file_path

C:\Users\Public\Pictures\api.db

discovered 2026-07-08

certutil-encoded first-stage blob saved by the initial hidden PowerShell.