The reccomended path would be to follow the instructions on this page (https://support-site.gremlin.com/support/solutions/articles/151000061026-manually-installing-the-gremlin-agent). However if needed, this document describes the steps necessary to manually install the Gremlin agent.

Windows

This section describes the steps necessary to manually install the Gremlin agent for the Windows operating system.

Download

The files that comprise the Gremlin agent for Windows can be downloaded from here:

https://windows.gremlin.com/installer/latest/gremlin_agent.zip

Install

Every step requires administrator access.

The first step is to extract the contents of the downloaded ZIP file to:

C:\Program Files\Gremlin\Agent

For the first installation that directory will not exist.  It may be necessary to create the directory in advance depending on the unzipper used.

The following works for 7-Zip assuming the downloaded ZIP file was placed in the administrator’s download directory:

7z x "C:\Users\Administrator\Downloads\gremlin_agent.zip" -o"C:\Program Files\Gremlin\Agent" -r -y *

Optionally add the C:\Program Files\Gremlin\Agent folder to the PATH.  Updating the PATH allows attacks to be easily run from the command line.

After the files have been extracted, install then start the kernel driver.  Gremlin provides a tool to simplify the process.  From the C:\Program Files\Gremlin\Agent folder run the following:

gremlins_control --find gremlins.sys --install --automatic --magic --start

The next step is to prepare a configuration file.  The configuration file is placed in the C:\ProgramData\Gremlin\Agent directory and is named config.yaml:

C:\ProgramData\Gremlin\Agent\config.yaml

The last step is to run the daemon.  Simply run gremlind from the C:\Program Files\Gremlin\Agent directory.

Upgrade

Every step requires administrator access.

The first step is to download the update.  The latest version is always available from the same link:

https://windows.gremlin.com/installer/latest/gremlin_agent.zip

The next step to upgrading is to shut down the daemon.  The daemon cleanly stops when it’s sent a Ctrl + C or Ctrl + Break.

The next step is to stop the kernel driver.  Gremlin provides a tool to simplify the process.  From the C:\Program Files\Gremlin\Agent folder run the following:

gremlins_control --stop

Next extract the contents of the downloaded ZIP file to:

C:\Program Files\Gremlin\Agent

The following works for 7-Zip assuming the downloaded ZIP file was placed in the administrator’s download directory:

7z x "C:\Users\Administrator\Downloads\gremlin_agent.zip" -o"C:\Program Files\Gremlin\Agent" -r -y *

The kernel driver has to be reinstalled and restarted.  From the C:\Program Files\Gremlin\Agent folder run the following:

gremlins_control --find gremlins.sys --install --automatic --magic --start

Finally, run the daemon.  Simply run gremlind from the C:\Program Files\Gremlin\Agent directory.

Essentially, the upgrade steps consist of stopping the daemon and the kernel driver then performing the install steps.

Remove

Every step requires administrator access.

Stop the daemon by sending it a Ctrl + C or Ctrl + Break.

Stop the kernel driver by running the following from the C:\Program Files\Gremlin\Agent folder:

gremlins_control --stop

If the PATH was updating during installation then remove C:\Program Files\Gremlin\Agent from the PATH.

Delete the entire contents of the C:\Program Files\Gremlin folder then delete the folder.

Delete the entire contents of the C:\ProgramData\Gremlin folder then delete the folder.