When executed, it attempts to mass mail itself, and then makes over 10,000 copies of itself on the desktop, taking up memory and space. Most of these copies cannot be seen through normal means. The copies are named "Sharoon(randomnumber).exe", "Bush (randomnumber).exe", or "ZA_Union(randomnumber).exe". During the payload, Control-Alt-Delete is disabled, so the user cannot easily disable the worm. The payload lasts until it makes around 10,000 copies or until there is no space left on the C:\ drive.