What is DatamngrCoordinator.exe?

DatamngrCoordinator.exe is part of Datamngr Coordinator and developed by Torch Media Inc according to the DatamngrCoordinator.exe version information.

DatamngrCoordinator.exe's description is "Datamngr Coordinator"

DatamngrCoordinator.exe is digitally signed by Torch Media Inc..

DatamngrCoordinator.exe is usually located in the 'C:\Program Files (x86)\Movies App\Datamngr\' folder.

Some of the anti-virus scanners at VirusTotal detected DatamngrCoordinator.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

VirusTotal report

25 of the 66 anti-virus programs at VirusTotal detected the DatamngrCoordinator.exe file. That's a 38% detection rate.

Scanner	Detection Name
AhnLab-V3	PUP/Win32.SearchSuite.C509487
ALYac	Adware.SearchSuite
Bkav	W32.HfsAdware.F59A
Comodo	Malware@#nu08visqey71
Cyren	W32/S-6d35679c!Eldorado
DrWeb	Adware.Bandoo.246
Endgame	malicious (high confidence)
ESET-NOD32	a variant of Win32/Toolbar.SearchSuite.Q potentially unwanted
F-Prot	W32/S-6d35679c!Eldorado
Fortinet	Riskware/SearchSuite
GData	Win32.Application.Searchsuite.C
Ikarus	PUA.SafetyNut
Invincea	heuristic
Jiangmin	WebToolbar.SearchSuite.c
Kaspersky	not-a-virus:HEUR:WebToolbar.Win32.SearchSuite.gen
McAfee	SearchSuite
McAfee-GW-Edition	SearchSuite
Microsoft	PUA:Win32/Bandoo
NANO-Antivirus	Riskware.Win32.SearchSuite.ejmxqs
Panda	PUP/SearchSuite
Rising	Malware.Heuristic!ET (CLOUD)
SentinelOne	static engine - malicious
SUPERAntiSpyware	PUP.SearchSuite/Variant
Yandex	PUA.Toolbar.SearchSuite!
ZoneAlarm	not-a-virus:HEUR:WebToolbar.Win32.SearchSuite.gen

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "file_exists": [
        "C:\\ProgramData\\Datamngr"
    ],
    "regkey_opened": [
        "HKEY_LOCAL_MACHINE\\Software\\Datamngr\\General"
    ],
    "directory_created": [
        "C:\\ProgramData\\Datamngr"
    ],
    "regkey_read": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Datamngr\\General\\srn0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
    ]
}

