value:  PowerSpritz decrypts a legitimate Skype or Telegram installer using a custom Spritz implementation with the key “Znxkai@ if8qa9w9489”. PowerSpritz then writes the legitimate installer to disk in the directory returned by GetTempPathA. 
name: Hijack Execution Flow: Executable Installer File Permissions Weakness