From what I can tell there were two main TMP files present on the infected USB stick. The smaller of the two would run first and hook various functions related to viewing files so as to hide the LNK and TMP files.
While this was happening would it not raise suspicions? Someone would view the USB stick, see the six files and then they would just disappear?
