File name:

Sailo-BGoo[t].exe

Full analysis: https://app.any.run/tasks/826d9362-7948-47f0-ae8e-99b37b817a67
Verdict: Malicious activity
Threats:

Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests.

Malware Trends Tracker     >>>
Analysis date: March 30, 2026, 13:45:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
vidar
stealer
stealc
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:

F842D9E83AE9EFD7CF72D73219013D78

SHA1:

610C0A8F5D6BBC7A4E1C226DE3EC01C9683F190C

SHA256:

694BCA134D88E0B39D65E38F7D5738D63BB93172BA722B5AA1651B1D94CE0AAB

SSDEEP:

98304:nryc8XqpAQv/splmZkZXSSdKp303445kAXn:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Sailo-BGoo[t].exe (PID: 7608)

    • VIDAR has been detected

      • Sailo-BGoo[t].exe (PID: 7608)

    • STEALC has been detected (SURICATA)

      • Sailo-BGoo[t].exe (PID: 7608)

    • Actions looks like stealing of personal data

      • Sailo-BGoo[t].exe (PID: 7608)

    • Steals credentials from Web Browsers

      • Sailo-BGoo[t].exe (PID: 7608)

    • VIDAR has been detected (YARA)

      • Sailo-BGoo[t].exe (PID: 7608)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • Sailo-BGoo[t].exe (PID: 7608)

    • Reads the date of Windows installation

      • Sailo-BGoo[t].exe (PID: 7608)

    • Searches for installed software

      • Sailo-BGoo[t].exe (PID: 7608)

    • Possible stealing from crypto wallets

      • Sailo-BGoo[t].exe (PID: 7608)

    • Possible stealing from password managers

      • Sailo-BGoo[t].exe (PID: 7608)

    • Possible stealing from browsers

      • Sailo-BGoo[t].exe (PID: 7608)

    • Multiple wallet extension IDs have been found

      • Sailo-BGoo[t].exe (PID: 7608)

  • INFO

    • Reads the computer name

      • Sailo-BGoo[t].exe (PID: 7608)

    • Checks supported languages

      • Sailo-BGoo[t].exe (PID: 7608)

    • Reads security settings of Internet Explorer

      • Sailo-BGoo[t].exe (PID: 7608)

    • Reads CPU info

      • Sailo-BGoo[t].exe (PID: 7608)

    • Reads Environment values

      • Sailo-BGoo[t].exe (PID: 7608)

    • Reads product name

      • Sailo-BGoo[t].exe (PID: 7608)

    • Reads the machine GUID from the registry

      • Sailo-BGoo[t].exe (PID: 7608)

    • There is functionality for taking screenshot (YARA)

      • Sailo-BGoo[t].exe (PID: 7608)

    • Application launched itself

      • chrome.exe (PID: 7656)
      • chrome.exe (PID: 2204)

    • Application based on Golang

      • Sailo-BGoo[t].exe (PID: 7608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Vidar

