"Save" command may be used to place malware file anywhere on user's computer (including Startup folder).
vulners.com/securityvulns/securityvulns:doc:2653