These are part of the "TTPs" (Tactics, Techniques, and Procedures) and serve to characterize the attackers and determine the attack surface. In the course of the lecture, we will search for clues together and reconstruct the program executions on Windows systems. 

The lecture is given by Adrian Klick-Strehl.