(PID) Process(7608) Sailo-BGoo[t].exe
BrowserExtensionsID (238)nkbihfbeogaeaoehlefnkodbefgpgknn
djclckkglechooblngghdinmeemkbgci
ejbalbakoplchlghecdalmeeeajnimhm
ibnejdfjmmkpcnlpebklmnkoeoihofec
ffnbelfdoeiohenkjibnmadjiehjhajb
kncchdigobghenbbaddojjnnaogfppfj
fnjhmkhhmkbjkkabndcnnogagogbneec
cphhlgmgameodnhkjdmkpanlelnlohao
nhnkbkgjikgcigadomkphalanndcapjk
kpfopkelmapcoipemfendmdcghnegimn
aiifbnbfobpmeekipheeijimdpnlpgpp
dmkamcknogkgcdfhhbddcghachkejeap
cnmamaachppnkjgnildpdmkaakejnhae
jojhfeoedkpkglbfimdfabpdfjaoolaf
flpiciilemghbmfalicajoolhkkenfel
aeachknmefphepccionboohckonoeemg
cgeeodpfagjceefieflmdfphplkenlfk
pdadjkfkgcafgbceimcpbkalnfnepbnk
acmacodkjbdgmoleebolmdjonilkdbch
bfnaelmomeimhlpmgjnjophhpkkoljpa
fhilaheimglignddkjgofkcbgekhenbh
mgffkfbidihjpoaomajlbgchddlicgpn
lpfcbjknijpeeillifnkikgncikgfhdo
bhhhlbepdkbapadjdnnojkbgioiodbic
dkdedlpgdmmkkfjabffeganieamfklkm
hcflpincpppdclinealmandijcmnkbgn
mnfifefkajgofkcjkemidiaecocnkjeh
jnkelfanjkeadonecabehalmbgpfodjm
kjmoohlgokccodicjjfebfomlbljgfhk
ppbibelpcjmhbdihakflkdcoccbgbkpo
pnndplcbkakcplkjnolgbkdgjikjednm
egjidjbpglichdcondbcbdnbeeppgdph
aholpfdialjgjfhomihkjbmgjidlcdno
jnlgamecbpmbajjfhmmmlhejkemejdma
kkpllkodjeloidieedojogacfhpaihoh
mcohilncbfahbmgdjkbpemcciiolgcge
epapihdplajcdnnkdeiahlgigofloibg
gjagmgiddbbciopjhllkdnddhcglnemk
bgpipimickeadkjlklgciifhnalhdjhe
phkbamefinggmakgklpkljjmgibohnba
cjmkndjhnagcfbpiemnkdpomccnjblmj
aijcbedoijmgnlmjeegjaglmepbmpkpi
fiedbfgcleddlbcmgdigjgdfcggjcion
nngceckbapebfimnlniiiahkandclblb
fmhmiaejopepamlcjkncpgpdjichnecm
oboonakemofpalcgghocfoadofidjkkk
hbbgbephgojikajhfbomhlmmollphcad
opfgelmcmbiajamepnmloijbpoleiama
fiikommddbeccaoicoejoniammnalkfa
bgjogpoidejdemgoochpnkmdjpocgkha
jgaaimajipbpdogpdglhaphldakikgef
fcfcfllfndlomdhbehjjcoimbgofdncg
dngmlblcodfobpdpecaadgfbcggfjfnm
kppfdiipphfccemcignhifpjkapfbihd
lgmpcpglpngdoalbgeoldeajfclnhafa
onhogfjeacnfoofkfgppdlbmlmnplgbn
mmmjbcfofconkannjonfmjjajpllddbg
loinekcabhlmhjjbocijdoimmejangoa
heefohaffomkkkphnlpohglngmbcclhi
idnnbdplmphpflfnlkomgpfbpcgelopg
anokgmphncpekkhclmingpimjmcooifb
cnncmdhjacpkmjmkcafchppbnpnhdmon
ocjdpmoallmgmjbbogfiiaofphbjgchh
ojggmchlghnjlapmfbnjholfjkiidbch
ciojocpkclfflombbcfigcijjcbkmhaf
mkpegjkblkkefacfnmkajcjmabijhclg
aflkmfhebedbjioipglgcbcmnbpgliof
omaabbefbmiijedngplfjmnooppbclkk
penjlddjkjgpnkllboccdgccekpkcbin
apenkfbbpmhihehmihndmmcdanacolnh
jiidiaalihmmhddjgbnbgdfflelocpak
nphplpgoakhhjchkkhmiggakijnkhfnd
fldfpgipfncgndfolcbkdeeknbbbnhcc
nnpmfplkfogfpmcngplhnbdnnilmcdcg
gdokollfhmnbfckbobkdbakhilldkhcj
fijngjgcjhjmmpcmkeiomlglpeiijkld
cgadeiniijaimpdmhfklcphfnglpkmll
pbpjkcldjiffchgbbndmhojiacbgflha
aheklkkgnmlknpgogcnhkbenfllfcfjb
ajcicjlkibolbeaaagejfhnofogocgcj
hjgoblidjnnnamdkinbichnfbmghmafd
gfenajajnjjmmdojhdjmnngomkhlnfjl
dfeccadlilpndjjohbjdblepmjeahlmm
hkkpjehhcnhgefhbdcgfkeegglpjchdc
jbkfoedolllekgbhcbcoahefnbanhhlh
lfochlioelphaglamdcakfjemolpichk
dppgmdbiimibapkepcbdbmkaabgiofem
emgfgdclgfeldebanedpihppahgngnle
keokhigifjinncljedmendkbikiakicj
ljpdiapgjljgaiiilgojopoonfnnpfgj
bbcinlkgjjkejfdpemiealijmmooekmp
gehmmocbbkpblljhkekmfhjpfbkclbph
apenkfbbpmhihehmihndmmcdanacolnh
niihfokdlimbddhfmngnplgfcgpmlido
jnmbobjmhlngoefaiojfljckilhhlhcj
abkahkcbhngaebpcgfmhkoioedceoigp
admmjipmmciaobhojoghlmleefbicajg
aflkmfhebedbjioipglgcbcmnbpgliof
cjookpbkjnpkmknedggeecikaponcalb
afbcbjpbpfadlkmhmclhkeeodmamcflc
bopcbmipnjdcdfflfgjdgdjejmgpoaab
canipghmckojpianfgiklhbgpfmhjkjg
cpmkedoipcpimgecpmgpldfpohjplkpp
aeblfdkhhhdcdjpifhhbdiojplfjncoa
agoakfejjabomempkjlepdflaleeobhb
