{
	"id": "b21ceaf0-3809-44bf-a595-b4e0d50d52ea",
	"created_at": "2026-04-06T00:09:15.347795Z",
	"updated_at": "2026-04-10T13:11:42.76866Z",
	"deleted_at": null,
	"sha1_hash": "502c19a66f857e836069da2326a446db83cc9500",
	"title": "WinExec function (winbase.h) - Win32 apps",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 55366,
	"plain_text": "WinExec function (winbase.h) - Win32 apps\r\nBy GrantMeStrength\r\nArchived: 2026-04-05 22:01:02 UTC\r\nRuns the specified application.\r\nNote  This function is provided only for compatibility with 16-bit Windows. Applications should use the\r\nCreateProcess function.\r\nUINT WinExec(\r\n [in] LPCSTR lpCmdLine,\r\n [in] UINT uCmdShow\r\n);\r\n[in] lpCmdLine\r\nThe command line (file name plus optional parameters) for the application to be executed. If the name of the\r\nexecutable file in the lpCmdLine parameter does not contain a directory path, the system searches for the\r\nexecutable file in this sequence:\r\n1. The directory from which the application loaded.\r\n2. The current directory.\r\n3. The Windows system directory. The GetSystemDirectory function retrieves the path of this directory.\r\n4. The Windows directory. The GetWindowsDirectory function retrieves the path of this directory.\r\n5. The directories listed in the PATH environment variable.\r\n[in] uCmdShow\r\nThe display options. For a list of the acceptable values, see the description of the nCmdShow parameter of the\r\nShowWindow function.\r\nIf the function succeeds, the return value is greater than 31.\r\nIf the function fails, the return value is one of the following error values.\r\nReturn code/value Description\r\n0 The system is out of memory or resources.\r\nERROR_BAD_FORMAT The .exe file is invalid.\r\nhttp://msdn.microsoft.com/en-us/library/ms687393\r\nPage 1 of 3\n\nERROR_FILE_NOT_FOUND The specified file was not found.\r\nERROR_PATH_NOT_FOUND The specified path was not found.\r\nThe WinExec function returns when the started process calls the GetMessage function or a time-out limit is\r\nreached. To avoid waiting for the time out delay, call the GetMessage function as soon as possible in any process\r\nstarted by a call to WinExec.\r\nThe executable name is treated as the first white space-delimited string in lpCmdLine. If the executable or path\r\nname has a space in it, there is a risk that a different executable could be run because of the way the function\r\nparses spaces. The following example is dangerous because the function will attempt to run \"Program.exe\", if it\r\nexists, instead of \"MyApp.exe\".\r\nWinExec(\"C:\\\\Program Files\\\\MyApp\", ...)\r\nIf a malicious user were to create an application called \"Program.exe\" on a system, any program that incorrectly\r\ncalls WinExec using the Program Files directory will run this application instead of the intended application.\r\nTo avoid this problem, use CreateProcess rather than WinExec. However, if you must use WinExec for legacy\r\nreasons, make sure the application name is enclosed in quotation marks as shown in the example below.\r\nWinExec(\"\\\"C:\\\\Program Files\\\\MyApp.exe\\\" -L -S\", ...)\r\nRequirement Value\r\nMinimum supported\r\nclient\r\nWindows XP [desktop apps only]\r\nMinimum supported\r\nserver\r\nWindows Server 2003 [desktop apps only]\r\nTarget Platform Windows\r\nHeader winbase.h (include Windows.h)\r\nLibrary Kernel32.lib\r\nDLL Kernel32.dll\r\nAPI set\r\next-ms-win-kernel32-process-l1-1-0 (introduced in Windows 10, version\r\n10.0.14393)\r\nCreateProcess\r\nhttp://msdn.microsoft.com/en-us/library/ms687393\r\nPage 2 of 3\n\nSource: http://msdn.microsoft.com/en-us/library/ms687393\r\nhttp://msdn.microsoft.com/en-us/library/ms687393\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"http://msdn.microsoft.com/en-us/library/ms687393"
	],
	"report_names": [
		"ms687393"
	],
	"threat_actors": [],
	"ts_created_at": 1775434155,
	"ts_updated_at": 1775826702,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/502c19a66f857e836069da2326a446db83cc9500.pdf",
		"text": "https://archive.orkl.eu/502c19a66f857e836069da2326a446db83cc9500.txt",
		"img": "https://archive.orkl.eu/502c19a66f857e836069da2326a446db83cc9500.jpg"
	}
}