drop ldrmodules malfind or raw memory region · detect reflective dll loading · module-less in-memory pe · reflectiveloader export and stubs · runs locally
ldrmodules False/False/True · ReflectiveLoader export · loader stub byte patterns
drop ldrmodules txt · malfind region · memory dump