MZ@ !L!This program cannot be run in DOS mode. $Rؕ3}3}3}H̴3}H̱3}Rich3}PEL!  @.rsrc@@( @Xpܾ||MUIa~] #:1dڑ1J = |U MUI zh-CN@#+(B-<DdVpc: SC /f(uegN gRc6R{thVT gRۏLO v}TNL z^0 (ul: sc <server> [command] [service name] <option1> <option2>... <server> yvN gR{|Wvr`0 queryex---------g gRvibU\r` bg>N gR{|Wvr`0 start-----------/TR gR0 pause-----------T gRS PAUSE c6RBl0 interrogate-----T gRS INTERROGATE c6RBl0 continue--------T gRS CONTINUE c6RBl0 stop------------T gRS STOP Bl0 config----------f9e gRvMn(8lEN)0 description-----f9e gRvc0 failure---------f9e gR1Y%egbLvd\O0 failureflag-----f9e gRv1Y%d\Oh0 sidtype---------f9e gRv gR SID {|W0 privs-----------f9e gRv@bCgP0 managedaccount--f9e gRNO\ gR^7b[x h:N1u LSA {t0 qc--------------g gRvMnOo`0 qdescription----g gRvc0 qfailure--------g gR1Y%egbLvd\O0 qfailureflag----g gRv1Y%d\Oh0 qsidtype--------g gRv gR SID {|W0 qprivs----------g gRv@bCgP0 qtriggerinfo----g gRvShVSpe0 qpreferrednode--g gRv NUMA p0 qrunlevel-------g gRvЏL~+R0 qmanagedaccount-g gR/f&T\^7b N LSA {tv[x~TO(u0 qprotection-----g gRvۏ zOb~+R0 delete----------(NlQh-N) Rd gR0 create----------R^ gR(v^\vQmR0RlQh-N)0 control---------T gRSc6R0 sdshow---------->f:y gRv[hQc&{0 sdset-----------n gRv[hQc&{0 showsid--------->f:yNNa Ty[^v gR SID W[&{2N0 triggerinfo-----Mn gRvShVSpe0 preferrednode---n gRv NUMA p0 runlevel--------n gRvЏL~+R0 GetDisplayName--S gRv DisplayName0 GetKeyName------S gRv ServiceKeyName0 EnumDepend------g>N gROVsQ|0 N N}TN NBlO(u gR Ty: sc <server> <command> <option> boot------------(ok | bad) c:y/f&T^\ NN!k_[OX[:N gяN!k]wvcknx_[Mn Lock------------[ gRpenc^ QueryLock-------g SCManager penc^v LockStatus :yO: sc start MyService /f&TS QUERY T QUERYEX }TNv.^R? [ y | n ]:  QUERY T QUERYEX y: Ygg}TN&^ gR Ty \ԏV gRvr`0vQN y NTُy `Q0Ygg}TN N&^Speb &^ NR yKNN \g>Ndk gR0 type= g>Nv gRv{|W(driver, service, all) ؞ = service) state= g>Nv gRvr` (inactive, all) (؞ = active) bufsize= g>NQ:Sv'Y\(NW[) (؞ = %1) ri= _Yg>Nvb` Y"}_S (؞ = 0) group= g>Nv gR~ (؞ = all groups) l:yO sc query - g>N;mR gRTqR z^vr` sc query eventlog - >f:y eventlog gRvr` sc queryex eventlog - >f:y eventlog gRvibU\r` sc query type= driver - Ng>N;mRqR z^ sc query type= service - Ng>N Win32 gR sc query state= all - g>N@b g gRTqR z^ sc query bufsize= 50 - g>NQ:S:N 50 W[ sc query ri= 14 - g>Neb` Y"}_ = 14 sc queryex group= "" - g>N N(W~Qv;mR gR sc query type= interact - g>N@b g N;mR gR sc query type= driver group= NDIS - g>N@b g NDIS qR z^ c: (WlQhT gRpenc^-NO9e gRy0 (ul: sc <server> config [service name] <option1> <option2>... y: la: y TySbI{S0 I{ST start= <boot|system|auto|demand|disabled|delayed-auto> error= <normal|severe|critical|ignore> binPath= <BinaryPathName to the .exe file> group= <LoadOrderGroup> tag= <yes|no> depend= <OX[sQ|(N / (e`g) R)> obj= <AccountName|ObjectName> DisplayName= <>f:y Ty> password= <[x> c: (WlQhT gRpenc^-NR^ gRy0 (ul: sc <server> create [service name] [binPath= ] <option1> <option2>... y: la: y TySbI{S0 I{ST (؞ = own) start= <boot|system|auto|demand|disabled|delayed-auto> (؞ = demand) error= <normal|severe|critical|ignore> (؞ = normal) binPath= <BinaryPathName to the .exe file> group= <LoadOrderGroup> tag= <yes|no> depend= <OX[sQ|(N / (e`g) R)> obj= <AccountName|ObjectName> (؞= LocalSystem) DisplayName= <>f:y Ty> password= <[x> c: f9e1Y%ed\O (ul: sc <server> failure [service name] <option1> <option2>... y: reset= <͑n1Y%pe:N 0 (SN/feP) KNMReve^(Ny)> (_{N actions= NwO(u) reboot= <1Y%e͑e/TRKNMRvmo`^d> command= <1Y%eЏLv}TNL> actions= <1Y%d\OTvQ^ߏe(N_y) N / (e`g) R -- Y run/5000/reboot/800 gHevd\O/f <run|restart|reboot> > (_{N reset= option NwO(u) c: /TR gRЏL0 (ul: sc <server> start [service name] <arg1> <arg2> ... c: S PAUSE c6RBl0R gR0 (ul: sc <server> pause [service name] c: S INTERROGATE c6RBl0R gR0 (ul: sc <server> interrogate [service name] Hc: S CONTROL x0R gR0 (ul: sc <server> control [service name] <value> <value> = (u7b[INvc6Rx <value> = <paramchange| netbindadd|netbindremove| netbindenable|netbinddisable> SS sc stop0sc pause I{0 c: S CONTINUE c6RBl0R gR0 (ul: sc <server> continue [service name] c: S STOP c6RBl0R gR0 (ul: sc <server> stop [service name] <reason> <comment> <reason> = gR\PbkvS SVNxS 1u NRCQ }~b = sQNN NSVvS Yl(gY 127 *NW[&{) c: n gRvcW[&{2N0 (ul: sc <server> description [service name] [description] c: g gRvMnOo` (ul: sc <server> qc [service name] <bufferSize> c: h"} gRvcW[&{2N0 (ul: sc <server> qdescription [service name] <bufferSize> c: h"}(W1Y% gR NgbLvd\O0 (ul: sc <server> qfailure [service name] <bufferSize> c: g SC {thVpenc^v[r`0 (ul: sc <server> querylock <bufferSize> c: NlQh Rd gRy0 Yg gRck(WЏL bSNۏ z]~Sb_ 0Rdk gRvSg gR\{US0Wh:N Rd0 (ul: sc <server> delete [service name] c: cf/f&T NN!k/TR(W,g0W{:g N OX[:NgT@bwv}Yv/TRMn0 Ygc[ gRhV T\_eu0 (ul: sc <server> boot <bad | ok> c: SNyr[ gRvsQv>f:y Ty (ul: sc <server> GetDisplayName <service key name> <bufsize> c: SNyr[ gRvsQv. T \>f:y Ty(u\OeQ (ul: sc <server> GetKeyName <service display name> <bufsize> c: g>NOX[Ndk gRv gR (ul: sc <server> EnumDepend <service name> <bufsize> c: N SDDL f:y gRv[hQc&{ (ul: sc <server> sdshow <service name> <showrights> c: n gRv[hQ'`c&{ (ul: sc <server> sdset <service name> <SD in SDDL format> @ SERVICE_NAME: %1 c: %2  Ty = %1  %1 D IsLocked : TRUE D IsLocked : FALSE  LockOwner : %1 LockDuration : %2 (STvype) $[SC] h = %1 0[SC] %1: Svy = %2  H ;mRpenc^]~[0 Ǐ API  c u: , [SC] \QNpenc^ h SERVICE_NAME: %1 %2 TYPE : %3 %4 %5 STATE : %6 %7 (%8, %9, %10) WIN32_EXIT_CODE : %11 (0x%12) SERVICE_EXIT_CODE : %13 (0x%14) CHECKPOINT : 0x%15 WAIT_HINT : 0x%16  SERVICE_NAME: %1 DISPLAY_NAME: %2 TYPE : %3 %4 %5 STATE : %6 %7 (%8, %9, %10) WIN32_EXIT_CODE : %11 (0x%12) SERVICE_EXIT_CODE : %13 (0x%14) CHECKPOINT : 0x%15 WAIT_HINT : 0x%16  SERVICE_NAME: %1 %2 TYPE : %3 %4 %5 STATE : %6 %7 (%8, %9, %10) WIN32_EXIT_CODE : %11 (0x%12) SERVICE_EXIT_CODE : %13 (0x%14) CHECKPOINT : 0x%15 WAIT_HINT : 0x%16 PID : %17 FLAGS : %18  SERVICE_NAME: %1 DISPLAY_NAME: %2 TYPE : %3 %4 %5 STATE : %6 %7 (%8, %9, %10) WIN32_EXIT_CODE : %11 (0x%12) SERVICE_EXIT_CODE : %13 (0x%14) CHECKPOINT : 0x%15 WAIT_HINT : 0x%16 PID : %17 FLAGS : %18 , SERVICE_NAME: %1 RESET_PERIOD (Ny) : %2 REBOOT_MESSAGE : %3 COMMAND_LINE : %4 | FAILURE_ACTIONS : ͑/TR -- ^ߏ = %1 _y0 | ͑/TR -- ^ߏ = %1 _y0 | FAILURE_ACTIONS : ͑/TR -- ^ߏ = %1 _y0 | ͑/TR -- ^ߏ = %1 _y0  FAILURE_ACTIONS : ЏLۏ z -- ^ߏ = %1 _y0  ЏLۏ z -- ^ߏ = %1 _y0 h SERVICE_NAME: %1 TYPE : %2 %3 %4 START_TYPE : %5 %6 ERROR_CONTROL : %7 %8 BINARY_PATH_NAME : %9 LOAD_ORDER_GROUP : %10 TAG : %11 DISPLAY_NAME : %12 DEPENDENCIES : %13 H : %1 H SERVICE_START_NAME : %1 [SC] %1 bR 4[SC] %1 1Y% %2: %3 ,[SC] %1 %2 W[ T [SC] %1: fYpenc (W"}_ %3 _Yb` Yv %2 W[ < [SC] %1: fYpenc %2 W[ ( : eHe %1 W $ : eHe y 4 : g>N~e Nc[ gR Ty , : gR Ty0 $ : *gw}TN 8 : ͑nTd\O y_{ Ten u y c: f9e gRv1Y%d\Oh_n0 Ygdkn:N 0 (؞ failureflag [service name] [flag] c: h"} gRv1Y%d\Oh_n0 Ygdkn:N 0 (؞ qfailureflag [service name]  SERVICE_NAME: %1 FAILURE_ACTIONS_ON_NONCRASH_FAILURES: TRUE  SERVICE_NAME: %1 FAILURE_ACTIONS_ON_NONCRASH_FAILURES: FALSE c: f9e gRv gR[hQhƋ&{(SID){|Wn0 Ygdkn:N unrestricted gRc6R{thV(SCM)OV:Nۏ z-Nv ,{N*N gRck(W/TR (W gRۏ z N!k/TRe\dk gRv SID mR gRۏ zNLr0 dknN[ Win32 (u7b!j_ gR gHe0 Ygdkn:N restricted gRc6R{thV(SCM)OV:Nۏ z-Nv,{ N*N gRck(W/TR (W gRۏ z N!k/TRe\dk gRv SID mR gRۏ zNLr0 dkY dk gRv SID _NOmRۏ zNLr-NvSP SID Rh Vdkۏ zNLr\b:NN*NSPvNLr0 gsQSPNLrv~Oo` S MSDN0dknN[ Win32 (u7b!j_ gR gHe0dkY [ NqQNۏ z gR qQYNۏ z-Nv@b g gRv SID {|W_{ :Ndkn NO gRuHe0 