files. Using the Multiple Siemens SIMATIC Products DLL Loading Arbitrary Code Execution Vulnerability (CVE2012-3015), the S7hkimdb.dll file is executed, which then decrypts and injects the main XR00001.MDX Stuxnet