value:  Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class. 
name: Obfuscated Files or Information: Compile After Delivery