A security operations analyst suspects that a malware infection on one of the endpoints may have led to unauthorized access. To identify the root cause and trace the malware's activities, which combination of data sources should the analyst prioritize for review?

A$.$Logs from applications and antivirus installed on a randomly selected endpoint.

B$.$Network logs$,$ packet captures, and logs generated by network$-$based vulnerability scanners.

C$.$Firewall logs$,$ system memory metadata, and automated reports from the SIEM tool.

D$.$Endpoint logs$,$ log files generated by the OS components of the affected host computer, and logs from the host$-$based intrusion detection system.