan\n    Write-Host \"(CH343/CH340/CH341 = Arduino-Klon | ESP32-S3 = MAKCU | COM-Port = serielles Geraet)\" -ForegroundColor DarkGray\n\n    $dsmLog   = 'Microsoft-Windows-DeviceSetupManager/Admin'\n    $dsmOper  = 'Microsoft-Windows-DeviceSetupManager/Operational'\n    $dsmMuster = 'CH34|CH340|CH341|CH343|ESP32|ESP8266|MAKCU|Arduino|CP2102|CP210|PL2303|FT232|FTDI|silabser|usbser'\n    $comMuster = 'COM\\d+'\n\n    $dsmTreffer = @()\n    foreach ($log in @($dsmLog, $dsmOper)) {\n        $events = @(Get-WinEvent -LogName $log -MaxEvents 500 -ErrorAction SilentlyContinue)\n        foreach ($e in $events) {\n            if ($e.Message -match $dsmMuster -or $e.Message -match 'COM[3-9]|COM[1-9][0-9]') {\n                $comPort = if ($e.Message -match '(COM\\d+)') { $matches[1] } else { '' }\n                $chip    = ''\n                foreach ($m in @('CH343','CH340','CH341','CH34','ESP32-S3','ESP32','ESP8266','CP2102','CP210','PL2303','FT232','FTDI','silabser','usbser','MAKCU','Arduino')) {\n                    if ($e.Message -match [regex]::Escape($m)) { $chip = $m; break }\n                }\n                $dsmTreffer += [PSCustomObject]@{\n                    Zeit    = $e.TimeCreated\n                    EID     = $e.Id\n                    Chip    = $chip\n                    COM     = $comPort\n                    Meldung = ($e.Message -replace '\\s+',' ').Substring(0, [Math]::Min(120, $e.Message.Length))\n                }\n            }\n        }\n    }\n\n    if ($dsmTreffer.Count -gt 0) {\n        Write-Host \"`n  [!] TREFFER: Serielle/Arduino/MAKCU-Geraete im DeviceSetupManager-Log!\" -ForegroundColor Red\n        $dsmTreffer | Sort-Object Zeit -Descending | Select-Object -First 20 | ForEach-Object {\n            $col = if ($_.Chip -match 'ESP32|MAKCU') { 'Red' } else { 'Yellow' }\n            Write-Host (\"`n  [{0}] EID {1}\" -f $_.Zeit, $_.EID) -ForegroundColor $col\n            if ($_.Chip) { Write-Host (\"  Chip/Typ : {0}\" -f $_.Chip) -ForegroundColor $col }\n            if ($_.COM)  { Write-Host (\"  COM-Port : {0}\" -f $_.COM)  -ForegroundColor $col }\n            Write-Host (\"  Meldung  : {0}...\" -f $_.Meldung) -ForegroundColor DarkGray\n        }\n        Write-Host \"`n  Bedeutung: CH34x = Arduino-Klon (Input-Emulator Basis)\" -ForegroundColor DarkGray\n        Write-Host \"             ESP32-S3 = MAKCU oder aehnliches Aim-Geraet\" -ForegroundColor DarkGray\n        Write-Host \"             COM-Port-Eintrag = serielles USB-Geraet war angeschlossen\" -ForegroundColor DarkGray\n    } else {\n        Write-Host \"  Keine Arduino/MAKCU/ESP32-Spuren im DeviceSetupManager-Log.\" -ForegroundColor Green\n    }\n\n    # --- COM-Port-Registry: jemals registrierte serielle Geraete ---\n    Write-Host \"`n--- COM-Port-Historie (Registry) ---\" -ForegroundColor DarkGray\n    $comKey = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\COM Name Arbiter\\Devices'\n    if (Test-Path $comKey) {\n        $comPorts = Get-ItemProperty $comKey -ErrorAction SilentlyContinue\n        if ($comPorts) {\n            $comPorts.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {\n                Write-Host (\"  {0} = {1}\" -f $_.Name, $_.Value)\n            }\n        }\n    } else {\n        Write-Host \"  COM-Arbiter-Key nicht vorhanden.\" -ForegroundColor DarkGray\n    }\n}\n\n# ============================================================\n#  7 - Fernwartungssoftware\n# ============================================================\nfunction Invoke-RemoteTools {\n    Write-Host \"`n=== Fernwartungssoftware ===\" -ForegroundColor Cyan\n    $fund = $false\n\n    Write-Host \"`n--- Installiert (Registry) ---\" -ForegroundColor DarkGray\n    $uninst = @(\n      'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',\n      'HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',\n      'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'\n    )\n    $tr = @(Get-ItemProperty $uninst -ErrorAction SilentlyContinue |\n        Where-Object { $_.DisplayName -match $MUSTER } |\n        Select-Object DisplayName, DisplayVersion, InstallDate, InstallLocation)\n    if ($tr) { $tr | Format-Table -AutoSize -Wrap; $fund = $true }\n    else { Write-Host \"Nichts gefunden.\" -ForegroundColor Green }\n\n    Write-Host \"`n--- Prefetch (belegt AUSFUEHRUNG) ---\" -ForegroundColor DarkGray\n    $pfEnabled = (Get-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters' -Name EnablePrefetcher -ErrorAction SilentlyContinue).EnablePrefetcher\n    if ($pfEnabled -eq 0) {\n        Write-Host \"Prefetch ist DEAKTIVIERT - dieser Test ist wertlos.\" -ForegroundColor Yellow\n    }\n    $pf = @(Get-ChildItem 'C:\\Windows\\Prefetch\\*.pf' -ErrorAction SilentlyContinue |\n        Where-Object { $_.Name -match $MUSTER } |\n        Select-Object Name, CreationTime, LastWriteTime)\n    if ($pf) { $pf | Format-Table -AutoSize; $fund = $true }\n    else { Write-Host \"Kein Prefetch-Eintrag.\" -ForegroundColor Green }\n\n    Write-Host \"`n--- Dateien / Ordner ---\" -ForegroundColor DarkGray\n    $pfade = @(\"$env:ProgramFiles\",\"${env:ProgramFiles(x86)}\",\"$env:APPDATA\",\n               \"$env:LOCALAPPDATA\",\"$env:ProgramData\",\"$env:USERPROFILE\\Downloads\",\"$env:USERPROFILE\\Desktop\")\n    $df = @(foreach ($p in $pfade) {\n        if (Test-Path $p) {\n            Get-ChildItem $p -Recurse -Depth 2 -ErrorAction SilentlyContinue |\n                Where-Object { $_.Name -match $MUSTER } |\n                Select-Object FullName, Length, CreationTime, LastWriteTime\n        }\n    })\n    if ($df) { $df | Sort-Object CreationTime | Format-Table -AutoSize -Wrap; $fund = $true }\n    else { Write-Host \"Keine Dateien gefunden.\" -ForegroundColor Green }\n\n    Write-Host \"`n--- Dienste ---\" -ForegroundColor DarkGray\n    $sv = @(Get-CimInstance Win32_Service -ErrorAction SilentlyContinue |\n        Where-Object { $_.Name -match $MUSTER -or $_.DisplayName -match $MUSTER -or $_.PathName -match $MUSTER } |\n        Select-Object Name, DisplayName, State, StartMode, PathName)\n    if ($sv) { $sv | Format-Table -AutoSize -Wrap; $fund = $true }\n    else { Write-Host \"Keine Dienste.\" -ForegroundColor Green }\n\n    Write-Host \"`n--- Programmspuren in der Registry ---\" -ForegroundColor DarkGray\n    $rk = @(\n      'HKCU:\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\Shell\\MuiCache',\n      'HKCU:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Store',\n      'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Store'\n    )\n    $sp = @(foreach ($k in $rk) {\n        if (Test-Path $k) {\n            (Get-Item $k).Property | Where-Object { $_ -match $MUSTER } |\n                ForEach-Object { [PSCustomObject]@{ Quelle=(Split-Path $k -Leaf); Eintrag=$_ } }\n        }\n    })\n    if ($sp) { $sp | Format-Table -AutoSize -Wrap; $fund = $true }\n    else { Write-Host \"Keine Registry-Spuren.\" -ForegroundColor Green }\n\n    Write-Host \"`n--- Firewall-Regeln ---\" -ForegroundColor DarkGray\n    $fw = @(Get-NetFirewallRule -ErrorAction SilentlyContinue |\n        Where-Object { $_.DisplayName -match $MUSTER } |\n        Select-Object DisplayName, Enabled, Direction, Action)\n    if ($fw) { $fw | Format-Table -AutoSize; $fund = $true }\n    else { Write-Host \"Keine Firewall-Regeln.\" -ForegroundColor Green }\n\n    if ($fund) {\n        Write-Host \"`nTREFFER vorhanden - Eintraege einzeln pruefen.\" -ForegroundColor Red\n        Write-Host \"Fernwartung hat viele harmlose Gruende. Der Zeitpunkt entscheidet.\" -ForegroundColor DarkGray\n    } else {\n        Write-Host \"`nKeine Hinweise auf Fernwartungssoftware.\" -ForegroundColor Green\n    }\n}\n\n# ============================================================\n#  8 - Fernwartung: Sitzungen und Dateiuebertragungen\n# ============================================================\nfunction Invoke-RemoteSessions {\n    Write-Host \"`n=== Fernwartung: Sitzungen und Dateiuebertragungen ===\" -ForegroundColor Cyan\n\n    # Schluesselwoerter, die auf Dateiuebertragung hindeuten\n    $ftMuster = 'file transfer|filetransfer|Files\\b|Starting file|Download|Upload|transfer of|Dateiuebertragung|Datei\u00c3\u00bcbertragung'\n\n    # --- AnyDesk ---\n    Write-Host \"`n--- AnyDesk ---\" -ForegroundColor DarkGray\n    $adPfade = @(\"$env:ProgramData\\AnyDesk\", \"$env:APPDATA\\AnyDesk\")\n    $adGefunden = $false\n    foreach ($p in $adPfade) {\n        if (-not (Test-Path $p)) { continue }\n        $adGefunden = $true\n        Write-Host \"Ordner: $p\" -ForegroundColor DarkGray\n        Get-ChildItem $p -Filter '*.trace' -ErrorAction SilentlyContinue |\n            Select-Object Name, Length, CreationTime, LastWriteTime | Format-Table -AutoSize\n\n        # connection_trace.txt: eine Zeile pro Sitzung\n        $ct = Join-Path $p 'connection_trace.txt'\n        if (Test-Path $ct) {\n            Write-Host \"-- Sitzungen (connection_trace.txt) --\" -ForegroundColor Yellow\n            Get-Content $ct -ErrorAction SilentlyContinue | Where-Object { $_.Trim() } |\n                ForEach-Object { Write-Host \"   $_\" }\n        }\n\n        # Dateiuebertragungen aus den Trace-Dateien\n        $tf = @(Get-ChildItem $p -Filter '*.trace' -ErrorAction SilentlyContinue)\n        foreach ($f in $tf) {\n            $hits = @(Select-String -Path $f.FullName -Pattern $ftMuster -ErrorAction SilentlyContinue)\n            if ($hits.Count -gt 0) {\n                Write-Host \"-- Moegliche Dateiuebertragung in $($f.Name) --\" -ForegroundColor Red\n                $hits | Select-Object -Last 40 | ForEach-Object { Write-Host \"   $($_.Line.Trim())\" }\n            }\n        }\n    }\n    if (-not $adGefunden) { Write-Host \"Keine AnyDesk-Ordner vorhanden.\" -ForegroundColor Green }\n\n    # --- RustDesk ---\n    Write-Host \"`n--- RustDesk ---\" -ForegroundColor DarkGray\n    $rdPfade = @(\"$env:APPDATA\\RustDesk\", \"$env:ProgramData\\RustDesk\", \"$env:LOCALAPPDATA\\RustDesk\")\n    $rdGefunden = $false\n    foreach ($p in $rdPfade) {\n        if (-not (Test-Path $p)) { continue }\n        $rdGefunden = $true\n        Write-Host \"Ordner: $p\" -ForegroundColor DarkGray\n        Get-ChildItem $p -Recurse -Include '*.log','*.toml' -ErrorAction SilentlyContinue |\n            Select-Object FullName, Length, CreationTime, LastWriteTime | Format-Table -AutoSize -Wrap\n\n        $logs = @(Get-ChildItem $p -Recurse -Filter '*.log' -ErrorAction SilentlyContinue)\n        foreach ($f in $logs) {\n            $hits = @(Select-String -Path $f.FullName -Pattern ($ftMuster + '|remote_id|Connection from|session') -ErrorAction SilentlyContinue)\n            if ($hits.Count -gt 0) {\n                Write-Host \"-- Eintraege in $($f.Name) --\" -ForegroundColor Yellow\n                $hits | Select-Object -Last 40 | ForEach-Object { Write-Host \"   $($_.Line.Trim())\" }\n            }\n        }\n    }\n    if (-not $rdGefunden) { Write-Host \"Keine RustDesk-Ordner vorhanden.\" -ForegroundColor Green }\n\n    # --- TeamViewer ---\n    Write-Host \"`n--- TeamViewer ---\" -ForegroundColor DarkGray\n    $tvPfade = @(\"$env:APPDATA\\TeamViewer\", \"$env:ProgramData\\TeamViewer\",\n                 \"$env:ProgramFiles\\TeamViewer\", \"${env:ProgramFiles(x86)}\\TeamViewer\")\n    $tvGefunden = $false\n    foreach ($p in $tvPfade) {\n        if (-not (Test-Path $p)) { continue }\n        $tvGefunden = $true\n        $conn = @(Get-ChildItem $p -Recurse -Include 'Connections*.txt' -ErrorAction SilentlyContinue)\n        foreach ($f in $conn) {\n            Write-Host \"-- $($f.FullName) --\" -ForegroundColor Yellow\n            Get-Content $f.FullName -ErrorAction SilentlyContinue | Where-Object { $_.Trim() } |\n                Select-Object -Last 40 | ForEach-Object { Write-Host \"   $_\" }\n        }\n        $tvlogs = @(Get-ChildItem $p -Recurse -Filter '*Logfile*.log' -ErrorAction SilentlyContinue)\n        foreach ($f in $tvlogs) {\n            $hits = @(Select-String -Path $f.FullName -Pattern $ftMuster -ErrorAction SilentlyContinue)\n            if ($hits.Count -gt 0) {\n                Write-Host \"-- Moegliche Dateiuebertragung in $($f.Name) --\" -ForegroundColor Red\n                $hits | Select-Object -Last 30 | ForEach-Object { Write-Host \"   $($_.Line.Trim())\" }\n            }\n        }\n    }\n    if (-not $tvGefunden) { Write-Host \"Keine TeamViewer-Ordner vorhanden.\" -ForegroundColor Green }\n\n    # --- Gegenprobe: geloeschte Logs / Ordnerzeiten ---\n    Write-Host \"`n--- Gegenprobe ---\" -ForegroundColor DarkGray\n    foreach ($p in ($adPfade + $rdPfade + $tvPfade)) {\n        if (Test-Path $p) {\n            $d = Get-Item $p\n            $anz = @(Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue).Count\n            Write-Host (\"{0} | Erstellt {1} | Geaendert {2} | {3} Dateien\" -f $p, $d.CreationTime, $d.LastWriteTime, $anz)\n        }\n    }\n\n    Write-Host \"`nHinweis: Ordner vorhanden, aber Logdateien fehlen oder sind leer\" -ForegroundColor DarkGray\n    Write-Host \"= Spuren wurden geloescht. Das ist selbst ein Befund.\" -ForegroundColor DarkGray\n    Write-Host \"Zeitangaben in den Logs sind Ortszeit des Rechners.