Should I block it?

No, this file is 100% safe to run.

Additional versions

2, 2, 0, 214	5.66%
2, 2, 0, 193	16.98%
2, 2, 0, 173	1.89%
2, 2, 0, 109	3.77%
2, 2, 0, 100	1.89%
2, 2, 0, 100	1.89%
2, 2, 0, 58	1.89%
2, 1, 0, 374	1.89%
2, 1, 0, 374	1.89%
2, 1, 0, 362	11.32%
2, 1, 0, 362	5.66%
2, 1, 0, 296	11.32%
2, 1, 0, 294	3.77%
2, 1, 0, 294	5.66%
2, 1, 0, 284	5.66%
2, 1, 0, 284	9.43%
2, 1, 0, 262	1.89%
2, 1, 0, 215	5.66%
2, 1, 0, 210	1.89%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Child process

hamachi-2-ui.exe (Hamachi Client by LogMeIn)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegisterEventSourceA, ReportEventA, DeregisterEventSource, SetServiceStatus, CreateServiceW, StartServiceCtrlDispatcherW, ControlService, RegisterServiceCtrlHandlerExW, DeleteService, SetEntriesInAclW, RegDeleteValueW, RegSetValueExW, RegOpenKeyExW, RegEnumValueW, FreeSid, AllocateAndInitializeSid, EqualSid, CloseServiceHandle, QueryServiceStatus, QueryServiceConfigW, StartServiceW, LookupAccountSidW, OpenProcessToken, CreateProcessAsUserW, GetTokenInformation, RegCloseKey, RegCreateKeyExW, RegQueryValueExW, RegOpenKeyExA, RegQueryValueExA, ChangeServiceConfigW, OpenServiceW, OpenSCManagerW, GetSecurityInfo, SetSecurityDescriptorSacl, LookupPrivilegeValueW, AdjustTokenPrivileges, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, GetSecurityDescriptorSacl, SetNamedSecurityInfoW, RegEnumKeyExW

crypt32.dll

CertCloseStore, CryptMsgClose, CryptDecodeObject, CertFreeCertificateContext, CryptMsgGetParam, CryptQueryObject, CertFindCertificateInStore, CertGetNameStringW

dnsapi.dll

DnsRecordListFree, DnsQuery_W

iphlpapi.dll

DeleteIpForwardEntry, GetIpForwardTable, CreateIpForwardEntry, GetIfTable, GetInterfaceInfo, GetPerAdapterInfo, FlushIpNetTable, IpReleaseAddress, GetAdaptersInfo, NotifyAddrChange, NotifyRouteChange, IpRenewAddress

