prefetch hash anomaly and collision detector — free browser tool | fatcousin

home

drop prefetch file listing csv · detect multiple prefetch files for the same executable name · identify prefetch hash collisions indicating execution from multiple paths · surface hash manipulation and path-based execution hiding · runs locally

prefetch listing

drop prefetch csv (PECmd · directory listing)

or click

Select file

EXECUTABLENAME-HASH.pf · path diversity · hash validation when SourcePath column present · POWERSHELL/CMD multi-path flags

drop prefetch file listing csv (PECmd or directory export)