This is also our 150th (!) investigation scenario! I'll pick a favorite response at the end of the week and give you a free class at https://networkdefense.io.