What Happened Next?

We had a pretty good lay of what was going on, but little things just like that started popping up. It's all in the timing, as they say. So at this point, data is being ex-filled. They've Kerber-roasted the domain controllers. At this point, we assume that they're already cracking passwords offline. We've got multiple files, both the, what would later be determined to be the black pasta mower, sorry, ransomware, spread throughout the servers.