Elena’s finger hovered over the power button. On her screen, a window labeled “Windows 11 - VM” sat perfectly still, its black console waiting for a breath of life. She clicked.
She booted the isolated VM. The worm, sensing a fresh x64 environment, unspooled itself. It tried to phone home—but there was no network. It tried to scan for SMB shares—nothing. It tried to escape the hypervisor using a known CVE-2024-XXXX, but Elena had already applied the patch that VMware Pro 17 had shipped last Tuesday.
The worm rattled against its bars. Elena watched the CPU meter spike to 100% for three seconds, then idle. vmware workstation pro 17
Inside the machine, silicon woke to silicon. A BIOS splash screen flickered, then gave way to a spinning circle of dots. Within ten seconds, a fresh, blank desktop appeared—a ghost born of her RAM and CPU cores.
She didn’t trust the real world anymore. Her own laptop, a high-end Dell Precision, might be compromised. But inside the VMware hypervisor, she controlled the laws of physics. She could pause time (suspend). Rewind it (snapshots). Build entire virtual networks—a domain controller, a workstation, a firewall—all on a single keyboard. Elena’s finger hovered over the power button
Then, she mounted an ISO. Not a Windows installer, but a custom image containing the worm’s first sector. From the VM’s perspective, it was a CD-ROM drive appearing from nowhere.
Now she could roll back forever. Study the worm’s encryption routine. Reverse its kill switch. She could even run it 100 times in parallel using the “VM Groups” feature, each in a different language locale, to see if it behaved differently. She booted the isolated VM
She took a snapshot. “Infected State,” she named it.