imm32.dll

  • File Path: C:\Windows\system32\imm32.dll
  • Description: Multi-User Windows IMM32 API Client DLL

Hashes

Type Hash
MD5 08B62B14F4A67BECAF911136D55CF126
SHA1 AB27842A2A2CDD7220C1B2875AA69DF10A548A6E
SHA256 1F214250D51CE1EC9D1A8EC97EE4FB24F4E05325B2443EEE5C5D3CA755B5459D
SHA384 B565E6CD88F1F71EA427D72F7DFB914A0E6365065A6A46CC384D25051D6A0BAC394A7B5DDA40EE93F965BECDAA213CDD
SHA512 A37C53E5BEA432C480F6DC0B69C3565FB8DBC22503FFECEF2F98367EF4FB2B9966078CBC036FC0D5D2206C561F63F0175DB5EBB29A1D130B5B4938F6E0F3784B
SSDEEP 3072:g82dTTrjijAT5RxGOSo3wnTZaDclJS6gdfR2D9XYsSmh2m5sHi9:g8zAAOSo3OTZaDSo6hXYxmh2m5sHE
IMP 5DA18AF11C75E49C602FE2CCDD45B0A5
PESHA1 2094378DE815DDA485CC2AA562DAE0C3DEBC97E0
PE256 B7632E50111256F5D5E0D8CAD193F347B664B00DF062A2B13D4F1A24655FEBF4

DLL Exports:

