> changing the trustedinstaller path to run payload using the base64 encoded string
this is literally powershell malware dropper design 101 stuff this is hilarious
this is literally powershell malware dropper design 101 stuff this is hilarious
December 13, 2025 at 10:10 PM
> changing the trustedinstaller path to run payload using the base64 encoded string
this is literally powershell malware dropper design 101 stuff this is hilarious
this is literally powershell malware dropper design 101 stuff this is hilarious
This Windows "TrustedInstaller" user group is some bullshit.
November 15, 2024 at 4:04 AM
This Windows "TrustedInstaller" user group is some bullshit.
NOT EVEN TRUSTEDINSTALLER?????
March 27, 2025 at 1:51 AM
NOT EVEN TRUSTEDINSTALLER?????
Windows: "Sorry you need to TrustedInstaller to remove this file!"
Me: "OK", *sc start TrustedInstaller* then impersonates the token of the service process.
Windows: "Wait no, not like that" 😆
Me: "OK", *sc start TrustedInstaller* then impersonates the token of the service process.
Windows: "Wait no, not like that" 😆
March 1, 2026 at 11:44 PM
Windows: "Sorry you need to TrustedInstaller to remove this file!"
Me: "OK", *sc start TrustedInstaller* then impersonates the token of the service process.
Windows: "Wait no, not like that" 😆
Me: "OK", *sc start TrustedInstaller* then impersonates the token of the service process.
Windows: "Wait no, not like that" 😆
Want to update Windows 10 LTSC 2021 to version 22H2?
Run all of these commands below (more in the replies) as TrustedInstaller (e.g., RunAsTI) then reboot:
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild" /t REG_SZ /d "19045" /f
Run all of these commands below (more in the replies) as TrustedInstaller (e.g., RunAsTI) then reboot:
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild" /t REG_SZ /d "19045" /f
March 16, 2025 at 8:07 AM
Want to update Windows 10 LTSC 2021 to version 22H2?
Run all of these commands below (more in the replies) as TrustedInstaller (e.g., RunAsTI) then reboot:
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild" /t REG_SZ /d "19045" /f
Run all of these commands below (more in the replies) as TrustedInstaller (e.g., RunAsTI) then reboot:
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild" /t REG_SZ /d "19045" /f
when downloading a game from the xbox app on pc, u dont even have access to the folder the game is installed in
the perms needed to access the folder is "trustedinstaller" which is actually higher than admin perms and impossible to obtain without third party tools
the perms needed to access the folder is "trustedinstaller" which is actually higher than admin perms and impossible to obtain without third party tools
May 5, 2025 at 9:28 AM
when downloading a game from the xbox app on pc, u dont even have access to the folder the game is installed in
the perms needed to access the folder is "trustedinstaller" which is actually higher than admin perms and impossible to obtain without third party tools
the perms needed to access the folder is "trustedinstaller" which is actually higher than admin perms and impossible to obtain without third party tools
My computer is all like "You require permission from TrustedInstaller to make changes to this file" like bro I own you fuck off
May 24, 2026 at 4:52 AM
My computer is all like "You require permission from TrustedInstaller to make changes to this file" like bro I own you fuck off
Is there a fucking simpler way to get "permission" to delete files on my own goddamn computer?!? I started doing this ⬇️ and jesus fuck. I'm exhausted and stalled out. #Spoonie #TrustedAdvisor #PCBullshit #FuckingWindows
www.partitionwizard.com/partitionmag...
www.partitionwizard.com/partitionmag...
Expert Way: Get Permission from TrustedInstaller in Windows 10/7
Are you troubled by the problem “you require permission from TrustedInstaller”. Don’t worry, this post will walk you through detailed steps to fix the problem.
www.partitionwizard.com
January 19, 2025 at 8:23 PM
Is there a fucking simpler way to get "permission" to delete files on my own goddamn computer?!? I started doing this ⬇️ and jesus fuck. I'm exhausted and stalled out. #Spoonie #TrustedAdvisor #PCBullshit #FuckingWindows
www.partitionwizard.com/partitionmag...
www.partitionwizard.com/partitionmag...
