https://www.sans.org/reading-room/whitepapers/forensics/windows-crash-dumps-remote-incident-identification-36012