403Webshell
Server IP : 209.209.40.120  /  Your IP : 216.73.217.112
Web Server : Microsoft-IIS/10.0
System : Windows NT NEWWWW 10.0 build 17763 (Windows Server 2019) i586
User : NEWWWW$ ( 0)
PHP Version : 8.3.30
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Windows/System32/en-US/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /Windows/System32/en-US/sc.exe.mui
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$�<ߵ�R���R���R�Ы����R�ЫP���R�Rich��R�PEL�!


@�`@ l8.rdata�@@.rsrc  @@��G
T88��G$��8.rdata8x.rdata$zzzdbg �.rsrc$01� �.rsrc$02 ��o}ax�Fה�7
��b��Ƭ[���G��(�@�X�p�����	�	�	�� ���! ��6��MUI����ph}���R
N�k�x��
�I�hav��g���MUIen-USX#+�b-<�ddo�xq�\|������DDESCRIPTION:

        SC is a command line program used for communicating with the

        Service Control Manager and services.

USAGE:

        sc <server> [command] [service name] <option1> <option2>...





        The option <server> has the form "\\ServerName"

        Further help on commands can be obtained by typing: "sc [command]"

        Commands:

          query-----------Queries the status for a service, or

                          enumerates the status for types of services.

          queryex---------Queries the extended status for a service, or

                          enumerates the status for types of services.

          start-----------Starts a service.

          pause-----------Sends a PAUSE control request to a service.

          interrogate-----Sends an INTERROGATE control request to a service.

          continue--------Sends a CONTINUE control request to a service.

          stop------------Sends a STOP request to a service.

          config----------Changes the configuration of a service (persistent).

          description-----Changes the description of a service.

          failure---------Changes the actions taken by a service upon failure.

          failureflag-----Changes the failure actions flag of a service.

          sidtype---------Changes the service SID type of a service.

          privs-----------Changes the required privileges of a service.

          managedaccount--Changes the service to mark the service account 

                          password as managed by LSA.

          qc--------------Queries the configuration information for a service.

          qdescription----Queries the description for a service.

          qfailure--------Queries the actions taken by a service upon failure.

          qfailureflag----Queries the failure actions flag of a service.

          qsidtype--------Queries the service SID type of a service.

          qprivs----------Queries the required privileges of a service.

          qtriggerinfo----Queries the trigger parameters of a service.

          qpreferrednode--Queries the preferred NUMA node of a service.

          qmanagedaccount-Queries whether a services uses an account with a 

                          password managed by LSA.

          qprotection-----Queries the process protection level of a service.

          quserservice----Queries for a local instance of a user service template.

          delete----------Deletes a service (from the registry).

          create----------Creates a service. (adds it to the registry).

          control---------Sends a control to a service.

          sdshow----------Displays a service's security descriptor.

          sdset-----------Sets a service's security descriptor.

          showsid---------Displays the service SID string corresponding to an arbitrary name.

          triggerinfo-----Configures the trigger parameters of a service.

          preferrednode---Sets the preferred NUMA node of a service.

          GetDisplayName--Gets the DisplayName for a service.

          GetKeyName------Gets the ServiceKeyName for a service.

          EnumDepend------Enumerates Service Dependencies.



        The following commands don't require a service name:

        sc <server> <command> <option>

          boot------------(ok | bad) Indicates whether the last boot should

                          be saved as the last-known-good boot configuration

          Lock------------Locks the Service Database

          QueryLock-------Queries the LockStatus for the SCManager Database

EXAMPLE:

        sc start MyService

�



QUERY and QUERYEX OPTIONS:

        If the query command is followed by a service name, the status

        for that service is returned.  Further options do not apply in

        this case.  If the query command is followed by nothing or one of

        the options listed below, the services are enumerated.

    type=    Type of services to enumerate (driver, service, userservice, all)

             (default = service)

    state=   State of services to enumerate (inactive, all)

