home

SAStarter.exe

Spell Check Anywhere Starter

McLean Software

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘RunSpellCheckAnywhere’.
Publisher:
none  (signed by McLean Software)

Product:
Spell Check Anywhere Starter

Version:
1.00

MD5:
d8f1638ad81ac10d3dd4d51207b47786

SHA-1:
7d99780996c53d043044ec244af8cce451d07404

SHA-256:
84820a65126e49c4da0ca5df0b267f4d071d7da11d45f141dc132b4de3860bd5

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
7/3/2025 7:25:26 AM UTC  (today)

File size:
248.1 KB (254,080 bytes)

Product version:
1.00

Original file name:
SAStarter.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\spell check anywhere\sastarter.exe

Digital Signature
Signed by:
McLean Software

Authority:
Thawte, Inc.

Valid from:
6/9/2014 8:00:00 PM

Valid to:
6/10/2015 7:59:59 PM

Subject:
CN=McLean Software, O=McLean Software, L=Holbrook, S=Massachusetts, C=US

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
0B3F4EF5F62C06E8D2B3052778910B6F

File PE Metadata
Compilation timestamp:
8/18/2013 6:55:28 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:yowFfYhfQEv1fHkdnhO2jMkbTx0X+XMymdy9MlJ8YcqH+DfHk/YhfQEvspw7AW:XwFm3vBkX7MkbTxdiBHikG3vspwEW

Entry address:
0x1590

Entry point:
68, 20, 80, 40, 00, E8, F0, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 60, 00, 00, 00, 40, 00, 00, 00, 65, 12, 6E, 95, 65, 27, 9C, 4C, A8, D6, 4B, E6, 0C, 2E, 8A, F1, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 53, 41, 53, 74, 61, 72, 74, 65, 72, 00, 00, 00, 00, 00, 00, 00, 53, 70, 65, 6C, 6C, 20, 43, 68, 65, 63, 6B, 20, 41, 6E, 79, 77, 68, 65, 72, 65, 20, 53, 74, 61, 72, 74, 65, 72, 00, 00, 00, 00, 00, 00, 00, 00, FF, CC, 31, 00, 01, FD, 95, 61, BE, DB, 9E, EA, 45, BD, 40, F7...
 
[+]

Entropy:
6.3456

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
208 KB (212,992 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
RunSpellCheckAnywhere

Command:
C:\Program Files\spell check anywhere\sastarter.exe startup


Scan SAStarter.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.