Publisher and signing
The primary trust anchor: verify the signature first, the hash second.
Publisher (subject)
DREAM VPS LTD (O=DREAM VPS LTD, C=IL), Private Organization, the company behind Cloudraw
Certificate
Sectigo Public Code Signing CA EV R36 (Extended Validation)
Certificate thumbprint (SHA-1)
615EFD6ABE022329B865A83C21AD9E7024E03A91
Timestamping
RFC 3161, timestamp.sectigo.com
Cloudraw Connect for Windows current 0.4.7
The desktop app your users run. It signs them in and connects them only to what your organisation allows.
Install folder
C:\Program Files\Cloudraw Connect\
Tunnel service
cloudraw-tunnel, LocalSystem, automatic start
Local control channel
\\.\pipe\cloudraw-tunnel.sock
Local-only named pipe between the app and its service. Since 0.3.6 it accepts only the signed Cloudraw Connect app and administrators.
Network adapter
WinTun (signed virtual adapter driver)
| File | Version | SHA-256 |
|---|---|---|
| cloudraw-connect-setup-0.4.7.exe (installer) | 0.4.7 | 479403e3ebc0591ca84d4bcb4c7236b92f557c1338e12f125f6cf80268234f72 |
| Cloudraw Connect.exe (app) | 0.4.7 | ac0662b706689d0844cd9235c3d931976f8d358cbfa5968f791d8981bf24ddff |
| cloudraw-tunnel.exe (tunnel service) | 0.4.7 | 45f3465a102389b93abd62e1162a21936f1d35303ac787a48aeac9cacb1a5ed9 |
Download: latest release · cloudraw-connect-setup-0.4.7.exe
Older releases
| File | Version | SHA-256 |
|---|---|---|
| cloudraw-connect-setup-0.4.6.exe (installer) | 0.4.6 | d5cfa09fde4c9630ea6dcea63ddc396acdcf901628a711ea06d69a63d1eba204 |
| Cloudraw Connect.exe (app) | 0.4.6 | a82abe9acc89476095b259eeba6a701789f80e681b704a52acc09e42d3a7d4c5 |
| cloudraw-tunnel.exe (tunnel service) | 0.4.6 | 5c8583419514b053600e7a0c510815742f42e6962db495d347f91bc6e911a966 |
| cloudraw-connect-setup-0.3.8.exe (installer) | 0.3.8 | b4af9b1b701c1e2872b83808821a31e4c5fa390750b16d904e5288a1b9a03eff |
| Cloudraw Connect.exe (app) | 0.3.8 | 94ec10ac42bfd5754926aeb970bf0a60a67cb09cfb7dcc4f9d7bedc0c6474265 |
| cloudraw-tunnel.exe (tunnel service) | 0.3.8 | 447d578a76a463ddce876dfb533b7dfc1d0d278ffa35915e2fdcb34761588993 |
| cloudraw-connect-setup-0.3.7.exe (installer) | 0.3.7 | e725db4d72da021ad56f243eb79c77f9190dde5b916ebba8ed6fcfce163ce409 |
| Cloudraw Connect.exe (app) | 0.3.7 | 6ea8e52139e114e4d3f37d99900a0a777360d364b5c5e2108991bd52c28832ba |
| cloudraw-tunnel.exe (tunnel service) | 0.3.7 | 2a6208ff4629cf978e45a57255849f85cc2293625d2989e3f28d443fb27651c5 |
| cloudraw-connect-setup-0.3.6.exe (installer) | 0.3.6 | fa5abde4a8619b32587b1dc5c80c0fb5f1af50b96b4b4d628d7f2b82b1b93b85 |
| Cloudraw Connect.exe (app) | 0.3.6 | 51380cea57222d5c354ccaaafb6e2a355b2f1650a37b64a696739f6732b800b0 |
| cloudraw-tunnel.exe (tunnel service) | 0.3.6 | a097dca7b1c6951c015c7d96b0f2890dd8a3baf7364596d89a3b16b69de1f5b2 |
| cloudraw-connect-setup-0.3.3.exe (installer) | 0.3.3 | f21404396b867dadcd981c0ed2b0dde6e589b8f375c1d401666b7bbc248078b0 |
| Cloudraw Connect.exe (app) | 0.3.3 | 1cfffe671479f53788cf4f7c06452fd58dbc8004d6eaa77d24e9375ef19d55f1 |
| cloudraw-connect-setup-0.3.2.exe (installer) | 0.3.2 | 29adfaf9609fc0bebe137eeddfb465fdec2419345c87c2b924c42cb461c3b0cd |
| Cloudraw Connect.exe (app) | 0.3.2 | 8f3c850bea3b2361b728fb3f53f4324d810225a576175f57cf81e5485827a120 |
| cloudraw-connect-setup-0.1.36.exe (installer) | 0.1.36 | d184cc675bb0b948cd9763f8e272ef2cd2e5bd3f0887a21472b5976220c7a658 |
| Cloudraw Connect.exe (app) | 0.1.36 | 4a1b9499ce00e05ef45f1266ad9fd2a61dae09c613d94fdb3d7a2bfb212e738f |
| cloudraw-connect-setup-0.1.35.exe (installer) | 0.1.35 | 7aa011273919e02fbe592f7be3d3b7edcd3979bc13b60c9f2f2b1e54fefe2458 |
| Cloudraw Connect.exe (app) | 0.1.35 | 0fb4a87b66e3ff53c0fc9e36358fa0df0710e0d6bc8c3c59c287a73722bca81b |
| cloudraw-connect-setup-0.1.34.exe (installer) | 0.1.34 | 92174269f1718f20d40dcc9ce7db5b1fc9ba24d34621e1eeb557df513d1a7d43 |
| Cloudraw Connect.exe (app) | 0.1.34 | 6bb5c902eec173dafcd4d1b66f3d1cec27135c9e79b29a867b225d8e1a1c6a14 |
| cloudraw-connect-setup-0.1.33.exe (installer) | 0.1.33 | 9162f179b7189d25ac2c14fc3625b7291af9b1bbca3a515d3c37a211a51c42f7 |
| Cloudraw Connect.exe (app) | 0.1.33 | 83113f8c91ca20445aa3781e08e4b85de03992d5b9b91a09cc3c4ced893bc032 |
