Employees report computer system crashes within the same week. An analyst is investigating one of the computers that crashed and discovers multiple shortcuts in the system's startup folder. It…

Removing shortcut files is a remediation action that should occur after the scope of the incident is fully understood, not before other affected systems are identified.

Checking audit logs on a single machine is useful for deeper forensic work but does not address the broader concern that multiple systems may be compromised simultaneously.

Identifying all affected systems determines the full scope and blast radius of the incident. Because multiple employees reported crashes in the same week, the malicious shortcuts likely exist on more than one machine. Scoping the incident first ensures that remediation and investigation efforts address every compromised endpoint, preventing reinfection from untouched systems.

Investigating the malicious URLs is a threat intelligence step that should follow scope identification, as it does not help determine which or how many systems are currently affected.