home

gnabcoms.exe

Printer Communication System

Lexmark International, Inc.

It runs as a windows Service named “gnab_device”.
Publisher:
Lexmark International, Inc.  (signed and verified)

Product:
Printer Communication System

Version:
8.2.18.0

MD5:
992849519449707ededd1ae4ea5d4a13

SHA-1:
b922257e1a1f7e1bf8b75e4af1cd4bd788edc912

SHA-256:
a6c74f8880dd94c2fa7059410d00601f35f709c5353e732ab2422f6f51aa5f1d

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/23/2024 11:29:41 AM UTC  (today)

File size:
576.7 KB (590,504 bytes)

Product version:
8.2.18.0

Original file name:
GN__coms.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Windows\System32\gnabcoms.exe

Digital Signature
Signed by:
Lexmark International, Inc.

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
7/9/2007 9:00:00 AM

Valid to:
8/4/2009 8:59:59 AM

Subject:
CN="Lexmark International, Inc.", OU=PS&SD BUSINESS SOFTWARE & SOLUTIONS, O="Lexmark International, Inc.", L=Lexington, S=Kentucky, C=US

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
166EB85E7D08509F2F215FB5E9177B98

File PE Metadata
Compilation timestamp:
4/1/2008 3:38:01 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:HwWj70t9n6+gzXHFGuZ9BHgtQdUHNaIrCLESRHeF6w9Ks0cV/XZMznQ+bdM:t+96+gzUuZ9Jgi6t0xYjBV/XyRbq

Entry address:
0x35E2D

Entry point:
E8, 53, 75, 00, 00, E9, 16, FE, FF, FF, 83, 7C, 24, 08, 00, 74, 06, C6, 01, 2D, 41, F7, D8, 56, 8B, F1, 33, D2, F7, 74, 24, 08, 83, FA, 09, 76, 05, 80, C2, 57, EB, 03, 80, C2, 30, 88, 11, 41, 85, C0, 77, E6, C6, 01, 00, 49, 8A, 16, 8A, 01, 88, 11, 49, 88, 06, 46, 3B, F1, 72, F2, 5E, C2, 08, 00, 55, 8B, EC, 33, C0, 83, 7D, 10, 0A, 75, 06, 39, 45, 08, 7D, 01, 40, 8B, 4D, 0C, 50, FF, 75, 10, 8B, 45, 08, E8, A0, FF, FF, FF, 8B, 45, 0C, 5D, C3, 8B, 4C, 24, 08, 8B, 44, 24, 04, 6A, 00, FF, 74, 24, 10, E8, 88, FF...
 
[+]

Entropy:
6.4714

Code size:
428 KB (438,272 bytes)

Service
Display name:
gnab_device

Type:
Win32OwnProcess, InteractiveProcess


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.