Function Name Ordinal Type
ImmIsIME 92 Exported Function
ImmInstallIMEW 91 Exported Function
ImmIsUIMessageW 94 Exported Function
ImmIsUIMessageA 93 Exported Function
ImmIMPSetIMEA 88 Exported Function
ImmIMPQueryIMEW 87 Exported Function
ImmInstallIMEA 90 Exported Function
ImmIMPSetIMEW 89 Exported Function
ImmLoadIME 95 Exported Function
ImmNotifyIME 101 Exported Function
ImmLockImeDpi 100 Exported Function
ImmPutImeMenuItemsIntoMappedFile 103 Exported Function
ImmProcessKey 102 Exported Function
ImmLockClientImc 97 Exported Function
ImmLoadLayout 96 Exported Function
ImmLockIMCC 99 Exported Function
ImmLockIMC 98 Exported Function
ImmGetImeInfoEx 75 Exported Function
ImmGetIMEFileNameW 74 Exported Function
ImmGetImeMenuItemsW 77 Exported Function
ImmGetImeMenuItemsA 76 Exported Function
ImmGetIMCCSize 71 Exported Function
ImmGetIMCCLockCount 70 Exported Function
ImmGetIMEFileNameA 73 Exported Function
ImmGetIMCLockCount 72 Exported Function
ImmGetOpenStatus 78 Exported Function
ImmIMPGetIMEA 84 Exported Function
ImmGetVirtualKey 83 Exported Function
ImmIMPQueryIMEA 86 Exported Function
ImmIMPGetIMEW 85 Exported Function
ImmGetRegisterWordStyleA 80 Exported Function
ImmGetProperty 79 Exported Function
ImmGetStatusWindowPos 82 Exported Function
ImmGetRegisterWordStyleW 81 Exported Function
ImmSimulateHotKey 126 Exported Function
ImmShowSoftKeyboard 125 Exported Function
ImmTranslateMessage 128 Exported Function
ImmSystemHandler 127 Exported Function
ImmSetHotKey 122 Exported Function
ImmSetConversionStatus 121 Exported Function
ImmSetStatusWindowPos 124 Exported Function
ImmSetOpenStatus 123 Exported Function
ImmUnlockClientImc 129 Exported Function
ImmWINNLSEnableIME 135 Exported Function
ImmUnregisterWordW 134 Exported Function
ImmWINNLSGetIMEHotkey 137 Exported Function
ImmWINNLSGetEnableStatus 136 Exported Function
ImmUnlockIMCC 131 Exported Function
ImmUnlockIMC 130 Exported Function
ImmUnregisterWordA 133 Exported Function
ImmUnlockImeDpi 132 Exported Function
ImmRequestMessageW 110 Exported Function
ImmRequestMessageA 109 Exported Function
ImmSendIMEMessageExA 111 Exported Function
ImmReSizeIMCC 104 Exported Function
ImmRegisterWordA 106 Exported Function
ImmRegisterClient 105 Exported Function
ImmReleaseContext 108 Exported Function
ImmRegisterWordW 107 Exported Function
ImmSendIMEMessageExW 112 Exported Function
ImmSetCompositionStringA 118 Exported Function
ImmSetCompositionFontW 117 Exported Function
ImmSetCompositionWindow 120 Exported Function
ImmSetCompositionStringW 119 Exported Function
ImmSetActiveContextConsoleIME 114 Exported Function
ImmSetActiveContext 113 Exported Function
ImmSetCompositionFontA 116 Exported Function
ImmSetCandidateWindow 115 Exported Function
ImmGetHotKey 69 Exported Function
CtfImmSetDefaultRemoteKeyboardLayout 23 Exported Function
CtfImmSetCiceroStartInThread 22 Exported Function
GetKeyboardLayoutCP 25 Exported Function
CtfImmTIMActivate 24 Exported Function
CtfImmNotify 19 Exported Function
CtfImmLeaveCoInitCountSkipMode 18 Exported Function
CtfImmSetAppCompatFlags 21 Exported Function
CtfImmRestoreToolbarWnd 20 Exported Function
ImmActivateLayout 26 Exported Function
ImmCreateContext 32 Exported Function
ImmConfigureIMEW 31 Exported Function
ImmCreateSoftKeyboard 34 Exported Function
ImmCreateIMCC 33 Exported Function
ImmAssociateContextEx 28 Exported Function
ImmAssociateContext 27 Exported Function
ImmConfigureIMEA 30 Exported Function
ImmCallImeConsoleIME 29 Exported Function
CtfImmGetCompatibleKeyboardLayout 6 Exported Function
CtfImmGenerateMessage 5 Exported Function
CtfImmGetGuidAtom 8 Exported Function
CtfImmGetGlobalIMEStatus 7 Exported Function
CtfImmCoUninitialize 2 Exported Function
CtfImmAppCompatEnableIMEonProtectedCode 1 Exported Function
CtfImmEnterCoInitCountSkipMode 4 Exported Function
CtfImmDispatchDefImeMessage 3 Exported Function
CtfImmGetIMEFileName 9 Exported Function
CtfImmIsGuidMapEnable 15 Exported Function
CtfImmIsComStartedInThread 14 Exported Function
CtfImmLastEnabledWndDestroy 17 Exported Function
CtfImmIsTextFrameServiceDisabled 16 Exported Function
CtfImmHideToolbarWnd 11 Exported Function
CtfImmGetTMAEFlags 10 Exported Function
CtfImmIsCiceroStartedInThread 13 Exported Function
CtfImmIsCiceroEnabled 12 Exported Function
ImmGetCompositionStringA 57 Exported Function
ImmGetCompositionFontW 56 Exported Function
ImmGetCompositionWindow 59 Exported Function
ImmGetCompositionStringW 58 Exported Function
ImmGetCandidateListW 53 Exported Function
ImmGetCandidateListCountW 52 Exported Function
ImmGetCompositionFontA 55 Exported Function
ImmGetCandidateWindow 54 Exported Function
ImmGetContext 60 Exported Function
ImmGetDescriptionW 66 Exported Function
ImmGetDescriptionA 65 Exported Function
ImmGetGuideLineW 68 Exported Function
ImmGetGuideLineA 67 Exported Function
ImmGetConversionListW 62 Exported Function
ImmGetConversionListA 61 Exported Function
ImmGetDefaultIMEWnd 64 Exported Function
ImmGetConversionStatus 63 Exported Function
ImmDisableLegacyIME 40 Exported Function
ImmDisableIME 38 Exported Function
ImmEnumInputContext 42 Exported Function
ImmDisableTextFrameService 41 Exported Function
ImmDestroyIMCC 36 Exported Function
ImmDestroyContext 35 Exported Function
ImmDisableIme 39 Exported Function
ImmDestroySoftKeyboard 37 Exported Function
ImmEnumRegisterWordA 43 Exported Function
ImmGetAppCompatFlags 49 Exported Function
ImmGenerateMessage 48 Exported Function
ImmGetCandidateListCountA 51 Exported Function
ImmGetCandidateListA 50 Exported Function
ImmEscapeA 45 Exported Function
ImmEnumRegisterWordW 44 Exported Function
ImmFreeLayout 47 Exported Function
ImmEscapeW 46 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: imm32
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/67
  • VirusTotal Link: https://www.virustotal.com/gui/file/1f214250d51ce1ec9d1a8ec97ee4fb24f4e05325b2443eee5c5d3ca755b5459d/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\SysWOW64\imm32.dll 36

Possible Misuse

The following table contains possible examples of imm32.dll being misused. While imm32.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_mimikatz_inmemory_detection.yml - 'imm32.dll' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.