> 2025-04-14 23:59:17 – shadow copy complete. Remote wipe initiated in T-10 minutes.
Someone had built a spy inside the automation layer. rpaextract.exe
The executable wasn’t extracting claim data. It was extracting exits . > 2025-04-14 23:59:17 – shadow copy complete
> Restarting rpaextract in persistence mode. User Marlene_D – status: flagged. rpaextract.exe
She yanked the network cable. Too late. A final entry appeared in the log: