write.exe
write.exe is a legacy executable file that serves as a wrapper for the WordPad application. While it appears as a standalone program, its primary purpose is to maintain backward compatibility.
File Details
| File Path | Architecture | Version | File Size |
|---|---|---|---|
| %WinDir%\write.exe C:\Windows\write.exe |
64-bit | 6.1.7600.16385 | 10 KB 10,240 bytes |
| %WinDir%\System32\write.exe C:\Windows\System32\write.exe |
64-bit | 6.1.7600.16385 | 10 KB 10,240 bytes |
| %WinDir%\SysWOW64\write.exe C:\Windows\SysWOW64\write.exe |
32-bit | 6.1.7600.16385 | 9 KB 9,216 bytes |
Launch Behavior and Redirection
The execution flow of write.exe depends on how the command is entered in the Windows interface. The system alternates between using the physical binary and the App Paths registry aliases.
Direct Execution
When running the binary file directly (or via Console), the program uses the ShellExecuteW function to call wordpad.exe, which launches the program specified in the registry path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WORDPAD.EXE
Start Menu
write and write.exe launches the binary (Direct Execution), however, using write. launches the program specified in the registry path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WRITE.EXE
Run Dialog
Behaves as the inverse of the Start Menu: write and write.exe use the App Paths registry alias, while write. launches the binary.
Explorer Address Bar
All variations (write, write.exe and write.) launch the binary.
Dependencies
kernel32.dll
- GetCurrentProcess
- GetCurrentProcessId
- GetCurrentThreadId
- GetModuleHandleW
- GetStartupInfoW
- GetSystemTimeAsFileTime
- GetTickCount
- HeapSetInformation
- QueryPerformanceCounter
- RtlCaptureContext
- RtlLookupFunctionEntry
- RtlVirtualUnwind
- SetUnhandledExceptionFilter
- Sleep
- TerminateProcess
- UnhandledExceptionFilter
msvcrt.dll
- __C_specific_handler
- __set_app_type
- __setusermatherr
- __wgetmainargs
- _amsg_exit
- _cexit
- _commode
- _exit
- _fmode
- _initterm
- _wcmdln
- _XcptFilter
- exit
- terminate
shell32.dll
- ShellExecuteW