Talos Vulnerability Report

TALOS-2018-0589

VMware Workstation 14 Shader Functionality Assert Denial Of Service

October 9, 2018

CVE Number

CVE-2018-6977

Summary

An exploitable denial-of-service vulnerability exists in VMware Workstation 14. A specially crafted pixel shader can cause denial-of-service issues. An attacker can provide a specially crafted shader file (either in binary or text form) to trigger this vulnerability. This vulnerability can be triggered from VMware guest, and VMware host will be affected (leading vmware-vmx.exe process to crash on host).

Tested Versions

VMware Workstation 14 (14.1.1 build-7528167) with Windows 10 x64 as guestVM

Product URLs

http://vmware.com

CVSSv3 Score

6.5 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CWE

CWE-617: Reachable Assertion

Details

This vulnerability can be triggered by supplying a malformed pixel shader (in text or binary form) inside VMware guest OS. Such an attack can be triggered from the VMware guest usermode to cause a memory denial-of-service attack on vmware-vmx.exe process on the host, or theoretically through WEBGL (remote website) — assuming the browser will not use ANGLE, and will somehow supply the malformed shader.

A sample shader that triggers the bug is provided below:

void main( void ) {
        // min: 0x80000000 (-2147483648)
        // max: 0xfff00000 (-1048576)
        for(int j=0x80000000;j<1;j++){
            gl_FragColor+=vec4(1, 1, 1,1);
        }
}

By forcing the initial value of the loop counter variable (“j”) to be in range from 0x80000000 to 0xfff00000, it is possible to cause the vmware-vmx.exe process to terminate due to an assert condition. VMware compiles the shader and passes it to the graphics card driver on host. The shader gets executed and causes a reset of the device. We can assume so by two errors reported in the VMware log. The DXGI_ERROR_DEVICE_REMOVED error states that “video card has been physically removed from the system, or a driver upgrade for the video card has occurred. The application should destroy and recreate the device.” The DXGI_ERROR_DEVICE_HUNG error states that “the application’s device failed due to badly formed commands sent by the application. This is a design-time issue that should be investigated and fixed.” This situation most likely causes panic in the vmware-vmx.exe process and leads to its termination.

From the vmware-vmx.exe:

2018-04-24T14:51:21.778+02:00| svga| W115: CreateTexture2D: hr=DXGI_ERROR_DEVICE_REMOVED
2018-04-24T14:51:21.778+02:00| svga| W115: CreateTexture2D: hr=DXGI_ERROR_DEVICE_HUNG
2018-04-24T14:51:21.778+02:00| svga| W115: DX11Resource_CreateTexture2D: WxH=(816, 639), MipLevels=1, ArraySize=1, DXGI format=2
2018-04-24T14:51:21.778+02:00| svga| W115: DX11Resource_CreateTexture2D: SampleCount=1, SampleQuality=0
2018-04-24T14:51:21.778+02:00| svga| W115: DX11Resource_CreateTexture2D: CPUAccessFlags=0x0, Usage=0, BindFlags=0x28, MiscFlags=0x0
2018-04-24T14:51:21.779+02:00| svga| E105: PANIC: VERIFY bora\mks\hostops\DX11\DX11ShimOps.c:5332

From the vmware-vmx-debug.exe:

2018-04-24T12:46:00.376+02:00| svga| W115: ResourceMap: hr=DXGI_ERROR_DEVICE_REMOVED
2018-04-24T12:46:00.376+02:00| svga| W115: ResourceMap: hr=DXGI_ERROR_DEVICE_HUNG
2018-04-24T12:46:00.376+02:00| svga| W115: DX11Resource_Map: failed D3D11 map of staging resource: resource=0x1569091BA40, sid=36, stagingResource=0x156908C95E0, SVGA format=141, DXGI format=90, numMipLevels=1, arraySize=1, subresource=0, mapType=1, mapResource=0xEF05FF560
2018-04-24T12:46:00.376+02:00| svga| W115: DX11Renderer: DX11Resource_MapSubresourceBox: failed to map resource: resource=0x1569091BA40, sid=36, SVGA format=141, mipmap=0, index=0
2018-04-24T12:46:00.377+02:00| svga| E105: PANIC: ASSERT bora\mks\hostops\DX11\DX11Resource.c:2375
2018-04-24T12:46:00.378+02:00| svga| W115: Win32 object usage: GDI 7, USER 25
2018-04-24T12:46:00.378+02:00| svga| I125: CoreDump_CoreDump: faking exception to get context
2018-04-24T12:46:00.379+02:00| svga| I125: CoreDump: Minidump file

Crash Information

From vmware-vmx.exe (this is not a windbg crash dump):

