Should I block it?

98%

Yes, 98% block recommendation.

Possible reasons:

Multiple malware detections

Performance resource utilization

Additional versions

64eb5	3.51%
e202a	7.02%
1b34b	10.53%
af529	1.75%
952ec	1.75%
67873	3.51%
7e109	10.53%
0e4fd	8.77%
26b5c	1.75%
6870e	1.75%
c9eb9	1.75%
332a7	7.02%
6ec14	5.26%
a5584	1.75%
3cda2	3.51%
94ca1	1.75%
62e62	1.75%
40a32	1.75%
2e0f2	3.51%
d4c00	3.51%
b5f86	1.75%
d86f9	3.51%
3ccdd	1.75%
fb2d4	1.75%
87ecf	5.26%
View more
7c3a7	1.75%
10fc7	1.75%

(Note, Bandoo Media publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

explorer.exe (Windows Explorer by Microsoft Corporation)

Related files

PE file structure

Show functions

Import table

advapi32.dll

ConvertSidToStringSidW, IsValidSid, GetTokenInformation, GetLengthSid, InitializeAcl, AddAce, GetSecurityInfo, GetAclInformation, GetAce, DeleteAce, SetSecurityInfo, OpenThreadToken, OpenProcessToken, RegEnumKeyW, ConvertStringSecurityDescriptorToSecurityDescriptorW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegNotifyChangeKeyValue, RegEnumValueW, RegQueryValueExW, RegEnumKeyExW, RegQueryInfoKeyW, RegSetValueExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegOpenKeyExW, RegCloseKey, SetKernelObjectSecurity, LookupAccountNameW, SaferCreateLevel, SaferCloseLevel, SetTokenInformation, CreateProcessAsUserW, GetSidSubAuthorityCount, GetUserNameW, GetSidLengthRequired, InitializeSid, GetSidSubAuthority, CopySid, SaferComputeTokenFromLevel

comctl32.dll

InitCommonControlsEx, _TrackMouseEvent

gdi32.dll

GetTextExtentPoint32W, SetTextColor, DeleteDC, CreateCompatibleBitmap, BitBlt, CreateFontIndirectW, CreateCompatibleDC, GetObjectW, SetBkMode, CreatePatternBrush, CreateSolidBrush, DeleteObject, GetTextMetricsW, SelectObject, GetStockObject

iphlpapi.dll

GetAdaptersInfo

kernel32.dll

DllMain

netapi32.dll

Netbios

ole32.dll

CoTaskMemRealloc, CoCreateInstance, CoTaskMemFree, CoUninitialize, CoInitialize, CLSIDFromString, StringFromGUID2, CoTaskMemAlloc, StringFromIID, CoCreateGuid, CoSetProxyBlanket

sensapi.dll

IsNetworkAlive

shell32.dll

SHGetSpecialFolderPathW, SHFileOperationW, ShellExecuteExW

shlwapi.dll

PathRemoveFileSpecW, UrlIsW, PathAddBackslashW, SHDeleteKeyW, SHCopyKeyW, StrStrIW

user32.dll

PeekMessageW, MsgWaitForMultipleObjectsEx, SetPropW, MessageBoxW, FindWindowW, MsgWaitForMultipleObjects, IsWindowUnicode, GetMessageA, DispatchMessageA, SetCursor, GetSysColor, ReleaseDC, GetDC, EndPaint, BeginPaint, PtInRect, IsWindow, RedrawWindow, SetWindowPos, DrawTextW, GetActiveWindow, SetLayeredWindowAttributes, SystemParametersInfoW, GetClientRect, GetWindowRect, MoveWindow, FillRect, DialogBoxParamW, LoadBitmapW, GetCursorPos, TrackMouseEvent, GetTopWindow, ChildWindowFromPoint, ShowWindow, ScreenToClient, GetMessageW, TranslateMessage, DispatchMessageW, CreateWindowExW, RegisterClassExW, PostQuitMessage, LoadCursorW, GetClassInfoExW, KillTimer, SetTimer, PostMessageW, LoadStringW, GetDlgItem, SetWindowTextW, SendMessageW, EndDialog, GetWindowLongW, SetWindowLongW, CallWindowProcW, DestroyWindow, CharNextW, DefWindowProcW, GetParent, UnregisterClassA, LoadStringA, InvalidateRect, GetGUIThreadInfo

version.dll

GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW

wininet.dll

InternetCloseHandle, InternetReadFile, HttpQueryInfoW, HttpSendRequestW, InternetSetOptionW, HttpOpenRequestW, InternetConnectW, InternetOpenW, InternetGetConnectedState

datamngrUI.exe

By Bandoo Media (Signed)

