home

SageCSClient.exe

Sage Notification

Pastel Software

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Payroll Notification Service’.
Publisher:
Sage South Africa (Pty) Ltd  (signed by Pastel Software)

Product:
Sage Notification

Description:
Sage Notification Service

Version:
1.6.0.2

MD5:
800e7a57b9c9a8e0cadd4b86a283dbca

SHA-1:
4e8599ef18b4ebe62d2c205af5eeda1571ac6a5c

SHA-256:
87f53d0de094aafc1bbc39a40e38c57899b30ad7d7cfa15cea313aeadcde0442

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/10/2024 11:22:22 PM UTC  (a few moments ago)

File size:
873 KB (893,968 bytes)

Product version:
1.6.0.2

Copyright:
Copyright Sage South Africa (Pty) Ltd © 2013

Original file name:
SageCSClient.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\sage connected services\sagecsclient.exe

Digital Signature
Signed by:
Pastel Software

Authority:
Thawte, Inc.

Valid from:
2/22/2012 7:00:00 PM

Valid to:
2/20/2014 6:59:59 PM

Subject:
CN=Pastel Software, OU=Development, O=Pastel Software, L=Johannesburg, S=Gauteng, C=ZA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
35E73DDCC2689360CB7568B91A502FAB

File PE Metadata
Compilation timestamp:
8/15/2013 5:56:19 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:9u5slpg4jxttPVfD1dRwbufsJKo2HeIBmIvFIAPyR30QkiMjJ82uzd:9urU/xVpkb2+IhyAPyF0QdMduzd

Entry address:
0xD15EE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, EA, 9A, FE, 99, CA, 1D, CE, BF, 09, AF, C8, 9C, 0E, CB, B1, 7B, 84, A4, 87, 92, 41, 06, B9, A7, BC, 97, A7, B7, 52, 90, AF, 85, 0B, 16, 44, CE, A0, AC, 2F, 0E, F6, B6, 3A, F0, 2C, 08, 33, ED, 52, 66, 68, 6E, 20, 4D, 18, 22, 76, B5, 33, 11, 12, 33, 0C, 6D, 0A, 20, 4D, 18, 22, 9E, A1, 29, 61, 1C, 76, B5, 05, 19, 01, 58, 04, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
829.5 KB (849,408 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Payroll Notification Service

Command:
"C:\users\{user}\appdata\local\sage connected services\sagecsclient.exe"


Scan SageCSClient.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.