File name:

CloudyBootstrapInstaller.exe

Full analysis: https://app.any.run/tasks/3d4ab982-4959-4d2f-885a-b2610e62f0ec
Verdict: Malicious activity
Analysis date: November 30, 2024, 15:16:23
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

9E681E8A6C61F2BD6CDE35842BDBE9D4

SHA1:

968CCFFF20166DB5AF30011E2D31F4D2AD5C52DA

SHA256:

F9CA892CE53CC42030042733AE4F131A9E335D342EAA895D6FEAF8AFD6C7ACC1

SSDEEP:

1536:Wf4j0QYluL5AE64Ujs5DVIQDX24wW8gioDPjVcl:9YluLWfsFV7DX2JWdhPJY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • CloudyBootstrapInstaller.exe (PID: 6260)

    • Executable content was dropped or overwritten

      • CloudyBootstrapInstaller.exe (PID: 6260)

    • Reads security settings of Internet Explorer

      • CloudyBootstrapInstaller.exe (PID: 6260)
      • cloudy.exe (PID: 3564)

  • INFO

    • Reads the computer name

      • CloudyBootstrapInstaller.exe (PID: 6260)
      • cloudy.exe (PID: 3564)

    • Checks supported languages

      • CloudyBootstrapInstaller.exe (PID: 6260)
      • cloudy.exe (PID: 3564)

    • Disables trace logs

      • CloudyBootstrapInstaller.exe (PID: 6260)
      • cloudy.exe (PID: 3564)

    • Creates files in the program directory

      • CloudyBootstrapInstaller.exe (PID: 6260)
      • cloudy.exe (PID: 3564)

    • Reads the machine GUID from the registry

      • CloudyBootstrapInstaller.exe (PID: 6260)
      • cloudy.exe (PID: 3564)

    • Checks proxy server information

      • CloudyBootstrapInstaller.exe (PID: 6260)
      • cloudy.exe (PID: 3564)

    • Reads the software policy settings

      • CloudyBootstrapInstaller.exe (PID: 6260)
      • cloudy.exe (PID: 3564)

    • The process uses the downloaded file

      • CloudyBootstrapInstaller.exe (PID: 6260)

    • Process checks computer location settings

      • CloudyBootstrapInstaller.exe (PID: 6260)

    • Reads Environment values

      • cloudy.exe (PID: 3564)

    • Creates files or folders in the user directory

      • cloudy.exe (PID: 3564)

    • Sends debugging messages

      • cloudy.exe (PID: 3564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (72.2)
.scr | Windows screen saver (12.9)
.dll | Win32 Dynamic Link Library (generic) (6.4)
.exe | Win32 Executable (generic) (4.4)
.exe | Generic Win/DOS Executable (1.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2084:07:27 23:13:25+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 13312
InitializedDataSize: 34816
UninitializedDataSize: -
EntryPoint: 0x539a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: cloudybootstrapnotretard
FileVersion: 1.0.0.0
InternalName: CloudyBtstrp.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: CloudyBtstrp.exe
ProductName: cloudybootstrapnotretard
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cloudybootstrapinstaller.exe conhost.exe no specs cloudy.exe cloudybootstrapinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3564"C:\ProgramData\Cloudy\cloudy.exe" C:\ProgramData\Cloudy\cloudy.exe
CloudyBootstrapInstaller.exe
User:
admin
Integrity Level:
HIGH
Description:
cloudy
Version:
1.0.0.0
Modules
Images
c:\programdata\cloudy\cloudy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5628"C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe" C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
cloudybootstrapnotretard
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cloudybootstrapinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6260"C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe" C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
cloudybootstrapnotretard
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cloudybootstrapinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6284\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CloudyBootstrapInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 764
Read events
3 663
Write events
100
Delete events
1

Modification events

(PID) Process:(6260) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6260) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6260) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6260) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6260) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6260) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6260) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6260) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6260) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6260) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
28
Suspicious files
1 212
Text files
268
Unknown types
33

Dropped files

PID
Process
Filename
Type
6260CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\Debug.zip —
MD5:—
SHA256:—
6260CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\workspace\.tests\isfile.txttext
MD5:260CA9DD8A4577FC00B7BD5810298076
SHA256:AEE408847D35E44E99430F0979C3357B85FE8DBB4535A494301198ADBEE85F27
6260CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\workspace\.tests\appendfile.txttext
MD5:260CA9DD8A4577FC00B7BD5810298076
SHA256:AEE408847D35E44E99430F0979C3357B85FE8DBB4535A494301198ADBEE85F27
6260CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\runtimes\win-x64\native\WebView2Loader.dllexecutable
MD5:61F430F292F85B18B57F06EA6D3D8B82
SHA256:9468470D6A4D11179EC179183D130465A380E0DEDFDBE1FC2AB404C86C45A85E
6260CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\manifest.fingerprinttext
MD5:0C9218609241DBAA26EBA66D5AAF08AB
SHA256:52493422AC4C18918DC91EF5C4D0E50C130EA3AA99915FA542B890A79EA94F2B
6260CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\workspace\.tests\getcustomasset.txttext
MD5:260CA9DD8A4577FC00B7BD5810298076
SHA256:AEE408847D35E44E99430F0979C3357B85FE8DBB4535A494301198ADBEE85F27
6260CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\workspace\.tests\listfiles\test_1.txttext
MD5:260CA9DD8A4577FC00B7BD5810298076
SHA256:AEE408847D35E44E99430F0979C3357B85FE8DBB4535A494301198ADBEE85F27
6260CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\workspace\.tests\readfile.txttext
MD5:260CA9DD8A4577FC00B7BD5810298076
SHA256:AEE408847D35E44E99430F0979C3357B85FE8DBB4535A494301198ADBEE85F27
6260CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\component_crx_cache\ojblfafjmiikbkepnnolpgbbhejhlcim_1.C1E0755E98DF77F5A56556098D6898E27C5295377F6F0703EF98DB199920CDB5 —
MD5:—
SHA256:—
6260CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\workspace\.tests\writefile.txttext
MD5:260CA9DD8A4577FC00B7BD5810298076
SHA256:AEE408847D35E44E99430F0979C3357B85FE8DBB4535A494301198ADBEE85F27
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
40
DNS requests
25
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
svchost.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3040
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6468
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3688
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3688
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3040
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3040
svchost.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.16.204.161:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.37.237.227
  • 2.16.253.202
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.bing.com
  • 2.16.204.161
  • 2.16.204.155
  • 2.16.204.134
  • 2.16.204.143
  • 2.16.204.138
  • 2.16.204.147
  • 2.16.204.148
  • 2.16.204.156
  • 2.16.204.152
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.64
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
raw.githubusercontent.com
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.108.133
shared
github.com
  • 140.82.121.3
shared
go.microsoft.com
  • 23.218.210.69
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
Process
Message
cloudy.exe
Loading script hub...
cloudy.exe
Making API request to: https://scriptblox.com/api/script/search?q=a&mode=free&page=1
cloudy.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
cloudy.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
cloudy.exe
