He clicked it. The download began, but it didn't ask for a save location. It didn't open a browser download bar. It simply streamed directly onto his screen.
Many universities run public FTP/HTTP indexes of licensed software for students. While most require login, a few leave directories open. Examples (historical): index of windows iso
of the downloaded file against known official values. If the "fingerprint" of the file doesn't match Microsoft’s official records, the file is considered compromised. Conclusion He clicked it
Download the Media Creation Tool from the Microsoft website. He clicked it. The download began