The plugin_host.exe application imports several functions from a library named python33, which is how the legitimate application sideloads the malicious DLL named PYTHON33.dll. This is the first instance we have observed Sublime Text’s plugin host application used for sideloading. Like the plugin host application, the CreateMedia.exe application imports several functions from a library named CreateTsMediaAdm that is leveraged to load the malicious DLL named CreateTsMediaAdm.dll