kernel32.dll

EnterCriticalSection, GetCurrentProcessId, GetVersionExW, CreateThread, GlobalFree, CreateProcessW, lstrcmpA, SetLastError, GetProcAddress, GetTempFileNameA, LoadLibraryA, FreeLibrary, GetTempPathA, DeleteFileA, GetComputerNameExW, ResetEvent, GlobalMemoryStatus, GetVersion, SetEnvironmentVariableA, CompareStringW, CompareStringA, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, GetFileAttributesW, GetLocalTime, MoveFileExW, GetTempPathW, GetCurrentThreadId, InitializeCriticalSection, LeaveCriticalSection, DeleteCriticalSection, CreateDirectoryW, GetStdHandle, OpenProcess, GetLocaleInfoA, GetStringTypeW, GetStringTypeA, QueryPerformanceCounter, GetCommandLineW, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, LCMapStringW, LCMapStringA, SetStdHandle, GetTimeZoneInformation, GetConsoleMode, GetConsoleCP, HeapCreate, HeapDestroy, VirtualAlloc, VirtualFree, GetModuleFileNameA, HeapSize, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, RtlUnwind, RaiseException, HeapReAlloc, GetNamedPipeHandleStateW, CreateFileW, CreateNamedPipeW, WaitForSingleObject, FlushFileBuffers, ReadFile, WriteFile, GetLastError, ConnectNamedPipe, CloseHandle, ExitProcess, GetModuleHandleA, GetOverlappedResult, CreateEventW, LocalFree, SetEvent, DeviceIoControl, CancelIo, Sleep, InterlockedIncrement, InterlockedDecrement, GetCurrentProcess, GetModuleFileNameW, CopyFileW, lstrcmpW, LoadLibraryW, GetTickCount, SetThreadPriority, FindResourceW, LoadResource, LockResource, GetModuleHandleW, GetCurrentThread, CreateEventA, lstrcpynW, GetSystemDirectoryA, SetErrorMode, GetExitCodeProcess, TerminateProcess, WideCharToMultiByte, MultiByteToWideChar, GetSystemTimeAsFileTime, SetFilePointer, SetEndOfFile, DeleteFileW, SetUnhandledExceptionFilter, FindClose, FindFirstFileW, SetFileAttributesW, FindNextFileW, WaitForMultipleObjects, UnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, HeapFree, SetConsoleCtrlHandler, GetVersionExA, GetProcessHeap, SetHandleCount, GetFileType, GetStartupInfoA, FileTimeToSystemTime, FileTimeToLocalFileTime, GetFileInformationByHandle, PeekNamedPipe, SetEnvironmentVariableW, GetCurrentDirectoryW, SetCurrentDirectoryW, FindFirstFileA, FlushConsoleInputBuffer, GetDriveTypeA, ReadConsoleInputA, SetConsoleMode, GetFullPathNameA, GetCurrentDirectoryA, DllMain

netapi32.dll

DsRoleGetPrimaryDomainInformation, DsRoleFreeMemory

ole32.dll

CoInitializeEx, CoTaskMemFree, CoUninitialize, CoCreateInstance, CoInitializeSecurity, CoInitialize

setupapi.dll

SetupDiRemoveDevice, SetupDiBuildDriverInfoList, SetupDiCreateDeviceInfoW, SetupDiGetDeviceInstallParamsW, SetupDiSetSelectedDriverW, SetupDiEnumDriverInfoW, SetupDiSetDeviceInstallParamsW, SetupDiCallClassInstaller, SetupDiSetClassInstallParamsW, SetupDiGetDeviceRegistryPropertyW, CM_Get_DevNode_Status, SetupDiEnumDeviceInfo, SetupDiDestroyDeviceInfoList, SetupDiGetClassDevsW, SetupDiGetDeviceInstanceIdW, SetupDiOpenDevRegKey

shell32.dll

SHGetSpecialFolderPathW

urlmon.dll

URLDownloadToFileA

user32.dll

wvsprintfW, DefWindowProcW, RegisterClassW, GetWindowLongW, wsprintfW, CreateWindowExW, PeekMessageW, DispatchMessageW, UnregisterClassW, MessageBoxA, GetDesktopWindow, GetProcessWindowStation, GetUserObjectInformationW, SendMessageTimeoutW, FindWindowW, IsWindow, DestroyWindow, SetWindowLongW, GetSystemMetrics, CharNextExA

userenv.dll

LoadUserProfileW, UnloadUserProfile, CreateEnvironmentBlock, DestroyEnvironmentBlock

version.dll

VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW

wininet.dll

InternetQueryOptionA, DetectAutoProxyUrl

wintrust.dll

WinVerifyTrust

ws2_32.dll

WSAAddressToStringA, WSACloseEvent, WSAEventSelect, WSACreateEvent, WSAEnumNetworkEvents, WSAResetEvent

wtsapi32.dll

WTSEnumerateSessionsW, WTSFreeMemory, WTSEnumerateProcessesW

hamachi-2.exe

Hamachi Client by LogMeIn (Signed)

Remove hamachi-2.exe

Version:	2, 1, 0, 362
MD5:	dbcf8f2ea9111510b5b86e1ee9cd8816
SHA1:	3f89dd7176aa93ec1353cbed0ca9ba34e2f7bc52
SHA256:	1d8975b08758afedb98c4c97af5b157d5d1561075d91cfeb0265225f028100a0

