A workstation is suspected of actively spreading malware to shared folders. What is the best initial action under the incident procedure?

1. Disable endpoint monitoring before collecting any context
2. Immediately copy its executables to every spare workstation
3. Reconnect all shared folders to confirm the scope
4. Isolate it from the network and notify the response team