Similar to the routine variant in Figure 6, the Excel VBA macros retrieve the FlawedAmmyy downloader from hxxp://195[.]123[.]245[.]185/r1 or hxxp://185[.]225[.]17[.]5/r1, in then decrypts and executes FlawedAmmyy RAT from hxxp://185[.]225[.]17[.]5/2.dat or hxxp://195[.]123[.]245[.]185/1.dat.