It reads to me that the DLL is something they found later while trying to determine what the attacker was doing after they were already in.