uhhhh i just found something
for anyone that doesnt know, if you go to a .dll on virus total and then go to details, scroll down and find urlmon.dll that probably means its a rat, to make sure press the plus next to and if it says "URLDownloadToFileA" that means its a rat and i just found that...