[faruaxn]

My victims are unable to delete the folder when they click on my server. The folder containing my server is unable to delete unless victims restart the machine. Is there a way the user can delete the server folder after executing it. User feels suspicious because when he delete the content of the folder successfully but when he tries to delete the folder he received message that folder is in use.

[CyberStrike]

I am guessing that the payload is running and uses some kind of UAC bypass to run as an administrator level or as administrator one way or another? Check the permissions of the process/thread such as user executing, Are you using for example CreateProccessAsUser or CreateProcessWithTokenW .. ? Also file permissions might want to use icacls for this and procmon/procexp.