A PowerShell script was detected executing on a compromised machine following a successful phishing attack. The script was used to download and execute the Ragnar Locker ransomware payload, indicating the beginning of the ransomware execution phase.