             (default = active)

    bufsize= The size (in bytes) of the enumeration buffer

             (default = %1)

    ri=      The resume index number at which to begin the enumeration

             (default = 0)

    group=   Service group to enumerate

             (default = all groups)



SYNTAX EXAMPLES

sc query                - Enumerates status for active services & drivers

sc query eventlog       - Displays status for the eventlog service

sc queryex eventlog     - Displays extended status for the eventlog service

sc query type= driver   - Enumerates only active drivers

sc query type= service  - Enumerates only Win32 services

sc query state= all     - Enumerates all services & drivers

sc query bufsize= 50    - Enumerates with a 50 byte buffer

sc query ri= 14         - Enumerates with resume index = 14

sc queryex group= ""    - Enumerates active services not in a group

sc query type= interact - Enumerates all interactive services

sc query type= driver group= NDIS     - Enumerates all NDIS drivers

�DESCRIPTION:

        Modifies a service entry in the registry and Service Database.

USAGE:

        sc <server> config [service name] <option1> <option2>...



OPTIONS:

NOTE: The option name includes the equal sign.

      A space is required between the equal sign and the value.

      To remove the dependency, use a single / as dependency value.

 type= <own|share|interact|kernel|filesys|rec|adapt|userown|usershare>

 start= <boot|system|auto|demand|disabled|delayed-auto>

 error= <normal|severe|critical|ignore>

 binPath= <BinaryPathName to the .exe file>

 group= <LoadOrderGroup>

 tag= <yes|no>

 depend= <Dependencies(separated by / (forward slash))>

 obj= <AccountName|ObjectName>

 DisplayName= <display name>

 password= <password>

HDESCRIPTION:

        Creates a service entry in the registry and Service Database.

USAGE:

        sc <server> create [service name] [binPath= ] <option1> <option2>...



OPTIONS:

NOTE: The option name includes the equal sign. 

      A space is required between the equal sign and the value.

 type= <own|share|interact|kernel|filesys|rec|userown|usershare>

       (default = own)

 start= <boot|system|auto|demand|disabled|delayed-auto>

       (default = demand)

 error= <normal|severe|critical|ignore>

       (default = normal)

 binPath= <BinaryPathName to the .exe file>

 group= <LoadOrderGroup>

 tag= <yes|no>

 depend= <Dependencies(separated by / (forward slash))>

 obj= <AccountName|ObjectName>

       (default = LocalSystem)

 DisplayName= <display name>

 password= <password>

�DESCRIPTION:

        Changes the actions upon failure

USAGE:

        sc <server> failure [service name] <option1> <option2>...



OPTIONS:

        reset=   <Length of period of no failures (in seconds)

                  after which to reset the failure count to 0 (may be INFINITE)>

                  (Must be used in conjunction with actions= )

        reboot=  <Message broadcast before rebooting on failure>

        command= <Command line to be run on failure>

        actions= <Failure actions and their delay time (in milliseconds),

                  separated by / (forward slash) -- e.g., run/5000/reboot/800

                  Valid actions are <run|restart|reboot> >

                  (Must be used in conjunction with the reset= option)

�DESCRIPTION:

        Starts a service running.

USAGE:

        sc <server> start [service name] <arg1> <arg2> ...

�DESCRIPTION:

        Sends a PAUSE control request to a service.

USAGE:

        sc <server> pause [service name]

DESCRIPTION:

        Sends an INTERROGATE control request to a service.

USAGE:

        sc <server> interrogate [service name]

�DESCRIPTION:

        Sends a CONTROL code to a service.

USAGE:

        sc <server> control [service name] <value>

            <value> = user-defined control code

            <value> = <paramchange|

                       netbindadd|netbindremove|

                       netbindenable|netbinddisable>



See also sc stop, sc pause, etc.

�DESCRIPTION:

        Sends a CONTINUE control request to a service.

USAGE:

        sc <server> continue [service name]

�DESCRIPTION:

        Sends a STOP control request to a service.