2018-04-24T14:51:21.803+02:00| svga| I125: CoreDump_CoreDump: faking exception to get context
2018-04-24T14:51:21.804+02:00| mks| W115: Panic in progress... ungrabbing
2018-04-24T14:51:21.804+02:00| mks| I125: MKS: Release starting (Panic)
2018-04-24T14:51:21.805+02:00| svga| I125: CoreDump: Minidump file K:\vmware_images\windows_10_x64_uefi\vmware-vmx.dmp exists. Rotating ...
2018-04-24T14:51:21.805+02:00| mks| I125: MKS: Release finished (Panic)
2018-04-24T14:51:21.811+02:00| svga| W115: CoreDump: Writing minidump to K:\vmware_images\windows_10_x64_uefi\vmware-vmx.dmp
2018-04-24T14:51:22.010+02:00| svga| I125: CoreDump: including module base 0x0x7ff75f850000 size 0x0x01674000
2018-04-24T14:51:22.010+02:00| svga| I125:   checksum 0x01395bfd timestamp 0x5a53448e
2018-04-24T14:51:22.010+02:00| svga| I125:   image file K:\tools\vmware\x64\vmware-vmx.exe
2018-04-24T14:51:22.010+02:00| svga| I125:   file version 14.1.1.28517
2018-04-24T14:51:22.010+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8c370000 size 0x0x001e0000
2018-04-24T14:51:22.010+02:00| svga| I125:   checksum 0x001e4c3c timestamp 0xe508fc03
2018-04-24T14:51:22.010+02:00| svga| I125:   image file C:\Windows\System32\ntdll.dll
2018-04-24T14:51:22.010+02:00| svga| I125:   file version 10.0.16299.334
2018-04-24T14:51:22.010+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8bfa0000 size 0x0x000ae000
2018-04-24T14:51:22.010+02:00| svga| I125:   checksum 0x000b3d84 timestamp 0x0c2cf900
2018-04-24T14:51:22.010+02:00| svga| I125:   image file C:\Windows\System32\kernel32.dll
2018-04-24T14:51:22.010+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.010+02:00| svga| I125: CoreDump: including module base 0x0x7ffc891e0000 size 0x0x00266000
2018-04-24T14:51:22.010+02:00| svga| I125:   checksum 0x00275bd0 timestamp 0x6369e29f
2018-04-24T14:51:22.010+02:00| svga| I125:   image file C:\Windows\System32\KERNELBASE.dll
2018-04-24T14:51:22.010+02:00| svga| I125:   file version 10.0.16299.371
2018-04-24T14:51:22.010+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8c0f0000 size 0x0x0018f000
2018-04-24T14:51:22.010+02:00| svga| I125:   checksum 0x0019e63b timestamp 0x6c242675
2018-04-24T14:51:22.010+02:00| svga| I125:   image file C:\Windows\System32\user32.dll
2018-04-24T14:51:22.010+02:00| svga| I125:   file version 10.0.16299.125
2018-04-24T14:51:22.010+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89450000 size 0x0x00020000
2018-04-24T14:51:22.010+02:00| svga| I125:   checksum 0x000266b4 timestamp 0x1900dcc9
2018-04-24T14:51:22.010+02:00| svga| I125:   image file C:\Windows\System32\win32u.dll
2018-04-24T14:51:22.010+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.010+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8c2a0000 size 0x0x00028000
2018-04-24T14:51:22.010+02:00| svga| I125:   checksum 0x0002e7ad timestamp 0xd7e6475d
2018-04-24T14:51:22.010+02:00| svga| I125:   image file C:\Windows\System32\gdi32.dll
2018-04-24T14:51:22.010+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc88f10000 size 0x0x00193000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x001932d0 timestamp 0x4ee89f99
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\gdi32full.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.98
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc640d0000 size 0x0x000ef000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x000f6c2b timestamp 0x56bc00d3
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\msvcr120.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 12.0.40649.5
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89740000 size 0x0x0009b000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x0009ebca timestamp 0x591e7571
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\msvcp_win.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.248
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89640000 size 0x0x000f6000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x000f65c3 timestamp 0xe71e5dfe
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\ucrtbase.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.248
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89b80000 size 0x0x00149000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x00153700 timestamp 0xe56d382d
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\ole32.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.371
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8a110000 size 0x0x00308000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x0031728d timestamp 0x3db461b4
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\combase.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89840000 size 0x0x0011f000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x001202de timestamp 0xd9cb376e
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\rpcrt4.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.371
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc890b0000 size 0x0x00072000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x00081082 timestamp 0x384d71d2
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\bcryptPrimitives.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.98
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8be30000 size 0x0x0005b000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x0006723a timestamp 0xcaf94b03
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\sechost.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8bef0000 size 0x0x000a1000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x000a12fc timestamp 0x7eb2aaf2
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\advapi32.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.371
