Corrections in Unknown values size.

[nisargsuthar]

• Made corrections for unknown values size for PFV 30, Variants 1 (Version 26) and 2.
• Document the new section found from WIP research as 'Hash string' as prefetch hash is computed using:

1. This string only, for normal prefetch files.
2. This string + a variable combination of (/prefetch: flag, command line arguments), for application hosting prefetch files.

Note to self:
Confirm/discard absence of the Hash string section in PFV 30, Variant 1.

[joachimmetz]

@nisargsuthar thanks I'll have a closer look later

[nisargsuthar]

@joachimmetz

Note to self:
Confirm/discard absence of the Hash string section in PFV 30, Variant 1.

I've confirmed that this section is also seen for Variant 1. Before, you verify and merge this let me further update my PR to reflect this change as well.

[nisargsuthar]

I've updated my parser to handle all cases of Prefetch files including the 4 versions, 2 variants, and 2 categories based on the presence/absence of the hash string section. You may refer to the prefetch.py module for verification purposes.
nisargsuthar/Veritas@cb0c3a0

[joachimmetz]

LGTM