Should I block it?

60%

60% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

5.0.0.8109	25.00%
5.0.0.7308	25.00%
5.0.0.6907	25.00%
5.0.0.6272	25.00%

Relationships

Child process

datamngrui.exe (Data Manager by Koyote-Lab Inc.)

Related files

PE file structure

Show functions

Import table

advapi32.dll

CloseServiceHandle, GetLengthSid, IsValidSid, CopySid, GetSidSubAuthority, InitializeSid, GetSidLengthRequired, GetUserNameW, RegSetValueExW, RegDeleteValueW, CreateProcessAsUserW, SetTokenInformation, SaferCloseLevel, SaferComputeTokenFromLevel, SaferCreateLevel, GetSidSubAuthorityCount, GetTokenInformation, ConvertSidToStringSidW, LookupAccountNameW, RegDeleteKeyW, RegQueryInfoKeyW, RegEnumKeyExW, GetSecurityInfo, GetAce, RegEnumValueW, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, ReportEventW, RegisterServiceCtrlHandlerW, SetServiceStatus, DeregisterEventSource, StartServiceCtrlDispatcherW, RegisterEventSourceW, GetSecurityDescriptorDacl, ControlService, CheckTokenMembership, BuildExplicitAccessWithNameW, FreeSid, SetEntriesInAclW, AllocateAndInitializeSid, ChangeServiceConfigW, ImpersonateLoggedOnUser, QueryServiceStatus, DuplicateTokenEx, StartServiceW, ChangeServiceConfig2W, QueryServiceObjectSecurity, AdjustTokenPrivileges, RevertToSelf, LookupPrivilegeValueW, InitializeAcl, AddAce, SetSecurityInfo, GetAclInformation, CreateServiceW, RegCreateKeyExW, OpenProcessToken, DeleteService, OpenSCManagerW, SetServiceObjectSecurity, OpenServiceW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, GetSecurityDescriptorSacl, ConvertStringSecurityDescriptorToSecurityDescriptorW

dbghelp.dll

StackWalk, SymGetModuleBase, UnDecorateSymbolName, SymGetSymFromAddr64, SymGetLineFromAddr, SymInitialize, SymCleanup, SymFunctionTableAccess, SymSetOptions

kernel32.dll

DllMain

ole32.dll

CLSIDFromProgID, CoUninitialize, CoCreateInstance, CoCreateGuid, CoTaskMemFree, StringFromIID, CoInitialize, StringFromCLSID, CLSIDFromString

psapi.dll

GetProcessMemoryInfo

rpcrt4.dll

RpcStringFreeW, UuidToStringW

sensapi.dll

IsNetworkAlive

shell32.dll

SHGetSpecialFolderPathW, SHGetFolderPathW, SHFileOperationW, ShellExecuteExW

shlwapi.dll

PathAppendW, PathFindFileNameW, PathFileExistsW, StrStrIW, UrlEscapeW

user32.dll

GetGUIThreadInfo, wsprintfW

userenv.dll

UnloadUserProfile, CreateEnvironmentBlock, DestroyEnvironmentBlock

version.dll

GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

wininet.dll

InternetGetConnectedState

wtsapi32.dll

WTSQueryUserToken, WTSFreeMemory, WTSQuerySessionInformationW

DatamngrCoordinator.exe

Datamngr Coordinator by Koyote-Lab Inc. (Signed)

Remove DatamngrCoordinator.exe

Version:	5.0.0.6907
MD5:	0ecd5a06487a666981a7d816826f3b0e
SHA1:	0a7b9fa5e7db1a3a4548cdb6919d9467378c9f60
SHA256:	a4cc456c5af5eda33a3a6ffa70cb8ffbe743f89e1dde6b409912e91d5475e9cf

Overview

datamngrcoordinator.exe runs as a service under the name DatamngrCoordinator (DatamngrCoordinator) with extensive SYSTEM privileges (full administrator access). This is typically installed with the program Settings Alerter published by Koyote-Lab Inc and is most likely removed by most users once installed (71% removed). The file is digitally signed by Koyote-Lab Inc. which was issued by the Thawte certificate authority (CA).

Details

File name:	datamngrcoordinator.exe
Publisher:	Koyote-Lab Inc.
Product name:	Datamngr Coordinator
Typical file path:	C:\Program Files\settings alerter\datamngr\datamngrcoordinator.exe
File version:	5.0.0.6907
Size:	2.88 MB (3,019,824 bytes)
Build date:	4/22/2013 11:43 PM
Certificate
Issued to:	Koyote-Lab Inc.
Authority (CA):	Thawte
Effective date:	Wednesday, February 22, 2012
Expiration date:	Friday, February 21, 2014
Digital DNA
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

Settings Alerter

Koyote-Lab Inc

71% remove

Settings Alerter is a web browser toolbar and extension that modifies the browsers search and home pages as well as delivers contextual based advertising. This toolbar currently supports Internet Explorer, Firefox and Chrome. In order to provide search advertising revenue, the software is designed not only to modify the search provider but to protect it so that it remains the default browser search engine. It is typically installed via...

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

DatamngrCoordinator
'DatamngrCoordinator' (Datamngr Coordinator)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00041674%	0.028634%
Kernel CPU:	0.00037278%	0.013761%
User CPU:	0.00004397%	0.014873%
Kernel CPU time:	12,422 ms/min	100,923,805ms/min
CPU cycles:	993,347/sec	17,470,203/sec
Memory
Private memory:	4.95 MB	21.59 MB
Private (maximum):	10.02 MB
Private (minimum):	7.54 MB
Non-paged memory:	4.95 MB	21.59 MB
Virtual memory:	188.91 MB	140.96 MB
Virtual memory (peak):	385.4 MB	169.69 MB
Working set:	7.79 MB	18.61 MB
Working set (peak):	10.54 MB	37.95 MB
Page faults:	397,794/min	2,039/min
I/O
I/O read transfer:	6.27 KB/sec	1.02 MB/min
I/O read operations:	204/sec	343/min
I/O write transfer:	24.07 KB/sec	274.99 KB/min
I/O write operations:	107/sec	227/min
I/O other transfer:	86 Bytes/sec	448.09 KB/min
I/O other operations:	131/sec	1,671/min
Resource allocations
Threads:	12	12
Handles:	237	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\settings alerter\datamngr\datamngrcoordinator.exe"
Owner:	SYSTEM
Windows Service
Service name:	DatamngrCoordinator
Display name:	DatamngrCoordinator
Description:	“Coordinates Datamngr modules functionality”
Type:	Win32OwnProcess, InteractiveProcess
Parent process:	services.exe (by Microsoft)

Threads