VmHostAI.dll
Description: CMI vmhost plug-in
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.3562
Architecture: 64-bit
Operating System: Windows NT
SHA256: ba176a79474a20d9840f685019095d79
File Size: 105.4 KB
Uploaded At: Dec. 1, 2025, 8:24 a.m.
Views: 13
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- DllCanUnloadNow (Ordinal: 1, Address: 0x35b0)
- DllCsiGetHandler (Ordinal: 2, Address: 0x35d0)
Imported DLLs & Functions
api-ms-win-core-com-l1-1-0.dll
- CoCreateInstance (Address: 0x18000f048)
- CoInitializeEx (Address: 0x18000f038)
- CoSetProxyBlanket (Address: 0x18000f030)
- CoTaskMemAlloc (Address: 0x18000f020)
- CoTaskMemFree (Address: 0x18000f028)
- CoTaskMemRealloc (Address: 0x18000f050)
- CoUninitialize (Address: 0x18000f040)
api-ms-win-core-debug-l1-1-0.dll
- OutputDebugStringA (Address: 0x18000f060)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x18000f090)
- RaiseException (Address: 0x18000f088)
- SetLastError (Address: 0x18000f070)
- SetUnhandledExceptionFilter (Address: 0x18000f080)
- UnhandledExceptionFilter (Address: 0x18000f078)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x18000f0a0)
api-ms-win-core-heap-l1-1-0.dll
- HeapSetInformation (Address: 0x18000f0b0)
api-ms-win-core-heap-obsolete-l1-1-0.dll
- LocalAlloc (Address: 0x18000f0c8)
- LocalFree (Address: 0x18000f0c0)
api-ms-win-core-libraryloader-l1-1-0.dll
- DisableThreadLibraryCalls (Address: 0x18000f118)
- FindResourceExW (Address: 0x18000f110)
- FreeLibrary (Address: 0x18000f0d8)
- GetModuleFileNameW (Address: 0x18000f0f8)
- GetModuleHandleW (Address: 0x18000f0e8)
- GetProcAddress (Address: 0x18000f108)
- LoadLibraryExW (Address: 0x18000f0e0)
- LoadResource (Address: 0x18000f0f0)
- SizeofResource (Address: 0x18000f100)
api-ms-win-core-processthreads-l1-1-0.dll
- CreateThread (Address: 0x18000f140)
- GetCurrentProcess (Address: 0x18000f130)
- GetCurrentProcessId (Address: 0x18000f150)
- GetCurrentThreadId (Address: 0x18000f158)
- GetExitCodeProcess (Address: 0x18000f148)
- OpenProcessToken (Address: 0x18000f128)
- TerminateProcess (Address: 0x18000f138)
api-ms-win-core-processthreads-l1-1-1.dll
- OpenProcess (Address: 0x18000f168)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x18000f178)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x18000f188)
- RegCreateKeyExW (Address: 0x18000f1b8)
- RegDeleteValueW (Address: 0x18000f1b0)
- RegEnumKeyExW (Address: 0x18000f1a0)
- RegOpenKeyExW (Address: 0x18000f198)
- RegQueryInfoKeyW (Address: 0x18000f190)
- RegSetValueExW (Address: 0x18000f1a8)
api-ms-win-core-rtlsupport-l1-1-0.dll
- RtlCaptureContext (Address: 0x18000f1d8)
- RtlLookupFunctionEntry (Address: 0x18000f1c8)
- RtlVirtualUnwind (Address: 0x18000f1d0)
api-ms-win-core-string-l1-1-0.dll
- MultiByteToWideChar (Address: 0x18000f1e8)
api-ms-win-core-string-l2-1-0.dll
- CharNextW (Address: 0x18000f1f8)
api-ms-win-core-string-obsolete-l1-1-0.dll
- lstrcmpiW (Address: 0x18000f208)
api-ms-win-core-synch-l1-1-0.dll
- DeleteCriticalSection (Address: 0x18000f218)
- EnterCriticalSection (Address: 0x18000f228)
- InitializeCriticalSection (Address: 0x18000f220)
- LeaveCriticalSection (Address: 0x18000f230)
- WaitForSingleObject (Address: 0x18000f238)
api-ms-win-core-synch-l1-2-0.dll
- Sleep (Address: 0x18000f248)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemTimeAsFileTime (Address: 0x18000f260)
- GetTickCount (Address: 0x18000f270)
- GetTickCount64 (Address: 0x18000f268)
- GetVersionExW (Address: 0x18000f258)
api-ms-win-security-base-l1-1-0.dll
- AddAccessAllowedAce (Address: 0x18000f2d8)
- AddAccessAllowedAceEx (Address: 0x18000f288)
- AddAce (Address: 0x18000f2a0)
- AllocateAndInitializeSid (Address: 0x18000f2f8)
- CreateWellKnownSid (Address: 0x18000f2c8)
- DeleteAce (Address: 0x18000f298)
- EqualSid (Address: 0x18000f280)
- FreeSid (Address: 0x18000f2f0)
- GetAce (Address: 0x18000f2a8)
- GetAclInformation (Address: 0x18000f2b0)
- GetLengthSid (Address: 0x18000f2c0)
- GetSecurityDescriptorDacl (Address: 0x18000f328)
- GetSecurityDescriptorGroup (Address: 0x18000f318)
