imm32.dll

  • File Path: C:\Windows\SysWOW64\imm32.dll
  • Description: Multi-User Windows IMM32 API Client DLL

Hashes

Type Hash
MD5 7137E6787E85DCA1643C8478EF258D15
SHA1 52B0B293BDBA2462050D421FD5176C32891517E7
SHA256 9D283E98946C008135DCD8C24B535C6BD5E47EEC9AFFB359476EB413E7F73FC8
SHA384 5207EA1EED4394FD394AE058EDACC54681471BD8085C3FDF7EDDCADA82510E3AF49DF50466A29D4D918DF78735118003
SHA512 646BE1364139FFB50B1E7AE49B3069064EBB2C5A1B8D00C2E2346D48EE42D7EB183701B16FE182BC186756F96D073C575394E8EE36ACF618D70FA7617DC760F8
SSDEEP 3072:Zf3+/BD8Gf2AeZJhJirgq/e6ryRorncmDH2ejuPkk23Smh2m5sHhkost:FZJAg16rYo7cdGkkbimh2m5sH+J
IMP 9E5EF8989C8F00935E2AB878FBB77214
PESHA1 63C677FEFCD12D14F8828051BE663911AEBA9CD6
PE256 3C43C6261442306FB97E58D1FC6E17A1212E11F2D3FD7474B9724BCAE9E3A5CC

DLL Exports:

