File name:

CloudyBootstrapInstaller.exe

Full analysis: https://app.any.run/tasks/71640468-094b-47bd-81ad-d89136d6542a
Verdict: Malicious activity
Analysis date: November 05, 2024, 19:07:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

9E681E8A6C61F2BD6CDE35842BDBE9D4

SHA1:

968CCFFF20166DB5AF30011E2D31F4D2AD5C52DA

SHA256:

F9CA892CE53CC42030042733AE4F131A9E335D342EAA895D6FEAF8AFD6C7ACC1

SSDEEP:

1536:Wf4j0QYluL5AE64Ujs5DVIQDX24wW8gioDPjVcl:9YluLWfsFV7DX2JWdhPJY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • CloudyBootstrapInstaller.exe (PID: 6752)

    • Executable content was dropped or overwritten

      • CloudyBootstrapInstaller.exe (PID: 6752)

  • INFO

    • Checks supported languages

      • CloudyBootstrapInstaller.exe (PID: 6752)

    • Creates files in the program directory

      • CloudyBootstrapInstaller.exe (PID: 6752)

    • Reads the computer name

      • CloudyBootstrapInstaller.exe (PID: 6752)

    • Reads the machine GUID from the registry

      • CloudyBootstrapInstaller.exe (PID: 6752)

    • Disables trace logs

      • CloudyBootstrapInstaller.exe (PID: 6752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (72.2)
.scr | Windows screen saver (12.9)
.dll | Win32 Dynamic Link Library (generic) (6.4)
.exe | Win32 Executable (generic) (4.4)
.exe | Generic Win/DOS Executable (1.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2084:07:27 23:13:25+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 13312
InitializedDataSize: 34816
UninitializedDataSize: -
EntryPoint: 0x539a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: cloudybootstrapnotretard
FileVersion: 1.0.0.0
InternalName: CloudyBtstrp.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: CloudyBtstrp.exe
ProductName: cloudybootstrapnotretard
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cloudybootstrapinstaller.exe conhost.exe no specs cloudy.exe cpr.exe conhost.exe no specs svchost.exe cloudybootstrapinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1112\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CPR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1432"C:\ProgramData\Cloudy\CPR.exe" C:\ProgramData\Cloudy\CPR.exe
cloudy.exe
User:
admin
Company:
KeyAuth LLC
Integrity Level:
HIGH
Description:
Loader
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\programdata\cloudy\cpr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3848"C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe" C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
cloudybootstrapnotretard
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cloudybootstrapinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5940\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CloudyBootstrapInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6260"C:\ProgramData\Cloudy\cloudy.exe" C:\ProgramData\Cloudy\cloudy.exe
CloudyBootstrapInstaller.exe
User:
admin
Integrity Level:
HIGH
Description:
cloudy
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\programdata\cloudy\cloudy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6752"C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe" C:\Users\admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
cloudybootstrapnotretard
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cloudybootstrapinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
5 963
Read events
5 852
Write events
110
Delete events
1

Modification events

(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6752) CloudyBootstrapInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CloudyBootstrapInstaller_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
28
Suspicious files
1 223
Text files
290
Unknown types
5

