Malware

#silence any errors
$ErrorActionPreference = 'SilentlyContinue'
#file location of Baseline file.
$file = New-Item -Path C:\Users\Anthony\Documents\ -Name "BeforeBase.txt" -ItemType "file" -Force

    #gets the registry valuse for current user typed urls, run, and run once. Add to output file
    Get-Item -Path "Registry::\HKCU\Software\Microsoft\Internet Explorer\TypedURLs" | Out-File -Append $file
    Get-Item -Path "Registry::\HKCU\Software\Microsoft\Windows\CurrentVersion\Run" | Out-File -Append $file
    Get-Item -Path "Registry::\HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Out-File -Append $file

    #gets the registry valuse for run and run once. Add to output file
    Get-Item -Path "Registry::\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" | Out-File -Append $file
    Get-Item -Path "Registry::\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Out-File -Append $file

    #gets all locations under the following registry location and assign to a variable
    Get-ChildItem 'Registry::\HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks' -Recurse | Out-File -Append $file
    Get-ChildItem 'Registry::\HKLM\SYSTEM\CurrentControlSet\SERVICES\' -Recurse | Out-File -Append $file
    Get-ChildItem 'Registry::\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\' -Recurse | Out-File -Append $file
    Get-ChildItem 'Registry::\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\' -Recurse | Out-File -Append $file



    #Pause script and allow for malware to run
    Read-Host -Prompt "Press enter after running malware."



    #file location of After Baseline file.
$file2 = New-Item -Path C:\Users\Anthony\Documents\ -Name "AfterBase.txt" -ItemType "file" -Force


    #gets the registry valuse for current user typed urls, run, and run once. Add to output file
    Get-Item -Path "Registry::\HKCU\Software\Microsoft\Internet Explorer\TypedURLs" | Out-File -Append $file2
    Get-Item -Path "Registry::\HKCU\Software\Microsoft\Windows\CurrentVersion\Run" | Out-File -Append $file2
    Get-Item -Path "Registry::\HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Out-File -Append $file2

    #gets the registry valuse for run and run once. Add to output file
    Get-Item -Path "Registry::\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" | Out-File -Append $file2
    Get-Item -Path "Registry::\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Out-File -Append $file2

    #gets all locations under the following registry location and assign to a variable
    Get-ChildItem 'Registry::\HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks' -Recurse | Out-File -Append $file2
    Get-ChildItem 'Registry::\HKLM\SYSTEM\CurrentControlSet\SERVICES\' -Recurse | Out-File -Append $file2
    Get-ChildItem 'Registry::\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\' -Recurse | Out-File -Append $file2
    Get-ChildItem 'Registry::\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\' -Recurse | Out-File -Append $file2

    Compare-Object (Get-Content C:\Users\Anthony\Documents\BeforeBase.txt) (Get-Content C:\Users\Anthony\Documents\AfterBase.txt) | ?{$_.sideIndicator -eq "=>"} | Select -ExpandProperty InputObject