A threat analyst is documenting an intrusion using the Diamond Model of Intrusion Analysis. Investigation reveals that the attacker used a spear-phishing email to compromise an accounts-payable employee's workstation, then leveraged that access to reach the finance department's payment system. The analyst wants to properly populate the model's four core vertices. Which piece of evidence should be recorded under the 'Victim' vertex?