Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	1.83%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.06%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.13%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.06%
6.2.9200.16384 (win8_rtm.120725-1247)	1.26%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.13%
6.1.7600.16385 (win7_rtm.090713-1255)	39.82%
6.1.7600.16385 (win7_rtm.090713-1255)	28.76%
6.1.7600.16385 (win7_rtm.090713-1255)	0.06%
6.0.6000.16386 (vista_rtm.061101-2205)	1.33%
6.0.6000.16386 (vista_rtm.061101-2205)	0.44%
6.0.6000.16386 (vista_rtm.061101-2205)	8.22%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.13%
5.1.2600.5512 (xpsp.080413-0852)	14.29%
5.1.2600.5512 (xpsp.080413-0852)	0.06%
5.1.2600.3311 (xpsp.080211-1047)	0.13%
5.1.2600.3300 (xpsp.080125-0707)	0.06%
5.1.2600.3244 (xpsp.071030-0319)	0.06%
5.1.2600.2743 (xpsp_sp2_gdr.050819-1525)	0.70%
5.1.2600.2743 (xpsp.050819-1528)	0.57%
5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)	1.90%

Relationships

PE file structure

Show functions

Import table

advapi32.dll

RegCloseKey, RegDeleteKeyW, RegQueryInfoKeyW, RegQueryValueExW, RegCreateKeyExW, RegOpenKeyExW, RegSetValueExW, AdjustTokenPrivileges, OpenProcessToken, RegEnumKeyExW, GetTokenInformation, EqualSid, RegDeleteValueW, OpenThreadToken, SetServiceStatus, RegisterServiceCtrlHandlerExW, CheckTokenMembership, ConvertStringSidToSidW, RegNotifyChangeKeyValue, DuplicateTokenEx, CloseServiceHandle, QueryServiceStatus, OpenServiceW, OpenSCManagerW, RegGetValueW, RegEnumValueW, UnlockServiceDatabase, LockServiceDatabase, DuplicateToken, FreeSid, AllocateAndInitializeSid, InitiateSystemShutdownExW, WmiNotificationRegistrationW

api-ms-win-core-console-l1-1-0.dll

GetConsoleMode, GetConsoleCP, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA

api-ms-win-core-debug-l1-1-0.dll

OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0.dll

SetUnhandledExceptionFilter, GetLastError, UnhandledExceptionFilter, SetLastError, RaiseException

api-ms-win-core-file-l1-1-0.dll

FlushFileBuffers, SetFilePointer, WriteFile, CreateFileA, CreateFileW, GetFileType

api-ms-win-core-handle-l1-1-0.dll

CloseHandle, DuplicateHandle

api-ms-win-core-heap-l1-1-0.dll

HeapCreate, HeapSize, GetProcessHeap, HeapDestroy, HeapFree, HeapAlloc, HeapReAlloc

api-ms-win-core-interlocked-l1-1-0.dll

InterlockedExchange, InterlockedCompareExchange, InterlockedIncrement, InterlockedDecrement

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl

api-ms-win-core-libraryloader-l1-1-0.dll

LockResource, GetModuleFileNameA, GetModuleHandleA, GetModuleFileNameW, LoadLibraryExW, LoadResource, SizeofResource, LoadLibraryExA, FreeLibrary, GetModuleHandleW, GetProcAddress, DisableThreadLibraryCalls

api-ms-win-core-localization-l1-1-0.dll

GetSystemDefaultLCID, GetOEMCP, GetACP, GetCPInfo, LCMapStringW

api-ms-win-core-memory-l1-1-0.dll

VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery

api-ms-win-core-misc-l1-1-0.dll

LocalAlloc, SetHandleCount, lstrlenW, lstrcmpiW, lstrcpynW, lstrlenA, Sleep, LocalFree, lstrcmpW, LCMapStringA

api-ms-win-core-processenvironment-l1-1-0.dll

FreeEnvironmentStringsA, ExpandEnvironmentStringsW, SetStdHandle, GetEnvironmentStringsW, GetCommandLineA, GetStdHandle, GetEnvironmentStrings, FreeEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessW, TerminateProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, OpenProcessToken, GetCurrentProcess, OpenThreadToken, TlsFree, ExitProcess, TlsGetValue, TlsAlloc, TlsSetValue

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0.dll

WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, CompareStringW

api-ms-win-core-synch-l1-1-0.dll

TryEnterCriticalSection, ResetEvent, DeleteCriticalSection, SetEvent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, OpenEventW, WaitForSingleObject, CreateEventW

api-ms-win-core-sysinfo-l1-1-0.dll

GetVersionExA, GetTickCount, GetSystemTimeAsFileTime, GetSystemInfo, GetVersionExW

