Ve
Domain ambiguity
Velocity
Two domains use the name. Both have a trust score of 1/100. The tracker records 100% sUNC.
01
The claim on the website
The ByteBreaker website title is "ByteBreaker – Free Keyless Roblox Executor | 99% sUNC" . The site description adds: "ByteBreaker is the best free, keyless Roblox executor with 99% sUNC score. No key system. 384,000+ downloads. Supports V1 (stable) and V2 (decompiler). Download free for Windows."
These are marketing claims on a website controlled by the project. A claim of 99% sUNC is not a measurement unless a tracker has independently run the sUNC suite and published the result. The 384,000+ download figure is likewise a self-reported number. Neither claim is verified by Gridinsoft or Triage in the sources reviewed here.
02
The domain scan
Gridinsoft classifies bytebreaker.cc as a suspicious website with a trust score of 27/100. One security source out of 25 reports a warning, and the visible provider verdict is "Malicious" from Forcepoint ThreatSeeker . The scan also notes a "Free Robux" risk indicator, which Gridinsoft describes as a common social engineering vector .
The domain was registered on February 4, 2025 through NameCheap . It is proxied through Cloudflare and uses Google Tag Manager . The scan was last checked on September 19, 2026 . A 27/100 trust score is not a malware verdict. It is a domain reputation signal that weighs multiple factors, including blacklist hits and on-page risk indicators.
03
The sandbox scores
Triage scored two different V1 samples at 8/10. The first sample, ByteBreaker V1_16331983.exe, is 583KB and has SHA256 ddbd930c... . Its behavioral flags include "Executes dropped EXE," "Loads dropped DLL," "Reads user/profile data of web browsers," "Checks installed software on the system," "Network Share Discovery," "Password Policy Discovery," and "Drops file in System32 directory" . The second sample, ByteBreaker V1_18264345.exe, has the same SHA256 and the same 8/10 score .
The second V1 sample carries a signature flag: "Revoked Certificate in Chain" and "Untrusted Codesign Signers" . The certificate was issued to "AN Soft" in Bergen op Zoom, Netherlands, and the revocation date is September 30, 2025 . A revoked certificate means the signing identity cannot be verified. It is a code-signing integrity flag, not a malware classification.
A third sample, ByteBreaker V2_48854090.exe, is 702KB and scored 3/10 . The V2 sample page shows a lower behavioral score but does not list the same behavioral flags in the summary reviewed here.
04
What the records do not resolve
No ScriptBunker, ScriptBlox, or Rscripts tracker entry for ByteBreaker was found in the sources reviewed here. That means there is no independent sUNC score to compare against the website's 99% claim. The claim is unverified by a tracker.
The sandbox scores describe behavior. The domain scan describes website reputation. The website claims describe marketing. None of the three resolves whether the file served from bytebreaker.cc matches the file that Triage scored. That gap is the same gap that exists for every executor delivered through a project-controlled domain.
Sources: Gridinsoft domain scan · Triage sample 260414-ne9slacw5w · Triage sample 260611-p9vgtsdy9z · Triage sample 260904-cweg8swzaw . The marketing claims are from the project-controlled website.
Why a self-reported sUNC score is not a tracker entry
The sUNC documentation describes the test suite as a tool that checks whether an executor can properly run essential global functions by testing them as if they were used in a real scenario . A tracker like ScriptBunker runs that suite and publishes the result. A website that claims "99% sUNC" in its title is making a statement about itself. The statement may be true. It is not the same as a published test result.
The difference matters because the sUNC docs explicitly note that executors have historically faked their environments to suit older test suites . A tracker entry is a third-party measurement. A website claim is a self-description. The two carry different weight.
No tracker entry for ByteBreaker was found in the sources reviewed here. That does not mean the 99% figure is false. It means the figure has not been independently recorded in the same way that Wave, Volt, or Potassium scores have been.
What the revoked certificate flag actually means
Triage's signature analysis on one V1 sample records a certificate issued to "AN Soft" with a revocation date of September 30, 2025 . A revoked certificate means the certificate authority invalidated it after issuance. This can happen for several reasons, including compromise of the signing key or misissuance.
The flag does not prove the executable is malicious. It proves the code-signing chain is broken: you cannot verify that the file was signed by the entity it claims to represent. The V2 sample, scored 3/10, does not show the same behavioral flags in the summary reviewed here, which suggests the V2 build may be a different codebase or a different packaging. The records do not resolve why the V1 and V2 scores differ so sharply.
The records, compared
| Source | What it records | What it does not record |
|---|---|---|
| bytebreaker.cc | 99% sUNC, 384K+ downloads, keyless, V1/V2 | Independent verification of any claim |
| Gridinsoft | 27/100 trust, 1 blacklist hit, Free Robux signal | Binary behavior, file contents |
| Triage V1 (x2) | 8/10, dropped EXE, browser data read, System32 drop | Whether the file is malicious |
| Triage V2 | 3/10, lower behavioral score | Why it differs from V1 |
| Tracker entry | None found | An independent sUNC score |
Each source answers a different question. The website answers "what does the project say about itself." The domain scan answers "what is the website's reputation." The sandbox answers "what did the file do in a controlled environment." None of them answers "is this safe."
What this page does not claim
- This page does not claim ByteBreaker is malware. The Triage 8/10 score is a behavioral observation, not a malware classification. The domain scan is a reputation signal, not a file verdict.
- This page does not claim the 99% sUNC figure is false. It claims the figure is self-reported and that no tracker entry was found to verify it.
- This page does not claim the revoked certificate proves the file is malicious. It proves the code-signing chain is broken, which is a traceability failure, not a malware flag.
- This page does not claim the V1 and V2 builds are the same codebase. Their Triage scores differ sharply (8/10 vs 3/10), but the records do not explain why.
ByteBreaker questions, separated from the marketing
Is the 99% sUNC claim verified?
No. The claim appears in the website title and description . No ScriptBunker, ScriptBlox, or Rscripts entry for ByteBreaker was found in the sources reviewed here. A self-reported score is not the same as a published tracker measurement.
What did Triage observe in the V1 samples?
Triage scored two V1 samples at 8/10. Behavioral flags include executing a dropped EXE, loading a dropped DLL, reading browser profile data, checking installed software via registry keys, network share discovery, password policy discovery, and dropping a file in System32 . One sample also carries a revoked certificate and untrusted codesign signer flag .
Why is the V2 sample scored 3/10?
The V2 sample page shows a 3/10 score , but the summary reviewed here does not list the same behavioral flags as the V1 samples. The records do not explain the difference. It could be a different build, a different packaging, or a different codebase. The gap is unresolved.
What does the 27/100 domain trust score mean?
Gridinsoft's trust model weighs domain age, blacklist hits, heuristic signals, and public reputation . A 27/100 score means warning signals are present. It does not mean a file on that domain has been confirmed as malware. It means the website has not earned trust.
Can I download ByteBreaker from this page?
Not yet. The Download button is a placeholder. When you have a confirmed source and choose to link it, replace the href. Until then, this page serves no file.
Why does this page look different from Velocity's?
Because the evidence is shaped differently. Velocity had two domains with the same trust score. ByteBreaker has a website that makes specific claims, a domain scan that flags the site, and sandbox scores that describe behavior. The layout uses layers to separate the marketing claim, the domain reputation, and the sandbox behavior, because they answer different questions.