Installing Bytesnare
What Bytesnare puts on the machine, what it does there, and what it takes away again.
Signed, and Windows may still warn you
Read this before you download, because the warning is easier to meet if somebody has told you it is coming.
These installers are signed. Windows will show the publisher as Triop AB — the company that makes Bytesnare. If it shows any other name, or says the publisher is unknown, you did not get this file from us and you should not run it.
You may still see “Windows protected your PC” anyway. A signature is not a reputation. Microsoft’s own guidance is that a validly signed application stays “unrecognized until reputation accumulates”, which takes weeks and hundreds of installs, and this is a first release. We would rather say that in advance than have you discover it and wonder which of us is wrong.
The other thing you can check is the file itself. The SHA-256 of every published file is below, and an artifact manifest beside each download lists what the package contains and the hash of each file in it. A signature tells you the file came from us; the hash tells you it is the exact build this page describes. They answer different questions:
Get-FileHash .\BytesnareDesktop-0.1.0-x64.msi -Algorithm SHA256The package installs, upgrades, rolls back and uninstalls cleanly, and that is verified on every change.
BytesnareDesktop-0.1.0-x64.msi — 1,662,976 bytes, for Intel and AMD machines, and ARM64 machines through emulation. On Windows on ARM the ARM64 build is the native one. Both are below with their checksums.
What you install
| Component | What it is |
|---|---|
| Agent service | A headless Windows service. Observes process and network activity, keeps records locally, uploads nothing unless a destination is configured. |
bytesnarectl | A read-only diagnostics client. It cannot change configuration, start or stop the service, or perform any endpoint action. |
| Desktop application | Optional, on every platform. The same status the client prints, laid out. |
What it does to the machine
- Registers one Windows service and one ETW consumer.
- Writes records under
ProgramData, encrypted at the application level with keys held by the operating system's key service. - Opens no listening port and makes no outbound connection unless a destination is configured.
- Removes what it installed on uninstall. Collected data is preserved by default and removed explicitly — a command exists for that, so deleting your evidence is never a side effect of removing software.
Requirements
Windows 11 on ARM64 or x64. There is no Linux or macOS build.
Questions
Is it free, and what is the catch?
Free, with no account, no licence key and no trial period. The catch is at the
top of this page: the build you can download is not signed, and only the desktop
application is published so far.
Do I need the desktop application?
No. The engine runs headless and reports the same facts to a command-line
client. The application is a window onto those facts, and an installation
without it is a complete installation.
Will it slow my machine down?
There are resource targets. There is no measurement worth quoting yet, so this
page quotes none — what Bytesnare does not do explains
why a benchmark without its machine is a decoration.
Does it send my files anywhere?
No files leave, and nothing at all leaves unless a destination is configured.
The application has a screen showing what the upload policy withheld, counted
by reason. Security and privacy has the detail.
Can I run it alongside another antivirus?
Yes. It observes and reports; it does not claim a filter driver, intercept file
operations, or register as a security provider your existing product would have
to yield to.
What happens if it cannot reach the service?
It says protection status cannot be determined, and it does not say safe. An
endpoint that cannot check is not the same as one that checked and found
nothing, and it will not show you a green tick for the second when it has the
first.
Getting it
Two builds of the desktop application, one per processor architecture. There is no form and nothing to sign up for: collecting addresses for an announcement is not worth a database of people who trusted us with one.
| File | For | SHA-256 |
|---|---|---|
| BytesnareDesktop-0.1.0-x64.msi 1,662,976 bytes |
Intel and AMD machines, and ARM64 machines through emulation. | 4e020b46f2f3b957de8eb26a2a0c74703405d169116b431d2b0f625f9535e4a7 |
| BytesnareDesktop-0.1.0-arm64.msi 1,601,536 bytes |
Windows on ARM — a Snapdragon or similar. Native, so it does not emulate. | c284048844239cfed6d77ac676c654f307785efa0dd313bce86fa2f3d20fdc27 |
It needs the Microsoft Edge WebView2 Runtime, which Windows 11 normally already has and which Microsoft distributes. The installer checks for it and refuses rather than installing an application that cannot open a window, so a machine without it is told at install time instead of being handed a shortcut that does nothing.
The engine is not offered here. This page is the desktop application — the window onto an endpoint's status. On its own it will tell you it cannot reach a service, because there is no service on the machine to reach. The agent is a headless Windows service with no window of its own, meant to be deployed across a fleet rather than double-clicked, so it is not a download this page hands to somebody who came for an application. That sentence used to read “not offered for download until it is signed”, which is no longer the reason: it is signed. The reason is who it is for.
Write to hello@bytesnare.com with anything this page does not answer.