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  9 - Unsignierte Dateien (Treiber / Prozesse / Ablageorte)\n# ============================================================\nfunction Invoke-Unsigned {\n    Write-Host \"`n=== Unsignierte Dateien ===\" -ForegroundColor Cyan\n\n    # Signaturstatus, der als unauffaellig gilt\n    $okStatus = @('Valid')\n\n    # --- 9a: Geladene Kernel-Treiber (wichtigster Teil) ---\n    Write-Host \"`n--- Geladene Kernel-Treiber ---\" -ForegroundColor DarkGray\n    $drv = @(Get-CimInstance Win32_SystemDriver -ErrorAction SilentlyContinue |\n        Where-Object { $_.State -eq 'Running' -and $_.PathName })\n    $drvBad = @()\n    foreach ($d in $drv) {\n        $path = ($d.PathName -replace '\\\\SystemRoot', $env:SystemRoot) -replace '^\\\\\\?\\?\\\\',''\n        if (-not (Test-Path $path)) { continue }\n        $sig = Get-AuthenticodeSignature $path -ErrorAction SilentlyContinue\n        if ($sig.Status -notin $okStatus) {\n            $drvBad += [PSCustomObject]@{\n                Name    = $d.Name\n                Status  = $sig.Status\n                Signierer = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1' } else { '-' }\n                Pfad    = $path\n            }\n        }\n    }\n    if ($drvBad.Count -gt 0) {\n        $drvBad | Format-Table -AutoSize -Wrap\n        Write-Host \"$($drvBad.Count) nicht gueltig signierte Treiber - EINZELN pruefen.\" -ForegroundColor Red\n    } else {\n        Write-Host \"Alle geladenen Treiber gueltig signiert.\" -ForegroundColor Green\n    }\n\n    # --- 9b: Laufende Prozesse ---\n    Write-Host \"`n--- Laufende Prozesse ---\" -ForegroundColor DarkGray\n    $procBad = @()\n    Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Path } |\n        Select-Object -Property Path -Unique | ForEach-Object {\n            $sig = Get-AuthenticodeSignature $_.Path -ErrorAction SilentlyContinue\n            if ($sig.Status -notin $okStatus) {\n                $procBad += [PSCustomObject]@{\n                    Status    = $sig.Status\n                    Signierer = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1' } else { '-' }\n                    Pfad      = $_.Path\n                }\n            }\n        }\n    if ($procBad.Count -gt 0) {\n        $procBad | Sort-Object Pfad | Format-Table -AutoSize -Wrap\n        Write-Host \"$($procBad.Count) nicht gueltig signierte Prozesse.\" -ForegroundColor Red\n    } else {\n        Write-Host \"Alle laufenden Prozesse gueltig signiert.\" -ForegroundColor Green\n    }\n\n    # --- 9c: Ausfuehrbare Dateien in typischen Ablageorten ---\n    Write-Host \"`n--- .exe/.sys/.dll in Ablageorten (Temp, Downloads, AppData) ---\" -ForegroundColor DarkGray\n    $orte = @(\"$env:TEMP\",\"$env:USERPROFILE\\Downloads\",\"$env:APPDATA\",\"$env:LOCALAPPDATA\\Temp\",\"$env:ProgramData\")\n    $fileBad = @()\n    foreach ($o in $orte) {\n        if (-not (Test-Path $o)) { continue }\n        Get-ChildItem $o -Recurse -Depth 2 -Include '*.exe','*.sys','*.dll' -ErrorAction SilentlyContinue |\n            ForEach-Object {\n                $sig = Get-AuthenticodeSignature $_.FullName -ErrorAction SilentlyContinue\n                if ($sig.Status -eq 'NotSigned') {\n                    $fileBad += [PSCustomObject]@{\n                        Erstellt = $_.CreationTime\n                        Groesse  = $_.Length\n                        Pfad     = $_.FullName\n                    }\n                }\n            }\n    }\n    if ($fileBad.Count -gt 0) {\n        $fileBad | Sort-Object Erstellt -Descending | Select-Object -First 60 | Format-Table -AutoSize -Wrap\n        Write-Host \"$($fileBad.Count) unsignierte Dateien (max. 60 gezeigt).\" -ForegroundColor Yellow\n    } else {\n        Write-Host \"Keine unsignierten Dateien in den Ablageorten.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`nHinweis: 'UnknownError' heisst meist, dass die Datei nicht\" -ForegroundColor DarkGray\n    Write-Host \"signiert ist. Viele legitime Programme sind unsigniert -\" -ForegroundColor DarkGray\n    Write-Host \"ein unsignierter KERNEL-TREIBER ist der relevante Befund,\" -ForegroundColor DarkGray\n    Write-Host \"unsignierte Nutzerprogramme sind es meist nicht.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  10 - PowerShell-History und Ausfuehrungsprotokoll\n# ============================================================\nfunction Invoke-PSHistory {\n    Write-Host \"`n=== PowerShell-History ===\" -ForegroundColor Cyan\n\n    # --- 10a: PSReadline-History aller Benutzer ---\n    Write-Host \"`n--- PSReadline ConsoleHost_history.txt (alle Profile) ---\" -ForegroundColor DarkGray\n    $profile = Get-ChildItem 'C:\\Users' -Directory -ErrorAction SilentlyContinue\n    $gefunden = $false\n    foreach ($u in $profile) {\n        $hf = Join-Path $u.FullName 'AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt'\n        if (Test-Path $hf) {\n            $gefunden = $true\n            $f = Get-Item $hf -Force\n            $zeilen = @(Get-Content $hf -ErrorAction SilentlyContinue)\n            Write-Host \"`nBenutzer: $($u.Name)\" -ForegroundColor Yellow\n            Write-Host (\"  Datei: {0:N0} Bytes | Geaendert: {1} | {2} Zeilen\" -f $f.Length,$f.LastWriteTime,$zeilen.Count)\n            if ($zeilen.Count -eq 0) {\n                Write-Host \"  AUFFAELLIG: History-Datei ist LEER.\" -ForegroundColor Red\n            } else {\n                Write-Host \"  --- Inhalt ---\" -ForegroundColor DarkGray\n                $zeilen | ForEach-Object { Write-Host \"    $_\" }\n            }\n        } else {\n            # Datei fehlt, aber Profil existiert\n            $psDir = Join-Path $u.FullName 'AppData\\Roaming\\Microsoft\\Windows\\PowerShell'\n            if (Test-Path $psDir) {\n                Write-Host \"`nBenutzer: $($u.Name)\" -ForegroundColor Yellow\n                Write-Host \"  AUFFAELLIG: PowerShell genutzt, aber History-Datei fehlt.\" -ForegroundColor Red\n            }\n        }\n    }\n    if (-not $gefunden) {\n        Write-Host \"Keine PSReadline-History gefunden.\" -ForegroundColor Yellow\n    }\n\n    # --- 10b: ScriptBlock-Logging (EID 4104) - ergiebigste Quelle ---\n    Write-Host \"`n--- ScriptBlock-Logging (PowerShell/Operational EID 4104) ---\" -ForegroundColor DarkGray\n    $sb = @(Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4104} -MaxEvents 200 -ErrorAction SilentlyContinue)\n    if ($sb.Count -gt 0) {\n        Write-Host \"$($sb.Count) Ereignisse geladen. Zeige zusammengesetzte Skriptbloecke:\" -ForegroundColor Green\n        # Nur den ersten Teil jedes mehrteiligen Blocks nehmen (Teil 1 von N),\n        # damit ein Skript nicht N-fach erscheint; Windows-Eigenaufrufe filtern.\n        $sb | Sort-Object TimeCreated -Descending | ForEach-Object {\n            $x = [xml]$_.ToXml()\n            $data = $x.Event.EventData.Data\n            $teil = ($data | Where-Object { $_.Name -eq 'MessageNumber' }).'#text'\n            $code = ($data | Where-Object { $_.Name -eq 'ScriptBlockText' }).'#text'\n            [PSCustomObject]@{ Zeit=$_.TimeCreated; Teil=$teil; Code=$code }\n        } | Where-Object {\n            $_.Teil -eq '1' -and\n            $_.Code -and\n            $_.Code -notmatch 'prompt|PSConsoleHostReadLine|Set-PSReadLine|__VSCode|Get-Module|CompletionPredictor|IsAzureContextPresent'\n        } | Select-Object -First 25 | ForEach-Object {\n            $c = ($_.Code -replace '\\s+',' ').Trim()\n            if ($c.Length -gt 200) { $c = $c.Substring(0,200) + ' [...]' }\n            Write-Host (\"`n  [{0}]\" -f $_.Zeit) -ForegroundColor Yellow\n            Write-Host (\"  {0}\" -f $c)\n        }\n    } else {\n        Write-Host \"ScriptBlock-Logging nicht aktiv oder keine Eintraege.\" -ForegroundColor Yellow\n        Write-Host \"(Standardmaessig aus - Fehlen ist hier NICHT auffaellig.)\" -ForegroundColor DarkGray\n    }\n\n    # --- 10c: Modul-Logging (EID 4103) ---\n    Write-Host \"`n--- Modul-Logging (EID 4103) ---\" -ForegroundColor DarkGray\n    $ml = @(Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4103} -MaxEvents 20 -ErrorAction SilentlyContinue)\n    if ($ml.Count -gt 0) {\n        Write-Host \"$($ml.Count) Ereignisse vorhanden.\" -ForegroundColor Green\n    } else {\n        Write-Host \"Kein Modul-Logging.\" -ForegroundColor Yellow\n    }\n\n    # --- 10e: HostApplication aus Klassik-Log (EID 400/600) ---\n    # Standardmaessig AKTIV - zeigt die Startkommandozeile jeder PS-Sitzung.\n    Write-Host \"`n--- Start-Kommandozeilen (Windows PowerShell EID 400/600) ---\" -ForegroundColor DarkGray\n    $klassik = @(Get-WinEvent -FilterHashtable @{LogName='Windows PowerShell';Id=400,600} -MaxEvents 500 -ErrorAction SilentlyContinue)\n    if ($klassik.Count -gt 0) {\n        $verdacht = '-enc |-encodedcommand|-e [A-Za-z0-9+/]{20}|downloadstring|downloadfile|downloaddata|-w hidden|-windowstyle hidden|invoke-expression| iex |frombase64|webclient|start-bitstransfer|certutil.*-urlcache|bitsadmin|invoke-webrequest|invoke-restmethod|\\bcurl |\\bwget |\\birm |\\biwr |net\\.webclient|system\\.net\\.http|http://|https://'\n        $cmds = $klassik | ForEach-Object {\n            if ($_.Message -match 'HostApplication=(.+?)(\\r?\\n|$)') {\n                [PSCustomObject]@{ Zeit=$_.TimeCreated; Cmd=$matches[1].Trim() }\n            }\n        } | Where-Object { $_.Cmd } |\n            Group-Object Cmd | ForEach-Object {\n                $g = $_.Group | Sort-Object Zeit\n                [PSCustomObject]@{ Erstmals=$g[0].Zeit; Zuletzt=$g[-1].Zeit; Anzahl=$_.Count; Cmd=$_.Name }\n            } | Sort-Object Zuletzt -Descending\n\n        Write-Host \"$($cmds.Count) unterschiedliche Start-Kommandozeilen:\" -ForegroundColor Green\n        # Bekannt-gute Aufrufe, die trotz Download-Muster NICHT rot sein sollen\n        # (der Lade-Einzeiler des Pruefwerkzeugs selbst).\n        $eigenesTool = 'gist\\.githubusercontent\\.com/analystdark|pnpcheck\\.ps1'\n        foreach ($c in $cmds) {\n            $ausg = $c.Cmd\n            if ($ausg.Length -gt 200) { $ausg = $ausg.Substring(0,200) + ' [...]' }\n            if ($c.Cmd -match $verdacht -and $c.Cmd -notmatch $eigenesTool) {\n                Write-Host (\"`n  [{0}]  ({1}x)\" -f $c.Zuletzt, $c.Anzahl) -ForegroundColor Red\n                Write-Host (\"  VERDAECHTIG: {0}\" -f $ausg) -ForegroundColor Red\n            } else {\n                Write-Host (\"`n  [{0}]  ({1}x)\" -f $c.Zuletzt, $c.Anzahl) -ForegroundColor Yellow\n                Write-Host (\"  {0}\" -f $ausg)\n            }\n        }\n        Write-Host \"`nRot = Muster wie -enc, hidden, DownloadString, IEX (nicht immer boese,\" -ForegroundColor DarkGray\n        Write-Host \"aber typisch fuer verschleierte Ausfuehrung - einzeln pruefen).\" -ForegroundColor DarkGray\n    } else {\n        Write-Host \"Keine 400/600-Ereignisse - Klassik-Log leer oder geleert.\" -ForegroundColor Red\n        Write-Host \"(Dieses Log ist normal AKTIV; ein leeres ist auffaellig.)\" -ForegroundColor DarkGray\n    }\n\n    # --- 10d: Wurde das PowerShell-Log geleert? ---\n    Write-Host \"`n--- PowerShell-Log-Status ---\" -ForegroundColor DarkGray\n    Get-WinEvent -ListLog 'Microsoft-Windows-PowerShell/Operational','Windows PowerShell' -ErrorAction SilentlyContinue |\n        Select-Object LogName, IsEnabled, RecordCount | Format-Table -AutoSize\n\n    Write-Host \"Hinweis: Eine leere/fehlende History bei sonst genutztem PowerShell\" -ForegroundColor DarkGray\n    Write-Host \"deutet auf gezieltes Loeschen hin - selbst ein Befund.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  11 - Discord-Account-IDs (nur User-ID, KEINE Token)\n# ============================================================\nfunction Invoke-DiscordId {\n    Write-Host \"`n=== Discord-Account-IDs ===\" -ForegroundColor Cyan\n    Write-Host \"(Liest ausschliesslich die user_id_cache-Kennung.\" -ForegroundColor DarkGray\n    Write-Host \" Token werden NICHT gelesen oder ausgegeben.)