this is a neat artifact that works despite many anti-forensic techniques. https://twitter.com/CrowdStrike/status/1179150266848993280