Emotet artifacts are typically found in arbitrary paths located off of the AppData\Local and AppData\Roaming directories. Persistence is typically maintained through Scheduled Tasks or via registry keys. Additionally, Emotet creates randomly-named files in the system root directories that are run as Windows services