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8c050000 size 0x0x0009d000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x0009ec48 timestamp 0x20688290
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\msvcrt.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 7.0.16299.125
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8a880000 size 0x0x01436000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x0146c67f timestamp 0x0d81d886
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\shell32.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.371
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc88ec0000 size 0x0x0004a000
2018-04-24T14:51:22.011+02:00| svga| I125:   checksum 0x0004f9c5 timestamp 0xa7a2bb4e
2018-04-24T14:51:22.011+02:00| svga| I125:   image file C:\Windows\System32\cfgmgr32.dll
2018-04-24T14:51:22.011+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.011+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89e60000 size 0x0x000a6000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x000ae81f timestamp 0x6c07e48f
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\SHCore.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc88770000 size 0x0x00747000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x00756832 timestamp 0xaa4d43b0
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\windows.storage.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.371
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8bdd0000 size 0x0x00051000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x0005d507 timestamp 0x2303fb66
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\shlwapi.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc88750000 size 0x0x00011000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x0000e866 timestamp 0xd758e164
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\kernel.appcore.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc88700000 size 0x0x0004c000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x0004f3bc timestamp 0x883ace6c
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\powrprof.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc886c0000 size 0x0x0001b000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x00020cca timestamp 0xce335499
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\profapi.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8a420000 size 0x0x0044e000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x0045a715 timestamp 0x6e870640
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\setupapi.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.248
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8c2d0000 size 0x0x0006c000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x0006e5d3 timestamp 0x9ac9e819
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\ws2_32.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89d70000 size 0x0x000c5000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x000c23a1 timestamp 0xda658619
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\oleaut32.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89470000 size 0x0x001ce000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x001cf658 timestamp 0x02d1080b
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\crypt32.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc886e0000 size 0x0x00012000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x000128b0 timestamp 0xcfb4ce3b
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\msasn1.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc86a50000 size 0x0x00023000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x0002dedf timestamp 0x711180df
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\winmm.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc620c0000 size 0x0x0008f000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x0009143d timestamp 0x2ccf947e
2018-04-24T14:51:22.012+02:00| svga| I125:   image file C:\Windows\System32\dsound.dll
2018-04-24T14:51:22.012+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.012+02:00| svga| I125: CoreDump: including module base 0x0x7ffc81560000 size 0x0x00040000
2018-04-24T14:51:22.012+02:00| svga| I125:   checksum 0x00044046 timestamp 0xb44180d3
2018-04-24T14:51:22.013+02:00| svga| I125:   image file C:\Windows\System32\WinSCard.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 10.0.16299.334
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x50350000 size 0x0x00018000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x0002291c timestamp 0x59d578c9
2018-04-24T14:51:22.013+02:00| svga| I125:   image file K:\tools\vmware\x64\zlib1.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 1.2.11.0
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc84710000 size 0x0x000de000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x000e9176 timestamp 0x989c8db4
2018-04-24T14:51:22.013+02:00| svga| I125:   image file C:\Windows\System32\winhttp.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 10.0.16299.371
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc85090000 size 0x0x00013000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x0001d14e timestamp 0xd029ef98
2018-04-24T14:51:22.013+02:00| svga| I125:   image file C:\Windows\System32\wtsapi32.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc86910000 size 0x0x0002a000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x00036d11 timestamp 0x61131a6d
2018-04-24T14:51:22.013+02:00| svga| I125:   image file C:\Windows\System32\winmmbase.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc884d0000 size 0x0x00027000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x00026f15 timestamp 0xb8e773ec
2018-04-24T14:51:22.013+02:00| svga| I125:   image file C:\Windows\System32\devobj.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89f10000 size 0x0x0002d000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x0002f706 timestamp 0x36b05a53
