https://www.lifars.com/knowledge-center/windows-memory-forensics-technical-guide-part-3/