The Downloader After the exploit or script executes, the system downloads install.exe, which has the following metadata: MD5             5a0c4e1925c76a959ab0588f683ab437 Size            46592 bytes Compile Time    2014-11-19 08:55:10Z Import Hash     6b8611f8148a6b51e37fd68e75b6a81c The file install.exe attempts to write two files (doc.exe and test.exe) to the hard-coded path “C:\Users\Public”, which fails on Windows XP because that path is not present by default