home

spyshelter.exe

Datpol Janusz Siemienowicz

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘SpyShelter’.
Publisher:
Datpol Janusz Siemienowicz  (signed and verified)

Version:
1.0.0.0

MD5:
2a106682a71fa63bd0f8f98e000e701c

SHA-1:
daf67714eb37d1e184a02cb01e3bff4f1e500487

SHA-256:
c23703d5525150eaf8912c65b045cdae9d831a7e8ede7a0bb90ebbaad51491ce

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
11/27/2024 9:32:37 AM UTC  (today)

Scan engine
Detection
Engine version

Trend Micro House Call
PAK_Generic.009
7.2.290

Trend Micro
PAK_Generic.009
10.465.17

File size:
3.3 MB (3,492,192 bytes)

Product version:
1.0.0.0

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\spyshelter premium\spyshelter.exe

Digital Signature
Signed by:
Datpol Janusz Siemienowicz

Authority:
GlobalSign nv-sa

Valid from:
8/26/2014 2:14:04 PM

Valid to:
12/8/2014 6:09:30 PM

Subject:
E=biuro@datpol.com, CN=Datpol Janusz Siemienowicz, O=Datpol Janusz Siemienowicz, L=Olkusz, S=Malopolskie, C=PL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121B2A7BEEB0FC74F69CC135D6161C7095F

File PE Metadata
Compilation timestamp:
10/7/2014 7:13:13 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:lm/XP07Kw6sVecqs5qjwAMX85hS6u40mDEZHoZYrBo2euDG2zMdwlULDiniSCnAE:s/87UUqp9ssJZYrBM2zzMrApgygZ

Entry address:
0x5B6296

Entry point:
9C, E9, D8, 08, FA, FF, F6, D7, 80, E3, 19, 66, 8B, 1E, 66, 0F, A3, F9, 81, E3, FF, 0F, 00, 00, F8, 66, 0F, A3, E8, 60, 66, 0F, BA, E1, 03, 66, 01, 14, 3B, 57, 9C, 8D, 64, 24, 28, E9, 0A, 37, FB, FF, 77, 73, 6F, 63, 6B, 33, 32, 2E, 64, 6C, 6C, 00, 00, 00, 48, 65, 6C, 70, 65, 72, 53, 65, 74, 44, 72, 69, 76, 65, 72, 46, 6C, 61, 67, 00, 00, 00, 47, 65, 74, 41, 73, 79, 6E, 63, 4B, 65, 79, 53, 74, 61, 74, 65, 00, 00, 00, 4B, 69, 6C, 6C, 54, 69, 6D, 65, 72, 00, 00, 00, 47, 65, 74, 43, 6C, 69, 70, 62, 6F, 61, 72...
 
[+]

Code size:
4 MB (4,173,312 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
SpyShelter

Command:
C:\Program Files\spyshelter premium\spyshelter.exe


Scan spyshelter.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.