A PowerShell script was executed on the compromised system. This script is suspected to be used to establish a foothold and download additional malicious payloads. The execution follows a successful phishing attempt that targeted user john.doe.