The group would also dump memory from the specified process by using comsvcs.dll: rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 764 C:\Windows\TEMP\dump.bin full Indicator Removal  To avoid exposing their footprints to investigators, the threat actors made their own tool to wipe out the event logs on the victimized machine.