When the self-extracting executable is launched, the downloader and legitimate file are typically dropped in one of the following directories and then executed:  When the malicious downloader is executed, it begins by creating the 'mcsong[]' event in order to ensure one instance is running.