ype":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-21T00:02:52.327Z","updatedAt":"2024-11-30T15:17:32.455Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"673de476275c19f290b0145e","title":"coin farm","game":{"gameId":17890861313,"name":"PANIK 2","imageUrl":"https://tr.rbxcdn.com/180DAY-8e28e6bc4ade094fcb7b337241ec3b9b/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/PANIK-2-coin-farm-22718\"))()","slug":"PANIK-2-coin-farm-22718","verified":true,"key":false,"keyLink":"","views":17086,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-20T13:30:30.891Z","updatedAt":"2024-11-30T15:16:56.365Z","__v":0,"matched":["features","game","script","tags","title","script"]}]}}
cloudy.exe
API response: {"result":{"totalPages":983,"scripts":[{"_id":"674b2a6441fd26d2502e0d7d","title":"Forge Hub (OP FAST AUTOFARMS, TELEPORTS MISC + LOTS MORE!)","game":{"gameId":16732694052,"name":"[UPD] Fisch","imageUrl":"https://tr.rbxcdn.com/180DAY-f95a3c55e4f4d81dd7cde6fcb9f17b9e/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/UPD-Fisch-Forge-hub-23437\"))()","slug":"UPD-Fisch-Forge-hub-23437","verified":true,"key":true,"keyLink":"https://ads.luarmor.net/get_key?for=Forge_Hub_Key_System-yoGtymGRJfTW","views":118,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-30T15:08:20.277Z","updatedAt":"2024-11-30T15:17:41.788Z","__v":0,"matched":["features","script","title","script"]},{"_id":"674b270160c60244a8fe84c4","title":"OP FREE GUI","game":{"gameId":16732694052,"name":"[UPD] Fisch","imageUrl":"/images/script/16732694052-1732978467212.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/UPD-Fisch-OP-FREE-GUI-23437\"))()","slug":"UPD-Fisch-OP-FREE-GUI-23437","verified":true,"key":true,"keyLink":"https://nicuse.xyz/getkey/","views":283,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-30T14:53:53.807Z","updatedAt":"2024-11-30T15:17:41.717Z","__v":0,"matched":["features","script","tags","script"]},{"_id":"674b19baf2aee85a330858e2","title":"OP SCRIPT WITH AUTOFARM","game":{"gameId":2753915549,"name":"Blox Fruits","imageUrl":"https://tr.rbxcdn.com/180DAY-5304fe8fb874c7244eb4fe24ff324b17/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Blox-Fruits-OP-SCRIPT-WITH-AUTOFARM-23429\"))()","slug":"Blox-Fruits-OP-SCRIPT-WITH-AUTOFARM-23429","verified":true,"key":true,"keyLink":"https://nicuse.xyz/getkey/","views":926,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-30T13:57:14.788Z","updatedAt":"2024-11-30T15:17:41.841Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"674b189554aa078674013af4","title":"Best Auto Find Fruit and Auto Farm Infinite Coins SOLARA","game":{"gameId":2753915549,"name":"Blox Fruits","imageUrl":"https://tr.rbxcdn.com/180DAY-5304fe8fb874c7244eb4fe24ff324b17/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Blox-Fruits-Best-Auto-Find-Fruit-and-Auto-Farm-Infinite-Coins-SOLARA-23427\"))()","slug":"Blox-Fruits-Best-Auto-Find-Fruit-and-Auto-Farm-Infinite-Coins-SOLARA-23427","verified":true,"key":false,"keyLink":"","views":686,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-30T13:52:21.422Z","updatedAt":"2024-11-30T15:17:41.256Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"674b0f388ed7d3ef9efd85fb","title":"Auto Farm Auto Roll Orbs Solara Supported Fixed Everything","game":{"gameId":18901165922,"name":"[??10x] PETS GO! ?","imageUrl":"https://tr.rbxcdn.com/180DAY-a41c72f4681bdfc56549e3d6f22f59a7/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/10x-PETS-GO!-Auto-Farm-Auto-Roll-Orbs-Solara-Supported-Fixed-Everything-23423\"))()","slug":"10x-PETS-GO!-Auto-Farm-Auto-Roll-Orbs-Solara-Supported-Fixed-Everything-23423","verified":true,"key":false,"keyLink":"","views":1451,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-30T13:12:24.257Z","updatedAt":"2024-11-30T15:17:41.688Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"674a320b70571e694cf3d0a0","title":"Free Roblox Accounts Gen","game":{"gameId":2386769,"name":"Universal Script ??","imageUrl":"/images/script/2386769-1732915723822.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Universal-Script-Free-Roblox-Accounts-Gen-23386\"))()","slug":"Universal-Script-Free-Roblox-Accounts-Gen-23386","verified":true,"key":false,"keyLink":"","views":4617,"scriptType":"free","isUniversal":true,"isPatched":false,"visibility":"public","createdAt":"2
