An impossible timeline

In your incident timeline, the firewall shows data leaving at 10:05, but EDR shows the malware starting at 13:40 the same day. Both are from the same host. What should you check first?

firewall.log   2026-03-12 10:05:17  ALLOW  10.1.4.22 -> 203.0.113.9:443  48MB
edr_event      2026-03-12T13:40:02+04:00  process_start  updater.exe  host=10.1.4.22