2018-04-24T14:51:22.013+02:00| svga| I125:   image file C:\Windows\System32\imm32.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc86cf0000 size 0x0x00095000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x000986a2 timestamp 0x384015f0
2018-04-24T14:51:22.013+02:00| svga| I125:   image file C:\Windows\System32\uxtheme.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc877f0000 size 0x0x00031000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x0003bb30 timestamp 0x66e0a464
2018-04-24T14:51:22.013+02:00| svga| I125:   image file C:\Windows\System32\ntmarta.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x50110000 size 0x0x0023e000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x0023fab2 timestamp 0x59fe8bc7
2018-04-24T14:51:22.013+02:00| svga| I125:   image file K:\tools\vmware\x64\libeay32.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 1.0.2.13
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc72510000 size 0x0x0005a000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x000686a6 timestamp 0x59fe8bd1
2018-04-24T14:51:22.013+02:00| svga| I125:   image file K:\tools\vmware\x64\ssleay32.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 1.0.2.13
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc88110000 size 0x0x00017000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x00021503 timestamp 0x32e5cbdc
2018-04-24T14:51:22.013+02:00| svga| I125:   image file C:\Windows\System32\cryptsp.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc87b50000 size 0x0x00033000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x00039e91 timestamp 0xf0b48762
2018-04-24T14:51:22.013+02:00| svga| I125:   image file C:\Windows\System32\rsaenh.dll
2018-04-24T14:51:22.013+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.013+02:00| svga| I125: CoreDump: including module base 0x0x7ffc88220000 size 0x0x00025000
2018-04-24T14:51:22.013+02:00| svga| I125:   checksum 0x0002604f timestamp 0x0a84c761
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\bcrypt.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.125
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc88130000 size 0x0x0000b000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x00016bb1 timestamp 0xa04d2d94
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\CRYPTBASE.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc885f0000 size 0x0x00030000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x00039bda timestamp 0xa7849cb8
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\sspicli.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.98
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc87f50000 size 0x0x00066000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x00064a95 timestamp 0x3a7c7ba7
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\mswsock.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc87d20000 size 0x0x000b6000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x000c000c timestamp 0xccee8975
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\dnsapi.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.334
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89e40000 size 0x0x00008000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x0000df0a timestamp 0x99bb6efc
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\nsi.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc87ce0000 size 0x0x00039000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x00037892 timestamp 0x097e71dc
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\IPHLPAPI.DLL
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc80600000 size 0x0x0000a000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x0000a8f8 timestamp 0x001abb0d
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\rasadhlp.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89cd0000 size 0x0x0009e000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x0009ea1d timestamp 0x2c498fd1
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\clbcatq.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 2001.12.10941.16384
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc80360000 size 0x0x0000f000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x00013e86 timestamp 0x2d600235
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\wbem\wbemprox.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc7d990000 size 0x0x00081000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x0007ee3e timestamp 0xe602587c
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\wbemcomn.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc7ef10000 size 0x0x00014000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x00019c92 timestamp 0x58e5a8fa
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\wbem\wbemsvc.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc7f300000 size 0x0x000f0000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x000f5116 timestamp 0x9d854283
2018-04-24T14:51:22.014+02:00| svga| I125:   image file C:\Windows\System32\wbem\fastprox.dll
2018-04-24T14:51:22.014+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.014+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8a870000 size 0x0x00008000
2018-04-24T14:51:22.014+02:00| svga| I125:   checksum 0x0000c85b timestamp 0x305ab344
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\psapi.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc79e60000 size 0x0x001c8000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x001a65c4 timestamp 0x38fe792a
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\dbghelp.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc89f40000 size 0x0x00167000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x0016739f timestamp 0x9be5ad6b
