https://www.reddit.com/r/blueteamsec/comments/1nrvzq7/werdump_a_beacon_object_file_bof_for_havoccs_to/