Following the initial access, the attackers exploited a zero-day vulnerability to execute a custom malware named 'StealthRat' on endpoint 192.168.1.45, gaining control over the system. The malware was executed using a payload dropped by the process svchost.exe, which connected to an external command and control server at 203.0.113.45. The hash of the malicious executable is d41d8cd98f00b204e9800998ecf8427e.