A user reports that a system is performing unusually and is sending requests to an unfamiliar IP address every five minutes. Which of the following should the technician check first to troubleshoot…

Application logs record events from specific applications, but they might not show the real-time, active process causing the outbound connection, and could be overwhelming to sift through without knowing the source.

Checking running processes allows the technician to immediately identify what applications or services are actively running on the system and consuming resources, including initiating network connections. This helps pinpoint the specific executable responsible for sending requests to an unfamiliar IP address, which is a strong indicator of malware or unauthorized software.

While running antivirus scans is a crucial step for malware, identifying the running process first can provide immediate insight into the threat, allow for manual termination, or help verify if existing antivirus is effective.

Recent system updates are unlikely to cause a system to repeatedly send requests to an unfamiliar IP address; this symptom points more directly to an actively running malicious or unauthorized application.