This request is followed by a call to “GetisrunasAbById” to determine if the Trojan should use “runas” to execute the downloaded executable with elevated privileges, which would display the UAC dialog for the user to click