A file name with full path causes the particular binary file to be excluded, i.e. any files it touches, regardless of where the file is located, will not be scanned by Windows Defender. A file name without any path causes any binary file with this file name to be excluded regardless of its location. A path followed by a "*" (e.g. c:\my\private\tools*) causes any binaries under this path to be excluded. Any files touched by these processes will be excluded. This is different from a path exclusion, where files touched by any process under the excluded path is excluded.