Given these fragmented Windows Event logs, how would you piece together the timeline of a lateral movement attack?
