Payloads & web probes

Files attackers tried to drop on the fake shell (hash only; samples are never redistributed), plus the most-requested web paths and client fingerprints.