        Figure 2. asycfilt.dll shown among loaded module names      lz32.dll is opened based on process monitoring tools.       Figure 3. lz32.dll shown among opened files      Only PuppetLoader’s dropper payload is loaded and none of the previously mentioned libraries is actually loaded.