File name:

CloudyBootstrapInstaller.exe

Full analysis: https://app.any.run/tasks/71640468-094b-47bd-81ad-d89136d6542a
Verdict: Malicious activity
Analysis date: November 05, 2024, 19:07:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

9E681E8A6C61F2BD6CDE35842BDBE9D4

SHA1:

968CCFFF20166DB5AF30011E2D31F4D2AD5C52DA

SHA256:

F9CA892CE53CC42030042733AE4F131A9E335D342EAA895D6FEAF8AFD6C7ACC1

SSDEEP:

1536:Wf4j0QYluL5AE64Ujs5DVIQDX24wW8gioDPjVcl:9YluLWfsFV7DX2JWdhPJY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • CloudyBootstrapInstaller.exe (PID: 6752)

    • Executable content was dropped or overwritten

      • CloudyBootstrapInstaller.exe (PID: 6752)

  • INFO

    • Creates files in the program directory

      • CloudyBootstrapInstaller.exe (PID: 6752)

    • Disables trace logs

      • CloudyBootstrapInstaller.exe (PID: 6752)

    • Reads the computer name

      • CloudyBootstrapInstaller.exe (PID: 6752)

    • Reads the machine GUID from the registry

      • CloudyBootstrapInstaller.exe (PID: 6752)

    • Checks supported languages

      • CloudyBootstrapInstaller.exe (PID: 6752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (72.2)
.scr | Windows screen saver (12.9)
.dll | Win32 Dynamic Link Library (generic) (6.4)
.exe | Win32 Executable (generic) (4.4)
.exe | Generic Win/DOS Executable (1.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2084:07:27 23:13:25+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 13312
InitializedDataSize: 34816
UninitializedDataSize: -
EntryPoint: 0x539a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: cloudybootstrapnotretard
FileVersion: 1.0.0.0
InternalName: CloudyBtstrp.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: CloudyBtstrp.exe
ProductName: cloudybootstrapnotretard
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cloudybootstrapinstaller.exe conhost.exe no specs cloudy.exe cpr.exe conhost.exe no specs svchost.exe cloudybootstrapinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1112\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CPR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1432"C:\ProgramData\Cloudy\CPR.exe" C:\ProgramData\Cloudy\CPR.exe
cloudy.exe
User:
admin
Company:
KeyAuth LLC
Integrity Level:
HIGH
Description:
Loader
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\programdata\cloudy\cpr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3848"C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe" C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
cloudybootstrapnotretard
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cloudybootstrapinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5940\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CloudyBootstrapInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6260"C:\ProgramData\Cloudy\cloudy.exe" C:\ProgramData\Cloudy\cloudy.exe
CloudyBootstrapInstaller.exe
User:
admin
Integrity Level:
HIGH
Description:
cloudy
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\programdata\cloudy\cloudy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6752"C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe" C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
cloudybootstrapnotretard
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cloudybootstrapinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
5 963
Read events
5 852
Write events
110
Delete events
1

Modification events

(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
28
Suspicious files
1 223
Text files
290
Unknown types
5

