I was under the impression that they were planting files on the user's computer to incriminate them. I don't really understand where this code is getting it's payload from though.
It seems like that code just builds random-ish data that conforms to the wanted file format and then gives it incriminating names. For example:
That could plausibly be a tool for generating test data for forensics tools. The hardcoded paths don't make a lot of sense for actually trying to plant evidence.
I would guess that's part of a codebase for generating sales demos before LEOs.