Should I block it?

60%

60% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

2.2.1.5	5.56%
2.2.1.3	50.00%
2.2.1.3	5.56%
2.2.1.3	38.89%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

OpenSCManagerA, GetSecurityDescriptorSacl, ConvertStringSecurityDescriptorToSecurityDescriptorA, FreeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, SetEntriesInAclA, AllocateAndInitializeSid, RegSetValueExA, RegCloseKey, RegCreateKeyA, StartServiceA, LookupPrivilegeValueA, RegisterEventSourceA, GetNamedSecurityInfoA, LookupAccountSidA, LookupAccountNameA, RegOpenKeyA, RegQueryInfoKeyA, RegEnumKeyExA, RegSetValueA, CreateServiceA, QueryServiceStatus, AdjustTokenPrivileges, OpenThreadToken, StartServiceCtrlDispatcherA, RegDeleteKeyA, QueryServiceStatusEx, ChangeServiceConfigW, DeleteService, CreateServiceW, ChangeServiceConfig2A, RegCreateKeyExA, RegDeleteValueA, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetLengthSid, CopySid, SetServiceStatus, RegisterServiceCtrlHandlerW, RegisterEventSourceW, ReportEventA, DeregisterEventSource, OpenServiceW, GetSecurityDescriptorLength, ConvertStringSecurityDescriptorToSecurityDescriptorW, ControlService, ChangeServiceConfigA, OpenServiceA, CloseServiceHandle, QueryServiceConfigW, OpenProcessToken, GetTokenInformation, RegEnumKeyA, ConvertStringSidToSidA, LookupAccountSidW, CryptAcquireContextA, CryptCreateHash, CryptHashData, CryptGetHashParam, CryptDestroyHash, CryptReleaseContext, RegQueryValueExA, RegOpenKeyExA, SetNamedSecurityInfoA

crypt32.dll

CertFreeCertificateChain, CertGetCertificateChain, CertCreateCertificateContext, CertNameToStrA, CertEnumCRLsInStore, CertEnumCertificatesInStore, CertOpenStore, CertCloseStore, CertOpenSystemStoreA, CertFreeCertificateContext

gdi32.dll

CreateCompatibleDC, GetDeviceCaps, CreateCompatibleBitmap, SelectObject, GetObjectA, BitBlt, GetBitmapBits, DeleteObject, DeleteDC, CreateDCA

kernel32.dll

DllMain

ole32.dll

CoInitializeSecurity, CoUninitialize, CoCreateGuid, StringFromGUID2, CoCreateInstance, ProgIDFromCLSID, CoTaskMemFree, CoRegisterClassObject, CoRevokeClassObject, CoInitialize, CoCreateFreeThreadedMarshaler, CoInitializeEx

psapi.dll

GetModuleFileNameExW, GetProcessImageFileNameW

secur32.dll

GetUserNameExW, GetUserNameExA

user32.dll

CharNextA, PostThreadMessageA, MessageBoxA, GetDesktopWindow, GetUserObjectInformationW, MsgWaitForMultipleObjectsEx, DefWindowProcA, RegisterClassA, UnregisterClassA, DestroyWindow, CreateWindowExA, PostMessageA, GetMessageA, TranslateMessage, KillTimer, SetTimer, SetThreadDesktop, GetProcessWindowStation, SetProcessWindowStation, CreateDesktopA, PeekMessageA, DispatchMessageA, LoadStringA

version.dll

GetFileVersionInfoSizeW, GetFileVersionInfoW

ws2_32.dll

WSASocketA, WSAIoctl, WSAEventSelect, WSCGetProviderPath, WSCEnumProtocols

sndappv2.exe

sndappv2.exe by Sendori (Signed)

Remove sndappv2.exe

Version:	2.2.1.3
MD5:	51630e657e104487ad3897a7a6047b94
SHA1:	a21db297579bbea86c3e0d9895a3012918dace0f
SHA256:	764d149e99db7cda9a240daeb7f7b973b6e0665c4ea7bc74bb6300903587cae5

What is sndappv2.exe?

sndappv2.exe is the Windows service (named sndappv2) part of Sendori that runs when Windows starts regardless if Senori is active. Sendori.com provides a in the domain space. Rather than parking domain names on a page with search listings the company’s service partners domains with advertisers in specific sectors. Sendori apparently has applied to patent their technology. Advertisers looking for traffic on a given topic can buy direct navigation traffic from Sendori’s domain name clients.

About sndappv2.exe (from Sendori)

“Sendori is a cloud-based web service that helps users navigate faster to their favorite websites. It is also a web filtering service that protects users from accessing malicious and phishing sites as ”

Details

File name:	sndappv2.exe
Publisher:	Sendori
Product name:	sndappv2.exe
Typical file path:	C:\Program Files\sendori\sndappv2.exe
File version:	2.2.1.3
Size:	3.4 MB (3,569,512 bytes)
Certificate
Issued to:	Sendori
Authority (CA):	VeriSign
Effective date:	Sunday, March 11, 2012
Expiration date:	Thursday, April 4, 2013
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

Sendori

Sendori, Inc.

79% remove

Sendori is a web browser plugin and layered service provider filter that is typically installed through a bundled installation. The plugin is designed to intercept Internet web traffic and provided modified results to various requests. Such results include DNS error redirection to sponsored affiliate advertisers. Sendori provides DNS redirection where advertisers can purchase navigation traffic from Sendori's domain name clients. When a...

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'sndappv2'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00055708%	0.028634%
Kernel CPU:	0.00039004%	0.013761%
User CPU:	0.00016704%	0.014873%
Kernel CPU time:	2,048,428 ms/min	100,923,805ms/min
CPU cycles:	17,936,722/sec	17,470,203/sec
Context switches:	6,521/sec	284/sec
Memory
Private memory:	8.27 MB	21.59 MB
Private (maximum):	11.85 MB
Private (minimum):	6.59 MB
Non-paged memory:	8.27 MB	21.59 MB
Virtual memory:	117.05 MB	140.96 MB
Virtual memory (peak):	136.22 MB	169.69 MB
Working set:	7.45 MB	18.61 MB
Working set (peak):	17.19 MB	37.95 MB
Page faults:	87,997,302/min	2,039/min
I/O
I/O read transfer:	3.25 KB/sec	1.02 MB/min
I/O read operations:	157/sec	343/min
I/O write transfer:	3 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	1.54 KB/sec	448.09 KB/min
I/O other operations:	26/sec	1,671/min
Resource allocations
Threads:	149	12
Handles:	749	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	"C:\Program Files\sendori\sndappv2.exe"
Owner:	SYSTEM
Windows Service
Service name:	sndappv2
Description:	“Sets and maintains sndappv2 LSP protection on this computer.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads