My guess is that some higher-up employee clicked on a bonus.pdf.exe and that's it