write.exe

Windows Write

Execute

Execute binary through legitimate proxy. This might be utilized to confuse detection solutions that rely on parent-child relationships.

write.exe

Executes a binary provided in default value of `HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe`. — MITRE: T1218 — Privileges: User