Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

9.0.2 build-1031769 4.00%
9.0.1 build-894247 36.00%
9.0.0 build-812388 24.00%
8.0.0 build-471780 4.00%
8.0.0 build-471780 4.00%
7.1.4 build-385536 4.00%
7.0.1 build-227600 4.00%
7.0.0 build-203739 12.00%
4.5.2 build-8848 4.00%
10.0.0 build-1295980 4.00%

Relationships


PE structurePE file structure

Show functions
Import table
advapi32.dll
OpenServiceW, ReportEventW, RegSetValueExW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegOpenKeyExW, RegQueryValueExW, StartServiceCtrlDispatcherA, RegCloseKey, RegisterServiceCtrlHandlerA, RegisterEventSourceA, DeregisterEventSource, SetServiceStatus, CloseServiceHandle, OpenSCManagerW
dnsapi.dll
DnsFree, DnsQuery_A
iphlpapi.dll
CancelIPChangeNotify, NotifyAddrChange, GetAdaptersAddresses, GetAdaptersInfo
kernel32.dll
LoadLibraryA, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapAlloc, VirtualAlloc, HeapReAlloc, RtlUnwind, HeapSize, GetLocaleInfoA, WideCharToMultiByte, GetStringTypeA, MultiByteToWideChar, GetStringTypeW, LCMapStringA, LCMapStringW, GetTimeZoneInformation, CompareStringA, CompareStringW, TerminateThread, WaitForSingleObject, CreateThread, ReadFile, CloseHandle, DeviceIoControl, CreateEventA, ResetEvent, WaitForMultipleObjects, SetEvent, InitializeCriticalSection, CreatePipe, RaiseException, PeekNamedPipe, GetFileInformationByHandle, GetProcessHeap, LeaveCriticalSection, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, HeapFree, VirtualFree, HeapCreate, InterlockedDecrement, GetLastError, GetCurrentThreadId, SetEndOfFile, FileTimeToLocalFileTime, FileTimeToSystemTime, SetLastError, InterlockedIncrement, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, DeleteCriticalSection, GetStartupInfoA, GetFileType, SetHandleCount, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetModuleFileNameW, GetModuleFileNameA, GetStdHandle, WriteFile, ExitProcess, GetProcAddress, Sleep, GetModuleHandleW, IsDebuggerPresent, GetCurrentProcess, UnhandledExceptionFilter, TerminateProcess, GetCurrentDirectoryA, EnterCriticalSection, SetUnhandledExceptionFilter, SetEnvironmentVariableA, GetModuleHandleA, SetFilePointer, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, GetFullPathNameW, FindFirstFileW, GetDriveTypeW, CreateFileW, DeleteFileW, CreateDirectoryW, GetFileAttributesW, LocalFree, FormatMessageW, OutputDebugStringW, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, GetFileAttributesA, GetVersionExA, FindClose, VirtualQuery, GetDriveTypeA, InterlockedCompareExchange, GetStartupInfoW
shfolder.dll
SHGetFolderPathW
user32.dll
CreateWindowExW, DispatchMessageA, GetMessageA, PostMessageA, MsgWaitForMultipleObjects, PeekMessageA, DestroyWindow, PostThreadMessageA
ws2_32.dll
WSAIoctl, WSACreateEvent

vmnat.exe

VMware Workstation by VMware (Signed)

Remove vmnat.exe
Version:   4.5.2 build-8848
MD5:   eb0d72844da3aed09870c1be90c9342f
SHA1:   130b71e3f65dda337dae75bc221c27badfdd5c0f
SHA256:   4b5a6c4f9f523306b405241075737f0ff82c932f5e282eb32ae3bbf7aa5358cc

What is vmnat.exe?

VMware NAT Service is part of VMware Workstation, a hypervisor that enables users to set up multiple virtual machines (VMs) and use them simultaneously along with the actual machine. Each virtual machine can execute its own operating system, such as Windows. VMware Workstation allows one physical machine to run multiple operating systems simultaneously.

About vmnat.exe (from VMware)

VMware Workstation provides a seamless way to access all of the virtual machines you need, regardless of where they are running. Remotely connect to virtual machines running on VMware vSphere, ESXi or

DetailsDetails

File name:vmnat.exe
Publisher:VMware, Inc.
Product name:VMware Workstation
Description:VMware NAT Service
Typical file path:C:\windows\syswow64\vmnat.exe
File version:4.5.2 build-8848
Size:140.07 KB (143,432 bytes)
Certificate
Issued to:VMware
Authority (CA):VeriSign
Digital DNA
File packed:No
.NET CLR:No
More details

BehaviorsBehaviors

Service
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
  • 'VMware NAT Service'

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.00000004%
0.028634%
Kernel CPU:0.00000001%
0.013761%
User CPU:0.00000003%
0.014873%
Kernel CPU time:16 ms/min
100,923,805ms/min
Memory
Private memory:684 KB
21.59 MB
Private (maximum):912 KB
Private (minimum):912 KB
Non-paged memory:684 KB
21.59 MB
Virtual memory:14.49 MB
140.96 MB
Virtual memory (peak):14.49 MB
169.69 MB
Working set:920 KB
18.61 MB
Working set (peak):1.88 MB
37.95 MB
Resource allocations
Threads:3
12
Handles:52
600
GUI GDI count:4
103
GUI USER count:2
49

BehaviorsProcess properties

Platform:32-bit
Command line:C:\Windows\System32\vmnat.exe
Owner:SYSTEM
Windows Service
Service name:VMware NAT Service
Description:“Network address translation for virtual networks.”
Type:Win32OwnProcess
Parent process:services.exe (Services and Controller app by Microsoft)

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Home Premium 29.17%
Windows 7 Ultimate 16.67%
Windows 8 Pro 12.50%
Windows 7 Professional 12.50%
Windows 7 Home Basic 8.33%
Microsoft Windows XP 8.33%
Windows Vista Home Premium 4.17%
Windows 8 Pro with Media Center 4.17%
Windows 8 Enterprise 4.17%

Distribution by countryDistribution by country

United States installs about 25.00% of VMware Workstation.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Dell 62.50%
Toshiba 12.50%
Acer 12.50%
Hewlett-Packard 6.25%
GIGABYTE 6.25%
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE