Don't have Telegram yet? Try it now!
https://www.andreafortuna.org/dfir/forensic-artifacts-evidences-of-program-execution-on-windows-systems/
Forensic Artifacts: evidences of program execution on Windows systems