home

SAStarter.exe

Spell Check Anywhere Starter

McLean Software

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘RunSpellCheckAnywhere’.
Publisher:
none  (signed by McLean Software)

Product:
Spell Check Anywhere Starter

Version:
1.00

MD5:
0076b0163b23d43432469753238c1a7b

SHA-1:
5b09f0ccfb21249e22d5b40c960837866fee1d4a

SHA-256:
8ca12c1e4b5fc62ffa4e83a62033d1cb5942304b702168832191677f5dfde018

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
7/3/2025 7:32:45 AM UTC  (today)

File size:
248.1 KB (254,096 bytes)

Product version:
1.00

Original file name:
SAStarter.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\spell check anywhere\sastarter.exe

Digital Signature
Signed by:
McLean Software

Authority:
thawte, Inc.

Valid from:
6/15/2015 1:00:00 AM

Valid to:
6/15/2016 12:59:59 AM

Subject:
CN=McLean Software, O=McLean Software, L=Holbrook, S=Massachusetts, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
5370AB20A58AF8DA0D954748591DE66F

File PE Metadata
Compilation timestamp:
1/27/2015 5:53:29 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:kwFm3vBkgjBEbTxiuMsVinFjIHikG3vspwkAzp:kwA5ktbTxiuMsVinFjZkGMwnp

Entry address:
0x15A0

Entry point:
68, 30, 80, 40, 00, E8, F0, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 60, 00, 00, 00, 40, 00, 00, 00, 13, 37, 43, 23, 5E, 3B, AC, 45, 97, 01, 6B, 32, EE, 81, FA, 5E, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 53, 41, 53, 74, 61, 72, 74, 65, 72, 00, 00, 00, 00, 00, 00, 00, 53, 70, 65, 6C, 6C, 20, 43, 68, 65, 63, 6B, 20, 41, 6E, 79, 77, 68, 65, 72, 65, 20, 53, 74, 61, 72, 74, 65, 72, 00, 00, 00, 00, 00, 00, 00, 00, FF, CC, 31, 00, 01, 29, 10, 40, 7B, CD, C8, CA, 4A, 93, 5B, BF...
 
[+]

Entropy:
6.3498

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
208 KB (212,992 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
RunSpellCheckAnywhere

Command:
C:\Program Files\spell check anywhere\sastarter.exe startup


Scan SAStarter.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.