Skip to content
Timelineparser

Glossary

AppId (JSON)

The ActivitiesCache.db column that identifies the application as a JSON array of platform and application pairs, often with known folder GUIDs.

The AppId column holds a JSON array such as [{"application": "{1AC14E77-...}\\notepad.exe", "platform": "windows_win32"}, ...]. Platforms seen include windows_win32, x_exe_path, windows_universal, packageId and alternateId (kacos2000).

Desktop app paths often start with a known folder GUID instead of a drive and folder. An x_exe_path entry with a literal path in a user-writable folder deserves attention. See activity types and payload fields.