Curl Downloading Python to Public Folder

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•8

Detects the use of curl.exe to download the Python embeddable zip file directly into the C:\Users\Public directory, indicative of NarwhalRAT staging.