USAGE:

        sc <server> stop [service name] <reason> <comment>

        <reason> = Optional reason code number for service stop 

                   formed with the following elements in the format:



                        Flag:Major reason:Minor reason



                        [E.g., 1:2:8 means Hardware: Disk (Unplanned)]



                        Flag                       Major reason

                   ------------------       ---------------------------

                   1    -   Unplanned       1       -   Other

                   2    -   Custom          2       -   Hardware

                   4    -   Planned         3       -   Operating System

                                            4       -   Software

                                            5       -   Application

                                            64-255  -   Custom



                            Minor reason

                   -----------------------------------

                   1            -   Other 

                   2            -   Maintenance 

                   3            -   Installation 

                   4            -   Upgrade 

                   5            -   Reconfiguration 

                   6            -   Hung 

                   7            -   Unstable

                   8            -   Disk

                   9            -   Network Card

                   10           -   Environment

                   11           -   Hardware Driver

                   12           -   Other Driver

                   13           -   Service Pack

                   14           -   Software Update

                   15           -   Security Fix

                   16           -   Security

                   17           -   Network Connectivity

                   18           -   WMI

                   19           -   Service Pack Uninstall

                   20           -   Software Update Uninstall

                   22           -   Security Fix Uninstall

                   23           -   MMC

                   256-65535    -   Custom



       <comment> = Optional comment for the reason above (127 characters maximum)

DESCRIPTION:

        Sets the description string for a service.

USAGE:

        sc <server> description [service name] [description]

DESCRIPTION:

        Queries the configuration information for a service.

USAGE:

        sc <server> qc [service name] <bufferSize>

 DESCRIPTION:

        Retrieves the description string of a service.

USAGE:

        sc <server> qdescription [service name] <bufferSize>

 DESCRIPTION:

        Retrieves the actions performed on service failure.

USAGE:

        sc <server> qfailure [service name] <bufferSize>

DESCRIPTION:

        Queries the Lock Status for a SC Manager Database.

USAGE:

        sc <server> querylock <bufferSize>

 DESCRIPTION:

        Deletes a service entry from the registry.

        If the service is running, or another process has an

        open handle to the service, the service is simply marked

        for deletion.

USAGE:

        sc <server> delete [service name]

�DESCRIPTION:

        Indicates whether the last boot should be saved as the

        last-known-good boot configuration on the local machine.

        If specified, the server name is ignored.

USAGE:

        sc <server> boot <bad | ok>

<DESCRIPTION:

        Gets the display name associated with a particular service

USAGE:

        sc <server> GetDisplayName <service key name> <bufsize>

�DESCRIPTION:

        Gets the key name associated with a particular service,

        using the display name as input

USAGE:

        sc <server> GetKeyName <service display name> <bufsize>

$DESCRIPTION:

        Enumerates the Services that are dependent on this one

USAGE:

        sc <server> EnumDepend <service name> <bufsize>

$DESCRIPTION:

        Displays a service's security descriptor in SDDL format

USAGE:

        sc <server> sdshow <service name> <showrights>

DESCRIPTION:

        Sets a service's security descriptor

USAGE:

        sc <server> sdset <service name> <SD in SDDL format>

T

SERVICE_NAME: %1

DESCRIPTION:  %2

Name = %1



%1

D        IsLocked      : TRUE

D        IsLocked      : FALSE

�        LockOwner     : %1

        LockDuration  : %2 (seconds since acquired)



$[SC] Tag = %1

<[SC] %1: entriesread = %2



|

Active database is locked.

