tokens: Figure 3 : Loading core malicious code into the benign application Once the “ core ” module is extracted and loaded , the “ loader ” uses the reflection technique to initialize and start the “ core ” module .