🔐 Smuggling Data Between #PowerShell Processes – Like Han Solo!
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
- YouTube
Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.
youtu.be
July 31, 2025 at 5:00 AM
🔐 Smuggling Data Between #PowerShell Processes – Like Han Solo!
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
🔐 Smuggling Data Between #PowerShell Processes – Like Han Solo!
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
- YouTube
Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.
youtu.be
March 2, 2026 at 4:30 PM
🔐 Smuggling Data Between #PowerShell Processes – Like Han Solo!
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
Here’s what I mean when I say Windows is bloatware: it comes with programs it won’t let you turn off. Like Copilot, TrustedInstaller, and many more.
Windows has significantly more memory usage (both RAM and disk but especially RAM) with a fraction of the utility of Linux or even Mac.
Windows has significantly more memory usage (both RAM and disk but especially RAM) with a fraction of the utility of Linux or even Mac.
March 3, 2026 at 12:10 AM
Here’s what I mean when I say Windows is bloatware: it comes with programs it won’t let you turn off. Like Copilot, TrustedInstaller, and many more.
Windows has significantly more memory usage (both RAM and disk but especially RAM) with a fraction of the utility of Linux or even Mac.
Windows has significantly more memory usage (both RAM and disk but especially RAM) with a fraction of the utility of Linux or even Mac.
wow, trustedinstaller must be hungry
August 9, 2024 at 11:29 PM
wow, trustedinstaller must be hungry
🔐 Smuggling Data Between #PowerShell Processes – Like Han Solo!
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
- YouTube
Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.
youtu.be
September 12, 2025 at 1:00 PM
🔐 Smuggling Data Between #PowerShell Processes – Like Han Solo!
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
In this #PSConfEU 25 session, @jborean.bsky.social shows :
⚡ Secure sub-process execution
⚡ Running as SYSTEM or TrustedInstaller
⚡ Avoiding secret leaks via logs & env vars
⚡ Safe credential handling tricks
Files remaining after deleting System32 files with TrustedInstaller privileges on Windows 10: approximately 680-800 files
Windows 11:
Windows 11:
December 7, 2025 at 8:54 PM
Files remaining after deleting System32 files with TrustedInstaller privileges on Windows 10: approximately 680-800 files
Windows 11:
Windows 11:
2/ Several advertised capabilities stand out:
• UAC bypass & TrustedInstaller privilege escalation
• Active Directory (LDAP) network discovery
• Network share enumeration & encryption
• Automatic backup and shadow copy deletion
• UAC bypass & TrustedInstaller privilege escalation
• Active Directory (LDAP) network discovery
• Network share enumeration & encryption
• Automatic backup and shadow copy deletion
July 17, 2026 at 10:16 AM
2/ Several advertised capabilities stand out:
• UAC bypass & TrustedInstaller privilege escalation
• Active Directory (LDAP) network discovery
• Network share enumeration & encryption
• Automatic backup and shadow copy deletion
• UAC bypass & TrustedInstaller privilege escalation
• Active Directory (LDAP) network discovery
• Network share enumeration & encryption
• Automatic backup and shadow copy deletion
my special trick:
open cmd as TrustedInstaller
taskkill /f /im msedge.exe
taskkill /f /im MicrosoftEdgeUpdate.exe
rmdir /s "C:\Program Files (x86)\Microsoft"
y
open cmd as TrustedInstaller
taskkill /f /im msedge.exe
taskkill /f /im MicrosoftEdgeUpdate.exe
rmdir /s "C:\Program Files (x86)\Microsoft"
y
July 30, 2025 at 4:02 AM
my special trick:
open cmd as TrustedInstaller
taskkill /f /im msedge.exe
taskkill /f /im MicrosoftEdgeUpdate.exe
rmdir /s "C:\Program Files (x86)\Microsoft"
y
open cmd as TrustedInstaller
taskkill /f /im msedge.exe
taskkill /f /im MicrosoftEdgeUpdate.exe
rmdir /s "C:\Program Files (x86)\Microsoft"
y
they are only used for stuff like stopping u from deleting system files so u dont accidentally fuck up ur pc
theres also ANOTHER thing above trustedinstaller called system
theres also ANOTHER thing above trustedinstaller called system
May 6, 2025 at 3:31 PM
they are only used for stuff like stopping u from deleting system files so u dont accidentally fuck up ur pc
theres also ANOTHER thing above trustedinstaller called system
theres also ANOTHER thing above trustedinstaller called system
funny how weak people are, that they will resort to messing with your computer inorder to slow you down. creating an account named "trustedInstaller" when I know for a fact I don't trust anyone.
