Which of the following should be the FIRST step when performing triage of a malware...

The first step when performing triage of a malware incident is to contain the affected system, which means isolating it from the network and preventing any further communication or data transfer with the attacker or other compromised systems. Containing the affected system helps to limit the scope and impact of the incident, preserve the evidence, and prevent the spread of the malware to other systems.

References = NIST SP 800-61 Revision 2, CISM Review Manual 15th Edition