provlaunch.exe

Provisioning package runtime command launching tool file version info (xCyclopedia)

LOLBAS Execute 1 ATT&CK technique 1 documented command 6 known copies with hashes

How provlaunch.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

lolbin

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for provlaunch.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution Administrator privileges

Executes command defined in the Registry. Requires 3 levels of the key structure containing some keywords. Such keys may be created with two reg.exe commands, e.g. reg.exe add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1 /v altitude /t REG_DWORD /d 0 and reg add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1\dummy2 /v Commandline /d calc.exe. Registry keys are deleted after successful execution.

provlaunch.exe LOLBin

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for provlaunch.exe, by Grzegorz Tworek, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for provlaunch.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1218System Binary Proxy Execution

Is it the real provlaunch.exe?

file version info and known copies

Original nameprovlaunch in the file’s header: a renamed copy still carries it

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionProvisioning package runtime command launching tool

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\provlaunch.exe · signed by Microsoft Windows

92cf2fe731351645eca10b4942e1c4e3164222f5eb83f942798aac699ef78b7b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\provlaunch.exe · signed by Microsoft Windows

c868b2cd314031dfb46903e56cb38d5d45c203a9aeb662d4f1b777f46450fe4d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\provlaunch.exe · signed by Microsoft Windows

337569c120a3f113a4dfd907427d939a44d60da2e6d300c85c8a286048bfd851

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\provlaunch.exe · signed by Microsoft Windows

b602337a386a68aa4b7d1e3d863a158601cf0891c22abf8b29427cae87853f82

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\provlaunch.exe · signed by Microsoft Windows

493fc3d1298666ad2168efa6f2166ed169f1879ee6520d61c7696dddaa53491a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\provlaunch.exe · signed by Microsoft Windows

d4ecb735ee81515e2eb1c06504897c377387a8857d7a6a22d042867bf360d455

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.