Dropped files

PID
Process
Filename
Type
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\Testr.zip —
MD5:—
SHA256:—
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\index.htmlhtml
MD5:59AE23B9C91F7EFD1E55258371EC8FC8
SHA256:8FBC36D8B133076122965EFD33CAE68D083ED730392F9156B15C1C48E72110CD
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\apex\apex.jsbinary
MD5:96D8E2D7E01AF1BF87B50E397EF14E1D
SHA256:12A9DE1BD5188E228D1B225B93BC1DE7545AA3EEB5DF2942D1B30DE8B4102279
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\base\worker\workerMain.jsbinary
MD5:6DCBB695DFDFFF091A88C7C5D7ABAF06
SHA256:90445461E39687CEB89ADCC0CC24A507D05757A82D2D922E326A2062B6F6A8FC
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\azcli\azcli.jsbinary
MD5:42A923C820D332DDFF89A68C376D4657
SHA256:09F4DD1E73F6BA879F28FB7E07930279AB4C5A295483799C53C6417FAE7B8D32
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\abap\abap.jsbinary
MD5:50F649F3E45A1F5C7F71F409BD5FB8A1
SHA256:C7BC6470BFB0D82DBC422CA008DFB8B25FB02C8216CC3EE91E9E3971764EFB2B
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\nls.metadata.jsonbinary
MD5:A2827169685AF87D243E7EEB3502F513
SHA256:500E1B23A18045BC82CE89BFA72269933B9AF147B01178E0102CBCC437077A83
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\dart\dart.jsbinary
MD5:344862A7AC127396FA25152F9D3D3D02
SHA256:6393139AA7FA19C2AA3207460A0B7AB5538CE96B470F7BB2CFD0DC6162DA4361
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\cpp\cpp.jsbinary
MD5:4267C07DC0EA63D7EBEA810584CD60FC
SHA256:7C0CF17651CF97B42714A99C06354822F98C676EA6F929BC25FA038E53A1FB48
6752CloudyBootstrapInstaller.exeC:\ProgramData\Cloudy\bin\Editor\package\dev\vs\basic-languages\bat\bat.jsbinary
MD5:C0EA60D00820705CAC4D2857DA94E7F8
SHA256:794CE7C333161E68FFF0C6A4A1BC7CDC678073147DC48E1A49AA5313483FC4AB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
66
DNS requests
42
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
2.23.154.57:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.18.69.217:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4904
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6436
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4700
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4700
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
95.101.23.73:443
www.bing.com
Akamai International B.V.
AT
whitelisted
1252
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
2.23.154.57:80
crl.microsoft.com
Akamai International B.V.
AT
whitelisted
5488
MoUsoCoreWorker.exe
2.18.69.217:80
www.microsoft.com
AKAMAI-AS
AT
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6752
CloudyBootstrapInstaller.exe
185.199.111.133:443
raw.githubusercontent.com
FASTLY
US
shared