Dropped files

PID
Process
Filename
Type
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\Testr.zip —
MD5:—
SHA256:—
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\clojure\clojure.jsbinary
MD5:672E3B1B27B133F9BF523FED06B174D7
SHA256:CDC784CA79FEAEDE6B98AAFB4A9B09BC519261B44E0D58597D47AE1BD9B514F3
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\coffee\coffee.jsbinary
MD5:778339EB31AFB7882486697D98C53B3A
SHA256:DCDD9BF38160BBAF18D8F2A976D04BB17BA143A4924058466B82DDA2C1BE3BCD
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\CHANGELOG.mdtext
MD5:0DAD2AE1A0F47A398135CBA485EF8624
SHA256:830C163B24384D1BFC06AFB61449F15A5D19C4B01940E7AFCB715AEE9F4DA3A0
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\cameligo\cameligo.jsbinary
MD5:C6716EDF2144EECA4EA7830BAA11BA15
SHA256:FD96854FE7970A6E9839396E8DAAED9412CDC531E36BAF2DFBAA2F6B61937B22
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\bat\bat.jsbinary
MD5:C0EA60D00820705CAC4D2857DA94E7F8
SHA256:794CE7C333161E68FFF0C6A4A1BC7CDC678073147DC48E1A49AA5313483FC4AB
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\base\browser\ui\codicons\codicon\codicon.ttfbinary
MD5:B13DAAAD214EF227A36FEFD95D924380
SHA256:774C4ACC42F27289850537E2B6E9B85F67FDE54145F6F41876DC4F65B45A4A20
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\abap\abap.jsbinary
MD5:50F649F3E45A1F5C7F71F409BD5FB8A1
SHA256:C7BC6470BFB0D82DBC422CA008DFB8B25FB02C8216CC3EE91E9E3971764EFB2B
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\apex\apex.jsbinary
MD5:96D8E2D7E01AF1BF87B50E397EF14E1D
SHA256:12A9DE1BD5188E228D1B225B93BC1DE7545AA3EEB5DF2942D1B30DE8B4102279
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\index.htmlhtml
MD5:59AE23B9C91F7EFD1E55258371EC8FC8
SHA256:8FBC36D8B133076122965EFD33CAE68D083ED730392F9156B15C1C48E72110CD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
66
DNS requests
42
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.18.69.217:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.23.154.57:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6436
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4904
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4700
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
4700
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
95.101.23.73:443
www.bing.com
Akamai International B.V.
AT
whitelisted
1252
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
2.23.154.57:80
crl.microsoft.com
Akamai International B.V.
AT
whitelisted
5488
MoUsoCoreWorker.exe
2.18.69.217:80
www.microsoft.com
AKAMAI-AS
AT
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6752
CloudyBootstrapInstaller.exe
185.199.111.133:443
raw.githubusercontent.com
FASTLY
US
shared