Generic

[
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\9864e0e0029fd738f00bb853ab7f7ee0fb3ebe0d06a4f509605685e2df23341a.bin",
        "process_name": "9864e0e0029fd738f00bb853ab7f7ee0fb3ebe0d06a4f509605685e2df23341a.bin",
        "pid": 2816,
        "summary": {
            "file_exists": [
                "C:\\ProgramData\\Datamngr"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\Software\\Datamngr\\General"
            ],
            "directory_created": [
                "C:\\ProgramData\\Datamngr"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Datamngr\\General\\srn0",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ]
        },
        "first_seen": 1601067187.578125,
        "ppid": 2732
    },
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1601067187.3125,
        "ppid": 376
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "This executable has a PDB path",
        "severity": 1,
        "marks": [
            {
                "category": "pdb_path",
                "ioc": "E:\\Work\\SearchSuite\\G13_Release\\SearchSuite\\Client\\Kipod\\Bin\\Release\\Coordinator.pdb",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "has_pdb"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "One or more processes crashed",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "9\n8\n6\n4\ne\n0\ne\n0\n0\n2\n9\nf\nd\n7\n3\n8\nf\n0\n0\nb\nb\n8\n5\n3\na\nb\n7\nf\n7\ne\ne\n0\nf\nb\n3\ne\nb\ne\n0\nd\n0\n6\na\n4\nf\n5\n0\n9\n6\n0\n5\n6\n8\n5\ne\n2\nd\nf\n2\n3\n3\n4\n1\na\n+\n0\nx\n1\nd\n2\nf\na\n \n@\n \n0\nx\n3\n0\nd\n2\nf\na\n\n\n9\n8\n6\n4\ne\n0\ne\n0\n0\n2\n9\nf\nd\n7\n3\n8\nf\n0\n0\nb\nb\n8\n5\n3\na\nb\n7\nf\n7\ne\ne\n0\nf\nb\n3\ne\nb\ne\n0\nd\n0\n6\na\n4\nf\n5\n0\n9\n6\n0\n5\n6\n8\n5\ne\n2\nd\nf\n2\n3\n3\n4\n1\na\n+\n0\nx\n6\n5\n9\n6\n \n@\n \n0\nx\n2\nf\n6\n5\n9\n6\n\n\n9\n8\n6\n4\ne\n0\ne\n0\n0\n2\n9\nf\nd\n7\n3\n8\nf\n0\n0\nb\nb\n8\n5\n3\na\nb\n7\nf\n7\ne\ne\n0\nf\nb\n3\ne\nb\ne\n0\nd\n0\n6\na\n4\nf\n5\n0\n9\n6\n0\n5\n6\n8\n5\ne\n2\nd\nf\n2\n3\n3\n4\n1\na\n+\n0\nx\n7\n1\n0\nc\n \n@\n \n0\nx\n2\nf\n7\n1\n0\nc\n\n\n9\n8\n6\n4\ne\n0\ne\n0\n0\n2\n9\nf\nd\n7\n3\n8\nf\n0\n0\nb\nb\n8\n5\n3\na\nb\n7\nf\n7\ne\ne\n0\nf\nb\n3\ne\nb\ne\n0\nd\n0\n6\na\n4\nf\n5\n0\n9\n6\n0\n5\n6\n8\n5\ne\n2\nd\nf\n2\n3\n3\n4\n1\na\n+\n0\nx\n7\n3\n0\n1\n \n@\n \n0\nx\n2\nf\n7\n3\n0\n1\n\n\n9\n8\n6\n4\ne\n0\ne\n0\n0\n2\n9\nf\nd\n7\n3\n8\nf\n0\n0\nb\nb\n8\n5\n3\na\nb\n7\nf\n7\ne\ne\n0\nf\nb\n3\ne\nb\ne\n0\nd\n0\n6\na\n4\nf\n5\n0\n9\n6\n0\n5\n6\n8\n5\ne\n2\nd\nf\n2\n3\n3\n4\n1\na\n+\n0\nx\n7\nb\n7\nf\n \n@\n \n0\nx\n2\nf\n7\nb\n7\nf\n\n\n9\n8\n6\n4\ne\n0\ne\n0\n0\n2\n9\nf\nd\n7\n3\n8\nf\n0\n0\nb\nb\n8\n5\n3\na\nb\n7\nf\n7\ne\ne\n0\nf\nb\n3\ne\nb\ne\n0\nd\n0\n6\na\n4\nf\n5\n0\n9\n6\n0\n5\n6\n8\n5\ne\n2\nd\nf\n2\n3\n3\n4\n1\na\n+\n0\nx\n1\n4\n7\na\nc\n1\n \n@\n \n0\nx\n4\n3\n7\na\nc\n1\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
                        "registers": {
                            "esp": 16512256,
                            "edi": 0,
                            "eax": 16512256,
                            "ebp": 16512336,
                            "edx": 0,
                            "ebx": 2130567168,
                            "esi": 16512592,
                            "ecx": 1
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc20a001c",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1601067187.656125,
                    "tid": 2420,
                    "flags": {}
                },
                "pid": 2816,
                "type": "call",
                "cid": 31
            }
        ],
        "references": [],
        "name": "raises_exception"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 546,
            "time": 3.0791730880737305,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 2374,
            "time": 3.016216993331909,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 2702,
            "time": 1.042057991027832,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 3030,
            "time": 3.0251710414886475,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 3358,
            "time": 1.6206300258636475,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 3686,
            "time": -0.10429883003234863,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 4014,
            "time": 1.579982042312622,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 8490,
            "time": 1.0628950595855713,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 12682,
            "time": 3.1096460819244385,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "a74c25a8987c45606d1807999bff0c4b2b449fbcab71adc297f832a9c797957a",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "d3fe546fbd9d6f56b476aed44b9bb88e566ad816a1b96cae3c35c6937bb8dd7b",
    "irc": [],
    "https_ex": []
}

Screenshots

DatamngrCoordinator.exe removal instructions

The instructions below shows how to remove DatamngrCoordinator.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the DatamngrCoordinator.exe file for removal, restart your computer and scan it again to verify that DatamngrCoordinator.exe has been successfully removed. Here are the removal instructions in more detail:

1. Download and install FreeFixer: http://www.freefixer.com/download.html
2. Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.

   
3. When the scan is finished, locate DatamngrCoordinator.exe in the scan result and tick the checkbox next to the DatamngrCoordinator.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate DatamngrCoordinator.exe in the scan result.

   

   

   C:\Program Files (x86)\Movies App\Datamngr\DatamngrCoordinator.exe

   
4. Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the DatamngrCoordinator.exe file.

   
5. Restart your computer.
6. Start FreeFixer and scan your computer again. If DatamngrCoordinator.exe still remains in the scan result, proceed with the next step. If DatamngrCoordinator.exe is gone from the scan result you're done.
7. If DatamngrCoordinator.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
8. Restart your computer.
9. Start FreeFixer and scan your computer again. Verify that DatamngrCoordinator.exe no longer appear in the scan result.

Other files also named DatamngrCoordinator.exe

DatamngrCoordinator.exe (766 votes)

Error Messages

• Privacy Policy