kernel32.dll

UnregisterWaitEx, DelayLoadFailureHook, FindResourceW, RegNotifyChangeKeyValue, RegEnumValueW, RegDeleteKeyExW, RegGetValueW, GetStartupInfoA, QueueUserWorkItem, GetPrivateProfileStringW, RegCloseKey, LoadLibraryW, RegQueryInfoKeyW, RegQueryValueExW, RegCreateKeyExW, RegOpenKeyExW, RegSetValueExW, RegEnumKeyExW, RegDeleteValueW, LeaveCriticalSection, DisableThreadLibraryCalls, GetVersionExW, VirtualProtect, VirtualAlloc, GetSystemInfo, VirtualQuery, lstrlenW, RaiseException, InitializeCriticalSection, DeleteCriticalSection, InterlockedIncrement, InterlockedDecrement, HeapFree, HeapAlloc, HeapReAlloc, lstrcmpiW, MultiByteToWideChar, WideCharToMultiByte, GetCurrentThreadId, GetLastError, CloseHandle, GetCurrentProcess, WaitForSingleObject, HeapDestroy, lstrcpynW, FreeLibrary, lstrlenA, SizeofResource, LoadResource, LoadLibraryExW, CreateFileW, GetModuleFileNameW, GetModuleHandleW, GetCurrentThread, CreateEventW, OpenEventW, OutputDebugStringA, CreateThread, SetEvent, GetProcAddress, InterlockedCompareExchange, LoadLibraryA, Sleep, LocalFree, lstrcmpW, InterlockedExchange, DuplicateHandle, TryEnterCriticalSection, ResetEvent, HeapCreate, GetCommandLineA, GetVersionExA, RtlUnwind, GetModuleHandleA, ExitProcess, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, SetHandleCount, GetStdHandle, GetFileType, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, EnterCriticalSection, GetEnvironmentStringsW, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCPInfo, GetACP, GetOEMCP, HeapSize, WriteFile, SetFilePointer, GetConsoleCP, GetConsoleMode, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, FlushFileBuffers, CompareStringW, LocalAlloc, GetSystemDefaultLCID, DeviceIoControl, LockResource, GetProcessHeap, CreateProcessW, ExpandEnvironmentStringsW, FreeEnvironmentStringsW

kernelbase.dll

GetStringTypeA, GetLocaleInfoA

nsi.dll

NsiGetParameter

ntdll.dll

RtlRegisterWait, NtClose, RtlOpenCurrentUser, RtlUnwind, RtlDeregisterWaitEx, RtlNtStatusToDosError, NtOpenFile, RtlGetNtProductType, RtlInitUnicodeString

ole32.dll

StringFromGUID2, CoTaskMemFree, CoTaskMemAlloc, CoRevokeClassObject, CoRegisterClassObject, CoTaskMemRealloc, CoImpersonateClient, CoRevertToSelf, CLSIDFromString, CoSetProxyBlanket, IIDFromString, CoInitializeEx, CoUninitialize, CoCreateInstance

rasapi32.dll

DwCloneEntry, RasSetAutodialAddressW, RasValidateEntryNameW, RasHangUpW, RasGetEntryPropertiesW, RasRenameEntryW, RasEnumConnectionsW, DwEnumEntryDetails, RasGetConnectStatusW, RasDeleteEntryW

user32.dll

MessageBoxW, LoadImageW, DestroyIcon, UnregisterDeviceNotification, CharNextW, PeekMessageW, DispatchMessageW, MsgWaitForMultipleObjects, RegisterDeviceNotificationW

winnsi.dll

NsiRpcRegisterChangeNotification, NsiRpcDeregisterChangeNotification, NsiDisconnectFromServer, NsiConnectToServer

Export table

DllRegisterServer

DllUnregisterServer

HrGetPnpDeviceStatus

HrLanConnectionNameFromGuidOrPath

HrPnpInstanceIdFromGuid

HrQueryLanMediaState

NetManDiagFromCommandArgs

ProcessQueue

ServiceMain

SvchostPushServiceGlobals

netman.dll

Network Connections Manager by Microsoft

Remove netman.dll

Version:	5.1.2600.3244 (xpsp.071030-0319)
MD5:	98f2cde9c8b2abb12d237cfd7191a895
SHA1:	aa47c84956ffa3f5a8f64a00bb78395df5b3acc7

This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

netman.dll is loaded as dynamic link library that runs in the context of a process. This will ad a run once registry key upon installation for all user profiles of the PC that will cause the file to be executed the first time any user logs in. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). This version is installed on Windows XP.

Details

File name:	netman.dll
Publisher:	Microsoft Corporation
Product name:	Network Connections Manager
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\netman.dll
Original name:	netman.dll.mui
File version:	5.1.2600.3244 (xpsp.071030-0319)
Product version:	5.1.2600.3244
Size:	193.5 KB (198,144 bytes)
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Hosted services

Runs as a shared service under the Windows svcHost

Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'
Shared name is 'Netman'

Startup files (all users) run once

Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'

'NCInstallQueue' → rundll32 netman.dll,ProcessQueue

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	57.50%
Windows 7 Ultimate	26.50%
Windows 7 Professional	10.00%
Windows 7 Home Basic	2.50%
Windows 7 Starter	1.50%
Windows Seven Black Edition	0.50%
Windows 7 Enterprise	0.50%
Windows Se7en Titan	0.50%
Windows Vista Business	0.50%

Distribution by country

United States installs about 43.65% of Network Connections Manager.

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	25.64%
ASUS	16.12%
Hewlett-Packard	15.75%
Acer	13.55%
Toshiba	11.72%
Lenovo	4.40%
Sony	2.93%
Samsung	2.20%
Intel	2.20%
GIGABYTE	1.83%
Alienware	0.73%
Medion	0.73%
Gateway	0.73%
MSI	0.73%
NEC	0.73%

Remove Adware and Spyware Programs, FREE Download!