When the shellcode embedded within the malicious EPS is executed, the following three files are dropped:  %PROGRAMDATA%\Microsoft\DeviceSync\VMwareCplLauncher.exe %PROGRAMDATA%\Microsoft\DeviceSync\vmtools.dll %PROGRAMDATA%\Microsoft\DeviceSync\MSBuild.exe  In the list of dropped files, VMwareCplLauncher.exe is a legitimate, signed VMware executable that serves to ultimately deliver the BADNEWS payload