SNOWLIGHT Dynamic GetUserNameA Resolution via advapi32.dll

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the SNOWLIGHT dropper executing or loading modules as 'wusvc.exe' (a common masquerading name) from a user Downloads directory. This behavior is indicative of a reconnaissance phase where the dropper attempts to resolve 'GetUserNameA' from 'advapi32.dll' to identify the current system user.