windows-command-line-obfuscation/sample_results/schtasks.log at main · wietze/windows-command-line-obfuscation · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
PROCESS OBFUSCATION REPORT FOR schtasks
- Generated on 2021-01-02T13:24:43.862104
- Command used      : schtasks /showsid /TN \Microsoft\XblGameSave\XblGameSaveTask
- Insertion position:           ^
- Char ranges scanned: 0x0001..0xFFFE

:: Option Char Substitution
The following 2 commands were found to be working:
0x002D : schtasks -showsid /TN \Microsoft\XblGameSave\XblGameSaveTask
0xFE63 : schtasks ﹣showsid /TN \Microsoft\XblGameSave\XblGameSaveTask

:: Character Insertion
No alternative commands were found.

:: Character Substitution
The following commands were found to be working:
0x02E2 : schtasks /ˢhowsid /TN \Microsoft\XblGameSave\XblGameSaveTask

:: Quote Insertion
Inserting quotes in the first argument did work, such as:
schtasks /"s"howsid /TN \Microsoft\XblGameSave\XblGameSaveTask

:: Shorthand Commands
No alternative commands were found.