To unlock via API, press u:

d

[SC] Will be unlocking database by exiting

h

SERVICE_NAME: %1 %2

        TYPE               : %3  %4 %5

        STATE              : %6  %7

                                (%8, %9, %10)

        WIN32_EXIT_CODE    : %11  (0x%12)

        SERVICE_EXIT_CODE  : %13  (0x%14)

        CHECKPOINT         : 0x%15

        WAIT_HINT          : 0x%16

�

SERVICE_NAME: %1

DISPLAY_NAME: %2

        TYPE               : %3  %4 %5

        STATE              : %6  %7

                                (%8, %9, %10)

        WIN32_EXIT_CODE    : %11  (0x%12)

        SERVICE_EXIT_CODE  : %13  (0x%14)

        CHECKPOINT         : 0x%15

        WAIT_HINT          : 0x%16

�

SERVICE_NAME: %1 %2

        TYPE               : %3  %4 %5

        STATE              : %6  %7

                                (%8, %9, %10)

        WIN32_EXIT_CODE    : %11  (0x%12)

        SERVICE_EXIT_CODE  : %13  (0x%14)

        CHECKPOINT         : 0x%15

        WAIT_HINT          : 0x%16

        PID                : %17

        FLAGS              : %18



SERVICE_NAME: %1

DISPLAY_NAME: %2

        TYPE               : %3  %4 %5

        STATE              : %6  %7

                                (%8, %9, %10)

        WIN32_EXIT_CODE    : %11  (0x%12)

        SERVICE_EXIT_CODE  : %13  (0x%14)

        CHECKPOINT         : 0x%15

        WAIT_HINT          : 0x%16

        PID                : %17

        FLAGS              : %18

0

SERVICE_NAME: %1

        RESET_PERIOD (in seconds)    : %2

        REBOOT_MESSAGE               : %3

        COMMAND_LINE                 : %4

�        FAILURE_ACTIONS              : RESTART -- Delay = %1 milliseconds.

�                                       RESTART -- Delay = %1 milliseconds.

�        FAILURE_ACTIONS              : REBOOT -- Delay = %1 milliseconds.

�                                       REBOOT -- Delay = %1 milliseconds.

�        FAILURE_ACTIONS              : RUN PROCESS -- Delay = %1 milliseconds.

�                                       RUN PROCESS -- Delay = %1 milliseconds.

h

SERVICE_NAME: %1

        TYPE               : %2  %3 %4

        START_TYPE         : %5   %6

        ERROR_CONTROL      : %7   %8

        BINARY_PATH_NAME   : %9

        LOAD_ORDER_GROUP   : %10

        TAG                : %11

        DISPLAY_NAME       : %12

        DEPENDENCIES       : %13

H                           : %1

H        SERVICE_START_NAME : %1

([SC] %1 SUCCESS

<[SC] %1 FAILED %2:



%3

8[SC] %1 needs %2 bytes

�

[SC] %1: more data, need %2 bytes start resume at index %3

P

[SC] %1: more data, need %2 bytes

@

ERROR: Invalid %1 field



@

ERROR:  Invalid Option



�

ERROR:  Cannot specify a service name when enumerating a group



X

ERROR:  A service name is required



L

ERROR:  Unrecognized command



�

ERROR:  The reset and actions options must be set simultaneously



u

�DESCRIPTION:

        Changes the failure actions flag setting of a service. 

        If this setting is 0 (default), the Service Control Manager 

        (SCM) enables configured failure actions on the service

        only if the service process terminates with the service in

        a state other than SERVICE_STOPPED. If this setting is 1, 

        the SCM enables configured failure actions on the service

        if the service enters the SERVICE_STOPPED state with a Win32 

        exit code other than 0 in addition to the service process 

        termination as above. This setting is ignored if the service 

        does not have any failure actions configured.

USAGE:

        sc <server> failureflag [service name] [flag]

�DESCRIPTION:

        Retrieves the failure actions flag setting of a service. 

        If this setting is 0 (default), the Service Control Manager 

        (SCM) enables configured failure actions on the service

        only if the service process terminates with the service in

        a state other than SERVICE_STOPPED. If this setting is 1, 

        the SCM enables configured failure actions on the service

        if the service enters the SERVICE_STOPPED state with a Win32 

        exit code other than 0 in addition to the service process 

        termination as above. This setting is ignored if the service 

        does not have any failure actions configured.

