Daily Blog #462: ObjectIDs and intrusion triage
To summarize the point if a file gets created in the GUI in Windows 10 it creates a shell item (lnk, jumplist, recent doc, etc.) and gets an ObjectID