Opening the documents will enable the macros and download the same FlawedAmmyy downloader as the .ISO file iteration from hxxp://92[.]38[.]135[.]67 or hxxp://27[.]102[.]70[.]196, with filenames k1 or k2.