Exam NSK200 topic 1 question 20 discussion

You are given an MD5 hash of a file suspected to be malware by your security incident response team. They ask you to offer insight into who has encountered this file and from where was the threat initiated.
In which two Scope IT events tables would you search to find the answers to these questions? (Choose two.)