Initial response Kit

@echo on
echo************************** ****> . \evidence\evidence.txt
echo********    yangxiong  ******* >> . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********   Starting time    time /t    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
time /t >> . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********   Start date   date /t   ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
date /t >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********    system information   systeminfo   ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
systeminfo >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********   psinfo   ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
psinfo >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********    Network configuration information    ipconfig   ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
ipconfig >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********  Mac Address    arp -a    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
arp -a >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********   Run the process   pslist    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
pslist >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********   Listening port    netstat -an    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
netstat -an >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********   At present SID code   psgetsid    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
psgetsid >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********    Connect the user   psloggedon /t  ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
psloggedon /t >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********  NetBios Connect    nbtstat -c    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
nbtstat -c >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********   psservice    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
psservice >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********   open TCP/IP End in process    tcpvcon    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
tcpvcon >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********   End time   time /t    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
time /t >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********    End date  date /t    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
date /t >>  . \evidence\evidence.txt
echo****************************** >> . \evidence\evidence.txt
echo********    Command history    doskey /history    ********** >> . \evidence\evidence.txt
echo******************************* >> . \evidence\evidence.txt
doskey /history >>  . \evidence\evidence.txt
cd .\evidence
md5sum *.txt > hash.txt