\" -ForegroundColor DarkGray\n\n    $enc = [System.Text.Encoding]::GetEncoding('ISO-8859-1')\n    $script:treffer = @()\n\n    # Hilfsfunktion: eine Datei nach user_id_cache absuchen\n    $scan = {\n        param($file,$user,$quelle)\n        try { $raw = [System.IO.File]::ReadAllText($file, $enc) } catch { return }\n        foreach ($m in [regex]::Matches($raw, 'user_id_cache[^\\d]{0,20}(\\d{17,20})')) {\n            $script:treffer += [PSCustomObject]@{ Benutzer=$user; Quelle=$quelle; ID=$m.Groups[1].Value }\n        }\n    }\n\n    Get-ChildItem 'C:\\Users' -Directory -ErrorAction SilentlyContinue | ForEach-Object {\n        $user   = $_.Name\n        $roam   = Join-Path $_.FullName 'AppData\\Roaming'\n        $local  = Join-Path $_.FullName 'AppData\\Local'\n\n        # --- Desktop-App (alle Discord-Varianten) ---\n        foreach ($fl in @('discord','discordcanary','discordptb','discorddevelopment')) {\n            $ldb = Join-Path $roam \"$fl\\Local Storage\\leveldb\"\n            if (Test-Path $ldb) {\n                Get-ChildItem $ldb -Include '*.ldb','*.log' -Recurse -ErrorAction SilentlyContinue |\n                    ForEach-Object { & $scan $_.FullName $user \"App:$fl\" }\n            }\n        }\n\n        # --- Chromium-Browser (Profile: Default, Profile 1, ...) ---\n        $chromium = @{\n            'Chrome'  = \"$local\\Google\\Chrome\\User Data\"\n            'Edge'    = \"$local\\Microsoft\\Edge\\User Data\"\n            'Brave'   = \"$local\\BraveSoftware\\Brave-Browser\\User Data\"\n            'Vivaldi' = \"$local\\Vivaldi\\User Data\"\n            'OperaGX' = \"$roam\\Opera Software\\Opera GX Stable\"\n            'Opera'   = \"$roam\\Opera Software\\Opera Stable\"\n        }\n        foreach ($b in $chromium.Keys) {\n            $root = $chromium[$b]\n            if (-not (Test-Path $root)) { continue }\n            # Opera hat kein Profile-Unterverzeichnis, Chrome/Edge/Brave schon\n            Get-ChildItem $root -Directory -ErrorAction SilentlyContinue |\n                Where-Object { $_.Name -eq 'Default' -or $_.Name -like 'Profile *' } |\n                ForEach-Object {\n                    $ldb = Join-Path $_.FullName 'Local Storage\\leveldb'\n                    if (Test-Path $ldb) {\n                        Get-ChildItem $ldb -Include '*.ldb','*.log' -Recurse -ErrorAction SilentlyContinue |\n                            ForEach-Object { & $scan $_.FullName $user \"$b/$($_.Directory.Parent.Parent.Name)\" }\n                    }\n                }\n            # Opera-Fall (leveldb direkt unter root)\n            $ldbDirect = Join-Path $root 'Local Storage\\leveldb'\n            if (Test-Path $ldbDirect) {\n                Get-ChildItem $ldbDirect -Include '*.ldb','*.log' -Recurse -ErrorAction SilentlyContinue |\n                    ForEach-Object { & $scan $_.FullName $user $b }\n            }\n        }\n\n        # --- Firefox (localStorage in SQLite) ---\n        $ffRoot = Join-Path $roam 'Mozilla\\Firefox\\Profiles'\n        if (Test-Path $ffRoot) {\n            Get-ChildItem $ffRoot -Directory -ErrorAction SilentlyContinue | ForEach-Object {\n                $lsRoot = Join-Path $_.FullName 'storage\\default'\n                if (Test-Path $lsRoot) {\n                    Get-ChildItem $lsRoot -Directory -ErrorAction SilentlyContinue |\n                        Where-Object { $_.Name -like '*discord*' } | ForEach-Object {\n                            Get-ChildItem $_.FullName -Include '*.sqlite' -Recurse -ErrorAction SilentlyContinue |\n                                ForEach-Object { & $scan $_.FullName $user 'Firefox' }\n                        }\n                }\n            }\n        }\n    }\n\n    if ($script:treffer.Count -eq 0) {\n        Write-Host \"`nKeine Discord-User-ID gefunden.\" -ForegroundColor Yellow\n        Write-Host \"(Discord nicht installiert/eingeloggt, nur portable genutzt, oder Daten entfernt.)\" -ForegroundColor DarkGray\n        return\n    }\n\n    # Deduplizieren und Account-Alter aus der Snowflake ableiten\n    $script:treffer | Group-Object ID | ForEach-Object {\n        $id = $_.Name\n        $created = try {\n            $ms = ([int64]$id -shr 22) + 1420070400000\n            [DateTimeOffset]::FromUnixTimeMilliseconds($ms).UtcDateTime\n        } catch { $null }\n        [PSCustomObject]@{\n            DiscordID   = $id\n            Erstellt    = if ($created) { $created.ToString('dd.MM.yyyy HH:mm') + ' UTC' } else { '?' }\n            GefundenBei = (($_.Group | Select-Object -ExpandProperty Benutzer -Unique) -join ', ')\n            Quelle      = (($_.Group | Select-Object -ExpandProperty Quelle -Unique) -join ', ')\n        }\n    } | Sort-Object Erstellt | Format-Table -AutoSize -Wrap\n\n    $anz = @($script:treffer | Select-Object -ExpandProperty ID -Unique).Count\n    if ($anz -gt 1) {\n        Write-Host \"$anz unterschiedliche Discord-IDs auf diesem Rechner.\" -ForegroundColor Red\n        Write-Host \"Mehrere Accounts koennen auf geteilte Nutzung oder Ban-Ausweichen deuten - im Kontext pruefen.\" -ForegroundColor DarkGray\n    } else {\n        Write-Host \"1 Discord-ID gefunden.\" -ForegroundColor Green\n    }\n    Write-Host \"Quelle = App-Variante oder Browser/Profil, in dem die ID lag.\" -ForegroundColor DarkGray\n    Write-Host \"Erstelldatum ist aus der ID berechnet (Snowflake), kein Online-Abruf.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  12 - PE Binary & Driver Heuristics Inspector\n# ============================================================\nfunction Invoke-PEInspector {\n    Write-Host \"`n=== PE Binary & Driver Heuristics Inspector ===\" -ForegroundColor Cyan\n    Write-Host \"(SHA256, BYOVD-Abgleich, Signatur, PE-Header, Entropie, APIs, Keywords)\" -ForegroundColor DarkGray\n    Write-Host \"Tipp: Start-Transcript (P) vorher aktivieren um Ergebnis zu sichern.\" -ForegroundColor DarkGray\n\n    $byovdHashes = @{\n        \"01ee72782b1d4182da0eef7f9859f7aa2f89cc46e9df51ef2807f43db4872121\" = \"RTCore64.sys (Micro-Star CVE-2019-16098)\"\n        \"31f4d725d8d7e01dd582120aa0f23223fa1ac3cb4414f4e5da801db9402ab490\" = \"gdrv.sys (GIGABYTE CVE-2018-19320)\"\n        \"eb601822c9a7da4175345a55018698dc54fe66d11a91d1e434f676ab65d382bb\" = \"Capcom.sys (Root-Exploit / SMEP)\"\n        \"046e8c8959d72215a774136e632831f2ff2cc0bcbc2becc278912efee7e3cf40\" = \"mhyprot2.sys (miHoYo Process/Memory Killer)\"\n        \"a66d92ff488e0402b8813c9fb60cf649372d65ab19aa67a421dff03fc29fc2a2\" = \"AsrDrv103.sys (ASRock Physical Memory R/W)\"\n        \"60c38ea120015ff363fe9d63c5a70ebfb44766b9319de8d98d248b6bb83c509a\" = \"ene.sys (ENE Technology DeviceIoControl)\"\n    }\n    $packerSections = @(\"upx0\",\"upx1\",\"upx2\",\".vmp0\",\".vmp1\",\".vmp2\",\"themida\",\".themida\",\".enigma1\",\".enigma2\",\".aspack\",\".adata\",\"pec1\",\"pec2\",\".mpress1\",\".mpress2\")\n    $dangerousAPIs = @{\n        \"Process Injection\"  = @(\"VirtualAllocEx\",\"WriteProcessMemory\",\"CreateRemoteThread\",\"NtQueueApcThread\",\"RtlCreateUserThread\",\"SetThreadContext\")\n        \"Memory Tampering\"   = @(\"NtMapViewOfSection\",\"ZwMapViewOfSection\",\"VirtualProtectEx\",\"NtWriteVirtualMemory\")\n        \"Kernel Interaction\" = @(\"ZwLoadDriver\",\"NtLoadDriver\",\"DeviceIoControl\",\"ObRegisterCallbacks\",\"MmCopyVirtualMemory\",\"MmMapIoSpace\")\n        \"Anti-Debug/Evasion\" = @(\"IsDebuggerPresent\",\"CheckRemoteDebuggerPresent\",\"NtQueryInformationProcess\",\"NtSetInformationThread\")\n    }\n    $suspiciousStrings = @(\n        # Cheat-Funktionen\n        'aimbot','wallhack','silentaim','triggerbot','cheatengine',\n        'processhacker','kdmapper','blackbone','drvload','kernelhook','minifilter',\n        # Injection-Techniken (aus realem WptsExtensions.dll Fund)\n        'manualmap','manual map','manualmapping',\n        'kernelmap','kernel manual map',\n        'injecthost','injectmonitor','injecttrigger',\n        'trigger=%s','injected ok','inject failed',\n        # Weitere Injection-Indikatoren\n        'reflectiveinject','reflective inject','shellcode',\n        'dllinjection','dll injection','remotethread',\n        'mapviewofsection inject','zwmapviewofsection'\n    )\n    # Wortgrenz-Keywords (kommen auch in legitimen Dateien vor)\n    $suspiciousStringsWB = @('hack','inject')\n\n    # Datei waehlen\n    $ziel = Read-Host \"`nPfad zur Datei (.exe/.dll/.sys) - leer lassen fuer Datei-Dialog\"\n    if ([string]::IsNullOrWhiteSpace($ziel)) {\n        Add-Type -AssemblyName System.Windows.Forms -ErrorAction SilentlyContinue\n        $dlg = New-Object System.Windows.Forms.OpenFileDialog\n        $dlg.Filter = \"Binaries & Treiber (*.exe;*.dll;*.sys)|*.exe;*.dll;*.sys|Alle (*.*)|*.*\"\n        if ($dlg.ShowDialog() -eq 'OK') { $ziel = $dlg.FileName }\n        else { Write-Host \"Abgebrochen.\" -ForegroundColor Yellow; return }\n    }\n    if (-not (Test-Path $ziel)) { Write-Host \"Datei nicht gefunden: $ziel\" -ForegroundColor Red; return }\n    if ((Get-Item $ziel).PSIsContainer) { Write-Host \"Pfad ist ein Ordner, keine Datei: $ziel\" -ForegroundColor Red; return }\n\n    $dateiname = Split-Path $ziel -Leaf\n    Write-Host \"`nZiel: $ziel\" -ForegroundColor White\n    Write-Host (\"=\" * 70) -ForegroundColor DarkGray\n\n    try { $bytes = [System.IO.File]::ReadAllBytes($ziel) }\n    catch { Write-Host \"Lesefehler: $_\" -ForegroundColor Red; return }\n\n    # Phase 1: SHA256 & BYOVD\n    Write-Host \"`n[*] Phase 1: SHA256 & BYOVD-Abgleich\" -ForegroundColor Cyan\n    $hasher = [System.Security.Cryptography.SHA256]::Create()\n    $sha256 = [BitConverter]::ToString($hasher.ComputeHash($bytes)).Replace(\"-\",\"\").ToLower()\n    Write-Host \"    SHA256 : $sha256\"\n    if ($byovdHashes.ContainsKey($sha256)) {\n        Write-Host \"    [!!!] BYOVD ERKANNT: $($byovdHashes[$sha256])\" -ForegroundColor Red\n    } else {\n        Write-Host \"    BYOVD  : Kein bekannter anfaelliger Treiber-Hash.\" -ForegroundColor Green\n    }\n\n    # Phase 2: Signatur & EKUs\n    Write-Host \"`n[*] Phase 2: Digitale Signatur & Zertifikats-EKUs\" -ForegroundColor Cyan\n    $sig = Get-AuthenticodeSignature -FilePath $ziel -ErrorAction SilentlyContinue\n    if ($sig) {\n        $sigCol = if ($sig.Status -eq 'Valid') { 'Green' } else { 'Red' }\n        Write-Host \"    Status     : $($sig.Status)\" -ForegroundColor $sigCol\n        if ($sig.SignerCertificate) {\n            Write-Host \"    Inhaber    : $($sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1')\"\n            Write-Host \"    Aussteller : $($sig.SignerCertificate.Issuer -replace '^CN=([^,]+).*','$1')\"\n            foreach ($ext in $sig.SignerCertificate.Extensions) {\n                if ($ext -is [System.Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension]) {\n                    foreach ($oid in $ext.EnhancedKeyUsages) {\n                        switch ($oid.Value) {\n                            \"1.3.6.1.4.1.311.61.1.1\" { Write-Host \"    [EKU] WHQL Hardware-Signatur\" -ForegroundColor Green }\n                            \"1.3.6.1.4.1.311.10.3.6\" { Write-Host \"    [EKU] Windows Kernel-Mode Driver Signing\" -ForegroundColor Green }\n                            \"1.3.6.1.5.5.7.3.3\"       { Write-Host \"    [EKU] Standard Code-Signing\" }\n                        }\n                    }\n                }\n            }\n        } else { Write-Host \"    [!] Nicht signiert.\" -ForegroundColor Red }\n    }\n\n    # Phase 3: PE-Header\n    Write-Host \"`n[*] Phase 3: PE-Header & Anomalien\" -ForegroundColor Cyan\n    if ($bytes.Length -lt 64) { Write-Host \"    Datei zu klein.\" -ForegroundColor Red; return }\n\n    $stream = [System.IO.FileStream]::new($ziel, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read)\n    $reader = [System.IO.BinaryReader]::new($stream)\n    $highestRawEnd = 0\n\n    try {\n        if ($reader.ReadUInt16() -ne 0x5A4D) { Write-Host \"    Kein MZ-Header.\" -ForegroundColor Red; return }\n        $null = $stream.Seek(0x3C, 0); $peOff = $reader.ReadUInt32()\n        $null = $stream.Seek($peOff, 0)\n        if ($reader.ReadUInt32() -ne 0x00004550) { Write-Host \"    Keine PE-Signatur.\" -ForegroundColor Red; return }\n\n        $null = $reader.ReadUInt16()              # Machine\n        $numSec = $reader.ReadUInt16()\n        $null = $reader.ReadUInt32()              # TimeDateStamp\n        $null = $stream.Seek(10, 1)\n        $optHdrSize = $reader.ReadUInt16()\n        $null = $reader.ReadUInt16()              # Characteristics\n        $optPos = $stream.Position\n        $optMagic = $reader.ReadUInt16()\n        $is64 = ($optMagic -eq 0x20B)\n        $null = $stream.Seek($optPos + 16, 0); $epRVA = $reader.ReadUInt32()\n        $null = $stream.Seek($optPos + 32, 0)\n        $secAlign = $reader.ReadUInt32(); $fileAlign = $reader.ReadUInt32()\n        $null = $stream.Seek(16, 1); $sizeHdr = $reader.ReadUInt32()\n        $dllCharOff = if ($is64) { $optPos + 70 } else { $optPos + 46 }\n        $null = $stream.Seek($dllCharOff, 0); $dllChar = $reader.ReadUInt16()\n        $hasASLR = ($dllChar -band 0x0040) -ne 0\n        $hasDEP  = ($dllChar -band 0x0100) -ne 0\n\n        Write-Host \"    Architektur : $(if($is64){'x64'}else{'x86'})\"\n        Write-Host (\"    ASLR        : \" + $(if($hasASLR){'An'}else{'[!] AUS'})) -ForegroundColor $(if($hasASLR){'White'}else{'Red'})\n        Write-Host (\"    DEP/NX      : \" + $(if($hasDEP){'An'}else{'[!] AUS'})) -ForegroundColor $(if($hasDEP){'White'}else{'Red'})\n        Write-Host \"    Alignments  : Sektion=0x$($secAlign.ToString('X')) | Datei=0x$($fileAlign.ToString('X'))\"\n        if ($sizeHdr -gt 4096) { Write-Host \"    [!] SizeOfHeaders ungewoehnlich gross: $sizeHdr Bytes\" -ForegroundColor Yellow }\n\n        # Sanity-Check: Werte ausserhalb realistischer Grenzen = gepackt/geschuetzt\n        $parserValid = $true\n        if ($secAlign -gt 0x200000 -or $fileAlign -gt 0x100000 -or $sizeHdr -gt 0x100000) {\n            Write-Host \"`n    [!] PARSER-WARNUNG: Header-Werte ausserhalb normaler Bereiche.\" -ForegroundColor Yellow\n            Write-Host \"        SectionAlignment=0x$($secAlign.ToString('X')) | FileAlignment=0x$($fileAlign.ToString('X')) | SizeOfHeaders=$sizeHdr\" -ForegroundColor Yellow\n            Write-Host \"        Datei ist wahrscheinlich gepackt oder geschuetzt (z.B. Electron/Chromium, VMProtect, Themida).\" -ForegroundColor Yellow\n            Write-Host \"        Phase 4 (Sektionen) wird uebersprungen - Ergebnisse waeren nicht zuverlaessig.\" -ForegroundColor Yellow\n            $parserValid = $false\n        }\n\n        # Phase 4: Sektionen\n        Write-Host \"`n[*] Phase 4: Sektionen, Entropie & Packer-Erkennung\" -ForegroundColor Cyan\n        if (-not $parserValid) {\n            Write-Host \"    Uebersprungen (siehe Warnung oben).