October 17, 2025 at 7:58 AM
funny how weak people are, that they will resort to messing with your computer inorder to slow you down. creating an account named "trustedInstaller" when I know for a fact I don't trust anyone.
Deleted the RUXIM folder in Program Files on the Surface, recreated it, removed ALL access permissions for ALL accounts -- including TrustedInstaller, System, etc --, added *read-only* access permissions for just my own account.
Wonder if that'll prevent it from reinstalling itself!
Wonder if that'll prevent it from reinstalling itself!
April 4, 2025 at 8:21 PM
Deleted the RUXIM folder in Program Files on the Surface, recreated it, removed ALL access permissions for ALL accounts -- including TrustedInstaller, System, etc --, added *read-only* access permissions for just my own account.
Wonder if that'll prevent it from reinstalling itself!
Wonder if that'll prevent it from reinstalling itself!
linux : Im not the problem its the bitch who compiled my drivers!
mac : Im the solution to a problem intentionally put here for other reasons!
windows : WHY MUST THE SYSTEM AND TRUSTEDINSTALLER ACCOUNT EXIST I OWN YOU PIECE OF SHIT UNMOUNT THE DRIVE ALREADY
mac : Im the solution to a problem intentionally put here for other reasons!
windows : WHY MUST THE SYSTEM AND TRUSTEDINSTALLER ACCOUNT EXIST I OWN YOU PIECE OF SHIT UNMOUNT THE DRIVE ALREADY
March 11, 2025 at 5:37 AM
linux : Im not the problem its the bitch who compiled my drivers!
mac : Im the solution to a problem intentionally put here for other reasons!
windows : WHY MUST THE SYSTEM AND TRUSTEDINSTALLER ACCOUNT EXIST I OWN YOU PIECE OF SHIT UNMOUNT THE DRIVE ALREADY
mac : Im the solution to a problem intentionally put here for other reasons!
windows : WHY MUST THE SYSTEM AND TRUSTEDINSTALLER ACCOUNT EXIST I OWN YOU PIECE OF SHIT UNMOUNT THE DRIVE ALREADY
considering "TrustedInstaller" is a core system component, I do feel like it should be pretty easy for the OS itself to check and see if it has any processes running.
It would, however, take a microsoft engineer actually thinking of the issue and caring to fix it, though.
It would, however, take a microsoft engineer actually thinking of the issue and caring to fix it, though.
February 17, 2025 at 5:05 AM
considering "TrustedInstaller" is a core system component, I do feel like it should be pretty easy for the OS itself to check and see if it has any processes running.
It would, however, take a microsoft engineer actually thinking of the issue and caring to fix it, though.
It would, however, take a microsoft engineer actually thinking of the issue and caring to fix it, though.
While it looks like it's going to do what it says, I wouldn't trust it, for two reasons:
1. It runs as TrustedInstaller, which is _very_ risky
2. I don't have any established trust for that user (if anyone else knows them, reach out)
Not trying to throw shade, just my $0.02
1. It runs as TrustedInstaller, which is _very_ risky
2. I don't have any established trust for that user (if anyone else knows them, reach out)
Not trying to throw shade, just my $0.02
August 28, 2025 at 12:39 AM
While it looks like it's going to do what it says, I wouldn't trust it, for two reasons:
1. It runs as TrustedInstaller, which is _very_ risky
2. I don't have any established trust for that user (if anyone else knows them, reach out)
Not trying to throw shade, just my $0.02
1. It runs as TrustedInstaller, which is _very_ risky
2. I don't have any established trust for that user (if anyone else knows them, reach out)
Not trying to throw shade, just my $0.02