home

vpnui.exe

Cisco AnyConnect Secure Mobility Client

Cisco Systems, Inc.

This is a setup program which is used to install the application. This is installed with multiple programs including Cisco AnyConnect Web Security Module and Cisco AnyConnect Secure Mobility Client. The file has been seen being downloaded from mailapp03.register.com.
Publisher:
Cisco Systems, Inc.  (signed and verified)

Product:
Cisco AnyConnect Secure Mobility Client

Description:
Cisco AnyConnect User Interface

Version:
3, 1, 10010

MD5:
99a9afd1844c69119706e078a2de2745

SHA-1:
a5b92d33eb977e5da4bfbf9d546a5beaf1d5c295

SHA-256:
7ab06fbd8403382188497c7c8079160b3931e1f3e801b6ce4609e834cfbe5626

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
1/3/2026 7:02:11 PM UTC  (today)

File size:
691.9 KB (708,496 bytes)

Product version:
3, 1, 10010

Copyright:
© Copyright 2004-2015, Cisco Systems, Inc.

Trademarks:
You can request legal trademarks and credits at anyconnect-credits@cisco.com

Original file name:
vpnui.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\a32b926\vpnui.exe

Digital Signature
Signed by:
Cisco Systems, Inc.

Authority:
VeriSign, Inc.

Valid from:
4/7/2014 9:00:00 PM

Valid to:
6/6/2016 8:59:59 PM

Subject:
CN="Cisco Systems, Inc.", OU=Endpoint Security, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Cisco Systems, Inc.", L=San Jose, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
636C7543DDBDF969F473160F4B099B9E

File PE Metadata
Compilation timestamp:
7/22/2015 12:51:23 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
12288:tZi2OsRbHH52kRxTEFBrMdTcH3XAQiIg+9bhdRz8E6:tZFRbHhRxiBhHHziLet8E6

Entry address:
0x45431

Entry point:
E8, 27, 13, 00, 00, E9, 58, FD, FF, FF, CC, 68, 95, 54, 44, 00, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 24, 80, 48, 00, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, F0, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, C3, 8B, FF, 55, 8B, EC, FF, 75, 14, FF, 75, 10, FF, 75, 0C, FF, 75, 08, 68, 80, 49, 44, 00, 68, 24, 80, 48, 00, E8...
 
[+]

Code size:
391.5 KB (400,896 bytes)

The file vpnui.exe has been discovered within the following programs.

Cisco AnyConnect Network Access Manager  by Cisco Systems, Inc.
Publisher's description - “The Network Access Manager is client software that provides a secure Layer 2 network in accordance with policies set forth by the enterprise network administrators.”
www.cisco.com
7% remove it
Cisco AnyConnect Secure Mobility Client  by Cisco Systems, Inc.
Publisher's description - “Make the VPN experience easier and more secure with the enhanced remote access technology of Cisco AnyConnect Secure Mobility Client.”
7% remove it
Cisco AnyConnect Web Security Module  by Cisco Systems, Inc.
Publisher's description - “You can deploy the Web Security module and benefit from the ScanSafe web scanning services without having to install an ASA and without enabling the VPN capabilities of the AnyConnect Secure Mobility Client.”
8% remove it
 
Powered by Should I Remove It?

The file vpnui.exe has been seen being distributed by the following URL.

https://mailapp03.register.com/.../dlAttach.php?attachment=2&index=1245844474&mailbox=bWJveA==&filename=vpnui.exe&d=3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.