### Overview
Following the detection of unusual network traffic, a detailed packet analysis was conducted. The traffic was traced back to a compromised endpoint within the corporate network.

### Key Findings
- **Source IP:** 192.168.1.105
- **Destination IP:** External IP linked to a known Command and Control (C2) server.
- **Traffic Pattern:** High-frequency connections at irregular intervals suggest automated data exfiltration attempts.

### Next Steps
- Enhanced endpoint monitoring is recommended to detect any suspicious file executions that could indicate the execution stage of the malware lifecycle.