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
www.bing.com
  • 95.101.23.73
  • 95.101.23.65
  • 95.101.23.75
  • 95.101.23.91
  • 95.101.23.80
  • 95.101.23.82
  • 95.101.23.98
  • 95.101.23.99
  • 95.101.23.72
whitelisted
crl.microsoft.com
  • 2.23.154.57
  • 104.103.72.96
whitelisted
www.microsoft.com
  • 2.18.69.217
  • 23.32.185.131
whitelisted
google.com
  • 142.250.184.238
whitelisted
raw.githubusercontent.com
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.109.133
shared
github.com
  • 140.82.121.3
shared
objects.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
shared
login.live.com
  • 20.190.159.73
  • 20.190.159.4
  • 40.126.31.71
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.64
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Potentially Bad Traffic
ET INFO KeyAuth Open-source Authentication System Domain in DNS Lookup (keyauth .win)
—
—
Potentially Bad Traffic
ET INFO KeyAuth Open-source Authentication System Domain (keyauth .win) in TLS SNI
Process
Message
cloudy.exe
Making API request to: https://scriptblox.com/api/script/search?q=a&mode=free&page=1
cloudy.exe
Loading script hub...
cloudy.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
cloudy.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
cloudy.exe
API response: {"result":{"totalPages":913,"scripts":[{"_id":"6729299f2fcf8c979d6f33cc","title":"Finger Getter","game":{"gameId":5130598377,"name":"[???HALLOWEEN???] A Universal Time 3.9 ??","imageUrl":"/images/script/5130598377-1730750879339.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/HALLOWEEN-A-Universal-Time-3.9-Finger-Getter-21719\"))()","slug":"HALLOWEEN-A-Universal-Time-3.9-Finger-Getter-21719","verified":true,"key":false,"keyLink":"","views":14312,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-04T20:07:59.426Z","updatedAt":"2024-11-05T19:08:42.483Z","__v":0,"matched":["features","game","script","tags","script"]},{"_id":"6728fb1b8c508a13959cd2e1","title":"Custom Entity Sp4wner V2","game":{"gameId":6516141723,"name":"?? DOORS ???","imageUrl":"https://tr.rbxcdn.com/180DAY-e144f55174652c1476802c98f0458fc8/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/DOORS-Custom-Entity-S*er-V2-21705\"))()","slug":"DOORS-Custom-Entity-S*er-V2-21705","verified":true,"key":false,"keyLink":"","views":5774,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-04T16:49:31.581Z","updatedAt":"2024-11-05T19:08:24.442Z","__v":0,"matched":["features","script","script"]},{"_id":"67280e0c581b5312741da6dd","title":"AtherHub","game":{"gameId":16732694052,"name":"[??] Fisch","imageUrl":"https://tr.rbxcdn.com/180DAY-38bef830053efbb55b10f4bae47ad954/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Fisch-AtherHub-21654\"))()","slug":"Fisch-AtherHub-21654","verified":true,"key":true,"keyLink":"https://ads.luarmor.net/get_key?for=AtherHub_Key-uOsEXGVZazzi","views":13333,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-03T23:58:04.587Z","updatedAt":"2024-11-05T19:09:25.643Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"67278cec8c508a1395821af6","title":"BypassBuddy","game":{"gameId":6114607,"name":"Universal Script ??","imageUrl":"/images/script/6114607-1730645228071.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Universal-Script-BypassBuddy-21615\"))()","slug":"Universal-Script-BypassBuddy-21615","verified":true,"key":false,"keyLink":"","views":7836,"scriptType":"free","isUniversal":true,"isPatched":false,"visibility":"public","createdAt":"2024-11-03T14:47:08.173Z","updatedAt":"2024-11-05T19:08:24.695Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"672168f0d00558f558695e8a","title":"Reaper Hub","game":{"gameId":8737899170,"name":"Pet Simulator 99! ??","imageUrl":"/images/script/8737899170-1730242800806.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Pet-Simulator-99!-Reaper-Hub-21267\"))()","slug":"Pet-Simulator-99!-Reaper-Hub-21267","verified":true,"key":true,"keyLink":"https://discord.gg/reaperhub","views":12135,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-29T23:00:00.873Z","updatedAt":"2024-11-05T19:09:08.584Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"6720198f5cfd33fad1358efe","title":"auto sell","game":{"gameId":2414851778,"name":"[??] Dungeon Quest! ?? RPG Adventure","imageUrl":"https://tr.rbxcdn.com/180DAY-4081183b7cd3dae8101622b46342c961/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Dungeon-Quest!-RPG-Adventure-auto-sell-21196\"))()","slug":"Dungeon-Quest!-RPG-Adventure-auto-sell-21196","verified":true,"key":false,"keyLink":"","views":8338,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-28T23:09:03.511Z","updatedAt":"2024-11-05T19:08:24.760Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"671fe45cd46e216416caa7a3","title":"quantum","game":{"gameId":16146832113,"name":"[UPDATE 1] Anime Vanguards","imageUrl":"https://tr.rbxcdn.com/180DAY-03c2c8ef3b93d742
