suspicious traffic tied to know abusive Ip but process has valid Microsoft signature

I recently decided to do a Wireshark scan after being in a game that had a known remote code execution vuln and had a person already exploiting (using mod menu). I ran an antivirus scan and nothing was flagged. However, when I started a network scan using Wireshark, I saw loads of TCP traffic coming from an Ip. I looked it up and found it on abuseipdb. This prompted me to factory reset my device to see if that would …

abuseipdb antivirus code code execution coming exploiting game malware microsoft mod network process remote code remote code execution scan signature tcp traffic valid vuln wireshark