Function Name Ordinal Type
ImmIsIME 92 Exported Function
ImmInstallIMEW 91 Exported Function
ImmIsUIMessageW 94 Exported Function
ImmIsUIMessageA 93 Exported Function
ImmIMPSetIMEA 88 Exported Function
ImmIMPQueryIMEW 87 Exported Function
ImmInstallIMEA 90 Exported Function
ImmIMPSetIMEW 89 Exported Function
ImmLoadIME 95 Exported Function
ImmNotifyIME 101 Exported Function
ImmLockImeDpi 100 Exported Function
ImmPutImeMenuItemsIntoMappedFile 103 Exported Function
ImmProcessKey 102 Exported Function
ImmLockClientImc 97 Exported Function
ImmLoadLayout 96 Exported Function
ImmLockIMCC 99 Exported Function
ImmLockIMC 98 Exported Function
ImmGetImeInfoEx 75 Exported Function
ImmGetIMEFileNameW 74 Exported Function
ImmGetImeMenuItemsW 77 Exported Function
ImmGetImeMenuItemsA 76 Exported Function
ImmGetIMCCSize 71 Exported Function
ImmGetIMCCLockCount 70 Exported Function
ImmGetIMEFileNameA 73 Exported Function
ImmGetIMCLockCount 72 Exported Function
ImmGetOpenStatus 78 Exported Function
ImmIMPGetIMEA 84 Exported Function
ImmGetVirtualKey 83 Exported Function
ImmIMPQueryIMEA 86 Exported Function
ImmIMPGetIMEW 85 Exported Function
ImmGetRegisterWordStyleA 80 Exported Function
ImmGetProperty 79 Exported Function
ImmGetStatusWindowPos 82 Exported Function
ImmGetRegisterWordStyleW 81 Exported Function
ImmSimulateHotKey 126 Exported Function
ImmShowSoftKeyboard 125 Exported Function
ImmTranslateMessage 128 Exported Function
ImmSystemHandler 127 Exported Function
ImmSetHotKey 122 Exported Function
ImmSetConversionStatus 121 Exported Function
ImmSetStatusWindowPos 124 Exported Function
ImmSetOpenStatus 123 Exported Function
ImmUnlockClientImc 129 Exported Function
ImmWINNLSEnableIME 135 Exported Function
ImmUnregisterWordW 134 Exported Function
ImmWINNLSGetIMEHotkey 137 Exported Function
ImmWINNLSGetEnableStatus 136 Exported Function
ImmUnlockIMCC 131 Exported Function
ImmUnlockIMC 130 Exported Function
ImmUnregisterWordA 133 Exported Function
ImmUnlockImeDpi 132 Exported Function
ImmRequestMessageW 110 Exported Function
ImmRequestMessageA 109 Exported Function
ImmSendIMEMessageExA 111 Exported Function
ImmReSizeIMCC 104 Exported Function
ImmRegisterWordA 106 Exported Function
ImmRegisterClient 105 Exported Function
ImmReleaseContext 108 Exported Function
ImmRegisterWordW 107 Exported Function
ImmSendIMEMessageExW 112 Exported Function
ImmSetCompositionStringA 118 Exported Function
ImmSetCompositionFontW 117 Exported Function
ImmSetCompositionWindow 120 Exported Function
ImmSetCompositionStringW 119 Exported Function
ImmSetActiveContextConsoleIME 114 Exported Function
ImmSetActiveContext 113 Exported Function
ImmSetCompositionFontA 116 Exported Function
ImmSetCandidateWindow 115 Exported Function
ImmGetHotKey 69 Exported Function
CtfImmSetDefaultRemoteKeyboardLayout 23 Exported Function
CtfImmSetCiceroStartInThread 22 Exported Function
GetKeyboardLayoutCP 25 Exported Function
CtfImmTIMActivate 24 Exported Function
CtfImmNotify 19 Exported Function
CtfImmLeaveCoInitCountSkipMode 18 Exported Function
CtfImmSetAppCompatFlags 21 Exported Function
CtfImmRestoreToolbarWnd 20 Exported Function
ImmActivateLayout 26 Exported Function
ImmCreateContext 32 Exported Function
ImmConfigureIMEW 31 Exported Function
ImmCreateSoftKeyboard 34 Exported Function
ImmCreateIMCC 33 Exported Function
ImmAssociateContextEx 28 Exported Function
ImmAssociateContext 27 Exported Function
ImmConfigureIMEA 30 Exported Function
ImmCallImeConsoleIME 29 Exported Function
CtfImmGetCompatibleKeyboardLayout 6 Exported Function
CtfImmGenerateMessage 5 Exported Function
CtfImmGetGuidAtom 8 Exported Function
CtfImmGetGlobalIMEStatus 7 Exported Function
CtfImmCoUninitialize 2 Exported Function
CtfImmAppCompatEnableIMEonProtectedCode 1 Exported Function
CtfImmEnterCoInitCountSkipMode 4 Exported Function
CtfImmDispatchDefImeMessage 3 Exported Function
CtfImmGetIMEFileName 9 Exported Function
CtfImmIsGuidMapEnable 15 Exported Function
CtfImmIsComStartedInThread 14 Exported Function
CtfImmLastEnabledWndDestroy 17 Exported Function
CtfImmIsTextFrameServiceDisabled 16 Exported Function
CtfImmHideToolbarWnd 11 Exported Function
CtfImmGetTMAEFlags 10 Exported Function
CtfImmIsCiceroStartedInThread 13 Exported Function
CtfImmIsCiceroEnabled 12 Exported Function
ImmGetCompositionStringA 57 Exported Function
ImmGetCompositionFontW 56 Exported Function
ImmGetCompositionWindow 59 Exported Function
ImmGetCompositionStringW 58 Exported Function
ImmGetCandidateListW 53 Exported Function
ImmGetCandidateListCountW 52 Exported Function
ImmGetCompositionFontA 55 Exported Function
ImmGetCandidateWindow 54 Exported Function
ImmGetContext 60 Exported Function
ImmGetDescriptionW 66 Exported Function
ImmGetDescriptionA 65 Exported Function
ImmGetGuideLineW 68 Exported Function
ImmGetGuideLineA 67 Exported Function
ImmGetConversionListW 62 Exported Function
ImmGetConversionListA 61 Exported Function
ImmGetDefaultIMEWnd 64 Exported Function
ImmGetConversionStatus 63 Exported Function
ImmDisableLegacyIME 40 Exported Function
ImmDisableIME 38 Exported Function
ImmEnumInputContext 42 Exported Function
ImmDisableTextFrameService 41 Exported Function
ImmDestroyIMCC 36 Exported Function
ImmDestroyContext 35 Exported Function
ImmDisableIme 39 Exported Function
ImmDestroySoftKeyboard 37 Exported Function
ImmEnumRegisterWordA 43 Exported Function
ImmGetAppCompatFlags 49 Exported Function
ImmGenerateMessage 48 Exported Function
ImmGetCandidateListCountA 51 Exported Function
ImmGetCandidateListA 50 Exported Function
ImmEscapeA 45 Exported Function
ImmEnumRegisterWordW 44 Exported Function
ImmFreeLayout 47 Exported Function
ImmEscapeW 46 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: imm32
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/65
  • VirusTotal Link: https://www.virustotal.com/gui/file/9d283e98946c008135dcd8c24b535c6bd5e47eec9affb359476eb413e7f73fc8/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\system32\imm32.dll 36

Possible Misuse

The following table contains possible examples of imm32.dll being misused. While imm32.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_mimikatz_inmemory_detection.yml - 'imm32.dll' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.