The article is not clear on the actual execution step. It is written by Cisco, after all, suggesting that the article is concerned mostly with how the worm spre

The article is not clear on the actual execution step. It is written by Cisco, after all, suggesting that the article is concerned mostly with how the worm spreads itself (with more focus on the command-and-control and networking). It's possible that it only spreads when it is saved locally and "opened" by the user in an application. It's also possible that it's executed in the browser upon open and/or render. Since the worm/payload is a DLL and the user-agent making the download requests is Trident, I'm guessing it's a problem with the Windows + IE code, which is likely shared, that renders PNG images.