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\msctf.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.19
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc87860000 size 0x0x00055000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x0005b7ec timestamp 0x8ebfd164
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\winsta.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc6a1b0000 size 0x0x00065000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x0006fbec timestamp 0x665fd221
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\SensorsApi.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc80000000 size 0x0x00010000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x00013e4b timestamp 0x114525b7
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\SensorsUtilsV2.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc75cd0000 size 0x0x00021000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x0002224e timestamp 0x4570fc18
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\SensorsNativeApi.V2.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc850f0000 size 0x0x001b1000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x001bdf91 timestamp 0x2e5aa65c
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\propsys.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 7.0.16299.334
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc62050000 size 0x0x00032000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x0002e84c timestamp 0xe4a7f39d
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\PortableDeviceTypes.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc71c00000 size 0x0x0005d000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x0006060e timestamp 0xa22d8a0d
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\deviceaccess.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc897e0000 size 0x0x00058000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x0005b3fa timestamp 0xdcc14b24
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\wintrust.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.309
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc86f60000 size 0x0x0002a000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x0002773f timestamp 0xe80a1430
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\dwmapi.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc8c280000 size 0x0x0001d000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x000235ee timestamp 0xd42d4094
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\imagehlp.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc80790000 size 0x0x00097000
2018-04-24T14:51:22.015+02:00| svga| I125:   checksum 0x0009a7d4 timestamp 0xcad51ef1
2018-04-24T14:51:22.015+02:00| svga| I125:   image file C:\Windows\System32\mscms.dll
2018-04-24T14:51:22.015+02:00| svga| I125:   file version 10.0.16299.334
2018-04-24T14:51:22.015+02:00| svga| I125: CoreDump: including module base 0x0x7ffc885c0000 size 0x0x00029000
2018-04-24T14:51:22.016+02:00| svga| I125:   checksum 0x0002f212 timestamp 0xd1cdc557
2018-04-24T14:51:22.016+02:00| svga| I125:   image file C:\Windows\System32\userenv.dll
2018-04-24T14:51:22.016+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: including module base 0x0x7ffc649c0000 size 0x0x00041000
2018-04-24T14:51:22.016+02:00| svga| I125:   checksum 0x00042c73 timestamp 0x47cabd86
2018-04-24T14:51:22.016+02:00| svga| I125:   image file C:\Windows\System32\icm32.dll
2018-04-24T14:51:22.016+02:00| svga| I125:   file version 10.0.16299.334
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: including module base 0x0x7ffc85e90000 size 0x0x002e2000
2018-04-24T14:51:22.016+02:00| svga| I125:   checksum 0x002e0ba0 timestamp 0x91f7d981
2018-04-24T14:51:22.016+02:00| svga| I125:   image file C:\Windows\System32\d3d11.dll
2018-04-24T14:51:22.016+02:00| svga| I125:   file version 10.0.16299.248
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: including module base 0x0x7ffc87520000 size 0x0x000af000
2018-04-24T14:51:22.016+02:00| svga| I125:   checksum 0x000bb251 timestamp 0xc29ffbca
2018-04-24T14:51:22.016+02:00| svga| I125:   image file C:\Windows\System32\dxgi.dll
2018-04-24T14:51:22.016+02:00| svga| I125:   file version 10.0.16299.98
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: including module base 0x0x7ffc80b30000 size 0x0x000eb000
2018-04-24T14:51:22.016+02:00| svga| I125:   checksum 0x000ec454 timestamp 0x5ab42d6e
2018-04-24T14:51:22.016+02:00| svga| I125:   image file C:\Windows\System32\DriverStore\FileRepository\nv_dispwi.inf_amd64_2af05e75955980a6\nvldumdx.dll
2018-04-24T14:51:22.016+02:00| svga| I125:   file version 23.21.13.9133
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: including module base 0x0x7ffc84070000 size 0x0x0000a000
2018-04-24T14:51:22.016+02:00| svga| I125:   checksum 0x00013a79 timestamp 0x4b7e1299
2018-04-24T14:51:22.016+02:00| svga| I125:   image file C:\Windows\System32\version.dll
2018-04-24T14:51:22.016+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: including module base 0x0x7ffc5a070000 size 0x0x01c08000
2018-04-24T14:51:22.016+02:00| svga| I125:   checksum 0x01c000dd timestamp 0x5ab433fd
2018-04-24T14:51:22.016+02:00| svga| I125:   image file C:\Windows\System32\DriverStore\FileRepository\nv_dispwi.inf_amd64_2af05e75955980a6\nvwgf2umx.dll
2018-04-24T14:51:22.016+02:00| svga| I125:   file version 23.21.13.9133
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: including module base 0x0x7ffc79d70000 size 0x0x00029000
2018-04-24T14:51:22.016+02:00| svga| I125:   checksum 0x00027c62 timestamp 0xbc00da9d
2018-04-24T14:51:22.016+02:00| svga| I125:   image file C:\Windows\System32\dbgcore.dll
