1) Ferocious dropper: The Excel dropper, after the user opens it and disables the protected mode, will execute a series of formulas placed in a hidden column. 19: Check if a mouse is present. 42: Check if the host computer is capable of playing sounds. 2) 1: Get the name of the environment in which Microsoft Excel is running, as text, followed by the environment’s version number. 3) 19: Check if a mouse is present. 4) 42: Check if the host computer is capable of playing sounds. 5) Ferocious run-1: After the macro finishes writing to disk, it runs winrm.vbs using explorer.exe. Microsoft’s command line licensing tool slmgr.vbs is also able to provide similar results. Registry keys used for COM hijacking After the above execution chain, the Excel 4.0 macro will clean up and delete the winrm.vbs and winrm.txt files. 6) Ferocious run-2: The macro will continue after the cleanup by recreating and opening the same files, winrm.vbs and winrm.txt