value:  Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context. 
name: Access Token Manipulation: Create Process With Token