home

vpnui.exe

Cisco AnyConnect Secure Mobility Client

Cisco Systems, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Cisco AnyConnect Secure Mobility Agent for Windows’.
Publisher:
Cisco Systems, Inc.  (signed and verified)

Product:
Cisco AnyConnect Secure Mobility Client

Description:
Cisco AnyConnect User Interface

Version:
4, 3, 00528

MD5:
d07c460a96d4c8b0b54bd602b8273856

SHA-1:
c8b78a66f1faecb742cec8db9e4cb699cfb04aaa

SHA-256:
66c27fde6ed1c64dc2f9d8e8c7a7e52586f35ede9342d0dcd995f9ff77020264

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/28/2024 1:17:03 AM UTC  (today)

File size:
1010.5 KB (1,034,752 bytes)

Product version:
4, 3, 00528

Copyright:
© Copyright 2004-2016, Cisco Systems, Inc.

Trademarks:
You can request legal trademarks and credits at anyconnect-credits@cisco.com

Original file name:
vpnui.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\cisco\cisco anyconnect secure mobility client\vpnui.exe

Digital Signature
Signed by:
Cisco Systems, Inc.

Authority:
Symantec Corporation

Valid from:
2/17/2016 5:30:00 AM

Valid to:
6/7/2016 5:29:59 AM

Subject:
CN="Cisco Systems, Inc.", OU=Endpoint Security, O="Cisco Systems, Inc.", L=San Jose, S=California, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
6EF03BA4D6D4EE8E886A4B8C07C99DEC

File PE Metadata
Compilation timestamp:
3/14/2016 1:44:10 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

Entry address:
0x57D53

Entry point:
E8, 15, 13, 00, 00, E9, 58, FD, FF, FF, CC, CC, CC, 68, B9, 7D, 45, 00, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 24, 90, 4B, 00, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, F0, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, C3, 8B, FF, 55, 8B, EC, FF, 75, 14, FF, 75, 10, FF, 75, 0C, FF, 75, 08, 68, 30, 70, 45, 00, 68, 24, 90, 4B...
 
[+]

Entropy:
6.4244

Code size:
540 KB (552,960 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Cisco AnyConnect Secure Mobility Agent for Windows

Command:
"C:\Program Files\cisco\cisco anyconnect secure mobility client\vpnui.exe" -autolaunched


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.