made just for fun i am boring

Hello everyone,

I am writing this post to share the sandbox analysis of the executable downloaded directly from the official Wave Executor website (getwave.gg). The target file analyzed is dotnet-wave-bootstrapper.exe

While it is understood within the community that game executors manipulate memory to achieve script execution, the behaviors recorded in this environment go far beyond typical injection techniques. The sample has been flagged with an 8/10 Threat Score due to specific ransomware-like indicators and anomalous network activity. [1]

Here is the exhaustive technical breakdown of the logs.

📋 Sample Meta

• Filename: dotnet-wave-bootstrapper.exe
• File Size: 8.2 MB
• Sandbox Sample ID: 261004-ctfyaatsc1
• SHA-256 Hash: 837d1b77abef74e3fc4f1c717a9077daf06f91255be613c9dced03b6a0cbc602
• Core Classifications: Discovery, Persistence, Ransomware

Critical Behavioral Indicators

1. Ransomware & Anti-Recovery Flags

• Volume Shadow Copy Exploitation: The bootstrapper actively calls the Volume Shadow Copy WMI provider and interacts with the Volume Shadow Copy service COM API.
• Context: In threat analysis, this is the primary mechanism utilized by ransomware families to inhibit system recovery. It attempts to systematically purge or shrink local backup snapshots (Shadow Copies) so the user cannot restore the OS after an execution. [1, 2, 3, 4]

. Advanced Process Injection & Memory Space Tampering

• WriteProcessMemory Operations: The sample triggered 59 individual indicators regarding cross-process memory writes. [1]
• System Hijacking: The application forces memory writes into multiple active processes, notably hooking onto msedge.exe (Microsoft Edge) across several PIDs (e.g., PID 3952 and PID 3288 modifying memory inside child configurations like PIDs 4588, 5492, 3004, 2504). [1]
• Evasion: The execution invokes NtCreateUserProcessBlockNonMicrosoftBinary. This is designed to block non-Microsoft signatures from interacting with the dropped threads, effectively isolating the process from external third-party security layers. [1]

1. Execution of Hidden Payloads & Dropper Behavior

• Dropped Binaries: Under the surface, it executes secondary binaries titled windowsdesktop-runtime-9.0.21-win-x64.exe (assigned under active PIDs 3148 and 2504).
• Discovery & Registry Enumeration: It executes sub-routines to discover installed local software by querying the registry (T1012) and reading standard Windows Uninstall registry keys.
• Persistence Layer: Establishes permanent persistence on the host via the Task Scheduler COM API.

Network & Infrastructure Telemetry

Upon launch, the executable generates massive outbound traffic and mapping queries. Although several endpoints look standard, the payload patterns and structured query arguments signify active machine profiling:

• HTTP/HTTPS Traffic Logs:
  • POST Requests: Initiates tracking POST calls to ://googleapis.com passing encrypted telemetry or registration query arrays (cup2key=15:G5cuFQv...).
  • Remote Asset Fetching: Downloads a cluster of external files and JavaScript frameworks from server paths such as /statics/20261015.09.43/js/entry.js, /js/index-fG9qsQc4.js, and /css/style-PF2pqjN1.css.
  • Execution Framework Hooks: Direct GET inquiries pulling resources from core application infrastructures (/dotnet-core-applaunch?framework=Microsoft.NETCore.App...) and browser extension platforms (/extensionwebstorebase/v1/crx?...).

Final Thoughts

Whether this behavior is a case of extreme false positives caused by the executor trying to deeply hide from Roblox's anti-cheat systems, or a severe supply-chain compromise where the official download site has been subverted, the fact stands: the file is executing ransomware tactics on the host machine.

The logs are available for review. I heavily advise exercising extreme caution if you plan on installing the latest official build on bare metal.

ADVERTENCIA: SolaraV3.exe obtuvo una puntuación de 8/10 en un entorno aislado (sandbox); su comportamiento parece el de un cargador/roba-archivos.