Remove datamngrUI.exe

MD5:	e202a85bac78281edf80055a07691987
SHA1:	0cf0d72461a5146dbbaeb0c7f589a4b4d97ca26f
SHA256:	535feefa048e901d3a733ad6ea87d26a29c7ff34222cf26ff90cb304b494d679

Warning 3 antivirus scanners has detected malware.

What is datamngrUI.exe?

Searchqu Toolbar is a browser add-on which adds various shortcuts and other buttons to your Internet browsers such as Internet Explorer, FireFox, Google Chrome. Some PC users may find such shortcuts useful but Searchqu Toolbar can be categorized as an unwanted program because it's deceptive ways of installation and not full uninstall procedures. When installed on your PC this toolbar by default will change your homepage to searchnu.com.

About datamngrUI.exe (from Bandoo Media)

“Windows Searchqu Toolbar is an Internet browser toolbar that offers helpful search suggestions as the user types keywords into the search box. Additionally, it catches misspelled words and suggests a ”

Details

File name:	datamngrUI.exe
Typical file path:	C:\Program Files\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
Size:	1.8 MB (1,890,744 bytes)
Certificate
Issued to:	Bandoo Media
Authority (CA):	Thawte
Expiration date:	Friday, November 2, 2012
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

Searchqu Toolbar

Bandoo Media Inc

83% remove

The Searchqu Toolbar is a Bandoo powered toolbar (by Bandoo Media Inc) for Intenet Explorer and Firefox. Searchqu collects and stores information about your web browsing habits and sends this information to Conduit so they can suggest services or provide advertising via the toolbar. The Bandoo Searchqu Toolbar will attempt to change your home page and search provider if you are not careful during installation and provides a search box a...

Windows Searchqu Toolbar

Bandoo Media Inc

88% remove

Windows Searchqu Toolbar is an ad-supported program installed into Internet Explorer, Firefox and Chrome. The programs collects and stores information about web browsing habits and sends this information to its remote servers in order to provide injected advertising in search results and various other places. It will also modify the browser's home page and search provider. It displays various pop-up advertisements and tracks and reports...

Behaviors

Startup files (all users) run

Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'DATAMNGR' → C:\Program Files1\WIA6EB~1\Datamngr\DATAMN~1.EXE

Network connections

[TCP] NYC-207-232-22-200.netvision.net.il (207.232.22.200:80)

Malware detections

Based on 40+ industry antivirus scanners, 3 of them detected the following malware.

Antivirus engine	Engine version	Detection
ESET NOD32	7.7994	a variant of Win32/Toolbar.SearchSuite.A
K7 AntiVirus	9.160.8201	Trojan
Trend Micro HouseCall	9.700.0.1001	TROJ_GEN.F47V0829

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00866624%	0.028634%
Kernel CPU:	0.00733194%	0.013761%
User CPU:	0.00133430%	0.014873%
Kernel CPU time:	195,343 ms/min	100,923,805ms/min
Memory
Private memory:	3.53 MB	21.59 MB
Private (maximum):	6.26 MB
Private (minimum):	4.65 MB
Non-paged memory:	3.53 MB	21.59 MB
Virtual memory:	84.12 MB	140.96 MB
Virtual memory (peak):	86.18 MB	169.69 MB
Working set:	5.28 MB	18.61 MB
Working set (peak):	9.29 MB	37.95 MB
Resource allocations
Threads:	14	12
Handles:	249	600
GUI GDI count:	13	103
GUI GDI peak:	15	142
GUI USER count:	12	49
GUI USER peak:	14	71

Process properties

Integrety level:	High
Platform:	32-bit
Command line:	"C:\Program Files\searchqu toolbar\datamngr\datamngrui.exe"
Owner:	User
Parent process:	explorer.exe (Windows Explorer by Microsoft Corporation)

Threads