What is Amcache ProgramId? (glossary)

ProgramId is the 44-character application-identity hash Amcache assigns to each logical application. Unlike FileId, which hashes file content, ProgramId hashes application metadata — name, publisher, version, and language.

A typical value:

0006fa0b2a9f8a4eb9d7c81e8b1f3c5d3e2a0000ffff

Two properties make ProgramId valuable in DFIR:

1. Stable across hosts. The same Office 365 build on two different workstations gets the same ProgramId.
2. Joins file records to application records. A file in Root\InventoryApplicationFile and the parent application in Root\InventoryApplication share the value.

How it differs from FileId#

	FileId	ProgramId
Length	41 chars ("0000" + SHA-1)	44 chars
Hashes	First 31 MiB of file bytes	Application metadata
Per-binary unique	Yes	No — siblings share
Per-host unique	No	No — cross-host stable
Pivot use	Exact-binary cross-host	Application-family cross-host

When ProgramId wins#

• Re-compiled tools with same identity. Attacker rebuilds their loader between hosts — Hash differs, ProgramId stays the same.
• Renamed binaries. mimikatz.exe → svchost64.exe → update.exe. If the attacker did not scrub the PE version-info resource, ProgramId follows the binary across the renames.
• Cross-host scoping. A single suspicious ProgramId on one host becomes a query against every other collected host's Amcache. See Lateral movement and Amcache ProgramId pivoting.

When ProgramId is the wrong pivot#

• Living-off-the-land binaries. net.exe, psexec.exe, and certutil.exe share ProgramId across every host that has them. Pivot on command line instead.
• Per-host implants. Truly per-victim malware produces unique ProgramId values per host. Use behavioural patterns (4624 logon, network indicators) for those.

For the full ProgramId reference, see Amcache ProgramId explained.

Related terms#

• FileId — the content-hash identifier.
• InventoryApplicationFile — where ProgramId is stored.
• Amcache.hve — the hive.