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
www.bing.com
  • 95.101.23.73
  • 95.101.23.65
  • 95.101.23.75
  • 95.101.23.91
  • 95.101.23.80
  • 95.101.23.82
  • 95.101.23.98
  • 95.101.23.99
  • 95.101.23.72
whitelisted
crl.microsoft.com
  • 2.23.154.57
  • 104.103.72.96
whitelisted
www.microsoft.com
  • 2.18.69.217
  • 23.32.185.131
whitelisted
google.com
  • 142.250.184.238
whitelisted
raw.githubusercontent.com
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.109.133
shared
github.com
  • 140.82.121.3
shared
objects.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
shared
login.live.com
  • 20.190.159.73
  • 20.190.159.4
  • 40.126.31.71
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.64
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2172
svchost.exe
Potentially Bad Traffic
ET INFO KeyAuth Open-source Authentication System Domain in DNS Lookup (keyauth .win)
1432
CPR.exe
Potentially Bad Traffic
ET INFO KeyAuth Open-source Authentication System Domain (keyauth .win) in TLS SNI
Process
Message
cloudy.exe
Making API request to: https://scriptblox.com/api/script/search?q=a&mode=free&page=1
cloudy.exe
Loading script hub...
cloudy.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
cloudy.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
cloudy.exe
API response: {"result":{"totalPages":913,"scripts":[{"_id":"6729299f2fcf8c979d6f33cc","title":"Finger Getter","game":{"gameId":5130598377,"name":"[???HALLOWEEN???] A Universal Time 3.9 ??","imageUrl":"/images/script/5130598377-1730750879339.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/HALLOWEEN-A-Universal-Time-3.9-Finger-Getter-21719\"))()","slug":"HALLOWEEN-A-Universal-Time-3.9-Finger-Getter-21719","verified":true,"key":false,"keyLink":"","views":14312,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-04T20:07:59.426Z","updatedAt":"2024-11-05T19:08:42.483Z","__v":0,"matched":["features","game","script","tags","script"]},{"_id":"6728fb1b8c508a13959cd2e1","title":"Custom Entity Sp4wner V2","game":{"gameId":6516141723,"name":"?? DOORS ???","imageUrl":"https://tr.rbxcdn.com/180DAY-e144f55174652c1476802c98f0458fc8/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/DOORS-Custom-Entity-S*er-V2-21705\"))()","slug":"DOORS-Custom-Entity-S*er-V2-21705","verified":true,"key":false,"keyLink":"","views":5774,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-04T16:49:31.581Z","updatedAt":"2024-11-05T19:08:24.442Z","__v":0,"matched":["features","script","script"]},{"_id":"67280e0c581b5312741da6dd","title":"AtherHub","game":{"gameId":16732694052,"name":"[??] Fisch","imageUrl":"https://tr.rbxcdn.com/180DAY-38bef830053efbb55b10f4bae47ad954/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Fisch-AtherHub-21654\"))()","slug":"Fisch-AtherHub-21654","verified":true,"key":true,"keyLink":"https://ads.luarmor.net/get_key?for=AtherHub_Key-uOsEXGVZazzi","views":13333,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-11-03T23:58:04.587Z","updatedAt":"2024-11-05T19:09:25.643Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"67278cec8c508a1395821af6","title":"BypassBuddy","game":{"gameId":6114607,"name":"Universal Script ??","imageUrl":"/images/script/6114607-1730645228071.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Universal-Script-BypassBuddy-21615\"))()","slug":"Universal-Script-BypassBuddy-21615","verified":true,"key":false,"keyLink":"","views":7836,"scriptType":"free","isUniversal":true,"isPatched":false,"visibility":"public","createdAt":"2024-11-03T14:47:08.173Z","updatedAt":"2024-11-05T19:08:24.695Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"672168f0d00558f558695e8a","title":"Reaper Hub","game":{"gameId":8737899170,"name":"Pet Simulator 99! ??","imageUrl":"/images/script/8737899170-1730242800806.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Pet-Simulator-99!-Reaper-Hub-21267\"))()","slug":"Pet-Simulator-99!-Reaper-Hub-21267","verified":true,"key":true,"keyLink":"https://discord.gg/reaperhub","views":12135,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-29T23:00:00.873Z","updatedAt":"2024-11-05T19:09:08.584Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"6720198f5cfd33fad1358efe","title":"auto sell","game":{"gameId":2414851778,"name":"[??] Dungeon Quest! ?? RPG Adventure","imageUrl":"https://tr.rbxcdn.com/180DAY-4081183b7cd3dae8101622b46342c961/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Dungeon-Quest!-RPG-Adventure-auto-sell-21196\"))()","slug":"Dungeon-Quest!-RPG-Adventure-auto-sell-21196","verified":true,"key":false,"keyLink":"","views":8338,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-28T23:09:03.511Z","updatedAt":"2024-11-05T19:08:24.760Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"671fe45cd46e216416caa7a3","title":"quantum","game":{"gameId":16146832113,"name":"[UPDATE 1] Anime Vanguards","imageUrl":"https://tr.rbxcdn.com/180DAY-03c2c8ef3b93d742