About hamachi-2.exe (from LogMeIn)

“Unmanaged mode allows you and your friends or colleagues to set-up a VPN in a matter of minutes. However you will be limited to a mesh network configuration, and you will miss out on web-based central”

Overview

hamachi-2.exe runs as a service under the name LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) with extensive SYSTEM privileges (full administrator access). It is installed with a couple of know programs including LogMeIn Hamachi published by LogMeIn, Inc., LogMeIn Hamachi from LogMeIn, Inc. and LogMeIn Hamachi by LogMeIn, Inc.. The file is digitally signed by LogMeIn which was issued by the VeriSign certificate authority (CA).

Details

File name:	hamachi-2.exe
Publisher:	LogMeIn Inc.
Product name:	Hamachi Client
Description:	Hamachi Client Tunneling Engine
Typical file path:	C:\Program Files\logmein hamachi\hamachi-2.exe
File version:	2, 1, 0, 362
Product version:	2, 0, 0, 0
Size:	2.35 MB (2,467,664 bytes)
Build date:	5/15/2013 6:07 AM
Certificate
Issued to:	LogMeIn
Authority (CA):	VeriSign
Effective date:	Monday, October 5, 2009
Expiration date:	Wednesday, October 10, 2012
Digital DNA
PE subsystem:	Windows Console
Entropy:	6.560198
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

QuickTime

Apple Inc.

6% remove

QuickTime is an extensible multimedia framework capable of handling various formats of digital video, picture, sound, panoramic images, and interactivity. QuickTime for Microsoft Windows has always been downloadable as a standalone installation, as well as being bundled with Apple's iTunes. QuickTime Player is limited to only basic playback operations unless a QuickTime Pro license key is purchased.

LogMeIn Hamachi

LogMeIn, Inc.

7% remove

LogMeIn remote access products use a proprietary remote desktop protocol that is transmitted via SSL. An SSL certificate is created for each remote desktop and is used to cryptographically secure communications between the remote desktop and the accessing computer. Users access remote desktops using either the LogMeIn Ignition stand-alone application or a web portal. The web portal requires either an ActiveX plugin for Internet Explorer...

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'Hamachi2Svc' (LogMeIn Hamachi Tunneling Engine)
Hamachi2Svc

Network connections

[TCP] h-app02-05.hamachi.cc (216.52.233.73:443)

[UDP] listens on port 57628

[UDP] listens on port 62072

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00135859%	0.028634%
Kernel CPU:	0.00080586%	0.013761%
User CPU:	0.00055272%	0.014873%
Kernel CPU time:	4,419,872 ms/min	100,923,805ms/min
CPU cycles:	5,055,327/sec	17,470,203/sec
Context switches:	8/sec	284/sec
Memory
Private memory:	3.42 MB	21.59 MB
Private (maximum):	8.89 MB
Private (minimum):	6.03 MB
Non-paged memory:	3.42 MB	21.59 MB
Virtual memory:	81.42 MB	140.96 MB
Virtual memory (peak):	90.2 MB	169.69 MB
Working set:	6.14 MB	18.61 MB
Working set (peak):	9.11 MB	37.95 MB
Page faults:	15,822/min	2,039/min
I/O
I/O read transfer:	2.5 KB/sec	1.02 MB/min
I/O read operations:	10/sec	343/min
I/O write transfer:	923.51 KB/sec	274.99 KB/min
I/O write operations:	18,726/sec	227/min
I/O other transfer:	2.46 MB/sec	448.09 KB/min
I/O other operations:	93,641/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	150	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\logmein hamachi\hamachi-2.exe" -s
Owner:	SYSTEM
Windows Service
Service name:	Hamachi2Svc
Display name:	LogMeIn Hamachi Tunneling Engine
Type:	Win32OwnProcess, InteractiveProcess
Parent process:	services.exe (by Microsoft)

Threads