It should be noted that most of the compilation timestamps of these DLL files have been modified by the attacker to a year in the far future (2060, 2099 …), and the server IP addresses are often hidden behind CloudFlare.