The Windows operating system uses what are called prefetch files to speed up the program starting process. It will store a list of all the files and DLLs used by the program when started in order to preload these files into the memory when the program starts to make it faster to start. Each executable has a prefetch file which contains the following:
The executable's name
The path to the executable
The number of times that the program ran within the system
The last run time
A list of DLLs used by the program
The prefetch files are located at %SystemRoot%\Prefetch, and each file has a "pf" extension. The naming schema of these files consists of adding the executable name in capital letters, followed by -, and then an eight character hash of the application's start location, as shown in Figure1 for the calc.exe Windows native tool:
Figure 1: A prefetch file example
If you find two different pf files on the same executable, this means that either there are two executables with...
