write.exe

write.exe is a legacy executable file that serves as a wrapper for the WordPad application. While it appears as a standalone program, its primary purpose is to maintain backward compatibility.

File Details

File Path Architecture Version File Size
%WinDir%\write.exe
C:\Windows\write.exe
64-bit 6.1.7600.16385 10 KB
10,240 bytes
%WinDir%\System32\write.exe
C:\Windows\System32\write.exe
64-bit 6.1.7600.16385 10 KB
10,240 bytes
%WinDir%\SysWOW64\write.exe
C:\Windows\SysWOW64\write.exe
32-bit 6.1.7600.16385 9 KB
9,216 bytes

Launch Behavior and Redirection

The execution flow of write.exe depends on how the command is entered in the Windows interface. The system alternates between using the physical binary and the App Paths registry aliases.

Direct Execution

When running the binary file directly (or via Console), the program uses the ShellExecuteW function to call wordpad.exe, which launches the program specified in the registry path:

Windows Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WORDPAD.EXE

Start Menu

write and write.exe launches the binary (Direct Execution), however, using write. launches the program specified in the registry path:

Windows Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WRITE.EXE

Run Dialog

Behaves as the inverse of the Start Menu: write and write.exe use the App Paths registry alias, while write. launches the binary.

Explorer Address Bar

All variations (write, write.exe and write.) launch the binary.

Dependencies

kernel32.dll
  • GetCurrentProcess
  • GetCurrentProcessId
  • GetCurrentThreadId
  • GetModuleHandleW
  • GetStartupInfoW
  • GetSystemTimeAsFileTime
  • GetTickCount
  • HeapSetInformation
  • QueryPerformanceCounter
  • RtlCaptureContext
  • RtlLookupFunctionEntry
  • RtlVirtualUnwind
  • SetUnhandledExceptionFilter
  • Sleep
  • TerminateProcess
  • UnhandledExceptionFilter
msvcrt.dll
  • __C_specific_handler
  • __set_app_type
  • __setusermatherr
  • __wgetmainargs
  • _amsg_exit
  • _cexit
  • _commode
  • _exit
  • _fmode
  • _initterm
  • _wcmdln
  • _XcptFilter
  • exit
  • terminate
shell32.dll
  • ShellExecuteW
Categories: (placeholder)