Notepad

Threat Actors commonly leverage a notepad/notepad++ file when they're interactive on a compromised host. They use it to copy/paste output from the cli commands they execute, then they choose to not save the file, believing it isn't saved to disk. Both of those files can be found in (mostly) plaintext and may show you what the TA was targeting.

Notepad:

• %LOCALAPPDATA%\packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState*.bin

Notepad++:

• %APPDATA%\Notepad++\backup