FILE_InstallMeCisco (renamed to CiscoSetup.exe) is a legitimate installer for the Cisco AnyConnect VPN Secure Mobility Client application. FILE_InstallMeExe (renamed to cisco2.ps1) is a PowerShell script. CTU researchers identified other samples that used the same technique with a different software installer and related PowerShell script name, such as Zoom (ZoomInstaller.exe and zoom.ps1), ChatGPT (ChatGPT.msi and chch.ps1) and Citrix (CitrixWorkspaceApp.exe and citrix.ps1).