The first download called, will open windows firewall to download the second exe, which if your AV defs are upto date, should catch the payload.