ajkifnllfhikkjbjopkhmjoieikeihjb
ajkigpnleboodhdlminnlmldegieilfc
amkmjjmmflddogmhpjloimipbofnfjih
andhndehpcjpmneneealacgnmealilal
apnehcjmnengpnmccpaibjmhhoadaico
bcopgchhojmggmffilplmbdicgaihlkp
bedogdpgdnifilpgeianmmdabklhfkcn
bfogiafebfohielmmehodmfbbebbbpei
bifidjkcdpgfnlbcjpdkdcnbiooooblg
bkgplkpdgidlgmnlhdfakhcjfpfgjjkb
bkklifkecemccedpkhcebagjpehhabfb
blgcbajigpdfohpgcmbbfnphcgifjopc
bmhejbnmpamgfnomlahkonpanlkcfabg
bmikpgodpkclnkgmnpphehdgcimmided
bnfdmghkeppfadphbnkjcicejfepnbfe
bnfooenhhgcnhdkdjelgmmkpaemlnoek
bocpokimicclpaiekenaeelehdjllofo
bofddndhbegljegmpmnlbhcejofmjgbn
caljgklbbfbcjjanaijlacgncafpegll
cgddkajmbckbjbnondgfcbcojjjdnmji
chgfefjpcobfbnpmiokfjjaglahmnded
cihmoadaighcejopammfbmddcmdekcje
cmndjbecilbocjfkibfbifhngkdmjgog
cnlhokffphohmfcddnibpohmkdfafdli
dbfoemgnkgieejfkaddieamagdfepnff
dbgibbbeebmbmmhmebogidfbfehejgfo
dbgnhckhnppddckangcjbkjnlddbjkna
didegimhafipceonhjepacocaffmoppf
dlcobpjiigpikoobohmabehhmhfoodbb
dldjpboieedgcmpkchcjcbijingjcgok
dmjmllblpcbmniokccdoaiahcdajdjof
eajafomhmkipbjmfmhebemolkcicgfmd
ebfidpplhabeedpnhjnobghokpiioolj
efbglgofoippbgcjepnhiblaibcnclgk
eiaeiblijfjekdanodkjadfinkhbfgcd
einhphiffjfjogeofkpclobkcgennocm
einnioafmpimabjcddiinlhmijaionap
ejbidfepgijlcgahbmbckmnaljagjoll
ejjladinnckdgjemekebdpeokbikhfci
eljmjmgjkbmpmfljlmklcfineebidmlo
ellkdbaphhldpeajbepobaecooaoafpg
eokbbaidfgdndnljmffldfgjklpjkdoi
fcckkdbjnoikooededlapcalpionmalo
fdchdcpieegfofnofhgdombfckhbcokj
fdcnegogpncmfejlfnffnofpngdiejii
fdfemjpbhpcjeadhbblfifdldedefnhe
fdjamakpfbbddfjaooikfcpapjohcfmg
fdojfgffiecmmppcjnahfgiignlnehap
fooolghllnmhmmndgjiamiiodkpenpbb
fopmedgnkfpebgllppeddmmochcookhc
fpkhgmpbidmiogeglndfbkegfdlnajnf
gafhhkghbfjjkeiendhlofajokpaflmk
gejiddohjgogedgjnonbofjigllpkmbf
ghlmndacnhlaekppcllcpcjjjomjkjpg
ghmbeldphafepmbegfdlkpapadhbakde
gjkdbeaiifkpoencioahhcilildpjhgh
gjlmehlldlphhljhpnlddaodbjjcchai
gjnckgkfmgmibbkoficdidcljeaaaheg
gmohoglkppnemohbcgjakmgengkeaphi
gpnihlnnodeiiaakbikldcihojploeca
hcjhpkgbmechpabifbggldplacolbkoh
hdokiejnpimakedhajhdlcegeplioahd
heamnjbnflcikcggoiplibfommfbkjpj
hfajfpbjlmembfdlhakjmefnbhjddofb
hfdkpbblioghdghhkdppipefbchgpohn
hgbeiipamcgbdjhfflifkgehomnmglgk
hifafgmccdpekplomjjkcfgodnhcellj
hldllnfgjbablcfcdcjldbbfopmohnda
hmeobnfnfcmdkdcmlblgagmfpfboieaf
hnebcbhjpeejiclgbohcijljcnjdofek
hpcbfphmanablmeomioemmamedfffmpd
hpclkefagolihohboafpheddmmgdffjm
ibpjepoimpcdofeoalokgpjafnjonkpc
ieldiilncjhfkalnemgjbffmpomcaigi
ifckdpamphokdglkkdomedpdegcjhjdp
ifclboecfhkjbpmhgehodcjpciihhmif
igkpcodhieompeloncfnbekccinhapdb
ilhaljfiglknggcoegeknjghdgampffk
imlcamfeniaidioeflifonfjeeppblda
inlkhilmjmjomfcpdifpfgllhhlpnbej
iokeahhehimjnekafflcihljlcjccdbe
jfdlamikmbghhapbgfoogdffldioobgl
jhfjfclepacoldmjmkmdlmganfaalklb
jhgnbkkipaallpehbohjmkbjofjdmeid
jiepnaheligkibgcjgjepjfppgbcghmp
jiiigigdinhhgjflhljdkcelcjfmplnd
kamfleanhcmjelnhaeljonilnmjpkcjc
kfdniefadaanbjodldohaedphafoffoh
kfmlopbepahlcjbkfnnklglgibbopkbk
kglcipoddmbniebnibibkghfijekllbl
khhapgacijodhjokkcjmleaempmchlem
khpkpbbcccdmmclmpigdgddabeilkdpd
klghhnkeealcohjjanjjdaeeggmfmlpl
klnaejjgbibmhlephnhpmaofohgkpgkd
kmcfomidfpdkfieipokbalgegidffkal
kmhcihpebfmpgmihbkipmjlmmioameka
kmphdnilpmdejikjdnlbcnmnabepfgkh
lccbohhgfkdikahanoclbdmaolidjdfl
ldinpeekobnhjjdofggfgjlcehhmanlj
lfmmjkfllhmfmkcobchabopkcefjkoip
lgbjhdkjmpgjgcbcdlhkokkckpjmedgc
lgdfffagihonfnkcffpikpifhegcdkge
lkpmkhpnhknhmibgnmmhdhgdilepfghe
lmkncnlpeipongihbffpljgehamdebgi
lpilbniiabackdjcionkobglmddfbcjo
mfgccjchihfkkindfppnaooecgfneiii
