value:  The downloaded installer is designed to look like a legitimate installation to trick the user into authenticating with their password to continue the second stage infection. 
name: Abuse Elevation Control Mechanism: Elevated Execution With Prompt