## Execution Analysis

**Context:** Following the initial suspicious software installation, unusual script executions were detected on several workstations.

**Findings:**
- Scripts were executed using PowerShell, likely to establish communication with command-and-control (C2) servers.
- The scripts were obfuscated, indicating a high level of sophistication typical of RTM Group operations.
- Network traffic analysis shows connections to known malicious IP addresses linked with RTM Group.

**Deeper Insight:**
- These scripts are part of the trojan's payload delivery mechanism, aiming to download additional malicious modules.

**Next Steps:**
- Investigate persistent network anomalies that may indicate the establishment of a more permanent foothold in the network.