- GetSecurityDescriptorLength (Address: 0x18000f308)
- GetSecurityDescriptorOwner (Address: 0x18000f320)
- GetSecurityDescriptorSacl (Address: 0x18000f330)
- GetTokenInformation (Address: 0x18000f350)
- InitializeAcl (Address: 0x18000f290)
- InitializeSecurityDescriptor (Address: 0x18000f2d0)
- IsValidAcl (Address: 0x18000f2b8)
- IsValidSecurityDescriptor (Address: 0x18000f338)
- MakeAbsoluteSD (Address: 0x18000f310)
- MakeSelfRelativeSD (Address: 0x18000f300)
- SetSecurityDescriptorControl (Address: 0x18000f2e8)
- SetSecurityDescriptorDacl (Address: 0x18000f2e0)
- SetSecurityDescriptorGroup (Address: 0x18000f348)
- SetSecurityDescriptorOwner (Address: 0x18000f340)
api-ms-win-security-lsalookup-l2-1-0.dll
- LookupAccountSidW (Address: 0x18000f360)
api-ms-win-security-sddl-l1-1-0.dll
- ConvertStringSidToSidW (Address: 0x18000f370)
api-ms-win-service-core-l1-1-1.dll
- EnumDependentServicesW (Address: 0x18000f380)
api-ms-win-service-management-l1-1-0.dll
- CloseServiceHandle (Address: 0x18000f390)
- OpenSCManagerW (Address: 0x18000f398)
- OpenServiceW (Address: 0x18000f3a0)
- StartServiceW (Address: 0x18000f3a8)
api-ms-win-service-management-l2-1-0.dll
- QueryServiceStatusEx (Address: 0x18000f3b8)
api-ms-win-service-winsvc-l1-1-0.dll
- ControlService (Address: 0x18000f3d0)
- QueryServiceStatus (Address: 0x18000f3c8)
msvcrt.dll
- __C_specific_handler (Address: 0x18000f4c0)
- __CxxFrameHandler3 (Address: 0x18000f4d8)
- __dllonexit (Address: 0x18000f438)
- _amsg_exit (Address: 0x18000f410)
- _callnewh (Address: 0x18000f468)
- _CxxThrowException (Address: 0x18000f460)
- _errno (Address: 0x18000f478)
- _initterm (Address: 0x18000f418)
- _lock (Address: 0x18000f480)
- _onexit (Address: 0x18000f440)
- _purecall (Address: 0x18000f4c8)
- _snwprintf_s (Address: 0x18000f428)
- _unlock (Address: 0x18000f430)
- _vsnwprintf_s (Address: 0x18000f470)
- _wstrdate (Address: 0x18000f3e8)
- _wstrtime (Address: 0x18000f3e0)
- _XcptFilter (Address: 0x18000f408)
- ??_V@YAXPEAX@Z (Address: 0x18000f4d0)
- ??0exception@@QEAA@AEBQEBD@Z (Address: 0x18000f490)
- ??0exception@@QEAA@AEBQEBDH@Z (Address: 0x18000f4e0)
- ??0exception@@QEAA@AEBV0@@Z (Address: 0x18000f3f0)
- ??1exception@@UEAA@XZ (Address: 0x18000f3f8)
- ??1type_info@@UEAA@XZ (Address: 0x18000f448)
- ??3@YAXPEAX@Z (Address: 0x18000f498)
- ?terminate@@YAXXZ (Address: 0x18000f420)
- ?what@exception@@UEBAPEBDXZ (Address: 0x18000f400)
- free (Address: 0x18000f4a8)
- malloc (Address: 0x18000f4b0)
- memcpy (Address: 0x18000f458)
- memcpy_s (Address: 0x18000f4a0)
- memmove (Address: 0x18000f450)
- memset (Address: 0x18000f4e8)
- realloc (Address: 0x18000f488)
- wcsncpy_s (Address: 0x18000f4b8)
NETAPI32.dll
- NetLocalGroupAddMembers (Address: 0x18000ef40)
- NetLocalGroupDelMembers (Address: 0x18000ef38)
OLEAUT32.dll
- SafeArrayAccessData (Address: 0x18000efc0)
- SafeArrayCopy (Address: 0x18000ef68)
- SafeArrayCreate (Address: 0x18000efb8)
- SafeArrayDestroy (Address: 0x18000ef50)
- SafeArrayGetLBound (Address: 0x18000ef58)
- SafeArrayGetUBound (Address: 0x18000ef60)
- SafeArrayGetVartype (Address: 0x18000ef70)
- SafeArrayLock (Address: 0x18000efa8)
- SafeArrayRedim (Address: 0x18000efc8)
- SafeArrayUnaccessData (Address: 0x18000ef78)
- SafeArrayUnlock (Address: 0x18000ef80)
- SysAllocString (Address: 0x18000ef98)
- SysFreeString (Address: 0x18000efa0)
- VariantClear (Address: 0x18000ef90)
- VariantInit (Address: 0x18000ef88)
- VarUI4FromStr (Address: 0x18000efb0)
WCP.dll
- ?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YAKPEAU_RTL_TRACING_FACILITY@123@@Z (Address: 0x18000eff0)
- ?RtlTraceFormat_PCWSTR_AsLiteralString@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z (Address: 0x18000efe0)
- ?RtlTraceVa@Rtl@WCP@Windows@@YAXKKPEAU_RTL_TRACING_FACILITY@123@QEBD_KPEAD@Z (Address: 0x18000efe8)
- RtlConcatenateLUnicodeStrings (Address: 0x18000f010)
- RtlConvertWin32RegistryPathToNtRegistryPath (Address: 0x18000f000)
- RtlFreeLBlob (Address: 0x18000efd8)
- RtlFreeLUnicodeString (Address: 0x18000eff8)
- RtlReportErrorOrigination (Address: 0x18000f008)