Find "Unauthorized" Files

Scenario

During this portion of the lab, you will be introduced to the ability to manually scan your workstation for new files and changes to files already in the baseline.

Find the Mystery Files.zip file in C:$\backslash$Temp and extract its contents to the desktop. Then, verify there are six files within the Suspicious folder.

Next, and similar to before, generate MD$5$ hashes for the six "suspicious" files we just extracted. Then, generate SHA$256$ hashes for them as well.

Lastly, generate MD$5$ hashes for all files in the C:$\backslash$ drive to find which files have changed in the background. You should be able to run a command to only show or output the hashes of files that have changed or been added to the system. This is to illustrate that operating systems do have a fair amount of dynamic change when they are used.

What do you find?