I was under the impression that they were planting files on the user's computer to incriminate them. I don't really understand where this code is getting it's payload from though.