iMonitor EAM version 9.6394 installs a system service named eamusbsrv64.exe that runs with NT AUTHORITY\SYSTEM privileges. This service uses an insecure update mechanism that automatically loads files from the C:\sysupdate\ directory during startup. Since any local user can write to this directory, an attacker can place malicious DLLs or executables there. When the service restarts, these files are moved to the application installation path and executed with SYSTEM privileges, enabling privilege escalation.