discovered 2026-07-08
First-stage: fetched by hidden PowerShell, saved to C:\Users\Public\Pictures\api.db then certutil-decoded to L.ps1.