USAGE:

        sc <server> qfailureflag [service name]

�

SERVICE_NAME: %1

FAILURE_ACTIONS_ON_NONCRASH_FAILURES:  TRUE

�

SERVICE_NAME: %1

FAILURE_ACTIONS_ON_NONCRASH_FAILURES:  FALSE

�
DESCRIPTION:

        Changes the service security identifier (SID) type 

        setting of a service. 



        If this setting is "unrestricted", the Service Control 

        Manager (SCM) will add this service's SID to the service 

        process token when the service process starts the next 

        time due to the first service in the process being started.  

        This setting is valid only for Win32 user mode services. 



        If this setting is "restricted", the Service Control 

        Manager (SCM) will add this service's SID to the service 

        process token when the service process starts the next 

        time due to the first service in the process being started. 

        In addition, this service's SID will also be added to

        the restricting SID list in the process token. The process

        token will be a restricted token.  See MSDN for details on

        restricted token. This setting is valid only for Win32 

        user mode services. In addition, for a share process service,

        all services cohosted in the process must have this SID type

        set for this to take effect.

        

        If this setting is "none", the SCM will not add the service's 

        SID to the service process token.   

USAGE:

        sc <server> sidtype [service name] [type]



OPTIONS:

        type = <none|unrestricted|restricted>

|
DESCRIPTION:

        Queries the service security identifier (SID) type 

        setting of a service. 



        If this setting is "unrestricted", the Service Control 

        Manager (SCM) will add this service's SID to the service 

        process token when the service process starts the next 

        time due to the first service in the process being started.  

        This setting is valid only for Win32 user mode services. 



        If this setting is "restricted", the Service Control 

        Manager (SCM) will add this service's SID to the service 

        process token when the service process starts the next 

        time due to the first service in the process being started. 

        In addition, this service's SID will also be added to

        the restricting SID list in the process token. The process

        token will be a restricted token.  See MSDN for details on

        restricted token. This setting is valid only for Win32 

        user mode services. In addition, for a share process service,

        all services cohosted in the process must have this SID type

        set for this to take effect.

        

        If this setting is "none", the SCM will not add the service's 

        SID to the service process token.       

USAGE:

        sc <server> qsidtype [service name]

p

SERVICE_NAME: %1

SERVICE_SID_TYPE:  UNRESTRICTED

`

SERVICE_NAME: %1

SERVICE_SID_TYPE:  NONE

l

SERVICE_NAME: %1

        PRIVILEGES       : %2

D                         : %1

�DESCRIPTION:

        Queries the required privileges setting for a service.

        The privilege settings take effect when the

        service process starts due to the first service in

        the process being started. At that time, the Service 

        Control Manager (SCM) computes the union of all privileges 

        required by all services that will be hosted in the same

        process and then creates the process with those

        privileges. An absence of this setting is taken to imply

        that the service requires all the privileges that

        the security subsystem allows for a process running

        in the service's configured account.



USAGE:

        sc <server> qprivs [service name] <bufferSize>

DESCRIPTION:

        Changes the required privileges setting of a service. 

        The privilege settings take effect when the

        service process starts due to the first service in

        the process being started. At that time, the Service 

        Control Manager (SCM) computes the union of all privileges 

        required by all services that will be hosted in the same

        process and then creates the process with those

        privileges. An absence of this setting is taken to imply

        that the service requires all the privileges that

        the security subsystem allows for the process running

        in the service's configured account.



