pcwrun.exe

Program Compatibility Troubleshooter Invoker file version info (xCyclopedia)

LOLBAS Execute 1 Sigma rule name it 1 ATT&CK technique 2 documented commands 7 known copies with hashes

How pcwrun.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for pcwrun.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Open the target .EXE file with the Program Compatibility Wizard.

Pcwrun.exe {PATH_ABSOLUTE:.exe}

Identify

Trips no Sigma process-creation rule.

Execute T1202 Indirect Command Execution User privileges

Leverage the MSDT follina vulnerability through Pcwrun to execute arbitrary commands and binaries. Note that this specific technique will not work on a patched system with the June 2022 Windows Security update.

Pcwrun.exe /../../$(calc).exe

Identify

Trips 1 Sigma rule: highExecute Pcwrun.EXE To Leverage Follina by Nasreddine Bencherchali (Nextron Systems)

1 of the 2 commands the identifier reads trips a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for pcwrun.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for pcwrun.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highExecute Pcwrun.EXE To Leverage FollinaNasreddine Bencherchali (Nextron Systems)

T1218System Binary Proxy Execution

Is it the real pcwrun.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionProgram Compatibility Troubleshooter Invoker

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\pcwrun.exe · signed by Microsoft Windows

3087f9aa4ea61fb0ac46e23721bda1f688919684f88b32ca6a37e5115094e5dc

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\system32\pcwrun.exe · signed by Microsoft Windows

3e324cb58048f034e83168c1d4a66a8984c2238f0cabb6c6357bcace00e2bb50

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\pcwrun.exe · signed by Microsoft Windows

e3d136c667662a2198da3d45a4637df1efe1f61b2b948f421fc0f8eee6d83c3a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\pcwrun.exe · signed by Microsoft Windows

c14f8c3f2d7005d3af2d880118c74523f40baefd44e34932e96f3a2a7fa690e5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\pcwrun.exe · signed by Microsoft Windows

3de0d85f8170457e741b8c7b2ec0cbfc5bdf6eb37012e4a5e7eee93b149ae7cf

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\pcwrun.exe · signed by Microsoft Windows

68bbe7b9f1c6b87b5a73edf9cf74a3ba0781307bfc08e61cd09c8d14ba3abc18

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\pcwrun.exe · not signed

122bb4863ef62678e95a39f412b224816e20784b6d7132a7ab4036a2152966d5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.