When the Excel document is opened, two executables (utilman.exe and mpsvc.dll) will be dropped at folder %AppData%MicrosoftCorporation. A shortcut for utilman.exe is then created at the startup folder so that the dropped files execute during the next reboot of the machine and communicate with a command and control (C2