cloudy.exe
43c16419bb64e971/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/UPDATE-1-Anime-Vanguards-quantum-21184\"))()","slug":"UPDATE-1-Anime-Vanguards-quantum-21184","verified":true,"key":false,"keyLink":"","views":20533,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-28T19:22:04.386Z","updatedAt":"2024-11-05T19:08:24.729Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"671eec80d46e216416b329ab","title":"The best free GUI script lots of features!","game":{"gameId":7991339063,"name":"Rainbow Friends","imageUrl":"https://tr.rbxcdn.com/180DAY-5bbf374367dd1c6e276173acdc4e8bef/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Rainbow-Friends-the-best-free-GUI-script-lots-of-features-21152\"))()","slug":"Rainbow-Friends-the-best-free-GUI-script-lots-of-features-21152","verified":true,"key":true,"keyLink":"https://raw.githubusercontent.com/zReal-King/Key-System/refs/heads/main/Key","views":36404,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-28T01:44:32.855Z","updatedAt":"2024-11-05T19:08:45.566Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"671da0b824507696b10f783d","title":"The Best Free PS99 Script [ZapHub] (Halloween Update 2)","game":{"gameId":8737899170,"name":"Pet Simulator 99! ??","imageUrl":"https://tr.rbxcdn.com/180DAY-f4d2688dcef7e2fdda13cf9d1a866f22/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Pet-Simulator-99!-The-Best-Free-PS99-Script-ZapHub-Halloween-Update-21153\"))()","slug":"Pet-Simulator-99!-The-Best-Free-PS99-Script-ZapHub-Halloween-Update-21153","verified":true,"key":true,"keyLink":"https://linkvertise.com/608384/zaphub-key-system","views":37757,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-27T02:08:56.447Z","updatedAt":"2024-11-05T19:09:08.325Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"671d79a2800ca506e424685a","title":"INFINITE MONEY Shinjuku","game":{"gameId":3039388345,"name":"Shinjuku, 2006","imageUrl":"https://tr.rbxcdn.com/180DAY-d9887bfbe3a040777a5aa5f7b6d2cfe4/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Shinjuku-2006-INFINITE-MONEY-Shinjuku-21144\"))()","slug":"Shinjuku-2006-INFINITE-MONEY-Shinjuku-21144","verified":true,"key":false,"keyLink":"","views":21713,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-26T23:22:10.665Z","updatedAt":"2024-11-05T19:08:45.390Z","__v":0,"matched":["features","script","tags","script"]},{"_id":"671c8c4935aa20cef02ddb37","title":"OP AUTOFARM FREE","game":{"gameId":2753915549,"name":"Blox Fruits","imageUrl":"https://tr.rbxcdn.com/180DAY-5304fe8fb874c7244eb4fe24ff324b17/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Blox-Fruits-OP-AUTOFARM-FREE-21073\"))()","slug":"Blox-Fruits-OP-AUTOFARM-FREE-21073","verified":true,"key":true,"keyLink":"https://nicuse.xyz/getkey/","views":34186,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-26T06:29:29.415Z","updatedAt":"2024-11-05T19:09:08.493Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"6719a4ae492ffc6e57a85355","title":"AtherHub","game":{"gameId":18901165922,"name":"PETS GO! ? [NEW]","imageUrl":"https://tr.rbxcdn.com/180DAY-44e39595f727387d507eb5da80c9b33e/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/PETS-GO!-NEW-AtherHub-20940\"))()","slug":"PETS-GO!-NEW-AtherHub-20940","verified":true,"key":false,"keyLink":"","views":30309,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-24T01:36:46.869Z","updatedAt":"2024-11-05T19:09:08.541Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"67192c35421
cloudy.exe