USAGE:

        sc <server> privs [service name] [privileges]



OPTIONS:        

        privileges = <Privileges(separated by / (forward slash))>

                     [E.g., SeBackupPrivilege/SeRestorePrivilege]



l

SERVICE_NAME: %1

SERVICE_SID_TYPE:  RESTRICTED

4

SDDL right       Right value

----------       -----------

   GA        -   GENERIC_ALL 

   GR        -   GENERIC_READ 

   GW        -   GENERIC_WRITE 

   GX        -   GENERIC_EXECUTE 

   RC        -   READ_CONTROL 

   SD        -   DELETE 

   WD        -   WRITE_DAC

   WO        -   WRITE_OWNER

   RP        -   SERVICE_START

   WP        -   SERVICE_STOP

   CC        -   SERVICE_QUERY_CONFIG

   DC        -   SERVICE_CHANGE_CONFIG

   LC        -   SERVICE_QUERY_STATUS

   SW        -   SERVICE_ENUMERATE_DEPENDENTS

   LO        -   SERVICE_INTERROGATE

   DT        -   SERVICE_PAUSE_CONTINUE

   CR        -   SERVICE_USER_DEFINED_CONTROL

�

SDDL right       Right value

----------       -----------

   GA        -   GENERIC_ALL 

   KA        -   GENERIC_ALL

   GR        -   GENERIC_READ 

   GW        -   GENERIC_WRITE 

   GX        -   GENERIC_EXECUTE 

   RC        -   READ_CONTROL 

   SD        -   DELETE 

   WD        -   WRITE_DAC

   WO        -   WRITE_OWNER

   RP        -   SC_MANAGER_QUERY_LOCK_STATUS

   WP        -   SC_MANAGER_MODIFY_BOOT_CONFIG

   CC        -   SC_MANAGER_CONNECT

   DC        -   SC_MANAGER_CREATE_SERVICE

   LC        -   SC_MANAGER_ENUMERATE_SERVICE

   SW        -   SC_MANAGER_LOCK



SERVICE_NAME: %1 %2

        TYPE               : %3  %4 %5

        STATE              : %6  %7

        WIN32_EXIT_CODE    : %11  (0x%12)

        SERVICE_EXIT_CODE  : %13  (0x%14)

        CHECKPOINT         : 0x%15

        WAIT_HINT          : 0x%16

(

SERVICE_NAME: %1

DISPLAY_NAME: %2

        TYPE               : %3  %4 %5

        STATE              : %6  %7

        WIN32_EXIT_CODE    : %11  (0x%12)

        SERVICE_EXIT_CODE  : %13  (0x%14)

        CHECKPOINT         : 0x%15

        WAIT_HINT          : 0x%16

�

SERVICE_NAME: %1 %2

        TYPE               : %3  %4 %5

        STATE              : %6  %7

        WIN32_EXIT_CODE    : %11  (0x%12)

        SERVICE_EXIT_CODE  : %13  (0x%14)

        CHECKPOINT         : 0x%15

        WAIT_HINT          : 0x%16

        PID                : %17

        FLAGS              : %18

�

SERVICE_NAME: %1

DISPLAY_NAME: %2

        TYPE               : %3  %4 %5

        STATE              : %6  %7

        WIN32_EXIT_CODE    : %11  (0x%12)

        SERVICE_EXIT_CODE  : %13  (0x%14)

        CHECKPOINT         : 0x%15

        WAIT_HINT          : 0x%16

        PID                : %17

        FLAGS              : %18



WARNING:  The service %1 is configured as interactive whose support is being deprecated. The service may not function properly.



`

NAME: %1

SERVICE SID: %2

STATUS: Active

|DESCRIPTION:

        Displays the service SID string corresponding to an arbitrary name. The name can be that of an existing or non-existent service.

USAGE:

        sc showsid [name]

D[SC] %1 FAILED with error %2.

�3DESCRIPTION:

        Changes the trigger parameters of a service.

USAGE:

        sc <server> triggerinfo [service name] <option1> <option2>...