Ygdkn:N none SCM NO\ gRv SID mR gRۏ zNLr0 (ul: sc <server> sidtype [service name] [type] y: type = <none|unrestricted|restricted> c: g gRv gR[hQhƋ&{(SID){|Wn0 Ygdkn:N unrestricted gRc6R{thV(SCM)OV:Nۏ z-Nv,{N*N gRck(W/TR (W gRۏ z N!k/TRe\dk gRv SID mR gRۏ zNLr0 dknN[ Win32 (u7b!j_ gR gHe0 Ygdkn:N restricted gRc6R{thV(SCM)OV:Nۏ z -Nv,{N*N gRck(W/TR (W gRۏ z N!k/TRe\dk gRv SID mR gRۏ zNLr0 dkY dk gRv SID _NOmRۏ zNLr-NvSP SID Rh Vdkۏ zNLr\b:NN*NSPvNLr0 gsQSPNLrv~Oo` S MSDN0dknN[ Win32 (u7b!j_ gR gHe0dkY [ NqQNۏ z gR qQYNۏ z-Nv@b g gRv SID {|W_{ :Ndkn NO gRuHe0 Ygdkn:N none SCM NO\ gRv SID mR gRۏ zNLr0 (ul: sc <server> qsidtype [service name] p SERVICE_NAME: %1 SERVICE_SID_TYPE: UNRESTRICTED ` SERVICE_NAME: %1 SERVICE_SID_TYPE: NONE l SERVICE_NAME: %1 PRIVILEGES : %2 D : %1 8c: g gR@bvCgPn0 CgPnO(W gRۏ zV:Nۏ z-Nv,{N*N gRck(W/TR /TRe uHe0dke gRc6R{thV(SCM)O{\N TN*Nۏ z:N[;N v@b g gR@bv@b gCgPvTT 6qTR^wQ gُNCgPvۏ z0 Ygl gndkn RasT@w gRO[hQP[|~@b~N(W gRv]Mn^7b NЏLvۏ zv@b gCgP0 (ul: sc <server> qprivs [service name] <bufferSize> c: f9e gR@bvCgPn0 CgPnO(W gRۏ zV:Nۏ z-Nv,{N*N gRck(W/TR /TRe uHe0dke gRc6R{thV(SCM)O{\N TN*Nۏ z:N[;N v@b g gR@bv@b gCgPvTT 6qTR^wQ gُNCgPvۏ z0 Ygl gndkn RasT@w gRO[hQP[|~@b~N(W gRv]Mn^7b NЏLvۏ zv@b gCgP0 (ul: sc <server> privs [service name] [privileges] y: privileges = <1ucke`gRvCgP> [OY: SeBackupPrivilege/SeRestorePrivilege] l SERVICE_NAME: %1 SERVICE_SID_TYPE: RESTRICTED  SDDL CgP CgP

f:yNNa Tyv[^v gR SID W[&{2N0 TySN/fs gb NX[(Wv gRv Ty0 (ul: SC showsid [ Ty] 8[SC] 1uNSu %2 %1 1Y%0 \&c: f9e gRvShVSpe0 (ul: sc <server> triggerinfo [service name] <option1> <option2>... y: start/device/UUID/HwId1/...<(W NR`Q N/TR gR: O(uN*NbY*NlxN ID W[&{2N T/b|Q[v ID W[&{2Nc[v YcS{| UUID W[&{2N0R> start/custom/UUID/data0/..<(W NR`Q N/TR gR: egO(uN*NbY*NNۏ6R pency(Ǒ(uASmQۏ6RW[&{2N stop/custom/UUID/data0/...<(W NR`Q N\Pbk gR: egO(uN*NbY*NNۏ6R pency(Ǒ(uASmQۏ6RW[&{2N start/strcustom/UUID/data0/..<(W NR`Q N/TR gR: egO(uN*NbY*NS W[&{2N pencyc[vꁚ[IN ETW cO z^ UUID W[&{2N vNN0R> stop/strcustom/UUID/data0/..<(W NR`Q N\Pbk gR: egO(uN*NbY*NS W[&{2N pencyc[vꁚ[IN ETW cO z^ UUID W[&{2N vNN0R> start/lvlcustom/UUID/data0/..<(W NR`Q N/TR gR: egO(u~+RؚNbI{N ASmQۏ6RpeW[ stop/lvlcustom/UUID/data0/..<(W NR`Q N\Pbk gR: egO(u~+RؚNbI{N ASmQۏ6RpeW[ start/kwanycustom/UUID/data0/..<(W NR`Q N/TR gR: egO(uNASmQۏ6RpeW[ stop/kwanycustom/UUID/data0/..<(W NR`Q N\Pbk gR: egO(uNASmQۏ6RpeW[ start/kwallcustom/UUID/data0/..<(W NR`Q N/TR gR: egO(uNASmQۏ6RpeW[ stop/kwallcustom/UUID/data0/..