https://www.bleepingcomputer.com/news/security/windows-registry-helps-find-malicious-docs-behind-infections/ > If a Windows computer becomes infected and you are trying to find its source, a good place to check is for malicious Microsoft Office documents that have been allowed to run on the computer. > Ransomware, donwloaders, RATs, and info-stealing Trojans are commonly distributed through phishing emails containing Word and Excel documents with malicious macros.