John, a security analyst, is analyzing a server suspected of being compromised. The attacker has used a non admin account and has already gained a foothold on the system. John discovers that a new Dynamic Link Library is loaded in the application directory of the affected server. This DLL does not have a fully quali ed path and seems to be malicious. What privilege escalation technique has the attacker likely used to compromise this server?