Should I block it?

60%

60% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

5.0.0.12712	3.03%
5.0.0.12627	3.03%
5.0.0.9854	3.03%
5.0.0.9396	12.12%
5.0.0.8109	6.06%
5.0.0.8109	3.03%
5.0.0.8080	6.06%
5.0.0.7931	3.03%
5.0.0.7254	36.36%
5.0.0.7189	3.03%
5.0.0.7062	3.03%
5.0.0.6767	3.03%
5.0.0.6254	3.03%
5.0.0.5848	12.12%

Relationships

Parent process

datamngrcoordinator.exe (Datamngr Coordinator by Bandoo Media)

Related files

PE file structure

Show functions

Import table

advapi32.dll

IsValidSid, AddAce, CloseServiceHandle, StartServiceW, OpenServiceW, OpenSCManagerW, SetKernelObjectSecurity, RegEnumValueW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegEnumKeyW, RegNotifyChangeKeyValue, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW, RegCloseKey, RegDeleteKeyW, OpenThreadToken, GetLengthSid, InitializeAcl, CopySid, GetSidSubAuthority, InitializeSid, GetSidLengthRequired, GetUserNameW, CreateProcessAsUserW, SetTokenInformation, SaferCloseLevel, SaferComputeTokenFromLevel, SaferCreateLevel, OpenProcessToken, GetSidSubAuthorityCount, GetTokenInformation, ConvertSidToStringSidW, LookupAccountNameW, QueryServiceStatus, SetSecurityInfo, DeleteAce, GetAce, GetAclInformation, GetSecurityInfo, GetSecurityDescriptorSacl, DuplicateTokenEx, RevertToSelf, ImpersonateLoggedOnUser, RegOpenKeyW, ChangeServiceConfigW, ControlService, QueryServiceStatusEx

comctl32.dll

InitCommonControlsEx, _TrackMouseEvent

crypt32.dll

CertFreeCertificateContext, CertGetCertificateContextProperty, CryptVerifyMessageSignature

gdi32.dll

SetTextColor, GetTextMetricsW, CreateFontIndirectW, GetStockObject, GetObjectW, SetBkMode, CreatePatternBrush, CreateSolidBrush, BitBlt, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, DeleteDC, DeleteObject, GetTextExtentPoint32W

imagehlp.dll

ImageEnumerateCertificates, ImageGetCertificateData

kernel32.dll

DllMain

ole32.dll

CLSIDFromString, CoUninitialize, CoInitialize, CoCreateInstance, CoTaskMemAlloc, CoTaskMemRealloc, StringFromIID, CoCreateGuid, StringFromGUID2, CoTaskMemFree, StringFromCLSID

sensapi.dll

IsNetworkAlive

shell32.dll

SHFileOperationW, ShellExecuteExW, SHGetSpecialFolderPathW

shlwapi.dll

PathRemoveExtensionW, StrStrIW, UrlEscapeW, PathAppendW, PathRemoveFileSpecW, UrlIsW, PathAddBackslashW

user32.dll

GetWindowLongW, DestroyWindow, DefWindowProcW, CallWindowProcW, LoadStringW, GetDlgItem, SetWindowTextW, EndDialog, SendMessageW, ShowWindow, GetTopWindow, CharNextW, SetWindowLongW, MsgWaitForMultipleObjects, FindWindowW, MsgWaitForMultipleObjectsEx, PeekMessageW, IsWindowUnicode, GetMessageW, GetMessageA, TranslateMessage, DispatchMessageW, DispatchMessageA, PostQuitMessage, SetPropW, MessageBoxW, CreateWindowExW, GetClassInfoExW, RegisterClassExW, DrawTextW, InvalidateRect, IsWindow, PtInRect, ReleaseDC, GetDC, GetParent, LoadCursorW, SetCursor, RedrawWindow, EndPaint, BeginPaint, SetWindowPos, GetSysColor, FillRect, GetClientRect, GetGUIThreadInfo, wsprintfW, UnregisterClassA, LoadStringA, MoveWindow, GetWindowRect, SystemParametersInfoW, SetLayeredWindowAttributes, GetActiveWindow, ChildWindowFromPoint, ScreenToClient, GetCursorPos, TrackMouseEvent, KillTimer, SetTimer, DialogBoxParamW, LoadBitmapW

userenv.dll

UnloadUserProfile, CreateEnvironmentBlock, DestroyEnvironmentBlock

version.dll

VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW

wininet.dll

InternetGetConnectedState

DatamngrUI.exe

Data Manager by Bandoo Media (Signed)