a3c1e76b8bfb8","title":"Cndy Frm l Open Source","game":{"gameId":537413528,"name":"Build A Boat For Treasure","imageUrl":"/images/script/537413528-1729702964940.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Build-A-Boat-For-Treasure-Cndy-Frm-l-Open-Source-20920\"))()","slug":"Build-A-Boat-For-Treasure-Cndy-Frm-l-Open-Source-20920","verified":true,"key":false,"keyLink":"","views":23776,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-23T17:02:45.008Z","updatedAt":"2024-11-05T19:08:24.727Z","__v":0,"matched":["features","game","script","tags","script"]},{"_id":"67181e9849f9251a219646c0","title":"Ultimate OP Auto Parry Instant Win Auto Walk Best Script","game":{"gameId":15002061926,"name":"Death Ball","imageUrl":"/images/script/15002061926-1729633944670.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Death-Ball-Ultimate-OP-Auto-Parry-Instant-Win-Auto-Walk-Best-Script-20880\"))()","slug":"Death-Ball-Ultimate-OP-Auto-Parry-Instant-Win-Auto-Walk-Best-Script-20880","verified":true,"key":true,"keyLink":"https://discord.gg/sd8EfWv9x3","views":45884,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-22T21:52:24.739Z","updatedAt":"2024-11-05T19:09:08.514Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"671816e7de464791e74adbe3","title":"Reaper Hub","game":{"gameId":18901165922,"name":"PETS GO! ? [NEW]","imageUrl":"/images/script/18901165922-1729631975037.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/PETS-GO!-NEW-Reaper-Hub-20879\"))()","slug":"PETS-GO!-NEW-Reaper-Hub-20879","verified":true,"key":true,"keyLink":"https://discord.gg/reaperhub","views":40294,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-22T21:19:35.129Z","updatedAt":"2024-11-05T19:09:08.590Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"6717434d7f400587946bdf80","title":"cJSON","game":{"gameId":9856211,"name":"Universal Script ??","imageUrl":"/images/script/9856211-1729577804978.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Universal-Script-cJSON-20830\"))()","slug":"Universal-Script-cJSON-20830","verified":true,"key":false,"keyLink":"","views":25290,"scriptType":"free","isUniversal":true,"isPatched":false,"visibility":"public","createdAt":"2024-10-22T06:16:45.052Z","updatedAt":"2024-11-05T19:08:59.400Z","__v":0,"matched":["features","game","script","script"]},{"_id":"67173569967fd5b7871275a2","title":"AtherHub","game":{"gameId":142823291,"name":"Murder Mystery 2","imageUrl":"https://tr.rbxcdn.com/180DAY-84ee08213272a584f2da956ca50eee99/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Murder-Mystery-2-AtherHub-20826\"))()","slug":"Murder-Mystery-2-AtherHub-20826","verified":true,"key":true,"keyLink":"https://ads.luarmor.net/get_key?for=AtherHub_Key-uOsEXGVZazzi","views":49878,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-22T05:17:29.313Z","updatedAt":"2024-11-05T19:08:44.879Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"6716791618c84ec0cb1cce43","title":"Ultimate Auto Farm Unlocker AFK Mode Auto Use OP Script","game":{"gameId":18901165922,"name":"PETS GO! ? [NEW]","imageUrl":"/images/script/18901165922-1729526038822.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/PETS-GO!-NEW-Ultimate-Auto-Farm-Unlocker-AFK-Mode-Auto-Use-OP-Script-20782\"))()","slug":"PETS-GO!-NEW-Ultimate-Auto-Farm-Unlocker-AFK-Mode-Auto-Use-OP-Script-20782","verified":true,"key":true,"keyLink":"https://discord.gg/sd8EfWv9x3","views":53644,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-21T15:53:58.898Z","updatedAt":"2024-11-05T19:09:08.496Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"671631cfc5bea3a9652b45b8","title":"Knife Ability Test The #1 free GUI script lots o
cloudy.exe
f features!","game":{"gameId":621129760,"name":"KAT","imageUrl":"https://tr.rbxcdn.com/180DAY-8a2f61f1b81b6de0462f4e64e4f17b72/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/KAT-THE-BEST-FREE-GUI-SCRIPT-LOTS-OF-FEATURES-20766\"))()","slug":"KAT-THE-BEST-FREE-GUI-SCRIPT-LOTS-OF-FEATURES-20766","verified":true,"key":true,"keyLink":"https://raw.githubusercontent.com/zReal-King/Key-System/refs/heads/main/Key","views":42469,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-21T10:49:51.466Z","updatedAt":"2024-11-05T19:08:46.520Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"67158bbc344afd8b17c79bc8","title":"Evade The #1 free GUI script lots of features!","game":{"gameId":9872472334,"name":"???Evade ???","imageUrl":"https://tr.rbxcdn.com/180DAY-dd74af00361341b1f9e7eabb53f98b8d/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Evade-Evade-The-Best-Free-GUI-Script-lots-of-Features-20718\"))()","slug":"Evade-Evade-The-Best-Free-GUI-Script-lots-of-Features-20718","verified":true,"key":true,"keyLink":"https://raw.githubusercontent.com/zReal-King/Key-System/refs/heads/main/Key","views":46183,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-20T23:01:16.555Z","updatedAt":"2024-11-05T19:08:45.403Z","__v":0,"matched":["features","game","script","tags","title","script"]}]}}
cloudy.exe
Script hub loaded successfully.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CloudyBootstrapInstaller.exe