Glossary
PrimaryId (AppUserModelID)
The identifier of the app behind a notification handler: usually an AppUserModelID such as a package family name plus app id, or a desktop app identifier.
PrimaryId is the column of the NotificationHandler table in wpndatabase.db that identifies the app behind a notification handler. It is usually an AppUserModelID (AUMID), the identifier Windows uses to group an app's windows, taskbar entries and notifications.
Its form depends on the kind of app:
- Packaged apps use the package family name plus an application id, as
Publisher.App_hash!AppId. - Desktop apps use the AUMID they declare, such as
Microsoft.Office.OUTLOOK.EXE.15, or the path of their executable. - System sources use identifiers beginning with
Windows.SystemToast..
When the identifier is a path, its first element can be a known-folder GUID instead of a drive letter. For example {6D809377-6AF0-444B-8957-A3773F02200E} stands for Program Files and {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7} for System32.
Why it matters in investigations
PrimaryId is how you attribute a notification to an app: join Notification.HandlerId to NotificationHandler.RecordId and read it. A path-based identifier also tells you where the executable lived when it registered. An app in Program Files or Windows is expected; one in ProgramData, Users\Public, a temp folder or a profile folder deserves a closer look, although plenty of legitimate software installs per user.
Example
| PrimaryId as stored | As displayed by the parser |
|---|---|
Contoso.Chat_8wekyb3d8bbwe!App | unchanged, short name Contoso.Chat |
{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\cmd.exe | %SystemRoot%\System32\cmd.exe |
{6D809377-6AF0-444B-8957-A3773F02200E}\Vendor\app.exe | %ProgramFiles%\Vendor\app.exe |
The drive letter is not recorded, so the parser renders known folders as environment variables.
Related terms
Filter notifications by app in the Windows Notification Parser; wpndatabase.db tables and columns explained covers the handler table in full.