Based on our investigation, instead of the usual three files, the threat actor used five:  dlpumgr32.exe, a legitimate signed file that belongs to the DESlock+ product DLPPREM32.DLL, a malicious DLL sideloaded by dlpumgr32.exe that loads and decodes DLPPREM32.bin DLPPREM32.bin, a shellcode that decompresses and loads a launcher in memory data.res, an encrypted file decoded by the launcher and contains two SysUpdate versions: one for a 32-bit architecture and another for a 64-bit architecture config.res, an encrypted file decoded by the launcher and contains the SysUpdate configuration, such as the command-and-control (C&C) address  