Recent VMWare virtual machines are able to capture their screen output and store it into AVI packed with their own codec. A quick study showed that this codec stores captured image in special type blocks, most of them are labeled WMVx (maybe VMW spelled backwards, but who knows 😉 ). Every block type has its own function to handle it. Blocks with labels WMVi or 0x00000005 can be found in almost every frame.