Someone had built a spy inside the automation layer.
> 2025-04-14 23:59:17 – shadow copy complete. Remote wipe initiated in T-10 minutes.
But this new process wasn't on the manifest.
> 2025-04-14 23:59:17 – shadow copy complete. Remote wipe initiated in T-10 minutes. rpaextract.exe
But this new process wasn't on the manifest. Someone had built a spy inside the automation layer