%~dp0Sysmon64 -c %~dp0sysmonconfig-logsign.xml
sc query "Sysmon64" | Find "RUNNING"
If "%ERRORLEVEL%" EQU "1" (
goto startsysmon
)
:startsysmon
cmd /c net start Sysmon64
 
If "%ERRORLEVEL%" EQU "0" (
goto installsysmon
)
:installsysmon
echo Check operating system …if defined PROGRAMFILES(X86) (
    echo 64-bit sytem detectedinstalling 64bit sysmon
    "%~dp0Sysmon64.exe" /accepteula -i %~dp0sysmonconfig-logsign.xml
    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Sysmon/Operational
     ) else (
goto:eof
) 
goto:eof