Skip to content

Glossary

Jump List AppID

The 16-hex-character identifier that names each Jump List file and maps it back to the application that created it.

Every Jump List file is named after an AppID, a 16-character hexadecimal string followed by .automaticDestinations-ms or .customDestinations-ms. The files live in each user's %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations and CustomDestinations folders. The AppID is how you tell which application a given Jump List belongs to.

By default Windows derives the AppID from the application's full executable path using a CRC-64 hash, unless the program declares its own explicit application identifier. Two consequences follow. First, a common application installed at its default path produces the same AppID on every machine, which is why community-maintained AppID lists and the tables built into parsers such as JLECmd can name most files automatically. Second, the same program run from a different path — a portable tool in Downloads, a renamed copy in a temp folder — produces a different AppID that no list will recognise.

That second point is an investigative lead rather than a nuisance. An unknown AppID sitting next to well-known ones may correspond to a program launched from an unusual location. Open the file anyway: the embedded LNK entries show the documents and paths that application touched, and their shell items and timestamps often reveal what the tool was even when its name cannot be resolved. Remember that a Jump List entry demonstrates file access through an application, which is related to, but not the same as, evidence of execution.

Related artifacts