Should I block it?

60%

60% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

18b74	20.00%
6d35a	20.00%
72ef4	20.00%
b85c1	20.00%
4e89a	20.00%

(Note, iMesh Inc. publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

PE file structure

Show functions

Import table

advapi32.dll

LookupAccountNameW, IsValidSid, ConvertSidToStringSidW, GetTokenInformation, GetLengthSid, InitializeAcl, AddAce, GetSecurityInfo, GetAclInformation, GetAce, DeleteAce, SetSecurityInfo, OpenThreadToken, OpenProcessToken, SetKernelObjectSecurity, RegEnumValueW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegEnumKeyW, RegNotifyChangeKeyValue, RegQueryValueExW, RegEnumKeyExW, RegQueryInfoKeyW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegOpenKeyExW

comctl32.dll

InitCommonControlsEx, _TrackMouseEvent

gdi32.dll

GetTextExtentPoint32W, SetTextColor, DeleteDC, CreateCompatibleBitmap, BitBlt, CreateFontIndirectW, CreateCompatibleDC, GetObjectW, SetBkMode, CreatePatternBrush, CreateSolidBrush, DeleteObject, GetTextMetricsW, SelectObject, GetStockObject

kernel32.dll

DllMain

ole32.dll

CoTaskMemAlloc, CoCreateInstance, CoTaskMemFree, CoUninitialize, CoInitialize, CLSIDFromString, StringFromGUID2, CoTaskMemRealloc

shell32.dll

SHGetSpecialFolderPathW

shlwapi.dll

SHDeleteKeyW, SHCopyKeyW, UrlIsW, PathAddBackslashW, PathRemoveFileSpecW

user32.dll

MessageBoxW, FindWindowW, MsgWaitForMultipleObjects, PostQuitMessage, SetPropW, MsgWaitForMultipleObjectsEx, PeekMessageW, IsWindowUnicode, GetMessageW, GetMessageA, TranslateMessage, DispatchMessageW, DispatchMessageA, SetCursor, CreateWindowExW, RegisterClassExW, GetSysColor, ReleaseDC, GetDC, BeginPaint, PtInRect, LoadCursorW, GetClassInfoExW, IsWindow, GetParent, RedrawWindow, InvalidateRect, SetWindowPos, DrawTextW, GetActiveWindow, GetWindowLongW, SetLayeredWindowAttributes, SystemParametersInfoW, GetClientRect, GetWindowRect, MoveWindow, FillRect, GetCursorPos, TrackMouseEvent, ChildWindowFromPoint, KillTimer, SetTimer, ScreenToClient, DialogBoxParamW, LoadBitmapW, GetTopWindow, ShowWindow, SetWindowLongW, LoadStringW, GetDlgItem, SetWindowTextW, SendMessageW, EndDialog, DefWindowProcW, DestroyWindow, CharNextW, EndPaint, UnregisterClassA, LoadStringA, CallWindowProcW

version.dll

GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW

wininet.dll

InternetCloseHandle, HttpSendRequestW, InternetSetOptionW, HttpOpenRequestW, InternetConnectW, InternetOpenW

datamngrui.exe

By iMesh Inc. (Signed)

Remove datamngrui.exe

MD5:	72ef4aea108963dd77f323947b3cf25d
SHA1:	639f147894b5d3a45def637417c2c1dfb9e07bf1

Overview

datamngrui.exe executes as a process with the local user's privileges. It is set to be start when the PC boots and any user logs into Windows (added to the Run registry key for the all users under the local machine). It is installed with a couple of know programs including MediaBar published by iMesh Inc., iMesh from iMesh Inc. and iMesh by iMesh Inc.. The file is digitally signed by iMesh Inc. which was issued by the Thawte certificate authority (CA).

Details

File name:	datamngrui.exe
Typical file path:	C:\Program Files\imesh applications\mediabar\datamngr\datamngrui.exe
Size:	1.48 MB (1,546,672 bytes)
Certificate
Issued to:	iMesh Inc.
Authority (CA):	Thawte
Digital DNA
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

MediaBar

iMesh Inc.

73% remove

Visicom MediaBar is an ad-supported (users may see additional banner, search, pop-up, pop-under, interstitial and in-text link advertisements) cross web browser plugin for Internet Explorer (BHO) and Firefox/Chrome (plugin) and distributed through various monitization platforms during installation. The browser extension includes various features that will modify the default or custom settings of the browser including the home page, sea...

iMesh

iMesh Inc.

24% remove

iMesh is a media and file sharing client that's available in 9 languages. It uses a proprietary, centralized, P2P network (IM2Net) operating on ports 80, 443 and 1863. iMesh operates the first "RIAA-approved" P2P service, allowing users residing in United States and Canada to download music content of choice for a monthly fee in the form of either a Premium subscription or a "ToGo" subscription. This subscription based approach is advoc...

Wincore MediaBar

iMesh Inc.

77% remove

Wincore MediaBar (Visicom Media Inc) is an ad-supported (users may see additional banner, search, pop-up, pop-under, interstitial and in-text link advertisements) cross web browser plugin for Internet Explorer (BHO) and Firefox/Chrome (plugin) and distributed through various monitization platforms during installation. The browser extension includes various features that will modify the default or custom settings of the browser includin...

Behaviors

Startup files (all users) run

Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'DATAMNGR' → C:\Program Files1\IMESHA~1\Mediabar\Datamngr\DATAMN~1.EXE

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00022686%	0.028634%
Kernel CPU:	0.00006122%	0.013761%
User CPU:	0.00016564%	0.014873%
Kernel CPU time:	2,652,017 ms/min	100,923,805ms/min
Memory
Private memory:	5.3 MB	21.59 MB
Private (maximum):	10.27 MB
Private (minimum):	6.02 MB
Non-paged memory:	5.3 MB	21.59 MB
Virtual memory:	98.42 MB	140.96 MB
Virtual memory (peak):	102.42 MB	169.69 MB
Working set:	7.02 MB	18.61 MB
Working set (peak):	10.28 MB	37.95 MB
Resource allocations
Threads:	6	12
Handles:	168	600
GUI GDI count:	11	103
GUI GDI peak:	14	142
GUI USER count:	7	49
GUI USER peak:	8	71