I have found the following in a trojan sample. First, it gets the token of the current process and then it calls the GetTokenInformation() API with TokenGroups as InfoClass parameter. So, it puts the TOKEN_GROUPS structure to a certain place. Later, it uses the AllocateAndInitializeSid() API with the following parameters:      PUSH EAX      PUSH EBX      PUSH EBX      PUSH EBX      PUSH EBX      PUSH EBX      PUSH EBX      PUSH 220      PUSH 20      PUSH 2      LEA EAX, DWORD PTR DS:[EBP - C]      PUSH EAX      CALL DWORD PTR DS:[&ADVAPI32.AllocateAndInitializeSid]So, is the SID string S-1-20-220 ? If not, how I can extract this?Note: Some lines later, the trojan compares this SID with the SID values from the TOKEN_GROUPS structure using using the EqualSid() API. I mean, it accesses the 2nd field of TOKEN_GROUPS structure which is an array that consists of SID_AND_ATTRIBUTES structures. Each of these structures has a SID field which is compared with the initialized SID. For that reason, I would like to know how the initialized SID looks like. best regards, 
How to extract the SID string?
assembly