cloudy.exe
43c16419bb64e971/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/UPDATE-1-Anime-Vanguards-quantum-21184\"))()","slug":"UPDATE-1-Anime-Vanguards-quantum-21184","verified":true,"key":false,"keyLink":"","views":20533,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-28T19:22:04.386Z","updatedAt":"2024-11-05T19:08:24.729Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"671eec80d46e216416b329ab","title":"The best free GUI script lots of features!","game":{"gameId":7991339063,"name":"Rainbow Friends","imageUrl":"https://tr.rbxcdn.com/180DAY-5bbf374367dd1c6e276173acdc4e8bef/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Rainbow-Friends-the-best-free-GUI-script-lots-of-features-21152\"))()","slug":"Rainbow-Friends-the-best-free-GUI-script-lots-of-features-21152","verified":true,"key":true,"keyLink":"https://raw.githubusercontent.com/zReal-King/Key-System/refs/heads/main/Key","views":36404,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-28T01:44:32.855Z","updatedAt":"2024-11-05T19:08:45.566Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"671da0b824507696b10f783d","title":"The Best Free PS99 Script [ZapHub] (Halloween Update 2)","game":{"gameId":8737899170,"name":"Pet Simulator 99! ??","imageUrl":"https://tr.rbxcdn.com/180DAY-f4d2688dcef7e2fdda13cf9d1a866f22/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Pet-Simulator-99!-The-Best-Free-PS99-Script-ZapHub-Halloween-Update-21153\"))()","slug":"Pet-Simulator-99!-The-Best-Free-PS99-Script-ZapHub-Halloween-Update-21153","verified":true,"key":true,"keyLink":"https://linkvertise.com/608384/zaphub-key-system","views":37757,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-27T02:08:56.447Z","updatedAt":"2024-11-05T19:09:08.325Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"671d79a2800ca506e424685a","title":"INFINITE MONEY Shinjuku","game":{"gameId":3039388345,"name":"Shinjuku, 2006","imageUrl":"https://tr.rbxcdn.com/180DAY-d9887bfbe3a040777a5aa5f7b6d2cfe4/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Shinjuku-2006-INFINITE-MONEY-Shinjuku-21144\"))()","slug":"Shinjuku-2006-INFINITE-MONEY-Shinjuku-21144","verified":true,"key":false,"keyLink":"","views":21713,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-26T23:22:10.665Z","updatedAt":"2024-11-05T19:08:45.390Z","__v":0,"matched":["features","script","tags","script"]},{"_id":"671c8c4935aa20cef02ddb37","title":"OP AUTOFARM FREE","game":{"gameId":2753915549,"name":"Blox Fruits","imageUrl":"https://tr.rbxcdn.com/180DAY-5304fe8fb874c7244eb4fe24ff324b17/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Blox-Fruits-OP-AUTOFARM-FREE-21073\"))()","slug":"Blox-Fruits-OP-AUTOFARM-FREE-21073","verified":true,"key":true,"keyLink":"https://nicuse.xyz/getkey/","views":34186,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-26T06:29:29.415Z","updatedAt":"2024-11-05T19:09:08.493Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"6719a4ae492ffc6e57a85355","title":"AtherHub","game":{"gameId":18901165922,"name":"PETS GO! ? [NEW]","imageUrl":"https://tr.rbxcdn.com/180DAY-44e39595f727387d507eb5da80c9b33e/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/PETS-GO!-NEW-AtherHub-20940\"))()","slug":"PETS-GO!-NEW-AtherHub-20940","verified":true,"key":false,"keyLink":"","views":30309,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-24T01:36:46.869Z","updatedAt":"2024-11-05T19:09:08.541Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"67192c35421
cloudy.exe
a3c1e76b8bfb8","title":"Cndy Frm l Open Source","game":{"gameId":537413528,"name":"Build A Boat For Treasure","imageUrl":"/images/script/537413528-1729702964940.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Build-A-Boat-For-Treasure-Cndy-Frm-l-Open-Source-20920\"))()","slug":"Build-A-Boat-For-Treasure-Cndy-Frm-l-Open-Source-20920","verified":true,"key":false,"keyLink":"","views":23776,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-23T17:02:45.008Z","updatedAt":"2024-11-05T19:08:24.727Z","__v":0,"matched":["features","game","script","tags","script"]},{"_id":"67181e9849f9251a219646c0","title":"Ultimate OP Auto Parry Instant Win Auto Walk Best Script","game":{"gameId":15002061926,"name":"Death Ball","imageUrl":"/images/script/15002061926-1729633944670.