Basically any system change would change hashes. We track them internally on a high value box and the most popular one is shadow/passwd