: Addition of a key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to the extracted folder.
: The malicious payload. This is the heart of the SnoozeGnat operation. When the launcher runs, it automatically calls this DLL, which contains the encrypted malware logic. SnoozeGnat.7z
: Creation of temporary .tmp files in the %AppData% directory that match the size of your system's ntdll.dll . Conclusion & Mitigation it automatically calls this DLL