Found while searching for info on Msft COFEE. Review later...

DoD Cybercrime Recovering Executables from memory