Add common installation paths

[hRun]

Hey,

Not a submission for a new WTFBin but a suggestion for an improvement: How about adding a field (list) to the JSON model for paths that the WTFBin is commonly found at? Similar to what's done at LOLBAS. It would help to better document the WTFBin and discern it from malware pretending to be a WTFBin but residing someplace else.

Cheers,
hRun