OPTIONS:

        start/device/UUID/HwId1/...     <Start the service on arrival of the 

                                        specified device interface class UUID 

                                        string with one or more hardware ID 

                                        strings and/or compatible ID strings>

        start/custom/UUID/data0/..      <Start the service on arrival of an 

                                        event from the specified custom ETW 

                                        provider UUID string with one or more 

                                        binary data items in hexadecimal 

                                        string format such as ABCDABCD to 

                                        set 4 byte data>

        stop/custom/UUID/data0/...      <Stop the service on arrival of an 

                                        event from the specified custom ETW 

                                        provider UUID string with one or more 

                                        binary data items in hexadecimal 

                                        string format such as ABCDABCD to 

                                        set 4 byte data>

        start/strcustom/UUID/data0/..   <Start the service on arrival of an 

                                        event from the specified custom ETW 

                                        provider UUID string with one or more 

                                        optional string data items>

        stop/strcustom/UUID/data0/..    <Stop the service on arrival of an 

                                        event from the specified custom ETW 

                                        provider UUID string with one or more 

                                        optional string data items>

        start/lvlcustom/UUID/data0/..   <Start the service on arrival of an 

                                        event from the specified custom ETW 

                                        provider UUID string with level higher

                                        or equal to the data items in

                                        hexadecimal number format such as

                                        0x01>

        stop/lvlcustom/UUID/data0/..    <Stop the service on arrival of an 

                                        event from the specified custom ETW 

                                        provider UUID string with level higher

                                        or equal to the data items in 

                                        hexadecimal number format such as

                                        0x01>

        start/kwanycustom/UUID/data0/.. <Start the service on arrival of an 

                                        event from the specified custom ETW 

                                        provider UUID string with keyword that

                                        matches any of the bits in the data

                                        items in hexadecimal number format 

                                        such as 0x0A03>

        stop/kwanycustom/UUID/data0/..  <Stop the service on arrival of an 

                                        event from the specified custom ETW 

                                        provider UUID string with keyword that

                                        matches any of the bits in the data 

                                        items in hexadecimal number format 

                                        such as 0x0A03>

        start/kwallcustom/UUID/data0/.. <Start the service on arrival of an 

                                        event from the specified custom ETW 

                                        provider UUID string with keyword that

                                        matches all of the bits in the data 

                                        items in hexadecimal number format 

                                        such as 0x0A03>

        stop/kwallcustom/UUID/data0/..  <Stop the service on arrival of an 

                                        event from the specified custom ETW 

                                        provider UUID string with keyword that

                                        matches all of the bits in the data 

                                        items in hexadecimal number format 

                                        such as 0x0A03>

        start/networkon                 <Start the service on first IP address>

        stop/networkoff                 <Stop the service on zero IP addresses>

        start/domainjoin                <Start the service on domain join>

        stop/domainleave                <Stop the service on domain leave>

        start/portopen/parameter        <Start the service on the opening of

                                        a network port. The parameter is of the

                                        semi-colon delimited form 

                                        portnumber;protocolname;imagepath;

                                        servicename>

        stop/portclose/parameter        <Stop the service on the closing of

                                        a network port. The parameter is of the

                                        semi-colon delimited form 

                                        portnumber;protocolname;imagepath;

                                        servicename>

        start/machinepolicy             <Start the service when machine group

                                        policy changes or is present at boot>

        start/userpolicy                <Start the service when user group

                                        policy changes or is present at boot>

        start/rpcinterface/UUID         <Start the service when a request 

                                        arrives at the RPC Endpoint Mapper for 

                                        the given interface>

        start/namedpipe/pipename        <Start the service when a request 

                                        arrives for the specified named pipe.  

                                        Do not include the "\\.\pipe\" portion 

                                        of the pipe's name>

        delete                          <Delete the existing trigger parameters>

                                                         

0

SERVICE_NAME: %1

�          DEVICE INTERFACE ARRIVAL     : %1 [INTERFACE CLASS GUID]

�          CUSTOM                       : %1 [ETW PROVIDER UUID]

�          IP ADDRESS AVAILABILITY      : %1 [NO IP ADDRESS AVAILABLE]

�          HUMAN INTERFACE DEVICE      : %1 [INTERFACE CLASS GUID]

 DESCRIPTION:

        Retrieves the trigger information of a service.

