Skip to content
NotificationPARSER

Glossary

Notification handler

An app registered with the Windows notification platform, stored as a NotificationHandler row with its PrimaryId, type and creation time.

A notification handler is an app, or a system component, registered with the Windows notification platform so that it can raise notifications for the user. Each handler is one row of the NotificationHandler table in wpndatabase.db. Its RecordId is the primary key that notifications point to through Notification.HandlerId, and its PrimaryId says which app it is.

Other columns describe the registration: HandlerType (for example app:desktop, app:immersive or app:system), WNSId and WNFEventName for the push and notification-facility identifiers, ParentId and ContainerSid, and CreatedTime / ModifiedTime. Related key / value tables, HandlerAssets and HandlerSettings, hold further details per handler; their keys vary by app and Windows build.

Why it matters in investigations

The handler table is a list of every app that could notify this user, whether or not any of its notifications survive. Two things deserve a look. First, a handler created during the period of interest: an app that registered for notifications in the middle of an intrusion. Second, a handler identified by a file path in a user-writable location such as ProgramData, Users\Public or a profile folder, which the parser flags as an unusual app. Many legitimate apps live there too, so corroborate with execution artifacts. Keep in mind that CreatedTime and ModifiedTime are text with an undocumented time zone, unlike the UTC FILETIME values of notifications.

Example

SELECT n.ArrivalTime, h.PrimaryId, h.HandlerType, h.CreatedTime
FROM Notification n
JOIN NotificationHandler h ON n.HandlerId = h.RecordId;

In the site's fictional sample, a handler with PrimaryId C:\ProgramData\Intel\m64.exe appears with a CreatedTime of 2026-09-14 10:11:58, one minute before its only toast.

The Apps & channels view of the Windows Notification Parser lists every handler; the incident walkthrough shows one in context.