As part of Reflective DLL loading the malware performs the following tasks on the DLL it has unwrapped in memory: Copy the unwrapped DLL into new locations in its own memory space. Build imports required by the DLL (based on the IAT of the DLL) - Copy the unwrapped DLL into new locations in its own memory space. Build imports required by the DLL (based on the IAT of the DLL