2018-04-24T14:51:22.016+02:00| svga| I125:   file version 10.0.16299.15
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 2224
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 7808
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 11092
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 504
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 9120
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 9812
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 5944
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 9704
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 568
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 4928
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 9932
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 8852
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 1828
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 2352
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 6468
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 5008
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 8224
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 11400
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 7764
2018-04-24T14:51:22.016+02:00| svga| I125: CoreDump: Including thread 9344
2018-04-24T14:51:22.132+02:00| svga| I125: Writing monitor file `vmmcores.gz`
2018-04-24T14:51:22.178+02:00| svga| W115: Dumping core for vcpu-0
2018-04-24T14:51:22.178+02:00| svga| I125: Beginning monitor coredump
2018-04-24T14:51:22.469+02:00| svga| I125: CoreDump error: Read, page 0x2209 (0xaceb1) Invalid access to memory location
2018-04-24T14:51:22.574+02:00| svga| I125: CoreDump error: Read, page 0x3129 (0xace91) Invalid access to memory location
2018-04-24T14:51:22.574+02:00| svga| I125: CoreDump error: Read, page 0x312e (0) Invalid access to memory location
2018-04-24T14:51:22.574+02:00| svga| I125: CoreDump error: Read, page 0x312f (0) Invalid access to memory location
2018-04-24T14:51:22.574+02:00| svga| I125: CoreDump error: Read, page 0x3130 (0) Invalid access to memory location
2018-04-24T14:51:22.574+02:00| svga| I125: CoreDump error: Read, page 0x3131 (0) Invalid access to memory location
2018-04-24T14:51:22.681+02:00| svga| I125: End monitor coredump
2018-04-24T14:51:22.681+02:00| svga| W115: Dumping core for vcpu-1
2018-04-24T14:51:22.681+02:00| svga| I125: Beginning monitor coredump
2018-04-24T14:51:22.943+02:00| svga| I125: CoreDump error: Read, page 0x2209 (0xaceb0) Invalid access to memory location
2018-04-24T14:51:23.042+02:00| svga| I125: CoreDump error: Read, page 0x3129 (0xace7c) Invalid access to memory location
2018-04-24T14:51:23.042+02:00| svga| I125: CoreDump error: Read, page 0x312e (0) Invalid access to memory location
2018-04-24T14:51:23.042+02:00| svga| I125: CoreDump error: Read, page 0x312f (0) Invalid access to memory location
2018-04-24T14:51:23.042+02:00| svga| I125: CoreDump error: Read, page 0x3130 (0) Invalid access to memory location
2018-04-24T14:51:23.042+02:00| svga| I125: CoreDump error: Read, page 0x3131 (0) Invalid access to memory location
2018-04-24T14:51:23.135+02:00| svga| I125: CoreDump error: Read, page 0x3f04 (0x1bf470) Invalid access to memory location
2018-04-24T14:51:23.135+02:00| svga| I125: CoreDump error: Read, page 0x3f08 (0x19256a) Invalid access to memory location
2018-04-24T14:51:23.141+02:00| svga| I125: End monitor coredump
2018-04-24T14:51:24.561+02:00| svga| I125: Printing loaded objects
2018-04-24T14:51:24.561+02:00| svga| I125: [0x005f850000-0x0060ec4000): K:\tools\vmware\x64\vmware-vmx.exe
2018-04-24T14:51:24.561+02:00| svga| I125: [0x008c370000-0x008c550000): C:\WINDOWS\SYSTEM32\ntdll.dll
2018-04-24T14:51:24.561+02:00| svga| I125: [0x008bfa0000-0x008c04e000): C:\WINDOWS\System32\KERNEL32.DLL
2018-04-24T14:51:24.561+02:00| svga| I125: [0x00891e0000-0x0089446000): C:\WINDOWS\System32\KERNELBASE.dll
2018-04-24T14:51:24.561+02:00| svga| I125: [0x008c0f0000-0x008c27f000): C:\WINDOWS\System32\USER32.dll
2018-04-24T14:51:24.561+02:00| svga| I125: [0x0089450000-0x0089470000): C:\WINDOWS\System32\win32u.dll
2018-04-24T14:51:24.561+02:00| svga| I125: [0x008c2a0000-0x008c2c8000): C:\WINDOWS\System32\GDI32.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x0088f10000-0x00890a3000): C:\WINDOWS\System32\gdi32full.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x00640d0000-0x00641bf000): C:\WINDOWS\SYSTEM32\MSVCR120.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x0089740000-0x00897db000): C:\WINDOWS\System32\msvcp_win.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x0089640000-0x0089736000): C:\WINDOWS\System32\ucrtbase.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x0089b80000-0x0089cc9000): C:\WINDOWS\System32\ole32.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x008a110000-0x008a418000): C:\WINDOWS\System32\combase.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x0089840000-0x008995f000): C:\WINDOWS\System32\RPCRT4.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x00890b0000-0x0089122000): C:\WINDOWS\System32\bcryptPrimitives.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x008be30000-0x008be8b000): C:\WINDOWS\System32\sechost.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x008bef0000-0x008bf91000): C:\WINDOWS\System32\ADVAPI32.dll
2018-04-24T14:51:24.562+02:00| svga| I125: [0x008c050000-0x008c0ed000): C:\WINDOWS\System32\msvcrt.dll
2018-04-24T14:51:24.563+02:00| svga| I125: [0x008a880000-0x008bcb6000): C:\WINDOWS\System32\SHELL32.dll
2018-04-24T14:51:24.563+02:00| svga| I125: [0x0088ec0000-0x0088f0a000): C:\WINDOWS\System32\cfgmgr32.dll
2018-04-24T14:51:24.563+02:00| svga| I125: [0x0089e60000-0x0089f06000): C:\WINDOWS\System32\shcore.dll
2018-04-24T14:51:24.563+02:00| svga| I125: [0x0088770000-0x0088eb7000): C:\WINDOWS\System32\windows.storage.dll
