home

scrunner.exe

ShadowCube - The Real DLP Product.

Duruan Co., Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘scmain’.
Publisher:
Duruan Co., Ltd.  (signed and verified)

Product:
ShadowCube - The Real DLP Product.

Description:
scrunner

Version:
5.18.6.16133

MD5:
852d0a7c166ebe3cea42c1d49b519a72

SHA-1:
4f05a536057539975ca89c3822d0d8f8eac6ce03

SHA-256:
dd738065a19bfbb5d47901bd973e8d14368bb0560c2ce4611bce9ef2a6c96c8e

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/9/2024 4:26:01 PM UTC  (today)

File size:
34.1 KB (34,968 bytes)

Product version:
5.18.6.16667

Copyright:
Copyright (c) 2004 - 2012 Duruan Co, Ltd. All rights reserved.

Trademarks:
ShadowCube(tm)

Original file name:
scrunner.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\duruan\shadowcube\scrunner.exe

Digital Signature
Signed by:
Duruan Co., Ltd.

Authority:
Thawte, Inc.

Valid from:
8/28/2012 9:00:00 AM

Valid to:
9/28/2014 8:59:59 AM

Subject:
CN="Duruan Co., Ltd.", O="Duruan Co., Ltd.", L=Guro, S=Seoul, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
21C5308E14CDB5D6851C23824A883CB7

File PE Metadata
Compilation timestamp:
6/4/2013 6:16:31 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

Entry address:
0x1DC2

Entry point:
E8, 42, 05, 00, 00, E9, 6B, FD, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 98, 41, 40, 00, 89, 0D, 94, 41, 40, 00, 89, 15, 90, 41, 40, 00, 89, 1D, 8C, 41, 40, 00, 89, 35, 88, 41, 40, 00, 89, 3D, 84, 41, 40, 00, 66, 8C, 15, B0, 41, 40, 00, 66, 8C, 0D, A4, 41, 40, 00, 66, 8C, 1D, 80, 41, 40, 00, 66, 8C, 05, 7C, 41, 40, 00, 66, 8C, 25, 78, 41, 40, 00, 66, 8C, 2D, 74, 41, 40, 00, 9C, 8F, 05, A8, 41, 40, 00, 8B, 45, 00, A3, 9C, 41, 40, 00, 8B, 45, 04, A3, A0, 41, 40, 00, 8D, 45, 08, A3, AC, 41, 40...
 
[+]

Entropy:
5.6994

Code size:
5.5 KB (5,632 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
scmain

Command:
C:\Program Files\duruan\shadowcube\scrunner.exe


Scan scrunner.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.