Should I block it?

60%

60% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

2.2.1.5	5.56%
2.2.1.3	50.00%
2.2.1.3	5.56%
2.2.1.3	38.89%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

OpenSCManagerA, GetSecurityDescriptorSacl, ConvertStringSecurityDescriptorToSecurityDescriptorA, FreeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, SetEntriesInAclA, AllocateAndInitializeSid, RegSetValueExA, RegCloseKey, RegCreateKeyA, StartServiceA, LookupPrivilegeValueA, RegisterEventSourceA, GetNamedSecurityInfoA, LookupAccountSidA, LookupAccountNameA, RegOpenKeyA, RegQueryInfoKeyA, RegEnumKeyExA, RegSetValueA, CreateServiceA, QueryServiceStatus, AdjustTokenPrivileges, OpenThreadToken, StartServiceCtrlDispatcherA, RegDeleteKeyA, QueryServiceStatusEx, ChangeServiceConfigW, DeleteService, CreateServiceW, ChangeServiceConfig2A, RegCreateKeyExA, RegDeleteValueA, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetLengthSid, CopySid, SetServiceStatus, RegisterServiceCtrlHandlerW, RegisterEventSourceW, ReportEventA, DeregisterEventSource, OpenServiceW, GetSecurityDescriptorLength, ConvertStringSecurityDescriptorToSecurityDescriptorW, ControlService, ChangeServiceConfigA, OpenServiceA, CloseServiceHandle, QueryServiceConfigW, OpenProcessToken, GetTokenInformation, RegEnumKeyA, ConvertStringSidToSidA, LookupAccountSidW, CryptAcquireContextA, CryptCreateHash, CryptHashData, CryptGetHashParam, CryptDestroyHash, CryptReleaseContext, RegQueryValueExA, RegOpenKeyExA, SetNamedSecurityInfoA

crypt32.dll

CertFreeCertificateChain, CertGetCertificateChain, CertCreateCertificateContext, CertNameToStrA, CertEnumCRLsInStore, CertEnumCertificatesInStore, CertOpenStore, CertCloseStore, CertOpenSystemStoreA, CertFreeCertificateContext

gdi32.dll

CreateCompatibleDC, GetDeviceCaps, CreateCompatibleBitmap, SelectObject, GetObjectA, BitBlt, GetBitmapBits, DeleteObject, DeleteDC, CreateDCA

kernel32.dll

DllMain

ole32.dll

CoInitializeSecurity, CoUninitialize, CoCreateGuid, StringFromGUID2, CoCreateInstance, ProgIDFromCLSID, CoTaskMemFree, CoRegisterClassObject, CoRevokeClassObject, CoInitialize, CoCreateFreeThreadedMarshaler, CoInitializeEx

psapi.dll

GetModuleFileNameExW, GetProcessImageFileNameW

secur32.dll

GetUserNameExW, GetUserNameExA

user32.dll

CharNextA, PostThreadMessageA, MessageBoxA, GetDesktopWindow, GetUserObjectInformationW, MsgWaitForMultipleObjectsEx, DefWindowProcA, RegisterClassA, UnregisterClassA, DestroyWindow, CreateWindowExA, PostMessageA, GetMessageA, TranslateMessage, KillTimer, SetTimer, SetThreadDesktop, GetProcessWindowStation, SetProcessWindowStation, CreateDesktopA, PeekMessageA, DispatchMessageA, LoadStringA

version.dll

GetFileVersionInfoSizeW, GetFileVersionInfoW

ws2_32.dll

WSASocketA, WSAIoctl, WSAEventSelect, WSCGetProviderPath, WSCEnumProtocols

sndappv2.exe

sndappv2.exe by Sendori (Signed)

Remove sndappv2.exe

Version:	2.2.1.5
MD5:	1558e18e96cd8dd1f6c87a38463e0f56
SHA1:	ef436e99fdb47388e9ca6e4efe3a501143692bd9
SHA256:	0ef46971acd790efd83f7bea3221aff889c6589ed707d5d1c63882937c50f5fc

What is sndappv2.exe?

sndappv2.exe is the Windows service (named sndappv2) part of Sendori that runs when Windows starts regardless if Senori is active. Sendori.com provides a in the domain space. Rather than parking domain names on a page with search listings the company’s service partners domains with advertisers in specific sectors. Sendori apparently has applied to patent their technology. Advertisers looking for traffic on a given topic can buy direct navigation traffic from Sendori’s domain name clients.

About sndappv2.exe (from Sendori)

“Sendori is a cloud-based web service that helps users navigate faster to their favorite websites. It is also a web filtering service that protects users from accessing malicious and phishing sites as ”

Details

File name:	sndappv2.exe
Publisher:	Sendori
Product name:	sndappv2.exe
Typical file path:	C:\Program Files\sendori\sndappv2.exe
File version:	2.2.1.5
Size:	3.46 MB (3,623,200 bytes)
Certificate
Issued to:	Sendori
Authority (CA):	VeriSign
Effective date:	Sunday, March 11, 2012
Expiration date:	Thursday, April 4, 2013
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

Sendori

Sendori, Inc.

79% remove

Sendori is a web browser plugin and layered service provider filter that is typically installed through a bundled installation. The plugin is designed to intercept Internet web traffic and provided modified results to various requests. Such results include DNS error redirection to sponsored affiliate advertisers. Sendori provides DNS redirection where advertisers can purchase navigation traffic from Sendori's domain name clients. When a...

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'sndappv2'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00025897%	0.028634%
Kernel CPU:	0.00006796%	0.013761%
User CPU:	0.00019101%	0.014873%
Kernel CPU time:	901,249 ms/min	100,923,805ms/min
CPU cycles:	17,078,130/sec	17,470,203/sec
Memory
Private memory:	18.18 MB	21.59 MB
Private (maximum):	15.86 MB
Private (minimum):	3.22 MB
Non-paged memory:	18.18 MB	21.59 MB
Virtual memory:	170.76 MB	140.96 MB
Virtual memory (peak):	173.46 MB	169.69 MB
Working set:	7.2 MB	18.61 MB
Working set (peak):	16.01 MB	37.95 MB
Page faults:	88,631,655/min	2,039/min
I/O
I/O read transfer:	846 Bytes/sec	1.02 MB/min
I/O read operations:	39/sec	343/min
I/O write transfer:	16 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	341 Bytes/sec	448.09 KB/min
I/O other operations:	4/sec	1,671/min
Resource allocations
Threads:	151	12
Handles:	691	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\sendori\sndappv2.exe"
Owner:	SYSTEM
Windows Service
Service name:	sndappv2
Description:	“Sets and maintains sndappv2 LSP protection on this computer.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads