https://www.lifars.com/knowledge-center/windows-memory-forensics-technical-guide-2/