not able to make it work with memexec of brc4 after impersonating the SYSTEM. Tried modifying code of checksystem to openthreadtoken instead of openprocesstoken. No success.
Any idea how to make it work with get_system or impersonating the SYSTEM token