KB-prefixed AppData staging with tar extraction and renamed Java runtime

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•1•0•2

Detects command-line activity staging files using utilities like tar or mkdir into an AppData\Roaming\KB<digits> directory, followed shortly by the execution of a renamed Bun runtime (.js) or Java runtime (.java) from that same path.