Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Bytematrix76] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Bytematrix76] 'ImagePath' = '%ALLUSERSPROFILE%\Bytematrix76\Bytematrix76.exe'
Creates the following services
- 'Bytematrix76' %ALLUSERSPROFILE%\Bytematrix76\Bytematrix76.exe
Modifies file system
Creates the following files
- %TEMP%\is-f9t4v.tmp\<File name>.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-mibq2.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-nb4a7.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-7c838.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-9sh9l.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-5kmnv.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-65f6p.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-e03l2.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-hjkhp.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-5q6bl.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\lessmsi\is-15q05.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-rh971.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-89uak.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-jat2r.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-84j1n.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-1q8r5.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\plugins\internal\is-j06au.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-1p9fa.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-68sge.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-44ked.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-jkftd.tmp
- %ProgramFiles(x86)%\bitresorator\stuff\is-kuk6p.tmp
- %ProgramFiles(x86)%\bitresorator\stuff\is-rtocq.tmp
- %ProgramFiles(x86)%\bitresorator\stuff\is-qmuv9.tmp
- %ProgramFiles(x86)%\bitresorator\stuff\is-a500s.tmp
- %ProgramFiles(x86)%\bitresorator\is-s8e31.tmp
- %ProgramFiles(x86)%\bitresorator\unins000.dat
- %ProgramFiles(x86)%\bitresorator\bitrestore.exe
- %ALLUSERSPROFILE%\bytematrix76\bytematrix76.exe
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-9fqtq.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-eriff.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-gnbpn.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-pq185.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-06lkg.tmp
- %TEMP%\is-s2aga.tmp\_isetup\_setup64.tmp
- %TEMP%\is-s2aga.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-s2aga.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\bitresorator\is-bte1g.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-3s9vm.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-trgvs.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-314f3.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-g302e.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-6ol7d.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-meuld.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-5dk5l.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-757a7.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-hdl17.tmp
- %ALLUSERSPROFILE%\ts.dat
- %ProgramFiles(x86)%\bitresorator\bin\x86\plugins\internal\is-435gt.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-us7lj.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-m4l4v.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-i1un9.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-7dml2.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-hgul7.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-fv0eb.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-pqi55.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-pfuld.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-lr8tv.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-gkut3.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-in1tv.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-nn2sh.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-658oi.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-htjl0.tmp
- %TEMP%\is-s2aga.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\bitresorator\bin\x86\is-cpqti.tmp
- %ALLUSERSPROFILE%\resource.dat
Deletes the following files
- %ProgramFiles(x86)%\bitresorator\stuff\date.txt
- %ProgramFiles(x86)%\bitresorator\stuff\tagsreplace.txt
Moves the following files
- from %ProgramFiles(x86)%\bitresorator\is-bte1g.tmp to %ProgramFiles(x86)%\bitresorator\unins000.exe
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-eriff.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\libdtsdec.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-mibq2.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\dsd2.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-nb4a7.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\libvorbis.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-7c838.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\sqlite3.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-9sh9l.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\lame_enc.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-5kmnv.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\da.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-65f6p.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\daiso.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-e03l2.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\dstt.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-hjkhp.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\dsd2pcmt.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-5q6bl.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\pcm2dsd.exe
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-m4l4v.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bassmidi.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\lessmsi\is-15q05.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\lessmsi\lessmsi-v1.6.91.zip
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-89uak.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\libwebp.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-jat2r.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\libwinpthread-1.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-1q8r5.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\sd.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\plugins\internal\is-435gt.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\plugins\internal\peak_scanner_plugin_c.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\plugins\internal\is-j06au.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\plugins\internal\raw_decode_plugin_c.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-1p9fa.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\copying
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-68sge.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\7z.exe
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-44ked.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\takdec.exe
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-jkftd.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\tak_deco_lib.dll
- from %ProgramFiles(x86)%\bitresorator\stuff\is-kuk6p.tmp to %ProgramFiles(x86)%\bitresorator\stuff\date.txt
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-gnbpn.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\uchardet.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-9fqtq.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\utils.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-pq185.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\libsox-3.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-06lkg.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\libsoxr.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-htjl0.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\wavpackdll.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-trgvs.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bass_aac.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-314f3.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bassalac.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-g302e.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bassape.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-6ol7d.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bassdsd.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-meuld.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\basscd.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-5dk5l.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bassflac.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-757a7.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bassmix.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-hdl17.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bassopus.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-us7lj.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\basswma.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-84j1n.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\basswv.dll
- from %ProgramFiles(x86)%\bitresorator\stuff\is-rtocq.tmp to %ProgramFiles(x86)%\bitresorator\stuff\tagsreplace.txt
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-rh971.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\d_writer.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-cpqti.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bass_fx.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-7dml2.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\copying.lgplv2.1
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-hgul7.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\ff_helper.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-fv0eb.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\gain_analysis.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-pqi55.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\libflac_dynamic.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-pfuld.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\libmp4v2.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-lr8tv.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\opusenc.exe
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-gkut3.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bass_ofr.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-in1tv.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\optimfrog.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-nn2sh.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\mp3gain.exe
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-658oi.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\rg_ebur128.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-3s9vm.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bass.dll
- from %ProgramFiles(x86)%\bitresorator\bin\x86\is-i1un9.tmp to %ProgramFiles(x86)%\bitresorator\bin\x86\bass_tta.dll
- from %ProgramFiles(x86)%\bitresorator\is-s8e31.tmp to %ProgramFiles(x86)%\bitresorator\bitrestore.exe
Substitutes the following files
- %ProgramFiles(x86)%\bitresorator\stuff\date.txt
- %ProgramFiles(x86)%\bitresorator\stuff\tagsreplace.txt
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'f9c905_VCSTD12222FlashFixClass_f9c905'
Creates and executes the following
- '%TEMP%\is-f9t4v.tmp\<File name>.tmp' /SL5="$A0250,7180958,54272,<Full path to file>"
- '%ProgramFiles(x86)%\bitresorator\bitrestore.exe' -i
- '%ProgramFiles(x86)%\bitresorator\bitrestore.exe' -s
