related to https://github.com/rapid7/metasploit-framework/pull/903
as egyp7 suggested I modified to_win32pe_service instead of create all _service payloads.
Now services are created with any EXE::Template so AV evasion is much more better and psexec will reborn :D
with exe-only technique (use in to_win32pe_service) the default template template_x86_windows_old.exe crash.
I just replace it by template_x86_windows.exe