Reconstruct the Movement

Lateral movement is suspected in a fresh Marasi incident. From authentication and endpoint evidence, reconstruct where the attacker went, in what order, and where they stopped. Bound the scope with evidence — including the boundary a failed attempt provides.