mfhbebgoclkghebffdldpobeajmbecfk
mjgkpalnahacmhkikiommfiomhjipgjn
mlhdnjepakdfdaabohjgegnomlgeejep
mmhlniccooihdimnnjhamobppdhaolme
momakdpclmaphlamgjcndbgfckjfpemp
mpeengabcnhhjjgleiodimegnkpcenbk
naepdomgkenhinolocfifgehidddafch
nebnhfamliijlghikdgcigoebonmoibm
nhccebmfjcbhghphpclcfdkkekheegop
nhhldecdfagpbfggphklkaeiocfnaafm
nhihjlnjgibefgjhobhcphmnckoogdea
njimencmbpfibibelblbbabiffimoajp
nknhiehlklippafakaeklbeglecifhad
nlgbhdfgdhgbiamfdfmbikcdghidoadd
nopnfnlbinpfoihclomelncopjiioain
ojbcfhjmpigfobfclfflafhblgemeidi
ookjlbkiijinhpmnjffcofjonbfbgaoc
opnnmgopaggjpapnoknbphfpjfadbddc
papngmkmknnmfhabbckobgfpihpdgplk
pcndjhkinnkaohffealmlmhaepkpmgkb
pdgbckgdncnhihllonhnjbdoighgpimk
pdliaogehgdbhbnmkklieghmmjkpigpa
pmbjpcmaaladnfpacpmhmnfmpklgbdjb
pnbabdldpneocemigmicebglmmfcjccm
pocmplpaccanhmnllbbkpgfliimjljgo
ppdadbejkmjnefldpcdjhnkpbjkikoip
pnlccmojcmeohlpggmfnbbiapkmbliob
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 599552
InitializedDataSize: 29184
UninitializedDataSize: -
EntryPoint: 0x6e560
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
39
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #STEALC sailo-bgoo[t].exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=5984,i,3029758678261443647,13444229157352225066,262144 --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6068 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
932"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=5000,i,18202032464242313,9298305283243613526,262144 --variations-seed-version=20260330-010045.844000-production --mojo-platform-channel-handle=4972 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1728"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3272,i,18202032464242313,9298305283243613526,262144 --variations-seed-version=20260330-010045.844000-production --mojo-platform-channel-handle=3468 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2032"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3288,i,3029758678261443647,13444229157352225066,262144 --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=3320 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2204"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"C:\Program Files\Google\Chrome\Application\chrome.exe
Sailo-BGoo[t].exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2832"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=5948,i,3029758678261443647,13444229157352225066,262144 --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5896 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2988"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=5800,i,3029758678261443647,13444229157352225066,262144 --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=4996 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3048"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3224,i,18202032464242313,9298305283243613526,262144 --variations-seed-version=20260330-010045.844000-production --mojo-platform-channel-handle=3360 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3756"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=6056,i,3029758678261443647,13444229157352225066,262144 --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5712 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
4960"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=4904,i,3029758678261443647,13444229157352225066,262144 --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=4912 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
3 793
Read events
3 790
Write events
3
Delete events
0