cloudy.exe
024-11-29T21:28:43.907Z","updatedAt":"2024-11-30T15:17:04.190Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"674a1f3f82b1d27e0cde4616","title":"Reaper Hub Autumn Event","game":{"gameId":18901165922,"name":"[??10x] PETS GO! ?","imageUrl":"/images/script/18901165922-1732910911799.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/10x-PETS-GO!-Reaper-Hub-Autumn-Event-23380\"))()","slug":"10x-PETS-GO!-Reaper-Hub-Autumn-Event-23380","verified":true,"key":true,"keyLink":"https://discord.gg/reaperhub","views":5584,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-29T20:08:31.891Z","updatedAt":"2024-11-30T15:17:38.271Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"67493e8fc6edaee0434c7122","title":"Reaper Hub","game":{"gameId":16732694052,"name":"?? Fisch","imageUrl":"/images/script/16732694052-1732853391684.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Fisch-Reaper-Hub-23309\"))()","slug":"Fisch-Reaper-Hub-23309","verified":true,"key":true,"keyLink":"https://discord.gg/reaperhub","views":8959,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-29T04:09:51.765Z","updatedAt":"2024-11-30T15:17:41.824Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"67492e0b70571e694ce06ebf","title":"AtherHub","game":{"gameId":16732694052,"name":"?? Fisch","imageUrl":"https://tr.rbxcdn.com/180DAY-7526e87580aa9729bbc0155cad9edf6d/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Fisch-AtherHub-23307\"))()","slug":"Fisch-AtherHub-23307","verified":true,"key":true,"keyLink":"https://ads.luarmor.net/get_key?for=AtherHub_Key-uOsEXGVZazzi","views":9430,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-29T02:59:23.768Z","updatedAt":"2024-11-30T15:17:41.867Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"6748766954aa078674cdb86f","title":"Free OP Script","game":{"gameId":14708751132,"name":"[UPD!] Untitled Gym Game","imageUrl":"/images/script/14708751132-1732802153301.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/UPD!-Untitled-Gym-Game-Free-OP-Script-23286\"))()","slug":"UPD!-Untitled-Gym-Game-Free-OP-Script-23286","verified":true,"key":true,"keyLink":"https://platoboost.com/","views":6654,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-28T13:55:53.388Z","updatedAt":"2024-11-30T15:16:56.786Z","__v":0,"matched":["features","game","script","tags","script"]},{"_id":"67477f10be295a087452d573","title":"op script","game":{"gameId":17890861313,"name":"PANIK 2 [Event!]","imageUrl":"/images/script/17890861313-1732738831953.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/PANIK-2-Event!-op-script-23251\"))()","slug":"PANIK-2-Event!-op-script-23251","verified":true,"key":false,"keyLink":"","views":7928,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-27T20:20:32.012Z","updatedAt":"2024-11-30T15:17:28.103Z","__v":0,"matched":["features","game","script","tags","script"]},{"_id":"6747553b4ea92cf773d0a695","title":"Bats Sandbox [BETA]","game":{"gameId":7770860,"name":"Universal Script ??","imageUrl":"/images/script/7770860-1732728123876.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Universal-Script-Bats-Sandbox-23240\"))()","slug":"Universal-Script-Bats-Sandbox-23240","verified":true,"key":false,"keyLink":"","views":7005,"scriptType":"free","isUniversal":true,"isPatched":false,"visibility":"public","createdAt":"2024-11-27T17:22:03.951Z","updatedAt":"2024-11-30T15:17:10.664Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"674745359ea212d8ac264623","title":"nebora OP AUTO SHAKE, TELEPORTS AND LOTS MORE!","game":{"gameId":16732694052,"name":"?? Fisch","imageUrl":"/images/script/16732694052-1732724021829.png"},"script":"load
