There are many documented ways to use legitimate applications to download stuff from the net.
Here are two more:
- wmplayer.exe <URL>
- FlashPla.exe <URL>
when executed they will download the file pointed by URLs, save them to the browser cache folder e.g. %USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\IE, and .. fail playing them as media.
But the files will remain on the system…
The first one is a pretty obvious one – it’s just a Windows Media Player and it’s present natively on many systems.
The second one – FlashPla.exe – is your good ol’ Adobe Flash Player; you will find it all over the place as it’s being shipped with many drivers and tools accompanying various peripheral devices. It may not be called FlashPla (another name I came across is CL_Gallery.exe, FlashPlayer.exe, cs3flashplayer.exe,SAFlashPlayer.exe), but it’s pretty easy to find.
- c:\Program Files (x86)\CyberLink\Power2Go\Gallery\CL_Gallery.exe
- c:\Program Files (x86)\HP\Digital Imaging\help\player\FlashPla.exe
- C:\Program Files\HP\Digital Imaging\help\player\FlashPla.exe
- C:\ProgramData\LG\LG LIP2230\Help\flash\FlashPla.exe
- C:\Program Files\Macromedia\Flash 5\Players\FlashPla.exe
- C:\Program Files\FlashJester\Jugglor v30\Projector Files\CS3FlashPlayer.exe
Both players open windows and are pretty noisy (e.g. in Registry), but it’s always worth documenting the possibilities…