vmware-shell-ext-thunker.exe
Sources: 300M+ executions observed in the wild.
Summary
VMware shell extension thunker
vmware-shell-ext-thunker.exe is the 1401st most commonly executed Windows program in EchoTrail's dataset, observed 854 times across enterprise environments. It typically runs from C:\Program Files (x86)\VMware\VMware Workstation and it is most often launched by svchost.exe.
Get this in your tools
The same record for vmware-shell-ext-thunker.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/vmware-shell-ext-thunker.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Program Files (x86)\VMware\VMware Workstation83.61%
- C:\Program Files (x86)\VMware\VMware Player16.39%
Top Hashes (SHA256)
- 166388ae7d3be03b389b64b888e63267639155620a653740e879c938109a79a159.08%
- fc6cc9bcd5dff2f6dffb3fea02d79bee0b83cba98d4a8839273c11c311312a2030.95%
- 7452c43a5bfdf3c4cde646f00e5145230c469c0c6e78f6860dbaa2328610ab975.24%
- e8f7547864ff6a3eadf20efc34dd1b45f216631da93f25e65cca565f9b8387061.53%
- 3e60c68c0e62f59a0d74dacdecba8cbd08efa2d0a918248427883b6acdf2d6b71.15%
- efb0b64f9e378ce39f3cd694feff776894a288b95fd3e6e16ad43c312f6c90600.77%
- 5dc624e66111cb4f3a3279e2802cd5a1abc5d92f5353510eec5a9a800035ad9d0.51%
- 09e84a300a085d1288059b2069f065117341721554a25062b7bd1894725aaaa30.38%
- cc03b707840659d9390d7a1bcbe190fcb23b3d859ec7d794f37b06591f5555e40.26%
- eb58ccdd2a0f73e43219cfee58131f0f21597e147f2838ff035d2b4408846cdc0.13%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- svchost.exe100%
Ask Rocky about vmware-shell-ext-thunker.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for vmware-shell-ext-thunker.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.