SynkLoader malicious msvcp150/160.dll sideloading indicators

Emiliano Mema@Nosalva

•updated Aug 25, 2026•0•0•4

Detects malicious DLL files attempting to masquerade as legitimate Microsoft Visual C++ runtime libraries (msvcp150.dll or msvcp160.dll) by identifying export markers and internal strings associated with the SynkLoader reflective PE loader.