value:  REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user. ;; Shamoon can impersonate tokens using LogonUser ImpersonateLoggedOnUser and ImpersonateNamedPipeClient.
name: Access Token Manipulation: Token Impersonation/Theft