In this scenario, the attacker has observed traffic across the switch and found that a specific machine is attempting to download a file located at the UNC path: \10.0.0.100ShareLogin.bat .
On the attacker machine, a share is set up that exactly matches the UNC path of the file requested by the victim: \*ShareLogin.bat.