Windows 10 security question: How do miscreants use these for post-hack persistence?