\" -ForegroundColor Yellow\n        } else {\n        $null = $stream.Seek($peOff + 4 + 20 + $optHdrSize, 0)\n        $sectionMap = @()\n\n        for ($i = 0; $i -lt $numSec; $i++) {\n            $nameB = $reader.ReadBytes(8)\n            $sn    = [System.Text.Encoding]::ASCII.GetString($nameB).Trim([char]0)\n            $vSize = $reader.ReadUInt32(); $vAddr = $reader.ReadUInt32()\n            $rSize = $reader.ReadUInt32(); $rPtr  = $reader.ReadUInt32()\n            $null = $stream.Seek(12, 1); $sChar = $reader.ReadUInt32()\n            $isX = ($sChar -band 0x20000000) -ne 0\n            $isW = ($sChar -band 0x80000000) -ne 0\n            if (($rPtr + $rSize) -gt $highestRawEnd) { $highestRawEnd = $rPtr + $rSize }\n            $sectionMap += @{ VirtAddr=$vAddr; VirtSize=[Math]::Max($vSize,1); RawPtr=$rPtr }\n\n            # Entropie inline berechnen\n            $ent = 0.0\n            if ($rSize -gt 0 -and ($rPtr + $rSize) -le $bytes.Length) {\n                $cnt = @{}\n                for ($x = $rPtr; $x -lt ($rPtr + $rSize); $x++) { $b = $bytes[$x]; $cnt[$b] = $cnt[$b] + 1 }\n                foreach ($k in $cnt.Keys) { $p = $cnt[$k] / $rSize; $ent -= $p * [Math]::Log($p, 2) }\n                $ent = [Math]::Round($ent, 2)\n            }\n\n            $fl = \"\"\n            if ($isW -and $isX) { $fl += \" [ALERT: W+X]\" }\n            if ($packerSections -contains $sn.ToLower()) { $fl += \" [PACKER]\" }\n            $col = if ($fl) { 'Red' } elseif ($ent -gt 7.0) { 'Yellow' } else { 'White' }\n            Write-Host (\"    [{0}] Raw:{1,-8} Virt:{2,-8} Entropie:{3}{4}\" -f $sn.PadRight(8),$rSize,$vSize,$ent,$fl) -ForegroundColor $col\n            if ($rSize -eq 0 -and $vSize -gt 0) { Write-Host \"      [!] 0 Bytes auf Platte, $vSize im RAM (Loader/Unpacker)\" -ForegroundColor Yellow }\n            if ($sn -eq '.text' -and $ent -gt 7.0) { Write-Host \"      [!] .text Entropie $ent/8.0 - Code verschluesselt oder gepackt!\" -ForegroundColor Red }\n        }\n\n        # Phase 4b: Import-Tabelle & DLL-Hijacking-Kandidaten\n        Write-Host \"`n[*] Phase 4b: Import-Tabelle & DLL-Hijacking-Check\" -ForegroundColor Cyan\n        $importDirPos = if ($is64) { $optPos + 120 } else { $optPos + 104 }\n        $null = $stream.Seek($importDirPos, 0)\n        $importRVA  = $reader.ReadUInt32()\n        $importSz   = $reader.ReadUInt32()\n\n        if ($importRVA -eq 0 -or $importSz -eq 0) {\n            Write-Host \"    Keine Import-Tabelle vorhanden.\" -ForegroundColor DarkGray\n        } else {\n            # RVA -> Datei-Offset\n            $importOff = -1L\n            foreach ($s in $sectionMap) {\n                if ($importRVA -ge $s.VirtAddr -and $importRVA -lt ($s.VirtAddr + $s.VirtSize)) {\n                    $importOff = [int64]($importRVA - $s.VirtAddr + $s.RawPtr); break\n                }\n            }\n\n            if ($importOff -lt 0) {\n                Write-Host \"    Import-Tabelle nicht mappbar (gepackt?).\" -ForegroundColor Yellow\n            } else {\n                $importedDLLs = @()\n                $pos = [int64]$importOff\n                while ($pos + 20 -le $bytes.Length) {\n                    $nameRVA = [BitConverter]::ToUInt32($bytes, $pos + 12)\n                    if ($nameRVA -eq 0) { break }\n                    $nameOff = -1L\n                    foreach ($s in $sectionMap) {\n                        if ($nameRVA -ge $s.VirtAddr -and $nameRVA -lt ($s.VirtAddr + $s.VirtSize)) {\n                            $nameOff = [int64]($nameRVA - $s.VirtAddr + $s.RawPtr); break\n                        }\n                    }\n                    if ($nameOff -ge 0) {\n                        $sb = [System.Text.StringBuilder]::new()\n                        $nx = [int64]$nameOff\n                        while ($nx -lt $bytes.Length -and $bytes[$nx] -ne 0) { $null = $sb.Append([char]$bytes[$nx]); $nx++ }\n                        $dn = $sb.ToString()\n                        if ($dn -match '(?i)\\.dll$') { $importedDLLs += $dn }\n                    }\n                    $pos += 20\n                }\n\n                Write-Host \"    Importierte DLLs: $($importedDLLs.Count)\"\n                $parentDir = Split-Path $ziel -Parent\n                $hijackFound = $false\n                foreach ($dll in $importedDLLs) {\n                    $sameDir = Join-Path $parentDir $dll\n                    if (Test-Path $sameDir) {\n                        $dllSig = Get-AuthenticodeSignature $sameDir -ErrorAction SilentlyContinue\n                        $dllStatus = if ($dllSig) { $dllSig.Status } else { 'Unbekannt' }\n                        $dllColor = if ($dllStatus -eq 'Valid') { 'Yellow' } else { 'Red' }\n                        Write-Host (\"    [!] HIJACK-KANDIDAT: {0}\" -f $dll) -ForegroundColor $dllColor\n                        Write-Host (\"        Pfad: {0}\" -f $sameDir) -ForegroundColor $dllColor\n                        Write-Host (\"        Signatur: {0}\" -f $dllStatus) -ForegroundColor $dllColor\n                        $hijackFound = $true\n                    }\n                }\n                if (-not $hijackFound) {\n                    Write-Host \"    Keine gleichnamigen DLLs im selben Ordner.\" -ForegroundColor Green\n                }\n            }\n        }\n        } # Ende else parserValid\n\n        # Phase 5: Overlay & eingebettete PEs\n        Write-Host \"`n[*] Phase 5: Overlay & eingebettete PE-Dateien\" -ForegroundColor Cyan\n        if ($bytes.Length -gt $highestRawEnd -and $highestRawEnd -gt 0) {\n            $ovSize = $bytes.Length - $highestRawEnd\n            $cnt2 = @{}\n            for ($x = $highestRawEnd; $x -lt $bytes.Length; $x++) { $b=$bytes[$x]; $cnt2[$b]=$cnt2[$b]+1 }\n            $oe = 0.0\n            foreach ($k in $cnt2.Keys) { $p=$cnt2[$k]/$ovSize; $oe -= $p*[Math]::Log($p,2) }\n            Write-Host \"    [!] OVERLAY: $ovSize Bytes angehaengt (Entropie $([Math]::Round($oe,2))/8.0)\" -ForegroundColor Red\n        } else { Write-Host \"    Kein Overlay.\" -ForegroundColor Green }\n\n        $embN = 0\n        for ($j = 64; $j -lt ($bytes.Length - 1024); $j += 4) {\n            if ($bytes[$j] -eq 0x4D -and $bytes[$j+1] -eq 0x5A) {\n                $lf = [BitConverter]::ToUInt32($bytes, $j + 0x3C)\n                if ($lf -gt 0 -and ($j+$lf+4) -lt $bytes.Length -and $bytes[$j+$lf] -eq 0x50 -and $bytes[$j+$lf+1] -eq 0x45) {\n                    Write-Host \"    [!] Eingebettetes PE bei Offset 0x$($j.ToString('X')) (Dropper/Payload?)\" -ForegroundColor Red\n                    $embN++\n                }\n            }\n        }\n        if ($embN -eq 0) { Write-Host \"    Keine eingebetteten PE-Dateien.\" -ForegroundColor Green }\n\n    } finally { $reader.Close() }\n\n    # Phase 6: PDB-Pfad\n    Write-Host \"`n[*] Phase 6: Debug-Informationen (PDB-Pfad)\" -ForegroundColor Cyan\n    $pdb = $null\n    for ($i = 0; $i -lt ($bytes.Length - 28); $i++) {\n        if ($bytes[$i] -eq 0x52 -and $bytes[$i+1] -eq 0x53 -and $bytes[$i+2] -eq 0x44 -and $bytes[$i+3] -eq 0x53) {\n            $ss = $i + 24; $se = $ss\n            while ($se -lt $bytes.Length -and $bytes[$se] -ne 0) { $se++ }\n            if ($se -gt $ss) {\n                $p = [System.Text.Encoding]::UTF8.GetString($bytes, $ss, $se-$ss)\n                if ($p -match '(?i)\\.pdb$') { $pdb = $p; break }\n            }\n        }\n    }\n    if (-not $pdb) {\n        $ra = [System.Text.Encoding]::ASCII.GetString($bytes)\n        if ($ra -match '([a-zA-Z]:\\\\[^\\x00-\\x1F\\x7F-\\xFF]+\\.pdb)') { $pdb = $matches[1] }\n    }\n    if ($pdb) {\n        Write-Host \"    Build-Pfad: $pdb\"\n        if ($pdb -match '(?i)(cheat|inject|hook|hack|aim|esp|driver|bypass)') {\n            Write-Host \"    [!] ALERT: Verdaechtiges Keyword im Build-Pfad!\" -ForegroundColor Red\n        }\n    } else { Write-Host \"    PDB: Nicht gefunden oder gestrippt.\" -ForegroundColor DarkGray }\n\n    # Phase 7: High-Risk APIs & Cheat-Keywords\n    Write-Host \"`n[*] Phase 7: High-Risk APIs & Cheat-Keywords\" -ForegroundColor Cyan\n    $rawAscii = [System.Text.Encoding]::ASCII.GetString($bytes)\n    $apiTreffer = $false\n    foreach ($cat in $dangerousAPIs.Keys) {\n        $matched = @($dangerousAPIs[$cat] | Where-Object { $rawAscii -match [regex]::Escape($_) })\n        if ($matched.Count -gt 0) {\n            Write-Host \"    [!] $cat ($($matched.Count)): $($matched -join ', ')\" -ForegroundColor Red\n            $apiTreffer = $true\n        }\n    }\n    if (-not $apiTreffer) { Write-Host \"    Keine gefaehrlichen APIs im Klartext.\" -ForegroundColor Green }\n\n    $foundKW = @($suspiciousStrings | Where-Object { $rawAscii -match [regex]::Escape($_) })\n    $foundKW += @($suspiciousStringsWB | Where-Object { $rawAscii -match \"\\b$([regex]::Escape($_))\\b\" })\n    $foundKW = $foundKW | Select-Object -Unique\n    if ($foundKW.Count -gt 0) {\n        Write-Host \"    [!] Verdaechtige Keywords: $($foundKW -join ', ')\" -ForegroundColor Red\n    } else { Write-Host \"    Keine Cheat-Keywords im Klartext.\" -ForegroundColor Green }\n\n    Write-Host \"`n$('=' * 70)\" -ForegroundColor DarkGray\n    Write-Host \"Scan abgeschlossen: $dateiname\" -ForegroundColor Cyan\n    Write-Host \"Hinweis: Ergebnis wird im aktiven Transcript gesichert (Menue P).\" -ForegroundColor DarkGray\n    Write-Host \"Fuer groessere Dateien (.sys/.exe) empfiehlt sich zusaetzlich VirusTotal.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  13 - DLL Hijacking Live-Check (laufende Prozesse)\n# ============================================================\nfunction Invoke-DLLHijackCheck {\n    Write-Host \"`n=== DLL Hijacking Live-Check ===\" -ForegroundColor Cyan\n    Write-Host \"(Pr\u00c3\u00bcft laufende Prozesse auf Module aus unerwarteten Pfaden)\" -ForegroundColor DarkGray\n\n    # Pfade die als legitim gelten\n    $okPfade = @(\n        \"$env:SystemRoot\\\",\n        \"$env:ProgramFiles\\\",\n        \"${env:ProgramFiles(x86)}\\\",\n        \"$env:ProgramData\\Microsoft\\\"\n    )\n\n    Write-Host \"`n--- Module aus unerwarteten Pfaden ---\" -ForegroundColor DarkGray\n    $treffer = @()\n\n    Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Path } | ForEach-Object {\n        $proc    = $_\n        $procDir = (Split-Path $proc.Path -Parent).ToLower().TrimEnd('\\') + '\\'\n        try {\n            $proc.Modules | Where-Object { $_.FileName -and $_.FileName -notmatch '(?i)\\.(node|ocx|cpl|ax)$' } | ForEach-Object {\n                $modPath = $_.FileName\n                $modPathL = $modPath.ToLower()\n                $istOK = ($okPfade | Where-Object { $modPathL.StartsWith($_.ToLower()) }) -or\n                         $modPathL.StartsWith($procDir)\n                if (-not $istOK) {\n                    $sig = Get-AuthenticodeSignature $modPath -ErrorAction SilentlyContinue\n                    $status = if ($sig) { $sig.Status } else { 'Unbekannt' }\n                    $treffer += [PSCustomObject]@{\n                        Prozess  = $proc.Name\n                        PID      = $proc.Id\n                        Modul    = $_.ModuleName\n                        Pfad     = $modPath\n                        Signatur = $status\n                    }\n                }\n            }\n        } catch {}\n    }\n\n    if ($treffer.Count -gt 0) {\n        # Unsignierte zuerst\n        $treffer | Sort-Object Signatur, Prozess | ForEach-Object {\n            $col = if ($_.Signatur -eq 'Valid') { 'Yellow' } else { 'Red' }\n            Write-Host (\"`n  [{0}] PID {1}\" -f $_.Prozess, $_.PID) -ForegroundColor $col\n            Write-Host (\"  Modul : {0}\" -f $_.Modul) -ForegroundColor $col\n            Write-Host (\"  Pfad  : {0}\" -f $_.Pfad) -ForegroundColor $col\n            Write-Host (\"  Sig   : {0}\" -f $_.Signatur) -ForegroundColor $col\n        }\n        $unsigned = @($treffer | Where-Object { $_.Signatur -ne 'Valid' })\n        Write-Host \"`n$($treffer.Count) Treffer gesamt, davon $($unsigned.Count) nicht gueltig signiert.\" -ForegroundColor $(if($unsigned.Count -gt 0){'Red'}else{'Yellow'})\n    } else {\n        Write-Host \"Keine auffaelligen Module gefunden.\" -ForegroundColor Green\n    }\n\n    # Spielprozesse gezielt pruefen\n    Write-Host \"`n--- Spielprozesse gezielt pruefen ---\" -ForegroundColor DarkGray\n    $spielNamen = @('FiveM','FiveM_GTAProcess','GTA5','RageMP','altv','RedM','cfx')\n    $spielProcs = @(Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -match ($spielNamen -join '|') })\n    if ($spielProcs.Count -gt 0) {\n        foreach ($sp in $spielProcs) {\n            Write-Host \"`n  Prozess: $($sp.Name) (PID $($sp.Id))\" -ForegroundColor Yellow\n            try {\n                $sp.Modules | Where-Object { $_.FileName } | ForEach-Object {\n                    $sig = Get-AuthenticodeSignature $_.FileName -ErrorAction SilentlyContinue\n                    $status = if ($sig) { $sig.Status } else { 'Unbekannt' }\n                    if ($status -ne 'Valid') {\n                        Write-Host (\"  [!] Unsigniert: {0}\" -f $_.FileName) -ForegroundColor Red\n                    }\n                }\n            } catch {\n                Write-Host \"  Zugriff auf Module verweigert (Adminrechte noetig).\" -ForegroundColor Yellow\n            }\n        }\n    } else {\n        Write-Host \"Keine FiveM/GTA-Prozesse laufend.\" -ForegroundColor DarkGray\n    }\n\n    Write-Host \"`nHinweis: Gelb = signiert aber ungewoehnlicher Pfad.\" -ForegroundColor DarkGray\n    Write-Host \"         Rot  = unsigniert oder Signatur ungueltig = Befund pruefen.\" -ForegroundColor DarkGray\n    Write-Host \"Fuer Live-Analyse laufender Injektion: Sysinternals Process Monitor empfohlen.