mon.exe</code> will be probed before <code>C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe</code> and once Windows finds our malicious executable there, it will be executed with the service's permissions.</p>
<p><img src="Resources/Images/USP/Copy%20To%20Unquoted%20Path.png" alt="" /></p>
<p>If we couldn't restart the service, then we could have simply waited for something else to execute it.</p>
<p><img src="../Resources/Images/Shell.png" alt="" /></p>

                    </mai