| cloudraw-connect-setup-0.1.32.exe (installer) | 0.1.32 | 02f47b87db06b5ad78823951e6a6aec55b815224d339ef5c0c09bc3bfed4a799 |
| Cloudraw Connect.exe (app) | 0.1.32 | 937aa6f1d5803062f700bb67a1efda125aaf1de5fddfa6eb7f0b630cdb97aeee |
| cloudraw-connect-setup-0.1.31.exe (installer) | 0.1.31 | ae4c360b27beb866c71b9b4f48f29ff6811e1637105d0f79a735c2e4acb671cd |
| Cloudraw Connect.exe (app) | 0.1.31 | b0e380a9e86b8b4261d069a658a5449654e295c9e191f7c6280b1161eeb4a402 |
| tunnel service of releases up to 0.3.3 (file ziti-edge-tunnel.exe) | ≤ 0.3.3 | 146b59bce3efa304479d3b8153971eaf341572e10f852421ebf040bc17c6de2c |
Cloudraw Connector
Runs inside your network and publishes only the apps you choose, without opening anything to the internet.
Service
cloudraw-connector
Install folder (Windows)
C:\Program Files\Cloudraw Connector\
Behaviour
Outbound-only; no inbound ports; reaches only the addresses you publish.
Checksums
SHA256SUMS.txt (EV-signed installer and MSI)
Network: outbound TCP 443 only
Allow these destinations. Nothing listens on your machines.
| Destination | Purpose |
|---|---|
| ctrl1.cloudraw.com:443 | Control plane: sign-in, enrollment and policy |
| *.edge.cloudraw.com:443 (e.g. il1.edge.cloudraw.com) | Cloudraw network edges: the encrypted traffic to your apps |
| orchestrator-stg.cloudraw.com:443 | Signed downloads, updates and diagnostics (staging) |
| downloads.cloudraw.com:443 | Client installers |
Device health it reports
Every 15 minutes and when it connects, so your access rules can require a healthy device. Exactly this list, nothing else.
- Windows version, build and update level; edition; last installed update; whether a restart is pending
- Disk encryption of the system drive (on / off / suspended, method, progress) and whether all fixed drives are encrypted
- Antivirus products registered with Windows (name, on/off, definitions up to date) and whether a known endpoint sensor is running
- Windows Firewall on/off per profile (domain, private, public)
- Screen-lock machine policy (on/off, timeout)
- Joined to a domain, to Entra ID, or enrolled in device management
- No software inventory
- No files, browsing or screen content
- No user names, keystrokes or location
Kept: the latest report, plus a log entry when a check changes. Your administrators see it on the device's page; the device's user sees the same report in the app.
What it does, and does not do
- Connects out over TLS only
- Updates are EV-signed, delivered over TLS and verified by the app before installing
- Uninstalls cleanly: removes its service, tasks and shortcuts
- No inbound ports or listening sockets reachable from your network
- No scanning, lateral movement or credential collection
- No persistence beyond its documented service
Allowlisting in EDR / antivirus
Behavioural EDRs may block the tunnel service's local control channel even though the program is signed. Allow it by publisher certificate (DREAM VPS LTD) where possible, otherwise by path and behaviour, not by hash alone (hashes change every release).
| Product | Where |
|---|---|
| SentinelOne | Console → Exclusions → publisher certificate DREAM VPS LTD (preferred), mode "Interoperability – Extended"; or path …\cloudraw-tunnel.exe. |
| ESET | Advanced setup (F5) → Detection engine → Exclusions → Performance (path) + HIPS → allow service cloudraw-tunnel. |
| CrowdStrike Falcon | Console → Exclusions → Sensor Visibility / ML exclusion for …\cloudraw-tunnel.exe. |
| Microsoft Defender | Exclusions → File → …\cloudraw-tunnel.exe (or a Defender for Endpoint allow indicator for the certificate). |
| Others | Allow path + behaviour for …\cloudraw-tunnel.exe and the cloudraw-tunnel service. |
Devices still on Cloudraw Connect 0.3.3 or older use the earlier tunnel file name listed under "Older releases". They move to cloudraw-tunnel.exe with the automatic update.
Open-source components
The tunnel service is built by Cloudraw from the source of the OpenZiti tunneler (Apache License 2.0) and EV-signed by DREAM VPS LTD. The virtual network adapter is WinTun. Full license notices are in Cloudraw Connect → Account & settings → Third-party licenses.