Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Ryuk has constructed legitimate appearing installation folder paths by calling <code>GetWindowsDirectoryW</code> and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as <code>C:\Users\Public</code>.