2018-04-24T14:51:24.563+02:00| svga| I125: [0x008bdd0000-0x008be21000): C:\WINDOWS\System32\shlwapi.dll
2018-04-24T14:51:24.563+02:00| svga| I125: [0x0088750000-0x0088761000): C:\WINDOWS\System32\kernel.appcore.dll
2018-04-24T14:51:24.563+02:00| svga| I125: [0x0088700000-0x008874c000): C:\WINDOWS\System32\powrprof.dll
2018-04-24T14:51:24.563+02:00| svga| I125: [0x00886c0000-0x00886db000): C:\WINDOWS\System32\profapi.dll
2018-04-24T14:51:24.564+02:00| svga| I125: [0x008a420000-0x008a86e000): C:\WINDOWS\System32\SETUPAPI.dll
2018-04-24T14:51:24.564+02:00| svga| I125: [0x008c2d0000-0x008c33c000): C:\WINDOWS\System32\WS2_32.dll
2018-04-24T14:51:24.564+02:00| svga| I125: [0x0089d70000-0x0089e35000): C:\WINDOWS\System32\OLEAUT32.dll
2018-04-24T14:51:24.564+02:00| svga| I125: [0x0089470000-0x008963e000): C:\WINDOWS\System32\CRYPT32.dll
2018-04-24T14:51:24.564+02:00| svga| I125: [0x00886e0000-0x00886f2000): C:\WINDOWS\System32\MSASN1.dll
2018-04-24T14:51:24.564+02:00| svga| I125: [0x0086a50000-0x0086a73000): C:\WINDOWS\SYSTEM32\WINMM.dll
2018-04-24T14:51:24.564+02:00| svga| I125: [0x00620c0000-0x006214f000): C:\WINDOWS\SYSTEM32\DSOUND.dll
2018-04-24T14:51:24.565+02:00| svga| I125: [0x0081560000-0x00815a0000): C:\WINDOWS\SYSTEM32\WinSCard.dll
2018-04-24T14:51:24.565+02:00| svga| I125: [0x0050350000-0x0050368000): K:\tools\vmware\x64\zlib1.dll
2018-04-24T14:51:24.565+02:00| svga| I125: [0x0084710000-0x00847ee000): C:\WINDOWS\SYSTEM32\WINHTTP.dll
2018-04-24T14:51:24.565+02:00| svga| I125: [0x0085090000-0x00850a3000): C:\WINDOWS\SYSTEM32\WTSAPI32.dll
2018-04-24T14:51:24.565+02:00| svga| I125: [0x0086910000-0x008693a000): C:\WINDOWS\SYSTEM32\winmmbase.dll
2018-04-24T14:51:24.565+02:00| svga| I125: [0x00884d0000-0x00884f7000): C:\WINDOWS\SYSTEM32\DEVOBJ.dll
2018-04-24T14:51:24.566+02:00| svga| I125: [0x0089f10000-0x0089f3d000): C:\WINDOWS\System32\IMM32.DLL
2018-04-24T14:51:24.566+02:00| svga| I125: [0x0086cf0000-0x0086d85000): C:\WINDOWS\system32\uxtheme.dll
2018-04-24T14:51:24.566+02:00| svga| I125: [0x00877f0000-0x0087821000): C:\WINDOWS\SYSTEM32\ntmarta.dll
2018-04-24T14:51:24.566+02:00| svga| I125: [0x0050110000-0x005034e000): K:\tools\vmware\x64\libeay32.dll
2018-04-24T14:51:24.566+02:00| svga| I125: [0x0072510000-0x007256a000): K:\tools\vmware\x64\ssleay32.dll
2018-04-24T14:51:24.566+02:00| svga| I125: [0x0088110000-0x0088127000): C:\WINDOWS\SYSTEM32\CRYPTSP.dll
2018-04-24T14:51:24.567+02:00| svga| I125: [0x0087b50000-0x0087b83000): C:\WINDOWS\system32\rsaenh.dll
2018-04-24T14:51:24.567+02:00| svga| I125: [0x0088220000-0x0088245000): C:\WINDOWS\SYSTEM32\bcrypt.dll
2018-04-24T14:51:24.567+02:00| svga| I125: [0x0088130000-0x008813b000): C:\WINDOWS\SYSTEM32\CRYPTBASE.dll
2018-04-24T14:51:24.567+02:00| svga| I125: [0x00885f0000-0x0088620000): C:\WINDOWS\SYSTEM32\SspiCli.dll
2018-04-24T14:51:24.567+02:00| svga| I125: [0x0087f50000-0x0087fb6000): C:\WINDOWS\system32\mswsock.dll
2018-04-24T14:51:24.568+02:00| svga| I125: [0x0087d20000-0x0087dd6000): C:\WINDOWS\SYSTEM32\DNSAPI.dll
2018-04-24T14:51:24.568+02:00| svga| I125: [0x0089e40000-0x0089e48000): C:\WINDOWS\System32\NSI.dll
2018-04-24T14:51:24.568+02:00| svga| I125: [0x0087ce0000-0x0087d19000): C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL
2018-04-24T14:51:24.568+02:00| svga| I125: [0x0080600000-0x008060a000): C:\Windows\System32\rasadhlp.dll
2018-04-24T14:51:24.568+02:00| svga| I125: [0x0089cd0000-0x0089d6e000): C:\WINDOWS\System32\clbcatq.dll
2018-04-24T14:51:24.569+02:00| svga| I125: [0x0080360000-0x008036f000): C:\WINDOWS\system32\wbem\wbemprox.dll
2018-04-24T14:51:24.569+02:00| svga| I125: [0x007d990000-0x007da11000): C:\WINDOWS\SYSTEM32\wbemcomn.dll
2018-04-24T14:51:24.569+02:00| svga| I125: [0x007ef10000-0x007ef24000): C:\WINDOWS\system32\wbem\wbemsvc.dll
2018-04-24T14:51:24.569+02:00| svga| I125: [0x007f300000-0x007f3f0000): C:\WINDOWS\system32\wbem\fastprox.dll
2018-04-24T14:51:24.569+02:00| svga| I125: [0x008a870000-0x008a878000): C:\WINDOWS\System32\psapi.dll
2018-04-24T14:51:24.570+02:00| svga| I125: [0x0079e60000-0x007a028000): C:\WINDOWS\SYSTEM32\dbghelp.dll
2018-04-24T14:51:24.570+02:00| svga| I125: [0x0089f40000-0x008a0a7000): C:\WINDOWS\System32\MSCTF.dll
2018-04-24T14:51:24.570+02:00| svga| I125: [0x0087860000-0x00878b5000): C:\WINDOWS\SYSTEM32\WINSTA.dll
2018-04-24T14:51:24.570+02:00| svga| I125: [0x006a1b0000-0x006a215000): C:\WINDOWS\System32\SensorsApi.dll
2018-04-24T14:51:24.571+02:00| svga| I125: [0x0080000000-0x0080010000): C:\WINDOWS\System32\SensorsUtilsV2.dll
2018-04-24T14:51:24.571+02:00| svga| I125: [0x0075cd0000-0x0075cf1000): C:\WINDOWS\System32\SensorsNativeApi.V2.dll
2018-04-24T14:51:24.571+02:00| svga| I125: [0x00850f0000-0x00852a1000): C:\WINDOWS\System32\PROPSYS.dll
2018-04-24T14:51:24.571+02:00| svga| I125: [0x0062050000-0x0062082000): C:\Windows\System32\PortableDeviceTypes.dll
2018-04-24T14:51:24.571+02:00| svga| I125: [0x0071c00000-0x0071c5d000): C:\Windows\System32\deviceaccess.dll
2018-04-24T14:51:24.572+02:00| svga| I125: [0x00897e0000-0x0089838000): C:\WINDOWS\System32\WINTRUST.dll
2018-04-24T14:51:24.572+02:00| svga| I125: [0x0086f60000-0x0086f8a000): C:\WINDOWS\system32\dwmapi.dll
2018-04-24T14:51:24.572+02:00| svga| I125: [0x008c280000-0x008c29d000): C:\WINDOWS\System32\imagehlp.dll
2018-04-24T14:51:24.572+02:00| svga| I125: [0x0080790000-0x0080827000): C:\WINDOWS\SYSTEM32\mscms.dll
2018-04-24T14:51:24.573+02:00| svga| I125: [0x00885c0000-0x00885e9000): C:\WINDOWS\SYSTEM32\USERENV.dll
2018-04-24T14:51:24.573+02:00| svga| I125: [0x00649c0000-0x0064a01000): C:\WINDOWS\SYSTEM32\icm32.dll
2018-04-24T14:51:24.573+02:00| svga| I125: [0x0085e90000-0x0086172000): C:\WINDOWS\SYSTEM32\D3D11.DLL
2018-04-24T14:51:24.573+02:00| svga| I125: [0x0087520000-0x00875cf000): C:\WINDOWS\SYSTEM32\dxgi.dll