Remove DatamngrUI.exe

Version:	5.0.0.6767
MD5:	1f95a689e60d361c3a0ae3e461675896
SHA1:	ac71ccddab49af30762fc4aaed245a7d73c2360c
SHA256:	1f4fdf3414da652111da38469eaa44c1faf2fee16c04188c5c3fbdd9c72198b2

Overview

datamngrui.exe executes as a process with the local user's privileges typically within the context of its parent datamngrcoordinator.exe (Datamngr Coordinator by Bandoo Media). It is set to be start when the PC boots and any user logs into Windows (added to the Run registry key for the all users under the local machine). The file is digitally signed by Bandoo Media which was issued by the Thawte certificate authority (CA). Note, some antivirus scanners have flagged this file, however it is not necessarily considered malware (see below for details).

Details

File name:	datamngrui.exe
Publisher:	Bandoo Media Inc.
Product name:	Data Manager
Typical file path:	C:\Program Files\search results toolbar\datamngr\datamngrui.exe
File version:	5.0.0.6767
Size:	3.19 MB (3,348,480 bytes)
Build date:	4/18/2013 12:48 PM
Certificate
Issued to:	Bandoo Media
Authority (CA):	Thawte
Effective date:	Tuesday, September 18, 2012
Expiration date:	Sunday, November 2, 2014
Digital DNA
File packed:	No
.NET CLR:	No

More details

Behaviors

Startup files (all users) run

Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'DATAMNGR' → C:\Program Files2\SEARCH~1\Datamngr\DATAMN~2.EXE

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.09011135%	0.028634%
Kernel CPU:	0.00832354%	0.013761%
User CPU:	0.08178781%	0.014873%
Kernel CPU time:	468,003 ms/min	100,923,805ms/min
Context switches:	2/sec	284/sec
Memory
Private memory:	2.44 MB	21.59 MB
Private (maximum):	7.82 MB
Private (minimum):	7.43 MB
Non-paged memory:	2.44 MB	21.59 MB
Virtual memory:	81.01 MB	140.96 MB
Virtual memory (peak):	81.01 MB	169.69 MB
Working set:	7.42 MB	18.61 MB
Working set (peak):	9.22 MB	37.95 MB
Resource allocations
Threads:	5	12
Handles:	121	600
GUI GDI count:	9	103
GUI GDI peak:	10	142
GUI USER count:	7	49
GUI USER peak:	8	71

Process properties

Integrety level:	Medium
Platform:	64-bit
Command line:	"C:\Program Files\search results toolbar\datamngr\datamngrui.exe"
Owner:	User
Parent process:	datamngrcoordinator.exe (Datamngr Coordinator by Bandoo Media)

Distribution by Windows OS

OS version	distribution
Windows 7 Ultimate	35.48%
Windows 8 Pro	16.13%
Microsoft Windows XP	12.90%
Windows 7 Home Premium	6.45%
Windows 7 Professional	6.45%
Windows 8 Single Language	6.45%
Windows 8	6.45%
Windows 8.1 Single Language	3.23%
Windows 8 Enterprise	3.23%
Windows Seven Black Edition	3.23%

Distribution by country

United States installs about 10.34% of Data Manager.

Distribution by PC manufacturer

PC Manufacturer	distribution
Acer	22.86%
Dell	22.86%
ASUS	17.14%
Hewlett-Packard	11.43%
Toshiba	11.43%
Sony	5.71%
American Megatrends	5.71%
GIGABYTE	2.86%

Remove Adware and Spyware Programs, FREE Download!