<(W NR`Q N\Pbk gR: egO(uNASmQۏ6RpeW[ start/networkon <(W,{N*N IP 0W@W N/TR gR> stop/networkoff <(W IP 0W@W N\Pbk gR> start/domainjoin <(WReQWe/TR gR> stop/domainleave <(WQWe\Pbk gR> start/portopen/parameter <(WSb_Q~zSe /TR gR0SpeǑ(uRS Rv stop/portclose/parameter <sQQ~zSe \Pbk gR0SpeǑ(uRS Rv start/machinepolicy <S_{:g~V{euSuSSb(W/TRe X[(W{:g~V{eue/TR gRt> start/userpolicy <S_(u7b~V{euSuSSb(W/TReX[(W (u7b~V{eue/TR gR> start/rpcinterface/UUID <S_Bl0R~[cS v RPC ~~p f\hV e/TR gR> start/namedpipe/pipename <S_Bl0Rc[v}T T{S e/TR gR0 NS+T{S Ty v "\\.\pipe\" R> delete < Rds gvShVSpe> 0 SERVICE_NAME: %1 T YcS0R : %1 [cS{| GUID] | ꁚ[IN : %1 [ETW cO z^ UUID] \ IP 0W@WS(u'` : %1 [e IP 0W@WS(u] X NSOf[cSY : %1 [cS{| GUID] c: h"} gRvShVOo`0 (ul: sc <server> qtriggerinfo [service name] <bufferSize> \ penc : %1 D ؏l g:NNUO/TRb\PbkShVlQ gR %10 $ /TR gR $ \Pbk gR \ IP 0W@WS(u'` : %1 [*N IP 0W@WS(u] X ]ReQvWvr` : %1 []ReQvW] X ReQvWvr` : %1 [*gReQvW] c: f9e Win32 gRv NUMA p0 dknN[ꁫvۏ z gR gHe0 傁 Rds gn \pSn:N -10 YgcONeHev pS Rf9eBl\1Y%0 (ul: sc <server> preferrednode [service name] [node number] 8c: g Win32 gRv NUMA p0 dknN[ꁫvۏ z gR gHe0 Ygdk gRl g pn Rg\1Y%0 (ul: sc <server> qpreferrednode [service name]  p : %1 D [la: 1uN gR/TR{|Wy(u VdkShVy(u0] X 2kpXzSNN : %1 [zSSb_] X 2kpXzSNN : %1 [zSsQ] d ~V{eu : %1 [X[(W{:gV{eu] ` ~V{eu : %1 [X[(W(u7bV{eu] H Ty: %1 gR SID: %2 r`: ^;mR Xc: f9e gRvgNOЏL~+R0 dknN[N N/TR{|Wv gR gHe: ꁨR/TR0 c/TRNSy(uT^sS csS(u(PNP)qR z^ gR0 gRv ЏL~+Rn NNONvQOVv gR0 ЏL~+R 0 S(uNc[ Rd ЏL~+Rn0YgcONeHev ЏL~+R Rf9eBl\1Y%b gR\el/TR0 (ul: sc <server> runlevel [service name] [runlevel number] |c: g gRvgNOЏL~+R0 dknN[N N/TR{|Wv gR gHe: ꁨR/TR0 c/TRNSy(uT^sS csS(u(PNP)qR z^ gR0*gc[ЏL ~+Rnv gR\wQ g

qrunlevel [service name] $ gNOЏL~+R : %1 d Q~NN : %1 [RPC cSNN] ` Q~NN : %1 [}T T{SNN] D ꁚ[IN|~r`f9eNN : %1 tYgvQN gR]\}T T{Sb RPC ShV(uN N~[ gRv Tv~~pbcS RSOQsdk0 Dc: f9eЏL gR@b(uv^7b/f&T O(u{tv[x0 Ygdkn:N "true" R gRc6R {thV(SCM)\(W gR/TReN NetLogon Bl^7b[x0 Ygdkn:N "false" R SCM \O(u Mnv^7b[x0 (ul: sc <server> managedaccount [service name] [type] y: type = <true|false>  {tv^7b: %1 c: g:Ndk gRMnv ^7b/f&T g{tv^7b[x0 (ul: sc <server> qmanagedaccount [service name] , : ShVpenc qprotection [service name] ( gR %1 Ob~+R: e0 4 gR %1 Ob~+R: Windows0 < gR %1 Ob~+R: Windows {SOb0 8 gR %1 Ob~+R: Sv`aoN{SOb0 , gR %1 Ob~+R: eHe OriginalFilenamesc.exe.muij%ProductNameMicrosoft Windows Operating SystemBProductVersion6.3.9600.16384DVarFileInfo$TranslationPADDINGX