Windows_collector_KAPE_ADDS_DC.template

autoexec:
  argv: ["artifacts", "collect", "-v",
    "Windows.System.Pslist", "Windows.Network.NetstatEnriched", "Windows.KapeFiles.Targets",
      "--output", "Velociraptor_ADDS_$COMPUTERNAME.zip", "--password", "<PASSWORD>",
      "--args", "Device=C:",
      # Run the collection across all VSS and collect only unique changes.
      "--args", "VSSAnalysis=Y",
      "--args", "EventLogs=Y",
      "--args", "RegistryHivesSystem=Y",
      "--args", "RemoteAdmin=Y",
      "--args", "SUM=Y"
  ]