\" -ForegroundColor DarkGray\n\n    # --- Bekannte DLL-Hijacking-Zielordner ---\n    Write-Host \"`n--- Bekannte Hijacking-Zielordner (wbem, Tasks, Sysprep...) ---\" -ForegroundColor DarkGray\n\n    # Bekannte Ziel-DLLs fuer wbem-Hijacking (aus realen Faellen)\n    # PHANTOM = diese Dateien existieren auf normalem Windows NICHT in wbem\n    # Ihr blo\u00c3\u0178es Vorhandensein ist bereits verdaechtig - Signatur egal\n    $wbemPhantom = @(\n        'WptsExtensions.dll',   # Phantom-DLL - existiert nie in wbem (Trojan.Yogi u.a.)\n        'WaasMedicSvc.dll',     # Phantom-DLL - gehoert nicht in wbem\n        'wlbsctrl.dll'          # Phantom-DLL - IKEEXT-Hijacking-Ziel\n    )\n    $wbemTargets = @(\n        'msdtcprx.dll',\n        'wmicmiplugin.dll',\n        'wbemcomn.dll'\n    )\n\n    $hijackOrdner = @{\n        'wbem'    = 'C:\\Windows\\System32\\wbem'\n        'Tasks'   = 'C:\\Windows\\System32\\Tasks'\n        'Sysprep' = 'C:\\Windows\\System32\\Sysprep'\n        'Spool'   = 'C:\\Windows\\System32\\spool\\drivers\\x64\\3'\n    }\n\n    $hijackFund = $false\n    foreach ($name in $hijackOrdner.Keys) {\n        $ordner = $hijackOrdner[$name]\n        if (-not (Test-Path $ordner)) { continue }\n\n        $dlls = @(Get-ChildItem $ordner -Filter '*.dll' -ErrorAction SilentlyContinue)\n        if ($dlls.Count -eq 0) { continue }\n\n        Write-Host \"`n  [$name] $ordner\" -ForegroundColor DarkGray\n        foreach ($f in $dlls) {\n            $sig = Get-AuthenticodeSignature $f.FullName -ErrorAction SilentlyContinue\n            $status = if ($sig) { $sig.Status } else { 'Unbekannt' }\n            $signierer = if ($sig -and $sig.SignerCertificate) {\n                $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1'\n            } else { '-' }\n\n            $istMS      = $signierer -match '(?i)Microsoft'\n            $istPhantom = $wbemPhantom -contains $f.Name\n            $istTarget  = $wbemTargets -contains $f.Name\n            $istVerd    = (-not $istMS) -or ($status -ne 'Valid')\n\n            if ($istPhantom) {\n                # Phantom-DLLs sind immer ein Befund - egal ob signiert\n                $col = 'Red'\n                Write-Host (\"    [!!!] PHANTOM-DLL: {0} | Sig: {1} | {2}\" -f $f.Name, $status, $signierer) -ForegroundColor $col\n                Write-Host (\"          Diese Datei gehoert NICHT in diesen Ordner - Hijacking-Beweis!\" ) -ForegroundColor $col\n                $hijackFound = $true\n            } elseif ($istVerd -or $istTarget) {\n                $col = if ($status -ne 'Valid' -or -not $istMS) { 'Red' } else { 'Yellow' }\n                $hinweis = if ($istTarget -and -not $istMS) { ' [BEKANNTES HIJACK-ZIEL + FREMD]' } elseif ($istTarget) { ' [BEKANNTES HIJACK-ZIEL]' } else { '' }\n                Write-Host (\"    [!] {0} | Sig: {1} | {2}{3}\" -f $f.Name, $status, $signierer, $hinweis) -ForegroundColor $col\n                $hijackFund = $true\n            }\n        }\n    }\n\n    if (-not $hijackFund) {\n        Write-Host \"  Keine auffaelligen DLLs in Hijacking-Zielordnern.\" -ForegroundColor Green\n    }\n\n    # --- setupapi.dev.log auf USB-Spuren pruefen ---\n    Write-Host \"`n--- SetupAPI: USB-Cheat-Lader-Spuren ---\" -ForegroundColor DarkGray\n    $setupLog = 'C:\\Windows\\INF\\setupapi.dev.log'\n    if (Test-Path $setupLog) {\n        $hits = @(Select-String -Path $setupLog -Pattern 'setupplatform|cheat|hack|bypass|inject|loader|DMASetup|dma_setup' -ErrorAction SilentlyContinue)\n        if ($hits.Count -gt 0) {\n            Write-Host \"  [!] Verdaechtige Begriffe in setupapi.dev.log:\" -ForegroundColor Red\n            $hits | Select-Object -First 20 | ForEach-Object { Write-Host \"    $($_.Line.Trim())\" -ForegroundColor Red }\n        } else {\n            Write-Host \"  Keine verdaechtigen Cheat-Begriffe in setupapi.dev.log.\" -ForegroundColor Green\n        }\n        # Datei-Zeitstempel: frisch erstellt nach Windows-Installation?\n        $f = Get-Item $setupLog\n        $os2 = Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue\n        if ($os2 -and $f.CreationTime -gt $os2.InstallDate.AddDays(7)) {\n            Write-Host \"  [!] setupapi.dev.log wurde deutlich nach Windows-Installation erstellt - moeglicherweise neu angelegt (Spurverwischung).\" -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"  setupapi.dev.log fehlt - Datei koennte geloescht worden sein.\" -ForegroundColor Red\n    }\n}\n\n# ============================================================\n#  14 - Systemprozesse & Registry-Injection-Vektoren\n# ============================================================\nfunction Invoke-SystemProcessCheck {\n    Write-Host \"`n=== Systemprozesse & Injection-Vektoren ===\" -ForegroundColor Cyan\n    Write-Host \"(Pr\u00c3\u00bcft kritische Prozesse auf fremde Module + Registry-Einstiegspunkte)\" -ForegroundColor DarkGray\n\n    # --- 14a: Kritische Systemprozesse auf nicht-Microsoft-Module ---\n    Write-Host \"`n--- Fremde Module in Systemprozessen ---\" -ForegroundColor DarkGray\n    $kritisch = @('svchost','lsass','winlogon','services','spoolsv','wininit',\n                  'csrss','explorer','lsm','dllhost','dwm','ctfmon','taskhostw',\n                  'msdtc','audiodg','SearchIndexer','WmiPrvSE')\n\n    # Bekannte legitime Dritt-Hersteller die in Systemprozesse laden duerfen\n    $vertrauenswuerdig = @(\n        'Malwarebytes','NVIDIA','Adobe','Intel Corporation','Advanced Micro Devices',\n        'Logitech','Razer','SteelSeries','Corsair','ASUS','MSI','Gigabyte',\n        'Realtek','Qualcomm','Broadcom','Apple','Google','Dropbox','OneDrive'\n    )\n    # Geschuetzte Prozesse bei denen leere Module normal sind (PPL)\n    $geschuetzt = @('lsass','csrss','wininit','services','smss','MsMpEng')\n\n    $systemFund = $false\n    foreach ($pName in $kritisch) {\n        $procs = @(Get-Process -Name $pName -ErrorAction SilentlyContinue)\n        foreach ($proc in $procs) {\n            try {\n                $fremd   = @()\n                $pathlos = @()\n                $proc.Modules | ForEach-Object {\n                    # Nur Module MIT Namen aber OHNE Pfad = Reflective Injection Kandidat\n                    # Leere Eintraege ohne Namen = Enumerierungs-Artefakt, kein Fund\n                    if ($_.ModuleName -and -not $_.FileName) {\n                        if ($geschuetzt -notcontains $pName) {\n                            $pathlos += $_.ModuleName\n                        }\n                        return\n                    }\n                    if (-not $_.FileName) { return }\n\n                    $sig = Get-AuthenticodeSignature $_.FileName -ErrorAction SilentlyContinue\n                    $istMS = $sig -and $sig.Status -eq 'Valid' -and\n                             $sig.SignerCertificate -and\n                             $sig.SignerCertificate.Subject -match '(?i)Microsoft'\n                    if (-not $istMS) {\n                        $status = if ($sig) { $sig.Status } else { 'Unbekannt' }\n                        $sign   = if ($sig -and $sig.SignerCertificate) {\n                            $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1'\n                        } else { 'Nicht signiert' }\n                        # Bekannte legitime Hersteller: grau, nicht rot\n                        $istBekannt = $vertrauenswuerdig | Where-Object { $sign -match [regex]::Escape($_) }\n                        $fremd += [PSCustomObject]@{\n                            Modul    = $_.ModuleName\n                            Pfad     = $_.FileName\n                            Sig      = $status\n                            Signierer= $sign\n                            Bekannt  = [bool]$istBekannt\n                        }\n                    }\n                }\n\n                # Nur ausgeben wenn wirklich verdaechtig (unbekannt/unsigniert ODER pathlos)\n                $echteWarnungen = @($fremd | Where-Object { -not $_.Bekannt -or $_.Sig -ne 'Valid' })\n                $bekannteListe  = @($fremd | Where-Object { $_.Bekannt -and $_.Sig -eq 'Valid' })\n\n                if ($echteWarnungen.Count -gt 0 -or $pathlos.Count -gt 0) {\n                    Write-Host (\"`n  [{0}] PID {1}\" -f $proc.Name, $proc.Id) -ForegroundColor Red\n                    $systemFund = $true\n                    foreach ($m in $echteWarnungen) {\n                        $col = if ($m.Sig -ne 'Valid') { 'Red' } else { 'Yellow' }\n                        Write-Host (\"    [!] {0}\" -f $m.Modul) -ForegroundColor $col\n                        Write-Host (\"        Pfad     : {0}\" -f $m.Pfad) -ForegroundColor $col\n                        Write-Host (\"        Sig      : {0} | {1}\" -f $m.Sig, $m.Signierer) -ForegroundColor $col\n                    }\n                    foreach ($m in $pathlos) {\n                        Write-Host (\"    [!!!] Modul ohne Dateipfad: $m (Reflective Injection?)\" ) -ForegroundColor Red\n                    }\n                }\n                if ($bekannteListe.Count -gt 0) {\n                    Write-Host (\"`n  [{0}] PID {1} - bekannte Dritt-Software ({2} Module):\" -f $proc.Name, $proc.Id, $bekannteListe.Count) -ForegroundColor DarkGray\n                    $bekannteListe | ForEach-Object { Write-Host (\"    $($_.Modul) | $($_.Signierer)\") -ForegroundColor DarkGray }\n                }\n            } catch {\n                if ($geschuetzt -notcontains $pName) {\n                    Write-Host (\"  [{0}] PID {1} - Zugriff verweigert\" -f $pName, $proc.Id) -ForegroundColor DarkGray\n                }\n            }\n        }\n    }\n    if (-not $systemFund) {\n        Write-Host \"Alle geprueften Systemprozesse: nur Microsoft-signierte Module.\" -ForegroundColor Green\n    }\n\n    # --- 14b: AppInit_DLLs ---\n    Write-Host \"`n--- AppInit_DLLs (laedt in JEDEN Prozess mit user32.dll) ---\" -ForegroundColor DarkGray\n    $appInitKeys = @(\n        'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows',\n        'HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows'\n    )\n    foreach ($k in $appInitKeys) {\n        if (Test-Path $k) {\n            $val = (Get-ItemProperty $k -ErrorAction SilentlyContinue).AppInit_DLLs\n            $load = (Get-ItemProperty $k -ErrorAction SilentlyContinue).LoadAppInit_DLLs\n            if ($val -and $val.Trim()) {\n                Write-Host \"  [!!!] AppInit_DLLs GESETZT: $val\" -ForegroundColor Red\n                Write-Host \"        LoadAppInit_DLLs: $load\" -ForegroundColor Red\n            } else {\n                Write-Host \"  $k : Leer (gut).\" -ForegroundColor Green\n            }\n        }\n    }\n\n    # --- 14c: Winlogon Injection (Shell, Userinit, Notify) ---\n    Write-Host \"`n--- Winlogon Injection-Vektoren ---\" -ForegroundColor DarkGray\n    $wlKey = 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon'\n    if (Test-Path $wlKey) {\n        $wl = Get-ItemProperty $wlKey -ErrorAction SilentlyContinue\n        # Shell sollte nur explorer.exe sein\n        if ($wl.Shell -and $wl.Shell -notmatch '^explorer\\.exe$') {\n            Write-Host \"  [!] Shell != explorer.exe: $($wl.Shell)\" -ForegroundColor Red\n        } else { Write-Host \"  Shell     : $($wl.Shell) (OK)\" -ForegroundColor Green }\n        # Userinit\n        if ($wl.Userinit -and $wl.Userinit -notmatch 'userinit\\.exe') {\n            Write-Host \"  [!] Userinit auffaellig: $($wl.Userinit)\" -ForegroundColor Red\n        } else { Write-Host \"  Userinit  : $($wl.Userinit) (OK)\" -ForegroundColor Green }\n    }\n\n    # --- 14d: LSA Security Packages ---\n    Write-Host \"`n--- LSA Authentication & Security Packages ---\" -ForegroundColor DarkGray\n    $lsaKey = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa'\n    if (Test-Path $lsaKey) {\n        $lsa = Get-ItemProperty $lsaKey -ErrorAction SilentlyContinue\n        $authPkg = $lsa.'Authentication Packages'\n        $secPkg  = $lsa.'Security Packages'\n        $notifPkg= $lsa.'Notification Packages'\n        $standard = @('msv1_0','','scecli')\n        foreach ($pkg in $authPkg) {\n            if ($pkg -and $standard -notcontains $pkg.ToLower()) {\n                Write-Host \"  [!] Unbekanntes Auth-Package: $pkg\" -ForegroundColor Red\n            }\n        }\n        Write-Host \"  Auth-Packages  : $($authPkg -join ', ')\"\n        Write-Host \"  Sec-Packages   : $($secPkg -join ', ')\"\n        Write-Host \"  Notify-Packages: $($notifPkg -join ', ')\"\n    }\n\n    # --- 14e: Dienste mit DLL in ungewoehnlichem Pfad ---\n    Write-Host \"`n--- Dienst-DLLs ausserhalb von System32/SysWOW64 ---\" -ForegroundColor DarkGray\n    $dienste = Get-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\*' -ErrorAction SilentlyContinue |\n        Where-Object { $_.ImagePath -like '*svchost*' }\n    $fremdDienst = $false\n    foreach ($svc in $dienste) {\n        $param = $svc.PSPath -replace 'Registry::',''\n        $paramKey = $param + '\\Parameters'\n        if (Test-Path \"Registry::$paramKey\") {\n            $dll = (Get-ItemProperty \"Registry::$paramKey\" -ErrorAction SilentlyContinue).ServiceDll\n            if ($dll -and $dll -notmatch '(?i)^(%SystemRoot%|C:\\\\Windows)\\\\(System32|SysWOW64)\\\\') {\n                Write-Host (\"  [!] Dienst '{0}' laedt DLL aus ungewoehnlichem Pfad:\" -f $svc.PSChildName) -ForegroundColor Red\n                Write-Host (\"      $dll\") -ForegroundColor Red\n                $sig = Get-AuthenticodeSignature ($dll -replace '%SystemRoot%',$env:SystemRoot) -ErrorAction SilentlyContinue\n                if ($sig) { Write-Host (\"      Sig: {0}\" -f $sig.Status) -ForegroundColor Red }\n                $fremdDienst = $true\n            }\n        }\n    }\n    if (-not $fremdDienst) { Write-Host \"  Alle Dienst-DLLs in erwarteten Systempfaden.