How a new PlugX variant abuses DLL search order hijacking