MZ@ !L!This program cannot be run in DOS mode. $Rؕ3}3}3}H̴3}H̱3}Rich3}PEL!  }@й.rsrc@@ (@xE     8Ph(@Xp !"#&'0(H)`*x+EFGLMN R8SPXhYZ[\^_ef(k@~Xp0H`x9XY_`  8 H X h x           ( 8 H X h x           ( 8 H X h x           ( 8 H X h x           ( 8 H X h x   `8"L&&*t /r2(6<99;8??|@&@tAdBfBCD0EE~8FF\HLb(MM<$N`NPN*OVXO<OPPhSLTW\"]`8dfkfqZtvDx|y~Ђ|L@DHԟX,4`\X2PhV<hZL@MUIy-5^YRa0L MUIzh-CN$: eHel0 .eQ "SCHTASKS /?" N(ulOo`0 9: /MO y N(uNdkRNR{|W0 .eQ "SCHTASKS /CREATE /?" N(ulOo`0 3: f:y : / \ | !fJT: NRR z^ gRl gЏL0`Os(W/TRdk gRT(Y/N)?: el/TRNRR z^ gR0 PAOo`: ck(W Rd v1 NReN0 -: eHel0 .eQ "SCHTASKS /SHOWSID /?" NN(ulOo`0 PA: RNR %s Sl gЏL V:Neln^7bOo`0 %fJT: "NT AUTHORITY\SYSTEM" (u7bv[x\_eu0 fJT: nx[ Rd@b gNRT (Y/N) ? fJT: nx[ RdNR "%s" T (Y/N )? K: :N /DU c[NeHef:y@b gRNR0  /Change f9eRNR^\'`0  /Run cЏLRNR0 $ /End -NbkS_MRck(WЏLvRNR0 ) /ShowSid >f:yNRvNR Tyv^v[hQhƋ&{0  /? >f:ydk.^Rmo`0 Examples:  SCHTASKS  SCHTASKS /?  SCHTASKS /Run /?  SCHTASKS /End /?  SCHTASKS /Create /? PA SCHTASKS /Delete /?  SCHTASKS /Query /?  SCHTASKS /Change /?  SCHTASKS /ShowSid /? PA; SCHTASKS /Query [/S system [/U username [/P [password]]]] 3 [/FO format | /XML [xml_type]] [/NH] [/V] c:  AQ{tXT>f:y,g0Wb܏ z|~ NvRNR0 SpeRh: ' /S system c[ޏc0Rv܏ z|~0 4 /U username c[ schtasks.exe gbLv(u7b N Ne0  , /P [password] c[~[v(u7b N Ne[x0YgweuR c:yeQ0 7 /FO format :NQc[f:yRh0 ( S[ TABLE f:y~NRQ0 " /TN taskname c[h"}vQOo` 0 vNR Ty &TROh"}@b gNR TyvOo`0 * /XML [xml_type] N XML f:yNR[IN0 = Yg xml_type :N ONE RQ:NN*N gHe XML eN0 0 Yg xml_type NX[(W RQ\:N * @b g XML NR[INv2NT0 # /? >f:ydk.^Rmo`0 :yO:  SCHTASKS /Query  SCHTASKS /Query /? 2 SCHTASKS /Query /S system /U user /P password > SCHTASKS /Query /FO LIST /V /S system /U user /P password % SCHTASKS /Query /FO TABLE /NH /V PA) [/TN taskname] [/HRESULT] [/?] . /HRESULT :N_fQrvEeʋeR YtQNx * \Ǒ(u HRESULT f:ydk.^Rmo`0 :yO:  SCHTASKS /Delete /TN * /F % SCHTASKS /Delete /TN "\YN\YNT؏S" B SCHTASKS /Delete /S system /U user /P password /TN "\YN\/TR؏S" E SCHTASKS /Delete /S system /U user /P password /TN "\YN\/TRYN" /F + /HRESULT :N_f}YvEeʋeR YtQNx ) \Ǒ(u HRESULT f:ydk.^Rmo`0 :yO: 2 SCHTASKS /Change /RP password /TN "\YN\YNT؏S" 4 SCHTASKS /Change /TR restore.exe /TN "\YN\/TR؏S" @ SCHTASKS /Change /S system /U user /P password /RU newuser /TN "\YN\/TRYN" /IT PA? [N v2 NR "NT AUTHORITY\LOCALSERVICE"T @ "NT AUTHORITY\NETWORKSERVICE"NS8^v SID # [ُ N*N_NS(u0  [/HRESULT] [/?] . /HRESULT :N_fQrvEeʋeR YtQNx * \Ǒ(u HRESULT SCHTASKS /Run [/S system [/U username [/P [password]]]] [/I] c:  cЏLRNR0 PASpeRh: ' /S system c[ޏc0Rv܏ z|~0 / /U username c[^(WvQ-NgbL schtasks.exe " v(u7b N Ne0 - /P [password] :N~[v(u7b N Nec[[x YgweuR c:yeQ0 ( /I _euNUOP6RzsSЏLNR0 ( /TN taskname hƋzsSЏLvRNR0 # /? >f:ydk.