The malware strategically chooses folders that evade detection from scanning software