Obtain hash of all running executables in Win OS using “CertUtil” while conducting Live Forensics.

CertUtil in windows is mostly related to managing and viewing certificates, but very useful for getting hash value of any file using -hashfile subcommand.

Here’s the command. Try this out.

FOR /F %i IN (‘wmic process where “ExecutablePath is not null” get ExecutablePath’) DO certutil -hashfile %i SHA256 | findstr -v : >> output.txt