Figure 8: Network communication to download the Pause.ps1 payload Zyklon Delivery In all these techniques, the same domain is used to download the next level payload (Pause.ps1), which is another PowerShell script that is Base64 encoded (as seen in Figure 8)