Ryuk has constructed legitimate appearing installation folder paths by calling "GetWindowsDirectoryW" and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as "C:\Users\Public".