UNC2452 removed evidence of email export requests using "Remove-MailboxExportRequest". They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.