Figure 4: Embedded URL in OLE object    Figure 5: HTTP GET request to download the next level payload The downloaded file, doc.doc, is XML-based and contains a PowerShell command (shown in Figure 6) that subsequently downloads the binary Pause.ps1