TrendLabs: New EMOTET Hijacks a Windows API

Figure 1. A CreateTimerQueueTimer API document (from CreateTimerQueueTimer function)

REF: http://blog.trendmicro.com/trendlabs-security-intelligence/new-emotet-hijacks-windows-api-evades-sandbox-analysis/