SharkLoader MinHook DLL and SyncRes.dat API Hooking from AppData xwreg/xgdf
Detects the loading of specific suspicious library files (SyncRes.dat, SystemSettings.dll, DscCoreR.mui) from the AppData Roaming directory subfolders 'xwreg' or 'xgdf'. This activity is often associated with file masquerading or persistence techniques where malicious code is executed under the guise of legitimate-sounding system files.
CQL
