SZ
Detected
Synapse Z
ScriptBunker records 98% sUNC and Detected. The missing 2% is a specific list of functions, not a vague gap.
sirhurt — measurement rail
What 100% sUNC covers
ScriptBunker records SirHurt at 100% sUNC and 99% UNC . That means every standard function in the sUNC test suite is implemented and working. A script that calls those functions will not throw a missing-function error.
The suite does not inspect the loader. It runs inside the Lua environment and reports which functions work. A malicious loader and a clean loader can both pass 100% sUNC if the executor functions are intact.
sUNC
100%
Every function passes
UNC
99%
One function short of full
Decompiler
Yes
Built into the build
What "Detected" means separately
ScriptBunker marks SirHurt as Detected . That is a game-security signal. It means the anti-cheat recognizes the executor. It does not mean the executable contains malware.
ScriptBunker itself adds the caveat: "Not marked detected" is not a guarantee of safety . The same caveat applies in reverse. "Detected" is a ban-risk signal, not a malware verdict.
Grokipedia records that version V5.414 was marked OUTDATED, with its last update dated January 31, 2026 . The current tracker entry shows V5.473, last updated October 13, 2026 . The build has moved forward. The detection status has not.
What Triage observed
Triage is a public sandbox. It scored sirhurt.dll at 3/10 and sirhurt.exe at 3/10 . A 3/10 score is a behavioral observation, not a malware classification. It is lower than Volt's 7/10 and Potassium's 6–7/10.
The Triage sample pages reviewed here do not list specific behavioral flags beyond the score. The score itself is the signal: the sandbox did not observe the higher-risk behaviors it flags in other samples.
What the domain reputation says
Gridinsoft flags sirhurt.org with a 12/100 trust score, six blacklist detections, and a domain registered February 5, 2026 — roughly two months before the scan . The same scan notes a "Free Robux" risk indicator on the site .
ScamAdviser records a 0 trust score for the same domain, citing a low Tranco rank, a young domain, and a registrar with a high percentage of spam and fraud sites .
A domain reputation score is not a file verdict. It measures the website, not the binary. A flagged domain can host a legitimate file, and a clean domain can host a malicious one. The two measurements are separate.
Sources: ScriptBunker SirHurt · Triage samples · Gridinsoft domain scan · ScamAdviser . Each measurement answers a different question.
Why a perfect coverage score and a detection flag coexist
sUNC tests functions. Detection tests whether the anti-cheat recognizes the executor. Those are different questions asked at different layers of the stack.
A build can implement every standard function and still be recognized by the anti-cheat, because the anti-cheat does not care whether getgenv works. It cares whether the process is doing something it recognizes as unauthorized. Function coverage and detection status are orthogonal. Neither one implies the other.
The practical consequence for a user is that the sUNC score tells you which scripts will run. The detection flag tells you whether using the executor carries a ban risk. Both are useful. Neither one is a safety rating.
Why the domain reputation is a fourth, separate measurement
Gridinsoft's 12/100 score for sirhurt.org measures the website, not the file . It weighs domain age, blacklist hits, and on-page signals. A "Free Robux" indicator on a site that sells a paid executor is a legitimate warning sign about the site's practices, but it does not tell you what is inside the DLL.
Triage's 3/10 score is closer to the file, but it is still behavioral, not a malware verdict . The four measurements — coverage, detection, sandbox behavior, domain reputation — each answer a different question. This page keeps them separate because conflating them is how listings become misleading.
The four measurements, compared
| Measurement | Value | What it answers | What it does not answer |
|---|---|---|---|
| sUNC | 100% | Do the standard functions exist? | Is the loader clean? |
| Detection | Detected | Does the anti-cheat recognize it? | Does it contain malware? |
| Triage | 3/10 | What did the sandbox observe? | Is it safe to run? |
| Domain trust | 12/100 | Does the website have a clean reputation? | Is the file on it clean? |
Each row is a separate measurement. Combining them into a single "score" would obscure which question is being answered.
What this page does not claim
- This page does not claim SirHurt is malware. It records four separate measurements from four separate sources .
- This page does not claim the 12/100 domain score applies to the binary. It measures the website's reputation, not the file's contents .
- This page does not claim the Triage 3/10 score is a safety clearance. It is a behavioral observation, not an audit .
SirHurt questions, separated from the reputation noise
How can SirHurt score 100% on sUNC and still be Detected?
Because the two measurements ask different questions. sUNC tests whether standard functions exist. Detection tests whether the anti-cheat recognizes the process. A build can implement every function and still be recognized. The two signals are orthogonal .
What does the Triage 3/10 score mean?
Triage scored sirhurt.dll at 3/10 and sirhurt.exe at 3/10 . That is a behavioral observation from a public sandbox. It is lower than the scores Triage assigned to Volt and Potassium, but it is not a malware classification.
Why is sirhurt.org flagged by Gridinsoft?
Gridinsoft cites six blacklist detections, a young domain, and a "Free Robux" risk indicator . ScamAdviser also records a 0 trust score, citing a low Tranco rank and a registrar with a high spam percentage . These are website reputation signals, not file verdicts.
Is SirHurt V5.414 still the current version?
No. Grokipedia records V5.414 as OUTDATED, last updated January 31, 2026 . ScriptBunker records the current version as V5.473, last updated October 13, 2026 . The build has moved forward.
Can I download SirHurt from this page?
Not yet. The Download button is a placeholder. When you have a confirmed source and choose to link it, replace the href. Until then, this page serves no file.
Why does this page look different from Synapse Z's?
Because the evidence is shaped differently. Synapse Z has layers of related coverage and detection evidence. SirHurt has four measurements that come from four unrelated sources — a tracker, a sandbox, a domain scanner, and a second domain scanner. The layout uses a vertical navigation rail so each measurement can be read on its own terms without implying they combine into a single score.
Related profiles
P
Tracker only
Potassium
Discord-gated distribution, kernel-level injection, Triage 6–7/10. The channel is documented. The file is not on a public page.
V
Tracker only
Volt
ScriptBlox records 100% sUNC and a rebrand from AWP.GG. A Triage score of 7/10 is the only independent signal.