A while ago I was using Kerio Personal Firewall. It had an application behavior control feature that alerted me when one application tried to launch another. Sometimes it alerted me that one application was replacing another (e.g. when reinstalling a program) how does it know when an application is being replaced?