cloudy.exe
string(game:HttpGet(\"https://rawscripts.net/raw/Fisch-nebora-OP-AUTO-SHAKE-23235\"))()","slug":"Fisch-nebora-OP-AUTO-SHAKE-23235","verified":true,"key":false,"keyLink":"","views":16166,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-27T16:13:41.912Z","updatedAt":"2024-11-30T15:17:41.253Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"6742a0e099a0c523532564d4","title":"DAMAGE BOOSTER [OVERPOWERED]","game":{"gameId":15659062652,"name":"Unusual Force","imageUrl":"https://tr.rbxcdn.com/180DAY-75df509ac65ebe81bf3e0836565c6764/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Unusual-Force-DAMAGE-BOOSTER-22965\"))()","slug":"Unusual-Force-DAMAGE-BOOSTER-22965","verified":true,"key":false,"keyLink":"","views":12756,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-24T03:43:28.601Z","updatedAt":"2024-11-30T15:16:56.002Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"67417afddb1fc8c0b78b2ff9","title":"EXTENDED HITBOX RANGE [OP]","game":{"gameId":15659062652,"name":"Unusual Force","imageUrl":"https://tr.rbxcdn.com/180DAY-75df509ac65ebe81bf3e0836565c6764/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Unusual-Force-EXTENDED-RANGE-22881\"))()","slug":"Unusual-Force-EXTENDED-RANGE-22881","verified":true,"key":false,"keyLink":"","views":19438,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-23T06:49:33.011Z","updatedAt":"2024-11-30T15:17:15.954Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"674119d26c0c3d39454761ac","title":"Astral free","game":{"gameId":10806004754,"name":"??NEW Drain City","imageUrl":"https://tr.rbxcdn.com/180DAY-67c5f6d5f52b8895860efb908830a793/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/NEW-Drain-City-Astral-free-22855\"))()","slug":"NEW-Drain-City-Astral-free-22855","verified":true,"key":false,"keyLink":"https://discord.gg/mgQRu5r9XH","views":17141,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-22T23:54:58.571Z","updatedAt":"2024-11-30T15:17:31.033Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"6740e072edc27f67077fac20","title":"UPDATED KEYLESS SCRIPT BANANA HUB","game":{"gameId":18901165922,"name":"[??5x LUCK] PETS GO! ?","imageUrl":"/images/script/18901165922-1732905826480.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/5x-LUCK-PETS-GO!-KEYLESS-SCRIPT-BANANA-HUB-22847\"))()","slug":"5x-LUCK-PETS-GO!-KEYLESS-SCRIPT-BANANA-HUB-22847","verified":true,"key":false,"keyLink":"","views":13503,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-22T19:50:10.028Z","updatedAt":"2024-11-30T15:16:55.763Z","__v":0,"matched":["features","script","title","script"]},{"_id":"673efa6f0f86d9b2c47b7a52","title":"Kill Enemies","game":{"gameId":118367369949006,"name":"Ground War","imageUrl":"/images/script/118367369949006-1732180591870.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Ground-War-Kill-Enemies-22757\"))()","slug":"Ground-War-Kill-Enemies-22757","verified":true,"key":false,"keyLink":"","views":17824,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-21T09:16:31.923Z","updatedAt":"2024-11-30T15:16:59.627Z","__v":0,"matched":["features","game","script","tags","script"]},{"_id":"673e78acc9439ea8c48e1bbe","title":"Astral free","game":{"gameId":13083893317,"name":"??Life Sentence ","imageUrl":"https://tr.rbxcdn.com/180DAY-73af31d14372f4eb84168bc3b5ca69e7/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Life-Sentence-Astral-free-22738\"))()","slug":"Life-Sentence-Astral-free-22738","verified":true,"key":true,"keyLink":"https://discord.gg/mgQRu5r9XH","views":27587,"scriptT
cloudy.exe
Script hub loaded successfully.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CloudyBootstrapInstaller.exe