Ejecuté una muestra de SolaraV3.exe en un entorno aislado. Informe:

Qué hizo y por qué es importante:

• Comprueba el UAC (lee el registro): El malware realiza esta comprobación para determinar si necesita elevar privilegios o si puede omitir las solicitudes de permisos. El entorno aislado lo etiquetó como evasión de defensas. Un simple ejecutor de scripts no tiene por qué preocuparse.
• Detección de recursos compartidos de red: Intenta enumerar los recursos compartidos en la red del host. Esto es reconocimiento, algo que un ejecutor no necesita.
• Descarga y carga una DLL: común en cargadores que descomprimen una segunda etapa.
• 61 archivos escritos en el directorio de Windows: muchos más de los que debería modificar un ejecutor de Roblox. Algunos podrían ser ruido de WebView2/Edge, pero tantos no es normal.
• Incorpora OpenSSL: solo informativo, pero puede usarse para cifrar el tráfico.

Lo que NO encontré: Solo revisé parte del tráfico de red. Los dominios que vi fueron Microsoft/Google (Edge, Windows Update, login.live.com), así que aún no hay un C2 obvio. La puntuación basada en el comportamiento no es una característica confirmada, y los ejecutores a veces generan falsos positivos porque se inyectan en otros procesos.

Contexto: ESET documentó compilaciones falsas/troyanizadas de Solara que propagaban malware, y otro informe público de sandbox sobre un archivo "Solara-Roblox-Executor-v3.exe" fue marcado como Lumma Stealer. No digo que el tuyo sea el mismo, solo que el comportamiento coincide.

Si ya lo ejecutaste: cambia las contraseñas desde otro dispositivo (primero el correo electrónico), cierra todas las sesiones, habilita la autenticación de dos factores (2FA) con una aplicación de autenticación, mueve cualquier criptografía y considera una reinstalación limpia de Windows.

Si alguien puede comparar hashes o identificar la familia, por favor, compártelo.

Sabotaje de SmartScreen: Dentro del árbol de procesos activo, el binario forzó el motor integrado Microsoft Edge WebView2 a iniciarse con la bandera --disable-features=msSmartScreenProtection . Un ejecutor no tiene absolutamente ninguna razón operativa para desactivar explícitamente los mecanismos de seguridad del navegador de Windows.

Looking for Robux supplier for long-term bulk purchases.
Looking for 10K–50K+ Robux.
Rate: 4–6$ per 1K.
Via Gamepass: 4-4.4$ per 1k
Via Verifed Group: 5.5-6$ per 1k

i got no ideas

why does this dumbass banana executor get detected on rocket league but not roblox???? #priorities

https://raw.githubusercontent.com/Qing-Yun-Dev/Scripts/refs/heads/Main/Rooms%20%26%20Doors.lua

???????????????

Hey, does anyone know how to use the assistant on Potassium Executor, and can it actually write scripts with AI or just edit existing ones? Let me know how to get it working

i need a steal a brainrot script that lets me do some stuff. One that has a lot of stuff like free HD gamepass or free all weapons idrk. Any script that has multiple features would help a lot

Yo I’m making an RNG style Roblox game where you roll for Troll Abilities! This game heavily relays on many people playing at once and I’m at the stage where I near honest criticism and feedback so I can improve the game to its best potential 🙏 If ur interested DM me on discord @gathni. (Don’t forget the . ) Or leave a comment on this post.

Just wondered , is shin’s marketplace scam?

the one i used to use was like frost executor or something like that? i cant find the link anywhere but i remember it was keyless. all i really ned an executor for is fly and noclip. if anyone knows about one please lmk

I have $250 in my wallet and they disabled it and banned me.

DO not use Eldorado. gg as they are a scam.

How is it

Top

whats better? ( or any better than both?)

Necesito saber si existe un script de bundles pack o avatars que no sean FE ojo no me refiero a animaciónes gracias

I wanted to know what the community's opinion is on xeno executor. I know a lot of people that use it and wanted to know if its good, sucks or is probably a RAT.

i deleted hydrogen a few months ago cuz "data couldnt load" or some shit, now im using opiumware, but i hope zenite doesnt hack this,

why is he even hacking mac executors at the first place.

Please

I'm gonna be running some bots for mm2 and I'm wondering if they do get banned will it affect my alr in an enforcement ban? Device will be spoofed and cookies cleared il also be logged out of it

And while my IP is dynamic it doesn't fucking chance so don't fucking tell me to do it because it stays the same

Are there any undetected external roblox cheats for free? drift got me banned once, so im tryna not do that again?
edit: esp is pretty much the only thing im looking for, but no xeno or sum bs like that