Impressive timeline! In many orgs going through all logs, let alone doing reconnaissance on attacker infra, seizing domains, and sharing threat intel with other companies because of such mediocre attack is out of question.

Was almost waiting for a dox of the attacker :-)