97 lines
4.8 KiB
PowerShell
97 lines
4.8 KiB
PowerShell
[Console]::OutputEncoding = [Text.Encoding]::UTF8
|
|
$ErrorActionPreference = 'Continue'
|
|
|
|
$ns = 'C:\Program Files\NirSoft'
|
|
$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
|
|
$hostname = $env:COMPUTERNAME
|
|
$outDir = Join-Path $env:TEMP "nirsoft-dump-$hostname-$stamp"
|
|
New-Item -ItemType Directory -Force -Path $outDir | Out-Null
|
|
|
|
function Run-Tool {
|
|
param(
|
|
[string]$Name,
|
|
[string]$Exe,
|
|
[string[]]$ArgList,
|
|
[int]$TimeoutSec = 60
|
|
)
|
|
$path = Join-Path $ns "$Name\$Exe"
|
|
if (-not (Test-Path $path)) {
|
|
Write-Host "[skip] $Name not installed"
|
|
return
|
|
}
|
|
Write-Host "[*] $Name"
|
|
try {
|
|
$p = Start-Process -FilePath $path -ArgumentList $ArgList -Wait -PassThru -WindowStyle Hidden
|
|
if ($p.ExitCode -ne 0) { Write-Host " (exit $($p.ExitCode))" }
|
|
} catch {
|
|
Write-Host " [!] $($_.Exception.Message)"
|
|
}
|
|
}
|
|
|
|
# === NirSoft CSV dumps ===
|
|
Run-Tool 'BlueScreenView' 'BlueScreenView.exe' @('/scomma', (Join-Path $outDir 'bluescreen.csv'))
|
|
Run-Tool 'LastActivityView' 'LastActivityView.exe' @('/scomma', (Join-Path $outDir 'lastactivity.csv'))
|
|
Run-Tool 'WhatInStartup' 'WhatInStartup.exe' @('/scomma', (Join-Path $outDir 'startup.csv'))
|
|
Run-Tool 'OpenedFilesView' 'OpenedFilesView.exe' @('/scomma', (Join-Path $outDir 'opened-files.csv'))
|
|
Run-Tool 'InstalledAppView' 'InstalledAppView.exe' @('/scomma', (Join-Path $outDir 'installed-apps.csv'))
|
|
Run-Tool 'DevManView' 'DevManView.exe' @('/scomma', (Join-Path $outDir 'devices.csv'))
|
|
Run-Tool 'USBDeview' 'USBDeview.exe' @('/scomma', (Join-Path $outDir 'usb-history.csv'))
|
|
Run-Tool 'TurnedOnTimesView' 'TurnedOnTimesView.exe' @('/scomma', (Join-Path $outDir 'uptime.csv'))
|
|
Run-Tool 'CurrPorts' 'cports.exe' @('/scomma', (Join-Path $outDir 'ports.csv'))
|
|
Run-Tool 'WifiInfoView' 'WifiInfoView.exe' @('/scomma', (Join-Path $outDir 'wifi-nearby.csv'))
|
|
Run-Tool 'WirelessNetView' 'WirelessNetView.exe' @('/scomma', (Join-Path $outDir 'wifi-tracking.csv'))
|
|
Run-Tool 'DNSDataView' 'DNSDataView.exe' @('/scomma', (Join-Path $outDir 'dns-cache.csv'))
|
|
|
|
# === Native Windows snapshots ===
|
|
Write-Host ""
|
|
Write-Host "[*] Native Windows snapshots"
|
|
|
|
& systeminfo.exe | Out-File (Join-Path $outDir 'systeminfo.txt') -Encoding UTF8
|
|
& ipconfig.exe /all | Out-File (Join-Path $outDir 'ipconfig.txt') -Encoding UTF8
|
|
& netstat.exe -ano | Out-File (Join-Path $outDir 'netstat.txt') -Encoding UTF8
|
|
|
|
Get-Process | Select-Object Id,ProcessName,CPU,WS,@{n='WS_MB';e={[math]::Round($_.WS/1MB,1)}},Path,StartTime |
|
|
Export-Csv -Path (Join-Path $outDir 'processes.csv') -NoTypeInformation -Encoding UTF8
|
|
|
|
Get-Service | Select-Object Name,DisplayName,Status,StartType |
|
|
Export-Csv -Path (Join-Path $outDir 'services.csv') -NoTypeInformation -Encoding UTF8
|
|
|
|
Get-ScheduledTask | Select-Object TaskPath,TaskName,State,Author |
|
|
Export-Csv -Path (Join-Path $outDir 'scheduled-tasks.csv') -NoTypeInformation -Encoding UTF8
|
|
|
|
# Recent error/warning events (System + Application, last 24h)
|
|
Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2,3; StartTime=(Get-Date).AddHours(-24)} -MaxEvents 500 -ErrorAction SilentlyContinue |
|
|
Select-Object TimeCreated,Id,LevelDisplayName,ProviderName,Message |
|
|
Export-Csv -Path (Join-Path $outDir 'events-system-24h.csv') -NoTypeInformation -Encoding UTF8
|
|
Get-WinEvent -FilterHashtable @{LogName='Application'; Level=1,2,3; StartTime=(Get-Date).AddHours(-24)} -MaxEvents 500 -ErrorAction SilentlyContinue |
|
|
Select-Object TimeCreated,Id,LevelDisplayName,ProviderName,Message |
|
|
Export-Csv -Path (Join-Path $outDir 'events-application-24h.csv') -NoTypeInformation -Encoding UTF8
|
|
|
|
# === Summary file ===
|
|
@"
|
|
=== Nirsoft + System Dump ===
|
|
Host: $hostname
|
|
Timestamp: $stamp
|
|
User running: $env:USERDOMAIN\$env:USERNAME
|
|
OS: $((Get-CimInstance Win32_OperatingSystem).Caption) $((Get-CimInstance Win32_OperatingSystem).Version)
|
|
Boot time: $((Get-CimInstance Win32_OperatingSystem).LastBootUpTime)
|
|
Uptime: $((Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime)
|
|
|
|
Files in this archive:
|
|
$((Get-ChildItem $outDir | Sort-Object Name | ForEach-Object { " - $($_.Name) ($(if ($_.Length) { '{0:N0}' -f $_.Length } else { '-' }) bytes)" }) -join "`r`n")
|
|
"@ | Out-File (Join-Path $outDir '_summary.txt') -Encoding UTF8
|
|
|
|
# === Zip and announce ===
|
|
$zipPath = "$outDir.zip"
|
|
Compress-Archive -Path (Join-Path $outDir '*') -DestinationPath $zipPath -Force
|
|
$zipSize = (Get-Item $zipPath).Length
|
|
|
|
Write-Host ""
|
|
Write-Host "====================================="
|
|
Write-Host "DUMP_ZIP: $zipPath"
|
|
Write-Host "DUMP_SIZE: $zipSize"
|
|
Write-Host "====================================="
|
|
|
|
# Optional cleanup of the uncompressed dir
|
|
Remove-Item $outDir -Recurse -Force -ErrorAction SilentlyContinue
|