SHA-256 hash of update.exe — WinDefCtl utility downloaded and renamed to svchost.exe in %TEMP% to disable Microsoft Defender via IFEO manipulation and kernel driver
