An open directory tied to Banana RAT exposed how the malware family is changing its Windows footprint, moving from fixed Microsoft-themed artifacts to randomized ProgramData paths.