blueteam-ref | Windows IR Command Reference

Triage Config

HOST USER DAYS PROC PATH PID IP

Insert Command

Triage Config

HOST USER DAYS PROC PATH PID IP

● Config applied — all commands updated

🔓 Decoder

📖 Case Study

Select a command from the list

Payload Decoder

Encoding type

Base64 PS -enc Hex URL Unicode

Auto-detect

Encoded Input

Paste encoded payload from logs

Decoded Output

XOR Decoder (Malware Analysis)

XOR Key (hex or string) e.g. 0x41, 0xFF, secret, AB

Input (plain text or hex bytes)

Output

Binary ↔ Hex Cheat Sheet

            0000 = 00100 = 41000 = 81100 = C
            0001 = 10101 = 51001 = 91101 = D
            0010 = 20110 = 61010 = A1110 = E
            0011 = 30111 = 71011 = B1111 = F
          

Split byte into nibbles: 0111 0000 → 7 and 0 → 0x70
XOR rule: same bits = 0, different bits = 1. A XOR A = 0, A XOR 0 = A