^Rmo`0 :yO:  SCHTASKS /Run /? ! SCHTASKS /Run /TN "\YN\/TRYN" C SCHTASKS /Run /S system /U user /P password /I /TN "\YN\YNT؏S" ' /TN taskname [/HRESULT] [/?] . /HRESULT :N_fQrvEeʋeR YtQNx * \Ǒ(u HRESULT f:ydk.^Rmo`0 :yO:  SCHTASKS /End /? ! SCHTASKS /End /TN "\YN\/TRYN" @ SCHTASKS /End /S system /U user /P password /TN "\YN\YNT؏S" ' /TN taskname [/HRESULT] [/?] * /HRESULT :N_fQrvEeʋeR YtQNx & \Ǒ(u HRESULT f:y SID0 SpeRh: , /TN taskname c[RvNR Ty0 Ty-N NAQ gwR~0  /? >f:ydk.^Rmo`0 :yO:  SCHTASKS /ShowSid /? % SCHTASKS /ShowSid /TN "\YN\/TRYN" * /HRESULT :N_fQrvEeʋeR YtQNx & \Ǒ(u HRESULT gHeRNR: MINUTE0 HOURLY0DAILY0WEEKLY0 J MONTHLY, ONCE, ONSTART, ONLOGON, ONIDLE, ONEVENT. * /MO modifier 9eۏR{|WNAQf}Y0Wc6RR͑ Y , hTg0 gHef:ydk.^Rmo`0 O9e: cR{|Wv /MO _sQv gHe (W܏ z:ghV "ABC" NR^RNR "doc" 0 :ghVk\e(W "runasuser" (u7b NЏL notepad.exe0 B SCHTASKS /Create /S ABC /U user /P password /RU runasuser D /RP runaspassword /SC HOURLY /TN doc /TR notepad * ==> (W܏ z:ghV "ABC" NR^RNR "accountant" $ (Wc[v_YegT~_gegKNv_YeT~_geQ  kNRЏL calc.exe0 F SCHTASKS /Create /S ABC /U domain\user /P password /SC MINUTE G /MO 5 /TN accountant /TR calc.exe /ST 12:00 /ET 14:00 O /SD 06/06/2006 /ED 06/06/2006 /RU runasuser /RP userpassword & ==> R^RNR "gametime" (Wkgv,{N*Nfg)Y  ЏL zzS_c 0 D SCHTASKS /Create /SC MONTHLY /MO first /D SUN /TN gametime 3 /TR c:\windows\system32\freecell % ==> (W܏ z:ghV "ABC" R^RNR "report"  k*NfgЏL notepad.exe0 PAB SCHTASKS /Create /S ABC /U user /P password /RU runasuser J /RP runaspassword /SC WEEKLY /TN report /TR notepad.exe ) ==> (W܏ z:ghV "ABC" R^RNR "logtracker"  kNRNc[v_Ye0Re~_ge " ЏL notepad.exe0\c:yeQ /RP [x0 F SCHTASKS /Create /S ABC /U domain\user /P password /SC MINUTE ' /MO 5 /TN logtracker ? /TR c:\windows\system32\notepad.exe /ST 18:30 $ /RU runasuser /RP ' ==> R^RNR "gaming" k)YN 12:00 p_Y0R & 14:00 pꁨR~_g ЏL freecell.exe0 H SCHTASKS /Create /SC DAILY /TN gaming /TR c:\freecell /ST 12:00  /ET 14:00 /K * ==> R^RNR EventLog N_YЏL wevtvwr.msc  S(W |~ S-NS^NN 101 B SCHTASKS /Create /TN EventLog /TR wevtvwr.msc /SC ONEVENT 7 /EC System /MO *[System/EventID=101] = [N v2 NR "NT AUTHORITY\LOCALSERVICE"T > "NT AUTHORITY\NETWORKSERVICE"NS8^v SID $ [ُ N*N_NS(u0 * /NP NPX[NUO[x0NRN~[(u7bvN + ^NNve_ЏL0S g,g0WDnS(u0 %fJT: XML (u7b T S /RU (u7b T N9SMO(u /RU (u7b T0 : ,g0W{:g N NAQ(u7bQnc0 PA localhostPAOo`: ]/T(uRvNR "%s"0 Oo`: ]y(uRvNR "%s"0 8: /RI y N(uNc[vR{|W0 .eQ "SCHTASKS /CREATE /?" N(ulOo`0 g: y /RI0/DU0/ST0/SD0/ET0/ED T /K N(uNR{|W: ONSTART0ONLOGON0ONIDLE0 .eQ "SCHTASKS /CREATE /?" N(ulOo`0 %: :N /RI c[v eN_-NSNReQzz FileDescriptionNRR z^Mn]wQr)FileVersion6.3.9600.16384 (winblue_rtm.130821-1623): InternalNameschtasks.exe.LegalCopyright Microsoft Corporation. All rights reserved.HOriginalFilenamesctasks.exe.muij%ProductNameMicrosoft Windows Operating SystemBProductVersion6.3.9600.16384DVarFileInfo$TranslationPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING