A security analyst received a report that several workstations at the company are experiencing slow performance. After scanning the network, the analyst identified several abnormal TCP connections. What is the most appropriate next step?