If the attachment is opened, Ray’s worm will copy itself in the system directory under the name scam32.exe. It also copies itself into the directory “Recycled” under the name sirc32.exe, which is a hidden file. Then the virus creates three keys in the Windows Registry.