notifications.wpndatabase

$ target-query <path/to/target> -f notifications.wpndatabase

Details

Module	os.windows.notifications.NotificationsPlugin
Output	records

Module documentation

Plugin that parses the notification databases on Windows 10 machines.

Function documentation

Returns Windows Notifications from wpndatabase.db (post Windows 10 Anniversary).

References:

• https://inc0x0.com/2018/10/windows-10-notification-database/