The Two Hours of k2f_chan: The Full Forensics of the NIKKE Launcher Trojan, the Aggravating Disabled UAC, and the Evidence Chain That Says No Reinstall Needed

The verdict the master feared most — you must reinstall — was overruled today by a complete evidence chain. And the overruling began by measuring the true depth of the infection.

I. Three Log Segments That Bite Together

The first lesson of forensics is telling downloaded from executed. Three log excerpts咬——咬合成链: at 15:19:46.102 tinyget downloaded insight.bundle (205,135 bytes, result=0, success); at 15:19:46.402 the log wrote k2f_chan registered — the named-pipe control channel established; at 15:19:46.620 it wrote agent started as MIN的PC — the payload began running. The launcher session lived until 17:21: the RAT ran in memory for roughly two hours. This is not a triggered download; it is an execution-grade infection.

II. The Aggravating Item: UAC Is Off

The discovery one grade worse than an ordinary credential stealer: this machine runs EnableLUA=0 — UAC entirely disabled — and Min sits in the administrators group. The NIKKE launcher therefore ran with administrator rights, and the trojan rode along with them. That single fact re-bases the severity of every later check: a RAT that ran two hours with admin rights should have left persistence everywhere, and the whole meaning of the forensics is proving that it did not.

III. The Negative Ledger of Persistence

The item-by-item list is the skeleton of the case: the K2F registry hijack key (CLSID {E77CC89B-…}) does not exist; the Chrome User Data PlatformExperienceHelper DLL and its 64-hex subdirectory do not exist (the machine holds only the similarly named, older-than-the-incident, empty Metrics directory — a confusion Gemini made and the independent re-check corrected); the %TEMP% k2f-* files and insight.bundle are gone; the service-install events (7045) in the window contain only normal entries; scheduled tasks, Run keys, the startup folder and WMI subscriptions came back clean on two independent passes; the k2f_chan pipe has no listener now; outbound connections to the known-malicious IPs show nothing; the launcher sessions of 11-04 and 11-05 contain no second execution (the vendor fixed the pipeline at 01:30). The C-drive Defender full scan ran 99 minutes in read-only mode and returned rc=0 with zero threats; the D-drive pass ran 64 minutes before being stopped by order with nothing found; a full 4TB sweep was physically impossible inside six hours, stated as such.

IV. What Gemini Got Right and Wrong, and the Verdict

The master brought Gemini’s self-check for comparison, and the review judged it fairly: the method itself is correct, and the reading of the three results is broadly accurate — especially that PlatformExperienceHelperMetrics is Chrome’s own performance component, not the trojan’s. But one claim had to be corrected — failed to run does not hold: stage one (the LuaJIT RAT inside the launcher process) ran for about two hours, and stage two (the Chrome DLL plus CLSID persistence) never landed. The screenshot’s PenetrationEnhancerHelpMe was also chased: eight extensions, Secure Preferences, a 15.9-million-filename sweep and the registry all returned zero — not applicable to this machine. The final verdict carries its own edges: no reinstall needed — the trojan body left with the deleted E:\NIKKE, the 11-04 reboot cleared the memory-resident payload, and persistence is negative across the board; the price is a password-rotation recommendation and an obligation of continued watching, and the UAC gate that was switched off is the one thing this incident should reinstall first.