The document attempts to execute code on the recipient’s computer, using a macro. The macro passes a Base64-encoded command to Windows PowerShell, which gathers system information via Windows Management Instrumentation (WMI), and attempts to determine the installed version of .NET by querying the registry (full script available in Appendix A: Stage One PowerShell Command