home

vpnui.exe

Cisco AnyConnect Secure Mobility Client

Cisco Systems, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Cisco AnyConnect Secure Mobility Agent for Windows’.
Publisher:
Cisco Systems, Inc.  (signed and verified)

Product:
Cisco AnyConnect Secure Mobility Client

Description:
Cisco AnyConnect User Interface

Version:
3, 1, 14018

MD5:
16ee6c61688efc4d2e5ffea7cb04b526

SHA-1:
d7d942baf967860ea651cfe2b5500d5db560676f

SHA-256:
493c5c1edb73fd3dc8b2c34173e27e5e6382875beecb1526b7af6dab4a1dea50

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/28/2024 1:06:51 AM UTC  (today)

File size:
820.5 KB (840,192 bytes)

Product version:
3, 1, 14018

Copyright:
© Copyright 2004-2016, Cisco Systems, Inc.

Trademarks:
You can request legal trademarks and credits at anyconnect-credits@cisco.com

Original file name:
vpnui.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\cisco\cisco anyconnect secure mobility client\vpnui.exe

Digital Signature
Signed by:
Cisco Systems, Inc.

Authority:
Symantec Corporation

Valid from:
2/17/2016 5:30:00 AM

Valid to:
6/7/2016 5:29:59 AM

Subject:
CN="Cisco Systems, Inc.", OU=Endpoint Security, O="Cisco Systems, Inc.", L=San Jose, S=California, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
6EF03BA4D6D4EE8E886A4B8C07C99DEC

File PE Metadata
Compilation timestamp:
2/29/2016 3:44:03 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

Entry address:
0x45431

Entry point:
E8, 27, 13, 00, 00, E9, 58, FD, FF, FF, CC, 68, 95, 54, 44, 00, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 24, 80, 48, 00, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, F0, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, C3, 8B, FF, 55, 8B, EC, FF, 75, 14, FF, 75, 10, FF, 75, 0C, FF, 75, 08, 68, 80, 49, 44, 00, 68, 24, 80, 48, 00, E8...
 
[+]

Entropy:
6.6273

Code size:
391.5 KB (400,896 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Cisco AnyConnect Secure Mobility Agent for Windows

Command:
"C:\Program Files\cisco\cisco anyconnect secure mobility client\vpnui.exe" -minimized


Scan vpnui.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.