SilentRunLoader Chrome Data Theft (cg.exe)

Ethan Andrews@eandrews

•updated Jun 4, 2026•4•0•20

Detects the execution of 'cg.exe', a secondary compiled Python executable deployed by SilentRunLoader (associated with TA4922) to pack and steal Google Chrome browser data. The detection specifically looks for 'cg.exe' where the initiating process or command line contains 'python'.