\" -ForegroundColor Green }\n\n    Write-Host \"`nHinweis: lsass-Module sind ohne SeDebugPrivilege oft nicht lesbar.\" -ForegroundColor DarkGray\n    Write-Host \"Fuer Kernel-Level-Injection (DKOM, direkte Speichermanipulation):\" -ForegroundColor DarkGray\n    Write-Host \"PowerShell reicht nicht aus - da braucht es WinPmem oder Volatility.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  15 - HVCI / Memory Integrity & Code Integrity Treiber-Check\n# ============================================================\nfunction Invoke-HVCICheck {\n    Write-Host \"`n=== HVCI / Memory Integrity & Inkompatible Treiber ===\" -ForegroundColor Cyan\n    Write-Host \"(Deaktivierte Speicherintegritaet + geblockte Kernel-Treiber = DMA-Indiz)\" -ForegroundColor DarkGray\n\n    # --- 15a: HVCI-Status ---\n    Write-Host \"`n--- Memory Integrity (HVCI) Status ---\" -ForegroundColor DarkGray\n    $hvciKey = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity'\n    $vbsKey  = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard'\n    $hvciAktiv = $false\n\n    if (Test-Path $hvciKey) {\n        $hvci = Get-ItemProperty $hvciKey -ErrorAction SilentlyContinue\n        $hvciAktiv = $hvci.Enabled -eq 1\n        $col = if ($hvciAktiv) { 'Green' } else { 'Red' }\n        Write-Host (\"  HVCI (Speicherintegritaet) : {0}\" -f $(if($hvciAktiv){'AKTIV'}else{'DEAKTIVIERT [!]'})) -ForegroundColor $col\n        if (-not $hvciAktiv) {\n            Write-Host \"  --> Inkompatible Treiber koennen in den Kernel geladen werden.\" -ForegroundColor Yellow\n            Write-Host \"      DMA-Karten mit schwach signierten Treibern nutzen genau das.\" -ForegroundColor Yellow\n            Write-Host \"  Manuell pruefen: Windows-Sicherheit \u00e2\u2020\u2019 Geraetesicherheit \u00e2\u2020\u2019 Kernisolierung\" -ForegroundColor DarkGray\n        }\n    } else {\n        Write-Host \"  HVCI-Key nicht gefunden - VBS moeglicherweise nicht konfiguriert.\" -ForegroundColor Yellow\n    }\n\n    if (Test-Path $vbsKey) {\n        $vbs = Get-ItemProperty $vbsKey -ErrorAction SilentlyContinue\n        $vbsAktiv = $vbs.EnableVirtualizationBasedSecurity -eq 1\n        Write-Host (\"  VBS (Virt. Based Security)  : {0}\" -f $(if($vbsAktiv){'AKTIV'}else{'DEAKTIVIERT'})) -ForegroundColor $(if($vbsAktiv){'Green'}else{'Yellow'})\n    }\n\n    # Secure Boot\n    try {\n        $sb = Confirm-SecureBootUEFI -ErrorAction Stop\n        Write-Host (\"  Secure Boot                 : {0}\" -f $(if($sb){'AKTIV'}else{'DEAKTIVIERT [!]'})) -ForegroundColor $(if($sb){'Green'}else{'Red'})\n    } catch {\n        Write-Host \"  Secure Boot                 : Nicht abfragbar (Legacy BIOS oder kein UEFI)\" -ForegroundColor Yellow\n    }\n\n    # --- 15b: Code Integrity Log - geblockte Treiber ---\n    Write-Host \"`n--- Code Integrity: geblockte / abgelehnte Treiber ---\" -ForegroundColor DarkGray\n    Write-Host \"(Event 3033 = geblockt | 3034 = Boot-Treiber | 3076 = Audit | 3077 = Prozess)\" -ForegroundColor DarkGray\n\n    $ciEvents = @(Get-WinEvent -FilterHashtable @{\n        LogName = 'Microsoft-Windows-CodeIntegrity/Operational'\n        Id      = 3033, 3034, 3076, 3077\n    } -MaxEvents 100 -ErrorAction SilentlyContinue)\n\n    # Bekannte legitime Security-DLLs die bei HVCI haeufig 3033 ausloesen\n    $ciWhitelist = @('mbae64\\.dll','mbae\\.dll','mbamswissarmy','MBAMSwissArmy',\n                     'mbamsi64\\.dll','mbamsi\\.dll','mbamupdatetool',\n                     'hmpalert','hmpalert64','CrExigency','sophos','mbae')\n\n    if ($ciEvents.Count -gt 0) {\n        $ciGefiltert = @($ciEvents | Where-Object {\n            $msg = $_.Message\n            -not ($ciWhitelist | Where-Object { $msg -match $_ })\n        })\n        $ciGefiltert_kurz = @($ciEvents | Where-Object {\n            $msg = $_.Message\n            ($ciWhitelist | Where-Object { $msg -match $_ })\n        })\n\n        if ($ciGefiltert_kurz.Count -gt 0) {\n            Write-Host \"  (Herausgefiltert: $($ciGefiltert_kurz.Count)x bekannte Security-Software wie Malwarebytes Anti-Exploit)\" -ForegroundColor DarkGray\n        }\n\n        if ($ciGefiltert.Count -gt 0) {\n            Write-Host \"  $($ciGefiltert.Count) relevante Ereignisse:\" -ForegroundColor Red\n            $ciGefiltert | Sort-Object TimeCreated -Descending | Select-Object -First 20 | ForEach-Object {\n                $eid = $_.Id\n                $col = if ($eid -in @(3033,3034)) { 'Red' } else { 'Yellow' }\n                $msg = ($_.Message -replace '\\s+',' ')\n                $datei = if ($msg -match '\\\\([^\\\\]+\\.sys|[^\\\\]+\\.dll)') { $matches[1] } else { '' }\n                Write-Host (\"`n  [{0}] EID {1}\" -f $_.TimeCreated, $eid) -ForegroundColor $col\n                if ($datei) { Write-Host (\"  Treiber : {0}\" -f $datei) -ForegroundColor $col }\n                Write-Host (\"  Details : {0}...\" -f $msg.Substring(0, [Math]::Min(160, $msg.Length))) -ForegroundColor DarkGray\n            }\n        } else {\n            Write-Host \"  Keine unbekannten geblockten Treiber - nur bekannte Security-Software.\" -ForegroundColor Green\n        }\n    } else {\n        Write-Host \"  Keine geblockten Treiber im Code Integrity Log.\" -ForegroundColor Green\n        if ($hvciAktiv) {\n            Write-Host \"  (HVCI aktiv = Treiber werden gar nicht erst geladen - das ist gut)\" -ForegroundColor DarkGray\n        }\n    }\n\n    # --- 15c: bcdedit - Testsigning und Integritaets-Bypass ---\n    Write-Host \"`n--- Boot-Konfiguration: Testsigning & Integrity-Checks ---\" -ForegroundColor DarkGray\n    $bcd = & bcdedit /enum 2>&1 | Out-String\n    $testsigning = $bcd -match 'testsigning\\s+yes'\n    $nointegrity = $bcd -match 'nointegritychecks\\s+yes'\n    $dbgmode     = $bcd -match 'debug\\s+yes'\n\n    Write-Host (\"  Testsigning        : {0}\" -f $(if($testsigning){'[!!!] AKTIV - unsignierte Treiber erlaubt!'}else{'Deaktiviert (OK)'})) -ForegroundColor $(if($testsigning){'Red'}else{'Green'})\n    Write-Host (\"  NoIntegrityChecks  : {0}\" -f $(if($nointegrity){'[!!!] AKTIV - Integritaetspruefung umgangen!'}else{'Deaktiviert (OK)'})) -ForegroundColor $(if($nointegrity){'Red'}else{'Green'})\n    Write-Host (\"  Debug-Modus        : {0}\" -f $(if($dbgmode){'[!] Aktiv'}else{'Deaktiviert (OK)'})) -ForegroundColor $(if($dbgmode){'Yellow'}else{'Green'})\n\n    if ($testsigning -or $nointegrity) {\n        Write-Host \"`n  [!!!] Treibersignaturen sind aktiv umgangen.\" -ForegroundColor Red\n        Write-Host \"        Jeder beliebige unsignierte Kernel-Treiber kann geladen werden.\" -ForegroundColor Red\n        Write-Host \"        Das ist eine Grundvoraussetzung vieler DMA- und Cheat-Treiber.\" -ForegroundColor Red\n    }\n\n    # --- 15d: Inkompatible Treiber aus pnputil (ergaenzt HVCI-Liste) ---\n    Write-Host \"`n--- Installierte Treiber ohne gueltige WHQL-Signatur ---\" -ForegroundColor DarkGray\n    Write-Host \"(Diese wuerden die HVCI-Aktivierung verhindern)\" -ForegroundColor DarkGray\n    try {\n        $pnpOut = & pnputil /enum-drivers 2>&1 | Out-String\n        $bloecke = $pnpOut -split '(?=Veroeffentlichter Name|Published Name)'\n        $verdaechtig = @($bloecke | Where-Object {\n            $_ -match 'Nicht signiert|Not Signed|Unsigned' -or\n            ($_ -match '(Signierer|Signer)\\s*:' -and $_ -notmatch '(?i)Microsoft|WHQL')\n        })\n        if ($verdaechtig.Count -gt 0) {\n            Write-Host \"  [!] $($verdaechtig.Count) potenziell inkompatible Treiber:\" -ForegroundColor Red\n            $verdaechtig | Select-Object -First 10 | ForEach-Object {\n                $name = if ($_ -match 'oem\\d+\\.inf') { $matches[0] } else { '' }\n                $pub  = if ($_ -match '(?:Herausgeber|Publisher)\\s*:\\s*(.+)') { $matches[1].Trim() } else { '' }\n                if ($name) { Write-Host (\"  {0} | {1}\" -f $name, $pub) -ForegroundColor Yellow }\n            }\n        } else {\n            Write-Host \"  Keine offensichtlich unsignierten Treiber gefunden.\" -ForegroundColor Green\n        }\n    } catch {\n        Write-Host \"  pnputil nicht verfuegbar.\" -ForegroundColor DarkGray\n    }\n\n    Write-Host \"`nFazit-Hilfe:\" -ForegroundColor DarkGray\n    Write-Host \"  Testsigning=Ja + unbekannter Treiber = starker DMA-Hinweis\" -ForegroundColor DarkGray\n    Write-Host \"  HVCI deaktiviert + CI-Events = Treiber wurde installiert und verweigert\" -ForegroundColor DarkGray\n    Write-Host \"  Gut konfigurierte DMA-Karten (echt signiert) erscheinen NICHT im CI-Log\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  16 - System32 Fremdkoerper & Typosquatting-Check\n# ============================================================\nfunction Invoke-System32Check {\n    Write-Host \"`n=== System32 Fremdkoerper & Typosquatting ===\" -ForegroundColor Cyan\n    Write-Host \"(Nicht-Microsoft DLLs + verdaechtige Namen + frische Dateien in System32)\" -ForegroundColor DarkGray\n\n    $sys32 = \"$env:SystemRoot\\System32\"\n    $osInstall = (Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue).InstallDate\n\n    # Bekannte kritische DLL-Namen fuer Typosquatting-Pruefung\n    # Angreifer ersetzen gerne l\u00e2\u2020\u20191, o\u00e2\u2020\u20190, I\u00e2\u2020\u2019l usw.\n    $kritischeDLLs = @(\n        'ntdll','kernel32','kernelbase','user32','advapi32','rpcrt4',\n        'msvcrt','sechost','combase','ucrtbase','win32u','gdi32',\n        'ole32','oleaut32','shell32','shlwapi','wininet','ws2_32',\n        'crypt32','bcrypt','ncrypt','lsasrv','wintrust','wldp'\n    )\n\n    # Bekannte Phantom-DLLs die NIE in System32 gehoeren\n    $system32Phantom = @(\n        'WptsExtensions.dll','WaasMedicSvc.dll','wlbsctrl.dll',\n        'cryptbase2.dll','version2.dll','cryptsp2.dll'\n    )\n\n    Write-Host \"`n--- Nicht-Microsoft DLLs in System32 ---\" -ForegroundColor DarkGray\n    Write-Host \"Scanne... (kann 30-60 Sekunden dauern)\" -ForegroundColor DarkGray\n\n    $fremd   = @()\n    $phantom = @()\n    $frisch  = @()\n    $typo    = @()\n\n    $dlls = @(Get-ChildItem $sys32 -Filter '*.dll' -ErrorAction SilentlyContinue)\n    $total = $dlls.Count\n    $i = 0\n\n    foreach ($f in $dlls) {\n        $i++\n        if ($i % 200 -eq 0) { Write-Host \"  ... $i / $total gepr\u00c3\u00bcft\" -ForegroundColor DarkGray }\n\n        # Phantom-DLL Direkttreffer\n        if ($system32Phantom -contains $f.Name) {\n            $phantom += $f\n            continue\n        }\n\n        # Signaturpruefung - bei gueltigem MS-Zertifikat sofort weiter\n        $sig = Get-AuthenticodeSignature $f.FullName -ErrorAction SilentlyContinue\n        $istMS = $sig -and $sig.Status -eq 'Valid' -and\n                 $sig.SignerCertificate -and\n                 $sig.SignerCertificate.Subject -match '(?i)Microsoft'\n        if ($istMS) { continue }\n\n        $status   = if ($sig) { $sig.Status } else { 'Unbekannt' }\n        $signierer = if ($sig -and $sig.SignerCertificate) {\n            $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1'\n        } else { 'Nicht signiert' }\n\n        $fremd += [PSCustomObject]@{\n            Name      = $f.Name\n            Sig       = $status\n            Signierer = $signierer\n            Erstellt  = $f.CreationTime\n            Groesse   = $f.Length\n        }\n\n        # Frisch nach Windows-Installation erstellt?\n        if ($osInstall -and $f.CreationTime -gt $osInstall.AddDays(30)) {\n            $frisch += $f.Name\n        }\n\n        # Typosquatting-Pruefung\n        $nameBasis = [System.IO.Path]::GetFileNameWithoutExtension($f.Name).ToLower()\n        foreach ($legit in $kritischeDLLs) {\n            if ($nameBasis -ne $legit) {\n                # Levenshtein-Distanz 1 = ein Zeichen anders\n                $dist = 0\n                $a = $nameBasis.ToCharArray()\n                $b = $legit.ToCharArray()\n                if ([Math]::Abs($a.Length - $b.Length) -le 1) {\n                    $diff = 0\n                    $minLen = [Math]::Min($a.Length, $b.Length)\n                    for ($x = 0; $x -lt $minLen; $x++) {\n                        if ($a[$x] -ne $b[$x]) { $diff++ }\n                    }\n                    $diff += [Math]::Abs($a.Length - $b.Length)\n                    if ($diff -le 1) {\n                        $typo += [PSCustomObject]@{ Datei=$f.Name; AehnlichWie=\"$legit.dll\" }\n                    }\n                }\n            }\n        }\n    }\n\n    # --- Ausgabe Phantom ---\n    if ($phantom.Count -gt 0) {\n        Write-Host \"`n  [!!!] PHANTOM-DLLs in System32 (gehoeren NICHT hierher):\" -ForegroundColor Red\n        $phantom | ForEach-Object {\n            $sig2 = Get-AuthenticodeSignature $_.FullName -ErrorAction SilentlyContinue\n            Write-Host (\"  {0} | Sig: {1} | Erstellt: {2}\" -f $_.Name, $(if($sig2){$sig2.Status}else{'Unbekannt'}), $_.CreationTime) -ForegroundColor Red\n        }\n    }\n\n    # --- Ausgabe Fremd ---\n    if ($fremd.Count -gt 0) {\n        Write-Host (\"`n  {0} nicht-Microsoft DLLs in System32:\" -f $fremd.Count) -ForegroundColor Red\n        $fremd | Sort-Object Erstellt -Descending | ForEach-Object {\n            $col = if ($_.Sig -ne 'Valid') { 'Red' } else { 'Yellow' }\n            Write-Host (\"  [!] {0,-35} Sig: {1,-12} Erstellt: {2}\" -f $_.Name, $_.Sig, $_.Erstellt) -ForegroundColor $col\n            if ($_.Signierer -ne 'Nicht signiert') {\n                Write-Host (\"      Signierer: {0}\" -f $_.Signierer) -ForegroundColor DarkGray\n            }\n        }\n    } else {\n        Write-Host \"`n  Alle DLLs in System32 sind Microsoft-signiert.