> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/references/references-classic/database-information-and-organization-classic/package-executable-mapping-classic.md).

# Package executable mapping (classic)

It isn’t always easy to figure out which package an executable belongs to and it is difficult to be 100% accurate as sometimes an executable may not even belong to a package. Use the heuristic below to help identify which executable belongs to which package.

Let's define an executable as the tuple path, hash and name/size for example `[PATH,HASH,FILE]`.

An MSI package contains both an installation and uninstallation script linked to embedded resources, usually binaries. Once installed, the system stores an MSI on the machine but strips out its resources to save disk space. However, the system lists most embedded binaries either by name or by size. In addition, an MSI defines an installation directory.

For each MSI there is a tuple `[{HASH},{FILE},DIR]` even though some installed binaries might not have either `{HASH}` or `{FILE}`.

Other types of packages are treated as a black box. In this case, we only take the installation directory if present or the path of the uninstallation program if not, so we have the tuple `[{},{},DIR]`.

An executable `[PATH,HASH,FILE]` is associated to a package `[{HASH},{FILE},{DIR}]` whenever one of these conditions is met:

* HASH is contained in `{HASH}`
* DIR is equal to `{DIR}`
* DIR parent is equal to `{DIR}`
* FILE is contained in `{FILE}`

If the system cannot associate a specific package to an executable, it associates the executable to the default “unknown” package.

The system excludes the following directories:

* WINDOWS\
  for example `C:\WINDOWS`
* SYSTEM\
  for example `C:\WINDOWS\system32`
* PROGRAM\_FILES\_COMMON\
  for example `C:\Program Files\Common Files\Common Files`
* PROGRAM\_FILES\
  for example `C:\Program Files\Common Files`
* COMMON\_STARTMENU\
  for example `C:\Documents and Settings\LeeT\Start Menu`
* COMMON\_PROGRAMS\
  for example `C:\Documents and Settings\LeeT\Start Menu\Programs`
* COMMON\_STARTUP\
  for example `C:\Documents and Settings\gjaunin\Start Menu\Programs\Startup`
* COMMON\_MUSIC\
  for example `C:\Documents and Settings\LeeT\Favorites`
* COMMON\_FAVORITES\
  for example `C:\Documents and Settings\LeeT\Favorites`
* COMMON\_DOCUMENTS\
  for example `C:\Documents and Settings\LeeT\My Documents`
* COMMON\_DESKTOPDIRECTORY\
  for example `C:\Documents and Settings\LeeT\Desktop`
* COMMON\_APPDATA\
  for example `C:\Documents and Settings\LeeT\Application Data`


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.nexthink.com/references/references-classic/database-information-and-organization-classic/package-executable-mapping-classic.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.