The macro in the XLS file uses PowerShell to download and execute gm.exe, which is the Warzone RAT - Gm.exe bypasses UAC to run at high integrity level - Gm.exe copies itself to %programdata% with the name Images.exe and then executes it