Modification events

(PID) Process:(7608) Sailo-BGoo[t].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7608) Sailo-BGoo[t].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7608) Sailo-BGoo[t].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
78
Text files
85
Unknown types
0

Dropped files

PID
Process
Filename
Type
2204chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RFe366d.TMP —
MD5:—
SHA256:—
2204chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
2204chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RFe367d.TMP —
MD5:—
SHA256:—
2204chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RFe367d.TMP —
MD5:—
SHA256:—
2204chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
2204chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
2204chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old~RFe366d.TMP —
MD5:—
SHA256:—
2204chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old~RFe367d.TMP —
MD5:—
SHA256:—
2204chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RFe367d.TMP —
MD5:—
SHA256:—
2204chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
80
TCP/UDP connections
67
DNS requests
55
Threats
25

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
unknown
—
—
whitelisted
—
—
GET
200
23.11.41.157:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
unknown
—
—
whitelisted
7608
Sailo-BGoo[t].exe
GET
200
138.199.175.21:443
https://138.199.175.21/
unknown
—
2 b
malicious
7608
Sailo-BGoo[t].exe
POST
200
138.199.175.21:443
https://138.199.175.21/
unknown
—
68 b
malicious
7608
Sailo-BGoo[t].exe
POST
200
138.199.175.21:443
https://138.199.175.21/
unknown
—
2 b
malicious
7608
Sailo-BGoo[t].exe
POST
200
138.199.175.21:443
https://138.199.175.21/
unknown
text
2.47 Kb
malicious
7608
Sailo-BGoo[t].exe
POST
200
138.199.175.21:443
https://138.199.175.21/
unknown
text
18.3 Kb
malicious
7608
Sailo-BGoo[t].exe
POST
200
138.199.175.21:443
https://138.199.175.21/
unknown
text
108 b
malicious
3448
svchost.exe
GET
200
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
unknown
text
5.74 Kb
whitelisted
5224
chrome.exe
OPTIONS
200
192.178.183.95:443
https://ogads-pa.clients6.google.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3448
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
92.123.104.9:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
7608
Sailo-BGoo[t].exe
138.199.175.21:443
—
HETZNER-AS
DE
unknown
3448
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 51.104.136.2
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
google.com
  • 142.251.14.100
  • 142.251.14.102
  • 142.251.14.139
  • 142.251.14.113
  • 142.251.14.138
  • 142.251.14.101
whitelisted
www.bing.com
  • 92.123.104.9
  • 92.123.104.13
  • 92.123.104.62
  • 92.123.104.66
  • 92.123.104.63
  • 92.123.104.5
  • 92.123.104.67
  • 92.123.104.14
  • 92.123.104.65
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
crl.microsoft.com
  • 23.216.77.26
  • 23.216.77.34
  • 23.216.77.27
  • 23.216.77.30
  • 23.216.77.31
  • 23.216.77.37
  • 23.216.77.35
  • 23.216.77.33
  • 23.216.77.36
whitelisted
www.microsoft.com
  • 23.52.181.212
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
clients2.google.com
  • 142.251.141.110
whitelisted

Threats

PID
Process
Class
Message
7608
Sailo-BGoo[t].exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7608
Sailo-BGoo[t].exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7608
Sailo-BGoo[t].exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7608
Sailo-BGoo[t].exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7608
Sailo-BGoo[t].exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
7608
Sailo-BGoo[t].exe
A Network Trojan was detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
7608
Sailo-BGoo[t].exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7608
Sailo-BGoo[t].exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
3448
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
7608
Sailo-BGoo[t].exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sailo-BGoo[t].exe