1) Ferocious dropper: The Excel dropper, after the user opens it and disables the protected mode, will execute a series of formulas placed in a hidden column. 19: Check if a mouse is present. 42: Check if the host computer is capable of playing sounds. 2) 1: Get the name of the environment in which Microsoft Excel is running, as text, followed by the environment’s version number. 3) 19: Check if a mouse is present. 4) 42: Check if the host computer is capable of playing sounds. If any of the above checks fail, or if the Windows environment matches any of the aforementioned versions predefined in the document (different documents have different predefined versions), the process will halt. 5) Ferocious run-1: After the macro finishes writing to disk, it runs winrm.vbs using explorer.exe. Registry keys used for COM hijacking After the above execution chain, the Excel 4.0 macro will clean up and delete the winrm.vbs and winrm.txt files. 6) Ferocious run-2: The macro will continue after the cleanup by recreating and opening the same files, winrm.vbs and winrm.txt