(Image:\\sc.exe OR OriginalFileName:sc.exe) CommandLine:query* CommandLine:termservice*