2018-04-24T14:51:24.574+02:00| svga| I125: [0x0080b30000-0x0080c1b000): C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispwi.inf_amd64_2af05e75955980a6\nvldumdx.dll
2018-04-24T14:51:24.574+02:00| svga| I125: [0x0084070000-0x008407a000): C:\WINDOWS\SYSTEM32\VERSION.dll
2018-04-24T14:51:24.574+02:00| svga| I125: [0x005a070000-0x005bc78000): C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispwi.inf_amd64_2af05e75955980a6\nvwgf2umx.dll
2018-04-24T14:51:24.575+02:00| svga| I125: [0x0079d70000-0x0079d99000): C:\WINDOWS\SYSTEM32\dbgcore.DLL
2018-04-24T14:51:24.575+02:00| svga| I125: End printing loaded objects
2018-04-24T14:51:24.575+02:00| svga| I125: Backtrace:
2018-04-24T14:51:24.579+02:00| svga| I125: backtrace[00] frame 0x68732ff030 IP 0x7ff75fc742c3 params 0x1 0x4 0x2 0x68732febe0 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x00000000004232c3] <K:\tools\vmware\x64\vmware-vmx.exe>+0x4242c3
2018-04-24T14:51:24.581+02:00| svga| I125: backtrace[01] frame 0x68732ff460 IP 0x7ff75f85ed79 params 0x7ff75ffe8b30 0x7ff76009e428 0x14d4 0x8000 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x000000000000dd79] <K:\tools\vmware\x64\vmware-vmx.exe>+0xed79
2018-04-24T14:51:24.583+02:00| svga| I125: backtrace[02] frame 0x68732ff4d0 IP 0x7ff75fab0727 params 0x10 0x1 0x1 0x7ff75fc23501 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x000000000025f727] <K:\tools\vmware\x64\vmware-vmx.exe>+0x260727
2018-04-24T14:51:24.585+02:00| svga| I125: backtrace[03] frame 0x68732ff550 IP 0x7ff75faf0c84 params 0x68000000b3 0x7ff75fc217c9 0xa0 0x208a0020 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x000000000029fc84] <K:\tools\vmware\x64\vmware-vmx.exe>+0x2a0c84
2018-04-24T14:51:24.587+02:00| svga| I125: backtrace[04] frame 0x68732ff5d0 IP 0x7ff75fa67c8b params 0x208a0020 0x1fed7a9ba40 0x1 0x1fed7a9ba40 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x0000000000216c8b] <K:\tools\vmware\x64\vmware-vmx.exe>+0x217c8b
2018-04-24T14:51:24.590+02:00| svga| I125: backtrace[05] frame 0x68732ff660 IP 0x7ff75f9c4842 params 0x1fed7a9ba40 0x1fed7a9ba40 0x1fed7cee5a0 0x1 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x0000000000173842] <K:\tools\vmware\x64\vmware-vmx.exe>+0x174842
2018-04-24T14:51:24.593+02:00| svga| I125: backtrace[06] frame 0x68732ff6d0 IP 0x7ff75f9c798c params 0x1fde0d9d580 0x7ff75f9c7541 0x58 0x18 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x000000000017698c] <K:\tools\vmware\x64\vmware-vmx.exe>+0x17798c
2018-04-24T14:51:24.594+02:00| svga| I125: backtrace[07] frame 0x68732ff710 IP 0x7ff75fa1e1e0 params 0x1 0 0x68732ff779 0x1 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x00000000001cd1e0] <K:\tools\vmware\x64\vmware-vmx.exe>+0x1ce1e0
2018-04-24T14:51:24.595+02:00| svga| I125: backtrace[08] frame 0x68732ff7d0 IP 0x7ff75fa20e30 params 0x1 0 0 0x1fde0d9d580 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x00000000001cfe30] <K:\tools\vmware\x64\vmware-vmx.exe>+0x1d0e30
2018-04-24T14:51:24.596+02:00| svga| I125: backtrace[09] frame 0x68732ff950 IP 0x7ff75f9b1cf2 params 0x68732ff9e8 0x120 0 0x1 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x0000000000160cf2] <K:\tools\vmware\x64\vmware-vmx.exe>+0x161cf2
2018-04-24T14:51:24.597+02:00| svga| I125: backtrace[10] frame 0x68732ff980 IP 0x7ff75f9b00b3 params 0x1fde0d9d580 0 0x1fde0d9d501 0 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x000000000015f0b3] <K:\tools\vmware\x64\vmware-vmx.exe>+0x1600b3
2018-04-24T14:51:24.598+02:00| svga| I125: backtrace[11] frame 0x68732ff9d0 IP 0x7ff75f908070 params 0xc 0x7ff700000000 0xc 0x1fde26d56a0 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x00000000000b7070] <K:\tools\vmware\x64\vmware-vmx.exe>+0xb8070
2018-04-24T14:51:24.598+02:00| svga| I125: backtrace[12] frame 0x68732ffa60 IP 0x7ff75fd9283e params 0 0 0 0 [K:\tools\vmware\x64\vmware-vmx.exe base 0x00007ff75f850000 0x0001:0x000000000054183e] <K:\tools\vmware\x64\vmware-vmx.exe>+0x54283e
2018-04-24T14:51:24.600+02:00| svga| I125: backtrace[13] frame 0x68732ffa68 IP 0x7ffc8bfb1fe4 params 0 0 0 0 [C:\WINDOWS\System32\KERNEL32.DLL base 0x00007ffc8bfa0000 0x0001:0x0000000000010fe4] BaseThreadInitThunk
2018-04-24T14:51:24.604+02:00| svga| I125: backtrace[14] frame 0x68732ffa98 IP 0x7ffc8c3df061 params 0 0 0 0 [C:\WINDOWS\SYSTEM32\ntdll.dll base 0x00007ffc8c370000 0x0001:0x000000000006e061] RtlUserThreadStart
2018-04-24T14:51:24.604+02:00| svga| I125: Msg_Post: Error
2018-04-24T14:51:24.604+02:00| svga| I125: [msg.log.error.unrecoverable] VMware Workstation unrecoverable error: (svga)
2018-04-24T14:51:24.604+02:00| svga| I125+ VERIFY bora\mks\hostops\DX11\DX11ShimOps.c:5332
2018-04-24T14:51:24.604+02:00| svga| I125: [msg.panic.haveLog] A log file is available in "K:\vmware_images\windows_10_x64_uefi\vmware.log".  
2018-04-24T14:51:24.604+02:00| svga| I125: [msg.panic.requestSupport.withoutLog] You can request support.  
2018-04-24T14:51:24.604+02:00| svga| I125: [msg.panic.requestSupport.vmSupport.windowsOrLinux] 
2018-04-24T14:51:24.604+02:00| svga| I125+ To collect data to submit to VMware support, choose "Collect Support Data" from the Help menu.
2018-04-24T14:51:24.604+02:00| svga| I125+ You can also run the "vm-support" script in the Workstation folder directly.
2018-04-24T14:51:24.604+02:00| svga| I125: [msg.panic.response] We will respond on the basis of your support entitlement.
2018-04-24T14:51:24.604+02:00| svga| I125: ----------------------------------------
2018-04-24T14:51:27.575+02:00| svga| I125: Exiting

Timeline

2018-05-07 - Vendor Disclosure
2018-10-09 - Public Release

Credit

Discovered by Piotr Bania of Cisco Talos.

TALOS-2018-0533

TALOS-2018-0639

Intelligence Center

Vulnerability Research

Security Resources

Media

Company