\" -ForegroundColor Green\n    }\n\n    # --- Ausgabe Frisch ---\n    if ($frisch.Count -gt 0) {\n        Write-Host (\"`n  [!] {0} DLLs nach Windows-Installation erstellt/geaendert:\" -f $frisch.Count) -ForegroundColor Yellow\n        $frisch | ForEach-Object { Write-Host \"  $_\" -ForegroundColor Yellow }\n    }\n\n    # --- Ausgabe Typosquatting ---\n    if ($typo.Count -gt 0) {\n        Write-Host \"`n  [!!!] Moegliches Typosquatting:\" -ForegroundColor Red\n        $typo | ForEach-Object {\n            Write-Host (\"  {0} sieht aus wie {1}\" -f $_.Datei, $_.AehnlichWie) -ForegroundColor Red\n        }\n    } else {\n        Write-Host \"`n  Kein Typosquatting bekannter System-DLLs gefunden.\" -ForegroundColor Green\n    }\n\n    Write-Host \"`nHinweis: Nicht-MS-signierte DLLs koennen legitim sein (z.B. AV-Software).\" -ForegroundColor DarkGray\n    Write-Host \"Rot + frisches Erstelldatum + unbekannter Signierer = hoechste Prioritaet.\" -ForegroundColor DarkGray\n    Write-Host \"Typosquatting-Treffer immer manuell pruefen.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  17 - DMA Fuser & Zweiter-PC-Verbindungen\n# ============================================================\nfunction Invoke-FuserCheck {\n    Write-Host \"`n=== DMA Fuser & Zweiter-PC-Verbindungen ===\" -ForegroundColor Cyan\n    Write-Host \"(Netzwerkverbindungen, windowlose Prozesse, Named Pipes, bekannte Fuser)\" -ForegroundColor DarkGray\n\n    # --- 17a: Bekannte Fuser-Prozessnamen ---\n    Write-Host \"`n--- Bekannte DMA-Fuser Prozesse ---\" -ForegroundColor DarkGray\n    $fuserNamen = @(\n        'pcileech','memflow','memprocfs','dmaclient','dmaservice',\n        'easymapi','leechcore','leechagent','fpga','dma_client',\n        'scatterclient','scatter','vmmdll','vmmsharp',\n        'winpmem','rekall','volatility','dumpit'\n    )\n    $fuserGefunden = $false\n    foreach ($n in $fuserNamen) {\n        $p = @(Get-Process -Name $n -ErrorAction SilentlyContinue)\n        if ($p.Count -gt 0) {\n            $p | ForEach-Object {\n                Write-Host (\"  [!!!] {0} (PID {1}) - {2}\" -f $_.Name, $_.Id, $_.Path) -ForegroundColor Red\n            }\n            $fuserGefunden = $true\n        }\n    }\n    if (-not $fuserGefunden) {\n        Write-Host \"  Keine bekannten Fuser-Prozesse gefunden.\" -ForegroundColor Green\n    }\n\n    # --- 17b: Netzwerkverbindungen zu lokalen IPs (PC2-Verbindung) ---\n    Write-Host \"`n--- Netzwerkverbindungen zu lokalen IPs (DMA PC2) ---\" -ForegroundColor DarkGray\n    Write-Host \"(192.168.x.x / 10.x.x.x / 172.16-31.x.x auf ungewoehnlichen Ports)\" -ForegroundColor DarkGray\n\n    $bekanntePortsOK = @(80,443,8080,8443,3389,5985,5986,53,67,68,123,137,138,139,445,1900,5353)\n    $lokaleVerbindungen = @()\n\n    Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {\n        $remIP = $_.RemoteAddress\n        $remPort = $_.RemotePort\n        $istLokal = $remIP -match '^192\\.168\\.|^10\\.|^172\\.(1[6-9]|2[0-9]|3[01])\\.'\n        $portUngewoehnlich = $bekanntePortsOK -notcontains $remPort\n\n        if ($istLokal -and $portUngewoehnlich) {\n            $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue\n            $lokaleVerbindungen += [PSCustomObject]@{\n                Prozess  = if ($proc) { $proc.Name } else { 'Unbekannt' }\n                PID      = $_.OwningProcess\n                LokPort  = $_.LocalPort\n                RemoteIP = $remIP\n                RemPort  = $remPort\n                Pfad     = if ($proc) { $proc.Path } else { '-' }\n            }\n        }\n    }\n\n    if ($lokaleVerbindungen.Count -gt 0) {\n        Write-Host \"  [!] $($lokaleVerbindungen.Count) Verbindungen zu lokalen IPs auf ungewoehnlichen Ports:\" -ForegroundColor Red\n        $lokaleVerbindungen | Sort-Object RemoteIP | ForEach-Object {\n            Write-Host (\"`n  [{0}] PID {1}\" -f $_.Prozess, $_.PID) -ForegroundColor Red\n            Write-Host (\"  Remote: {0}:{1}  (lokal Port {2})\" -f $_.RemoteIP, $_.RemPort, $_.LokPort) -ForegroundColor Red\n            Write-Host (\"  Pfad  : {0}\" -f $_.Pfad) -ForegroundColor DarkGray\n        }\n    } else {\n        Write-Host \"  Keine auffaelligen lokalen Netzwerkverbindungen.\" -ForegroundColor Green\n    }\n\n    # --- 17c: Windowlose Prozesse ohne bekanntes Elternteil ---\n    Write-Host \"`n--- Windowlose Hintergrundprozesse (moegliche versteckte Fuser) ---\" -ForegroundColor DarkGray\n    $systemProz = @('svchost','services','lsass','csrss','wininit','smss','System',\n                    'Registry','fontdrvhost','dwm','WmiPrvSE','spoolsv','SearchIndexer',\n                    'RuntimeBroker','ShellExperienceHost','StartMenuExperienceHost',\n                    'sihost','taskhostw','ctfmon','conhost','dllhost','audiodg',\n                    'MsMpEng','NisSrv','SecurityHealthService','TextInputHost')\n\n    $verdaechtigeProz = @()\n    Add-Type @\"\nusing System;\nusing System.Runtime.InteropServices;\npublic class WinAPI {\n    [DllImport(\"user32.dll\")]\n    public static extern bool IsWindowVisible(IntPtr hWnd);\n    [DllImport(\"user32.dll\")]\n    public static extern IntPtr GetForegroundWindow();\n}\n\"@ -ErrorAction SilentlyContinue\n\n    Get-Process -ErrorAction SilentlyContinue | Where-Object {\n        $_.Name -notin $systemProz -and\n        $_.MainWindowHandle -eq [IntPtr]::Zero -and\n        $_.SessionId -eq (Get-Process -PID $PID).SessionId\n    } | ForEach-Object {\n        $p = $_\n        # Nur Prozesse mit Pfad und ohne Fenster die nicht bekannte Apps sind\n        if ($p.Path -and $p.Path -notmatch '(?i)\\\\Windows\\\\|\\\\Program Files\\\\|\\\\Program Files \\(x86\\)\\\\') {\n            $sig = Get-AuthenticodeSignature $p.Path -ErrorAction SilentlyContinue\n            $istMS = $sig -and $sig.Status -eq 'Valid' -and $sig.SignerCertificate -and $sig.SignerCertificate.Subject -match '(?i)Microsoft'\n            if (-not $istMS) {\n                $verdaechtigeProz += [PSCustomObject]@{\n                    Name     = $p.Name\n                    PID      = $p.Id\n                    Pfad     = $p.Path\n                    Sig      = if ($sig) { $sig.Status } else { 'Unbekannt' }\n                    Signierer= if ($sig -and $sig.SignerCertificate) { $sig.SignerCertificate.Subject -replace '^CN=([^,]+).*','$1' } else { '-' }\n                }\n            }\n        }\n    }\n\n    if ($verdaechtigeProz.Count -gt 0) {\n        Write-Host \"  $($verdaechtigeProz.Count) windowlose, nicht-MS-signierte Prozesse ausserhalb Systemordner:\" -ForegroundColor Yellow\n        $verdaechtigeProz | ForEach-Object {\n            $col = if ($_.Sig -ne 'Valid') { 'Red' } else { 'Yellow' }\n            Write-Host (\"`n  [{0}] PID {1}\" -f $_.Name, $_.PID) -ForegroundColor $col\n            Write-Host (\"  Pfad : {0}\" -f $_.Pfad) -ForegroundColor $col\n            Write-Host (\"  Sig  : {0} | {1}\" -f $_.Sig, $_.Signierer) -ForegroundColor DarkGray\n        }\n    } else {\n        Write-Host \"  Keine auffaelligen windowlosen Prozesse.\" -ForegroundColor Green\n    }\n\n    # --- 17d: Named Pipes mit DMA-typischen Namen ---\n    Write-Host \"`n--- Named Pipes (DMA/Fuser-Kommunikation) ---\" -ForegroundColor DarkGray\n    $dmaPipeMuster = 'dma|fuser|pcileech|memflow|leech|scatter|fpga|cheat|inject|overlay|radar'\n    try {\n        $pipes = @([System.IO.Directory]::GetFiles('\\\\.\\pipe\\') 2>$null)\n        $verdPipes = @($pipes | Where-Object { $_ -match $dmaPipeMuster })\n        if ($verdPipes.Count -gt 0) {\n            Write-Host \"  [!] Verdaechtige Named Pipes:\" -ForegroundColor Red\n            $verdPipes | ForEach-Object { Write-Host \"  $_\" -ForegroundColor Red }\n        } else {\n            Write-Host \"  Keine DMA-typischen Named Pipes.\" -ForegroundColor Green\n        }\n        Write-Host \"  (Alle Pipes: $($pipes.Count) vorhanden)\" -ForegroundColor DarkGray\n    } catch {\n        # Alternativer Weg ueber Sysinternals wenn verfuegbar\n        Write-Host \"  Direkter Pipe-Zugriff nicht moeglich. Alternativ:\" -ForegroundColor DarkGray\n        Write-Host \"  handle.exe -a | findstr '\\pipe' (Sysinternals)\" -ForegroundColor DarkGray\n    }\n\n    # --- 17e: Autostart-Eintraege fuer Fuser ---\n    Write-Host \"`n--- Autostart-Eintraege (Fuser beim Boot) ---\" -ForegroundColor DarkGray\n    $autoKeys = @(\n        'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run',\n        'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run',\n        'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce',\n        'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce'\n    )\n    foreach ($k in $autoKeys) {\n        if (-not (Test-Path $k)) { continue }\n        $vals = Get-ItemProperty $k -ErrorAction SilentlyContinue\n        $vals.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {\n            $pfad = $_.Value -replace '\"','' -replace ' .*$',''\n            if (Test-Path $pfad -ErrorAction SilentlyContinue) {\n                $sig = Get-AuthenticodeSignature $pfad -ErrorAction SilentlyContinue\n                $istMS = $sig -and $sig.Status -eq 'Valid' -and $sig.SignerCertificate -and $sig.SignerCertificate.Subject -match '(?i)Microsoft'\n                if (-not $istMS) {\n                    $col = if ($sig -and $sig.Status -ne 'Valid') { 'Red' } else { 'Yellow' }\n                    Write-Host (\"  [!] {0} = {1}\" -f $_.Name, $_.Value) -ForegroundColor $col\n                    Write-Host (\"      Sig: {0}\" -f $(if($sig){$sig.Status}else{'Unbekannt'})) -ForegroundColor $col\n                }\n            }\n        }\n    }\n    Write-Host \"  Autostart-Check abgeschlossen.\" -ForegroundColor DarkGray\n\n    Write-Host \"`nFuser-Erkennungs-Tipp:\" -ForegroundColor DarkGray\n    Write-Host \"  Netzwerkverbindung zu 192.168.x.x auf Port >10000 + windowloser Prozess = starkes Indiz.\" -ForegroundColor DarkGray\n    Write-Host \"  Fuser laufen oft nur waehrend des Spiels - deshalb Pruefung waehrend aktiver Session.\" -ForegroundColor DarkGray\n\n    # --- 17f: Display-Analyse (HDMI-Splitter / Capture-Setup) ---\n    Write-Host \"`n--- Display-Analyse (HDMI-Splitter / gespiegeltes Bild) ---\" -ForegroundColor DarkGray\n    Write-Host \"(Mehr Displays als Monitore sichtbar = moeglicher Splitter oder Capture-Input)\" -ForegroundColor DarkGray\n\n    try {\n        $monitors = @(Get-CimInstance -Namespace root\\wmi -ClassName WmiMonitorID -ErrorAction SilentlyContinue)\n        Write-Host (\"  Erkannte Displays: {0}\" -f $monitors.Count)\n        foreach ($m in $monitors) {\n            $hersteller = try { [System.Text.Encoding]::ASCII.GetString(($m.ManufacturerName | Where-Object {$_ -ne 0})) } catch { '?' }\n            $modell     = try { [System.Text.Encoding]::ASCII.GetString(($m.UserFriendlyName  | Where-Object {$_ -ne 0})) } catch { '?' }\n            $serial     = try { [System.Text.Encoding]::ASCII.GetString(($m.SerialNumberID    | Where-Object {$_ -ne 0})) } catch { '' }\n            $col = 'White'\n            $hinweis = ''\n            # Typische Capture-Card oder Virtual-Display Hersteller\n            if ($hersteller -match '(?i)AVerMedia|Elgato|Magewell|Blackmagic|Datapath|DisplayLink|ITE|GENERIC|VirtualDisplay|Parsec|NoMachine') {\n                $col = 'Red'\n                $hinweis = ' [!] CAPTURE/VIRTUAL DISPLAY'\n            }\n            Write-Host (\"  {0,-8} {1,-25} Serial: {2}{3}\" -f $hersteller.Trim(), $modell.Trim(), $serial.Trim(), $hinweis) -ForegroundColor $col\n        }\n\n        if ($monitors.Count -gt 2) {\n            Write-Host (\"  [!] {0} Displays erkannt - mehr als 2 ist ungewoehnlich fuer einen Gaming-PC.\" -f $monitors.Count) -ForegroundColor Yellow\n            Write-Host \"      Moeglicher HDMI-Splitter oder Capture-Eingang aktiv.\" -ForegroundColor Yellow\n        }\n    } catch {\n        Write-Host \"  Display-Abfrage fehlgeschlagen.\" -ForegroundColor DarkGray\n    }\n\n    # --- 17g: Capture-Cards und Video-Devices auf PC1 ---\n    Write-Host \"`n--- Capture-Cards & Video-Geraete auf diesem PC ---\" -ForegroundColor DarkGray\n    $captureGeraete = @(Get-PnpDevice -ErrorAction SilentlyContinue | Where-Object {\n        $_.Class -match '(?i)Media|Image|Camera' -and $_.Status -eq 'OK'\n    })\n    if ($captureGeraete.Count -gt 0) {\n        foreach ($g in $captureGeraete) {\n            $istVerd = $g.FriendlyName -match '(?i)capture|hdmi|video|grabber|avermedia|elgato|magewell|blackmagic|hauppauge'\n            $col = if ($istVerd) { 'Yellow' } else { 'DarkGray' }\n            Write-Host (\"  [{0}] {1}\" -f $g.Class, $g.FriendlyName) -ForegroundColor $col\n            if ($istVerd) {\n                Write-Host (\"  --> Capture-Device: {0}\" -f $g.InstanceId) -ForegroundColor Yellow\n                Write-Host \"      Pruefe ob das Geraet fuer Cheat-Capture oder legitimes Streaming genutzt wird.\" -ForegroundColor DarkGray\n            }\n        }\n    } else {\n        Write-Host \"  Keine Video/Capture-Geraete gefunden.