HackTool - F-Secure C3 Load by Rundll32 (b18c9d4c-fac9-4708-bd06-dd5bfacf200f)

F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
HackTool - F-Secure C3 Load by Rundll32 (b18c9d4c-fac9-4708-bd06-dd5bfacf200f)	Sigma-Rules	Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5)	Attack Pattern	1
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5)	Attack Pattern	2