Executes VBScript using Process.Start. Next, the DLL loads an embedded resource named "78c855a088924e92a7f60d661c3d1845" into memory and decrypts it using multiple XOR operations. Loads the resource using Assembly.GetManifestResourceStream. Method that performs the XOR decryption. The decrypted resource is a DLL file embedded with two resources named "AdvancedRun" and "Waqybg" that are compressed with GZip. Two resources embedded in the decrypted resource. The third-stage DLL proceeds by loading the "AdvancedRun" resource into memory, decompressing it and dropping it as "AdvancedRun.exe" into the %TEMP% directory. Calling GZipStream class to decompress the resource. Drops AdvancedRun.exe using File.WriteAllBytes. The TrustedInstaller group was an addition to Windows beginning in Windows 7 with the goal of preventing accidental damage to critical system files