\" -ForegroundColor Green\n    }\n\n    # --- 17h: Aktive GPU-Ausgaenge (mehr als physische Monitore) ---\n    Write-Host \"`n--- GPU: aktive Video-Ausgaenge ---\" -ForegroundColor DarkGray\n    Get-CimInstance Win32_VideoController -ErrorAction SilentlyContinue | ForEach-Object {\n        Write-Host (\"  GPU       : {0}\" -f $_.Name)\n        Write-Host (\"  Adapter   : {0}\" -f $_.AdapterCompatibility)\n        Write-Host (\"  Aufloesung: {0}x{1}\" -f $_.CurrentHorizontalResolution, $_.CurrentVerticalResolution)\n    }\n\n    Write-Host \"`nHDMI-Splitter-Tipp:\" -ForegroundColor DarkGray\n    Write-Host \"  Physische Pruefung: 2 HDMI-Kabel am Monitor (Input 1 + Input 2) ist verdaechtig.\" -ForegroundColor DarkGray\n    Write-Host \"  Ein zweiter laufender PC ohne sichtbare Aktivitaet = moeglicher Cheat-PC.\" -ForegroundColor DarkGray\n    Write-Host \"  Netzwerk (Punkt 17b) findet die DMA-Verbindung zwischen PC1 und PC2.\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  18 - Forensische Tools herunterladen\n# ============================================================\nfunction Invoke-ToolDownload {\n    Write-Host \"`n=== Forensische Tools - Download ===\" -ForegroundColor Cyan\n    Write-Host \"(Alle Tools sind kostenlos und Open Source / Freeware)\" -ForegroundColor DarkGray\n\n    $zielOrdner = \"$env:USERPROFILE\\Desktop\\CTC_Tools\"\n    if (-not (Test-Path $zielOrdner)) {\n        New-Item -ItemType Directory -Path $zielOrdner | Out-Null\n        Write-Host \"Ordner erstellt: $zielOrdner\" -ForegroundColor Green\n    } else {\n        Write-Host \"Zielordner: $zielOrdner\" -ForegroundColor DarkGray\n    }\n\n    $tools = [ordered]@{\n        '1' = @{\n            Name   = 'Everything 1.4 (Blitzschnelle Dateisuche)'\n            URL    = 'https://www.voidtools.com/Everything-1.4.1.1024.x64.zip'\n            Zip    = $true\n            Tipp   = 'Findet DLLs, .sys-Dateien und Cheat-Dateien sofort'\n        }\n        '2' = @{\n            Name   = 'System Informer (Prozesse, Handles, Netzwerk)'\n            URL    = 'github_latest'\n            Repo   = 'winsiderss/systeminformer'\n            Zip    = $true\n            Tipp   = 'Zeigt geladene DLLs, Named Pipes und versteckte Prozesse'\n        }\n        '3' = @{\n            Name   = 'Autoruns (Alle Autostart-Eintraege)'\n            URL    = 'https://download.sysinternals.com/files/Autoruns.zip'\n            Zip    = $true\n            Tipp   = 'Zeigt JEDEN Autostart-Eintrag - Fuser-Erkennung'\n        }\n        '4' = @{\n            Name   = 'Process Monitor (Live Datei/Registry/Netzwerk)'\n            URL    = 'https://download.sysinternals.com/files/ProcessMonitor.zip'\n            Zip    = $true\n            Tipp   = 'Zeigt phantom DLL-Suchen in Echtzeit (DLL Hijacking live)'\n        }\n        '5' = @{\n            Name   = 'TCPView (Netzwerkverbindungen live)'\n            URL    = 'https://download.sysinternals.com/files/TCPView.zip'\n            Zip    = $true\n            Tipp   = 'Fuser-Verbindungen zu PC2 in Echtzeit sehen'\n        }\n        '6' = @{\n            Name   = 'Handle (Named Pipes & Handles)'\n            URL    = 'https://download.sysinternals.com/files/Handle.zip'\n            Zip    = $true\n            Tipp   = 'Zeigt alle Named Pipes - DMA Fuser Kommunikation'\n        }\n        '7' = @{\n            Name   = 'Strings (Strings aus Binaerdateien extrahieren)'\n            URL    = 'https://download.sysinternals.com/files/Strings.zip'\n            Zip    = $true\n            Tipp   = 'Wie im WptsExtensions.dll Fund - inject/manualmap Strings sehen'\n        }\n        '8' = @{\n            Name   = 'Hollows Hunter (Injizierte Module finden)'\n            URL    = 'github_latest'\n            Repo   = 'hasherezade/hollows_hunter'\n            Zip    = $false\n            Tipp   = 'Findet reflective injection und manual mapped Code in Prozessen'\n        }\n        'A' = @{ Name = 'Alle Tools herunterladen'; URL = ''; Zip = $false; Tipp = '' }\n    }\n\n    Write-Host \"`n  Verfuegbare Tools:\" -ForegroundColor Cyan\n    foreach ($k in $tools.Keys) {\n        if ($k -eq 'A') {\n            Write-Host \"`n  [A] Alle herunterladen\" -ForegroundColor Yellow\n        } else {\n            $t = $tools[$k]\n            Write-Host (\"  [{0}] {1}\" -f $k, $t.Name) -ForegroundColor White\n            Write-Host (\"      --> {0}\" -f $t.Tipp) -ForegroundColor DarkGray\n        }\n    }\n    Write-Host \"  [Q] Abbrechen\" -ForegroundColor DarkGray\n\n    $wahl = (Read-Host \"`nAuswahl\").Trim().ToUpper()\n    if ($wahl -eq 'Q') { return }\n\n    $zuLaden = if ($wahl -eq 'A') { $tools.Keys | Where-Object { $_ -ne 'A' } } else { @($wahl) }\n\n    foreach ($k in $zuLaden) {\n        if (-not $tools.ContainsKey($k)) { Write-Host \"Unbekannte Auswahl: $k\" -ForegroundColor Red; continue }\n        $tool = $tools[$k]\n        Write-Host (\"`n[{0}] Lade {1}...\" -f $k, $tool.Name) -ForegroundColor Cyan\n\n        $url = $tool.URL\n\n        # GitHub Latest Release URL holen\n        if ($url -eq 'github_latest') {\n            try {\n                Write-Host \"  GitHub Release API abfragen...\" -ForegroundColor DarkGray\n                $apiUrl = \"https://api.github.com/repos/$($tool.Repo)/releases/latest\"\n                $release = Invoke-RestMethod $apiUrl -Headers @{'User-Agent'='CTC-by-Dark'} -ErrorAction Stop\n                # Passende Asset-URL finden (x64, Windows)\n                $asset = $release.assets | Where-Object {\n                    $_.name -match '(?i)x64|amd64|win64' -and\n                    $_.name -match '(?i)\\.zip$|\\.exe$' -and\n                    $_.name -notmatch '(?i)debug|pdb|symbols'\n                } | Select-Object -First 1\n\n                if ($asset) {\n                    $url = $asset.browser_download_url\n                    Write-Host (\"  Version: {0} | Asset: {1}\" -f $release.tag_name, $asset.name) -ForegroundColor DarkGray\n                } else {\n                    Write-Host \"  Kein passendes Asset gefunden. Bitte manuell herunterladen:\" -ForegroundColor Yellow\n                    Write-Host (\"  https://github.com/{0}/releases\" -f $tool.Repo) -ForegroundColor Yellow\n                    continue\n                }\n            } catch {\n                Write-Host (\"  GitHub-Abfrage fehlgeschlagen: {0}\" -f $_) -ForegroundColor Red\n                Write-Host (\"  Manuell: https://github.com/{0}/releases\" -f $tool.Repo) -ForegroundColor Yellow\n                continue\n            }\n        }\n\n        # Dateiname aus URL\n        $dateiName = [System.IO.Path]::GetFileName($url)\n        $zielPfad  = Join-Path $zielOrdner $dateiName\n\n        try {\n            Write-Host (\"  Download: {0}\" -f $url) -ForegroundColor DarkGray\n            Invoke-WebRequest -Uri $url -OutFile $zielPfad -UseBasicParsing -ErrorAction Stop\n            Write-Host (\"  Gespeichert: {0}\" -f $zielPfad) -ForegroundColor Green\n\n            # ZIP entpacken\n            if ($tool.Zip -and $dateiName -match '\\.zip$') {\n                $extraktOrdner = Join-Path $zielOrdner ([System.IO.Path]::GetFileNameWithoutExtension($dateiName))\n                if (-not (Test-Path $extraktOrdner)) { New-Item -ItemType Directory -Path $extraktOrdner | Out-Null }\n                Expand-Archive -Path $zielPfad -DestinationPath $extraktOrdner -Force\n                Remove-Item $zielPfad -Force\n                Write-Host (\"  Entpackt: {0}\" -f $extraktOrdner) -ForegroundColor Green\n            }\n        } catch {\n            Write-Host (\"  Fehler: {0}\" -f $_) -ForegroundColor Red\n            Write-Host (\"  Manuell herunterladen: {0}\" -f $url) -ForegroundColor Yellow\n        }\n    }\n\n    Write-Host \"`n======================================\" -ForegroundColor Cyan\n    Write-Host \"  Tools gespeichert in:\" -ForegroundColor Cyan\n    Write-Host \"  $zielOrdner\" -ForegroundColor Yellow\n    Write-Host \"======================================\" -ForegroundColor Cyan\n    Write-Host \"Empfohlene Reihenfolge fuer eine Analyse:\" -ForegroundColor DarkGray\n    Write-Host \"  1. Autoruns    - Was startet beim Boot?\" -ForegroundColor DarkGray\n    Write-Host \"  2. TCPView     - Welche Verbindungen laufen?\" -ForegroundColor DarkGray\n    Write-Host \"  3. ProcMon     - Welche DLLs werden gesucht?\" -ForegroundColor DarkGray\n    Write-Host \"  4. SysInformer - Was ist in den Prozessen geladen?\" -ForegroundColor DarkGray\n    Write-Host \"  5. Everything  - Verdaechtige Dateien suchen\" -ForegroundColor DarkGray\n    Write-Host \"  6. HollowsHunter - Injizierte Module aufdecken\" -ForegroundColor DarkGray\n}\n\n# ============================================================\n#  Menue\n# ============================================================\nfunction Show-Menu {\n    Write-Host \"\"\n    Write-Host \"============================================\" -ForegroundColor Cyan\n    Write-Host \"  CTC by Dark - CatchTheCheat               \" -ForegroundColor Cyan\n    Write-Host \"============================================\" -ForegroundColor Cyan\n    Write-Host \"  1  PnP-Ereignisse (411 / 400 / 410 / 420)\"\n    Write-Host \"  2  Log-Integritaet, System, Ausfuehrungsartefakte\"\n    Write-Host \"  3  PCI/PCIe-Geraete\"\n    Write-Host \"  4  Entfernte Geraete (Zeitfenster)\"\n    Write-Host \"  5  Datentraeger-Historie\"\n    Write-Host \"  6  USB-Geraetehistorie\"\n    Write-Host \"  7  Fernwartungssoftware (installiert / ausgefuehrt)\"\n    Write-Host \"  8  Fernwartung: Sitzungen und Dateiuebertragungen\"\n    Write-Host \"  9  Unsignierte Dateien (Treiber / Prozesse)\"\n    Write-Host \" 10  PowerShell-History und -Protokoll\"\n    Write-Host \" 11  Discord-Account-IDs (nur ID, keine Token)\"\n    Write-Host \" 12  PE Binary & Driver Heuristics Inspector\"\n    Write-Host \" 13  DLL Hijacking Live-Check (laufende Prozesse)\"\n    Write-Host \" 14  Systemprozesse & Registry-Injection-Vektoren\"\n    Write-Host \" 15  HVCI / Memory Integrity & Inkompatible Treiber\"\n    Write-Host \" 16  System32 Fremdkoerper & Typosquatting\"\n    Write-Host \" 17  DMA Fuser & Zweiter-PC-Verbindungen\"\n    Write-Host \" 18  Forensische Tools herunterladen\"\n    Write-Host \"\"\n    Write-Host \"  A  Alles nacheinander\"\n    Write-Host \"  P  Protokoll auf Desktop starten/stoppen\"\n    Write-Host \"  Q  Beenden\"\n    Write-Host \"============================================\" -ForegroundColor Cyan\n}\n\n# ------------------------------------------------------------\nif (-not (Test-Admin)) {\n    Write-Host \"WARNUNG: Nicht als Administrator gestartet.\" -ForegroundColor Red\n    Write-Host \"Das Kernel-PnP-Log ist so nicht lesbar.\" -ForegroundColor Red\n    Write-Host \"\"\n}\n\n$protokoll = $false\n\ndo {\n    Show-Menu\n    $wahl = (Read-Host \"Auswahl\").Trim().ToUpper()\n\n    switch ($wahl) {\n        '1' { Invoke-PnpEvents }\n        '2' { Invoke-LogIntegrity }\n        '3' { Invoke-PciDevices }\n        '4' {\n              $h = Read-Host \"Zeitfenster in Stunden (Enter = 1)\"\n              if ([string]::IsNullOrWhiteSpace($h)) { $h = 1 }\n              Invoke-RemovedDevices -Stunden ([int]$h)\n            }\n        '5' { Invoke-DiskHistory }\n        '6' { Invoke-UsbHistory }\n        '7' { Invoke-RemoteTools }\n        '8' { Invoke-RemoteSessions }\n        '9' { Invoke-Unsigned }\n        '10' { Invoke-PSHistory }\n        '11' { Invoke-DiscordId }\n        '12' { Invoke-PEInspector }\n        '13' { Invoke-DLLHijackCheck }\n        '14' { Invoke-SystemProcessCheck }\n        '15' { Invoke-HVCICheck }\n        '16' { Invoke-System32Check }\n        '17' { Invoke-FuserCheck }\n        '18' { Invoke-ToolDownload }\n        'A' {\n              Invoke-LogIntegrity\n              Invoke-PnpEvents\n              Invoke-PciDevices\n              Invoke-RemovedDevices -Stunden 24\n              Invoke-DiskHistory\n              Invoke-UsbHistory\n              Invoke-RemoteTools\n              Invoke-RemoteSessions\n              Invoke-Unsigned\n              Invoke-PSHistory\n              Invoke-DiscordId\n              Invoke-DLLHijackCheck\n              Invoke-SystemProcessCheck\n              Invoke-HVCICheck\n              Invoke-FuserCheck\n              Write-Host \"`n[Punkt 16 wird im A-Durchlauf uebersprungen - manuell starten wegen Laufzeit]\" -ForegroundColor DarkGray\n            }\n        'P' {\n              if ($protokoll) {\n                  try { Stop-Transcript | Out-Null } catch {}\n                  $protokoll = $false\n                  Write-Host \"Protokoll gestoppt.\" -ForegroundColor Yellow\n              } else {\n                  $pfad = \"$env:USERPROFILE\\Desktop\\ctc_by_dark_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt\"\n                  try {\n                      Start-Transcript -Path $pfad | Out-Null\n                      $protokoll = $true\n                      Write-Host \"Protokoll laeuft: $pfad\" -ForegroundColor Green\n                  } catch {\n                      Write-Host \"Protokoll konnte nicht gestartet werden.\" -ForegroundColor Red\n                  }\n              }\n            }\n        'Q' { }\n        default { Write-Host \"Ungueltige Eingabe.\" -ForegroundColor Yellow }\n    }\n\n    if ($wahl -ne 'Q') {\n        Write-Host \"\"\n        Read-Host \"Enter fuer Menue\"\n        Clear-Host\n    }\n\n} while ($wahl -ne 'Q')\n\nif ($protokoll) { try { Stop-Transcript | Out-Null } catch {} }\nWrite-Host \"Beendet.\" -ForegroundColor Cyan\n", "creation_timestamp": "2026-09-23T13:02:51.875485Z"}]}