home

vpnui.exe

Cisco AnyConnect Secure Mobility Client

Cisco Systems, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Cisco AnyConnect Secure Mobility Agent for Windows’.
Publisher:
Cisco Systems, Inc.  (signed and verified)

Product:
Cisco AnyConnect Secure Mobility Client

Description:
Cisco AnyConnect User Interface

Version:
4, 3, 05019

MD5:
2b7e60b4fea111f61870bdbb45dd7e75

SHA-1:
1177fb12702c282226e90943144024353bc03cc4

SHA-256:
af9471ac3b97e6fd275403a530dd219021827d1b4c28c286ab20212d82e10e61

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 8:56:46 AM UTC  (today)

File size:
1.2 MB (1,207,808 bytes)

Product version:
4, 3, 05019

Copyright:
© Copyright 2004-2016, Cisco Systems, Inc.

Trademarks:
You can request legal trademarks and credits at anyconnect-credits@cisco.com

Original file name:
vpnui.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\cisco\cisco anyconnect secure mobility client\vpnui.exe

Digital Signature
Signed by:
Cisco Systems, Inc.

Authority:
Symantec Corporation

Valid from:
4/29/2016 5:30:00 AM

Valid to:
7/30/2018 5:29:59 AM

Subject:
CN="Cisco Systems, Inc.", OU=Endpoint Security, O="Cisco Systems, Inc.", L=San Jose, S=California, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3B5F35C73F400C6113BEEF9D414AF6E5

File PE Metadata
Compilation timestamp:
1/31/2017 10:29:36 AM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
14.0

Entry address:
0x4AD33

Entry point:
E8, 48, 05, 00, 00, E9, 8E, FE, FF, FF, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, BE, F5, FD, FF, C7, 06, 40, AB, 49, 00, 8B, C6, 5E, 5D, C2, 04, 00, 83, 61, 04, 00, 8B, C1, 83, 61, 08, 00, C7, 41, 04, 48, AB, 49, 00, C7, 01, 40, AB, 49, 00, C3, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, 8B, F5, FD, FF, C7, 06, 5C, AB, 49, 00, 8B, C6, 5E, 5D, C2, 04, 00, 83, 61, 04, 00, 8B, C1, 83, 61, 08, 00, C7, 41, 04, 64, AB, 49, 00, C7, 01, 5C, AB, 49, 00, C3, 8D, 41, 04, C7, 01, 34, AB, 49, 00, 50, E8, 70, 0B, 00, 00, 59...
 
[+]

Entropy:
6.1955

Code size:
606.5 KB (621,056 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Cisco AnyConnect Secure Mobility Agent for Windows

Command:
"C:\Program Files\cisco\cisco anyconnect secure mobility client\vpnui.exe" -minimized


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.