In the event this is successful the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\services\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\microsoft\mmc\  It proceeds to load and decrypt and embedded bitmap resource file