Always gotta run this kind of shit in an isolated vlan with no internet access. I would be really interested to see what traffic there was on the local network. I would expect them to be mapping and fingerprinting everything on the network and reporting that back home.