C:\Users\John Doe\malicious payload.exe
C:\Program Files\Windows Defender\MpCmdRun.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
\\FILE-SERVER\Finance Share\Q1 Reports\payload.exe
\\NAS01\HR Data\2024\export.csv
cmd.exe -e bin/run.sh
temp/payload.exe
modules/http/server.py
%APPDATA%\Microsoft
%LOCALAPPDATA%\Programs
$HOME/.config
$HOME/Library/Application Support
~/file
~user/.ssh
../scripts/build.sh
