Yes, that does give me the intersect of the keys. What I need to do is take each key in the intersect array (@keys_existing_in_both in your example) and act on each value associated with each key. Thats where I'm confused.
For example, lets say the the array in your example has the element psexec.exe. What I need to do is search the second hash (the one containing the system files) for psexec and then run a system command on each value associated with the psexec.exe key. Take the results of that data (the md5 of the file) and compare it to the other values ins the psexec.exe key in the first hash (known bad data).