https://tavares.re/hunting-privateloader-malware-behind-installskey-ppi-service/