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Death-Ball-Ultimate-OP-Auto-Parry-Instant-Win-Auto-Walk-Best-Script-20880\"))()","slug":"Death-Ball-Ultimate-OP-Auto-Parry-Instant-Win-Auto-Walk-Best-Script-20880","verified":true,"key":true,"keyLink":"https://discord.gg/sd8EfWv9x3","views":45884,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-22T21:52:24.739Z","updatedAt":"2024-11-05T19:09:08.514Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"671816e7de464791e74adbe3","title":"Reaper Hub","game":{"gameId":18901165922,"name":"PETS GO! ? [NEW]","imageUrl":"/images/script/18901165922-1729631975037.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/PETS-GO!-NEW-Reaper-Hub-20879\"))()","slug":"PETS-GO!-NEW-Reaper-Hub-20879","verified":true,"key":true,"keyLink":"https://discord.gg/reaperhub","views":40294,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-22T21:19:35.129Z","updatedAt":"2024-11-05T19:09:08.590Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"6717434d7f400587946bdf80","title":"cJSON","game":{"gameId":9856211,"name":"Universal Script ??","imageUrl":"/images/script/9856211-1729577804978.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Universal-Script-cJSON-20830\"))()","slug":"Universal-Script-cJSON-20830","verified":true,"key":false,"keyLink":"","views":25290,"scriptType":"free","isUniversal":true,"isPatched":false,"visibility":"public","createdAt":"2024-10-22T06:16:45.052Z","updatedAt":"2024-11-05T19:08:59.400Z","__v":0,"matched":["features","game","script","script"]},{"_id":"67173569967fd5b7871275a2","title":"AtherHub","game":{"gameId":142823291,"name":"Murder Mystery 2","imageUrl":"https://tr.rbxcdn.com/180DAY-84ee08213272a584f2da956ca50eee99/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Murder-Mystery-2-AtherHub-20826\"))()","slug":"Murder-Mystery-2-AtherHub-20826","verified":true,"key":true,"keyLink":"https://ads.luarmor.net/get_key?for=AtherHub_Key-uOsEXGVZazzi","views":49878,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-22T05:17:29.313Z","updatedAt":"2024-11-05T19:08:44.879Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"6716791618c84ec0cb1cce43","title":"Ultimate Auto Farm Unlocker AFK Mode Auto Use OP Script","game":{"gameId":18901165922,"name":"PETS GO! ? [NEW]","imageUrl":"/images/script/18901165922-1729526038822.png"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/PETS-GO!-NEW-Ultimate-Auto-Farm-Unlocker-AFK-Mode-Auto-Use-OP-Script-20782\"))()","slug":"PETS-GO!-NEW-Ultimate-Auto-Farm-Unlocker-AFK-Mode-Auto-Use-OP-Script-20782","verified":true,"key":true,"keyLink":"https://discord.gg/sd8EfWv9x3","views":53644,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-21T15:53:58.898Z","updatedAt":"2024-11-05T19:09:08.496Z","__v":0,"matched":["features","script","tags","title","script"]},{"_id":"671631cfc5bea3a9652b45b8","title":"Knife Ability Test The #1 free GUI script lots o
cloudy.exe
f features!","game":{"gameId":621129760,"name":"KAT","imageUrl":"https://tr.rbxcdn.com/180DAY-8a2f61f1b81b6de0462f4e64e4f17b72/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/KAT-THE-BEST-FREE-GUI-SCRIPT-LOTS-OF-FEATURES-20766\"))()","slug":"KAT-THE-BEST-FREE-GUI-SCRIPT-LOTS-OF-FEATURES-20766","verified":true,"key":true,"keyLink":"https://raw.githubusercontent.com/zReal-King/Key-System/refs/heads/main/Key","views":42469,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-21T10:49:51.466Z","updatedAt":"2024-11-05T19:08:46.520Z","__v":0,"matched":["features","game","script","tags","title","script"]},{"_id":"67158bbc344afd8b17c79bc8","title":"Evade The #1 free GUI script lots of features!","game":{"gameId":9872472334,"name":"???Evade ???","imageUrl":"https://tr.rbxcdn.com/180DAY-dd74af00361341b1f9e7eabb53f98b8d/500/280/Image/Jpeg/noFilter"},"script":"loadstring(game:HttpGet(\"https://rawscripts.net/raw/Evade-Evade-The-Best-Free-GUI-Script-lots-of-Features-20718\"))()","slug":"Evade-Evade-The-Best-Free-GUI-Script-lots-of-Features-20718","verified":true,"key":true,"keyLink":"https://raw.githubusercontent.com/zReal-King/Key-System/refs/heads/main/Key","views":46183,"scriptType":"free","isUniversal":false,"isPatched":false,"visibility":"public","createdAt":"2024-10-20T23:01:16.555Z","updatedAt":"2024-11-05T19:08:45.403Z","__v":0,"matched":["features","game","script","tags","title","script"]}]}}
cloudy.exe
Script hub loaded successfully.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CloudyBootstrapInstaller.exe