SNOWLIGHT Dynamic advapi32.dll Load and GetUserNameA Resolution for User Discovery

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the SNOWLIGHT dropper process (masquerading as wusvc.exe) dynamically loading advapi32.dll and invoking GetUserNameA via hash-based API resolution. This behavior is indicative of malware performing system owner/user discovery.