Following successful delivery, the malicious document's macros are executed, initiating the download and installation of Dridex on the compromised system. The execution of the macro was detected on the endpoint, which downloaded the Dridex payload from a known malicious IP.