https://systw.net/note/archives/353
Win Forensics(VolatileInfo)