Capabilities

network.transfer.download

Contract

Outputs

process.output

Command execution output

Side effects: network_traffic

Workflow Edges

Produces

process.output

Resource Profile

Resource	Value
CPU	low
Memory	16 MB
Network	medium
Disk I/O	low

Examples

IMEWDBLD.exe attempts to load a dictionary file, if provided a URL as an argument, it will download the file served at by that URL and save it to INetCache. (Download file from Internet)

C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}

Detection

Type	Rule / Indicator
sigma	https://github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/network_connection/net_connection_win_imewdbld.yml

Documentation

imewdbld

imewdbld is a Windows LOLBin. Microsoft IME Open Extended Dictionary Module Located at: C:\Windows\System32\IME\SHARED\IMEWDBLD.exe.

References

1367493406835040265