Required tools for playing around with memory:
hexdumpobjdumpreadelfxxdgcore
| c:\windows\system32\microsoft\crypto\rsa\machinekeys | |
| c:\windows\system32\tasks_migrated\microsoft\windows\pla\system | |
| c:\windows\syswow64\tasks\microsoft\windows\pla\system | |
| c:\windows\debug\wia | |
| c:\windows\system32\tasks | |
| c:\windows\syswow64\tasks | |
| c:\windows\tasks | |
| c:\windows\registration\crmlog | |
| c:\windows\system32\com\dmp | |
| c:\windows\system32\fxstmp |