USAGE:

        sc <server> qtriggerinfo [service name] <bufferSize>

`            DATA                       : %1

�

    The service %1 has not registered for any start or stop triggers.

8        START SERVICE 

4        STOP SERVICE

�          IP ADDRESS AVAILABILITY      : %1 [FIRST IP ADDRESS AVAILABLE]

�          DOMAIN JOINED STATUS         : %1 [DOMAIN JOINED]

�          DOMAIN JOINED STATUS         : %1 [NOT DOMAIN JOINED]

DESCRIPTION:

        Changes the preferred NUMA node for a Win32 service. 

        This setting is valid only for own process services.

        To delete an existing setting, set the node number as -1.

        If an invalid preferred node number is supplied, then the 

        change request will fail.



USAGE:

        sc <server> preferrednode [service name] [node number]

LDESCRIPTION:

        Queries the preferred NUMA node for a Win32 service. 

        This setting is valid only for own process services.

        If the service has no preferred node setting, then

        the query will fail.



USAGE:

        sc <server> qpreferrednode [service name]

4

PREFERRED NODE : %1

�

[NOTE: Since the service start type is disabled, the triggers are inactive.]

x          FIREWALL PORT EVENT          : %1 [PORT OPEN]

|          FIREWALL PORT EVENT          : %1 [PORT CLOSE]

�          GROUP POLICY                 : %1 [MACHINE POLICY PRESENT]

�          GROUP POLICY                 : %1 [USER POLICY PRESENT]

h

NAME: %1 

SERVICE SID: %2

STATUS: Inactive

�          NETWORK EVENT                : %1 [RPC INTERFACE EVENT]

�          NETWORK EVENT                : %1 [NAMED PIPE EVENT]

p          CUSTOM SYSTEM STATE CHANGE EVENT   : %1 

,This error may occur if another service is already using a Named 

Pipe or RPC trigger for the same endpoint or interface as the

given service.

�DESCRIPTION:

        Changes whether the account in which the service runs

        uses a managed password. 



        If this setting is "true", the Service Control 

        Manager (SCM) will request the account password from 

        NetLogon when starting the service. 



        If this setting is "false", the SCM will use the 

        configured account password.

USAGE:

        sc <server> managedaccount [service name] [type]



OPTIONS:

        type = <true|false>

8

ACCOUNT MANAGED : %1

tDESCRIPTION:

        Queries whether the account configured for this

        service has a managed account password.



USAGE:

        sc <server> qmanagedaccount [service name]

T

ERROR: Invalid trigger data value



�DESCRIPTION:

        Queries whether the service is marked to start in

        a protected process.  Note that this setting cannot

        be changed.



USAGE:

        sc <server> qprotection [service name]

PSERVICE %1 PROTECTION LEVEL: NONE.

TSERVICE %1 PROTECTION LEVEL: WINDOWS.

`SERVICE %1 PROTECTION LEVEL: WINDOWS LIGHT.

hSERVICE %1 PROTECTION LEVEL: ANTIMALWARE LIGHT.

`SERVICE %1 PROTECTION LEVEL: INVALID VALUE.

�DESCRIPTION:

        Queries for a user service instance for the current

        user in the same session created from the user service

        template specified.



USAGE:

        sc quserservice <service template name>

tUSER SERVICE TEMPLATE %1, LOCAL SERVICE INSTANCE %2.

�4VS_VERSION_INFO��
cE
cE?
StringFileInfo�040904B0LCompanyNameMicrosoft Corporation~+FileDescriptionService Control Manager Configuration Toolh$FileVersion10.0.17763.1 (WinBuild.160101.0800).InternalNamesc.exe�.LegalCopyright� Microsoft Corporation. All rights reserved.>OriginalFilenamesc.exe.muij%ProductNameMicrosoft� Windows� Operating System>
ProductVersion10.0.17763.1DVarFileInfo$Translation	�PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD

Youez - 2016 - github.com/yon3zu
LinuXploit