NEGui.exe
NeExtender GUI client by SonicWALL Inc. (Signed)
| Version: | 6, 0, 176, 1 |
| MD5: | 7fcb560e00ef7bc557a2ef3096c0dc95 |
| SHA1: | 9d7550738e7a1a194140ab907dcaeb1820f5fc87 |
| SHA256: | 655e3e7670232d0ec461834c3148bae1795e6bdbb43bab754f79a616a06f1286 |
Overview
negui.exe executes as a process with the local user's privileges usually within the context of Windows Explorer. It is set to be start when the PC boots and any user logs into Windows (added to the Run registry key for the all users under the local machine). This is typically installed with the program SonicWALL SSL-VPN NetExtender published by SonicWALL, Inc.. The file is digitally signed by SonicWALL Inc. which was issued by the VeriSign certificate authority (CA). This particular version is usually found on Windows Vista (TM) Ultimate (6.0.6002.131072).
Details
| File name: | negui.exe |
| Publisher: | SonicWALL Inc. |
| Product name: | NeExtender GUI client |
| Typical file path: | C:\Program Files\sonicwall\ssl-vpn\netextender\negui.exe |
| File version: | 6, 0, 176, 1 |
| Size: | 1.19 MB (1,244,192 bytes) |
| Build date: | 4/12/2012 11:37 PM |
| Certificate |
| Issued to: | SonicWALL Inc. |
| Authority (CA): | VeriSign |
| Effective date: | Tuesday, March 6, 2012 |
| Expiration date: | Saturday, March 7, 2015 |
| Digital DNA |
| PE subsystem: | Windows GUI |
| File packed: | No |
| .NET CLR: | No |
More details
Programs
The following program will install this file
“SonicWALL NetExtender is a transparent software application for Windows users that enables remote users to securely connect to the remote network. With NetExtender, remote users can securely run any application on the remote network. Users can upload and download files, mount network drives, and access resources in the same way as if they were on the local network. NetExtender acts as an IP-level mechanism provided by the virtual interf...”
Behaviors
Startup files (all users) run
Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
- 'SonicWALLNetExtender' → C:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEGui.exe -hideGUI -clearReboot
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
| CPU |
| Total CPU: | 0.00076249% | |
| Kernel CPU: | 0.00030255% | |
| User CPU: | 0.00045994% | |
| Kernel CPU time: | 1,422 ms/min | |
| CPU cycles: | 6,623,872/sec | |
| Memory |
| Private memory: | 19.95 MB | |
| Private (maximum): | 32.64 MB | |
| Private (minimum): | 17.17 MB | |
| Non-paged memory: | 19.95 MB | |
| Virtual memory: | 168.29 MB | |
| Virtual memory (peak): | 173.56 MB | |
| Working set: | 18.3 MB | |
| Working set (peak): | 34.98 MB | |
| Page faults: | 14,335/min | |
| I/O |
| I/O read transfer: | 113 Bytes/sec | |
| I/O read operations: | 1/sec | |
| I/O write transfer: | 1.45 KB/sec | |
| I/O write operations: | 1/sec | |
| I/O other transfer: | 1.98 KB/sec | |
| I/O other operations: | 12/sec | |
| Resource allocations |
| Threads: | 14 | |
| Handles: | 389 | |
| GUI GDI count: | 63 | |
| GUI USER count: | 37 | |
Process properties
Threads
Averages
| NEGui.exe (main module) |
| Total CPU: | 0.01089899% | |
| Kernel CPU: | 0.00372270% | |
| User CPU: | 0.00717629% | |
| CPU cycles: | 4,158,192/sec | |
| Context switches: | 27/sec | |
| Memory: | 1.2 MB | |
| mshtml.dll (Windows Internet Explorer by Microsoft) |
| Total CPU: | 0.00036027% | |
| Kernel CPU: | 0.00027020% | |
| User CPU: | 0.00009007% | |
| CPU cycles: | 394,036/sec | |
| Context switches: | 16/sec | |
| Memory: | 11.78 MB | |
| msvcrt.dll (Windows NT CRT DLL by Microsoft) |
| Total CPU: | 0.00018014% | |
| Kernel CPU: | 0.00000000% | |
| User CPU: | 0.00018014% | |
| CPU cycles: | 5,830/sec | |
| Memory: | 680 KB | |
Common loaded modules
These are modules that are typiclaly loaded within the context of this process.
Distribution by Windows OS
| OS version | distribution |
| Windows Vista Ultimate |
100.00% |
|
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Intel |
100.00% |
|
