Hi Todski17,
Based on what you described, I’ll first clarify an important point, then suggest a focused way to verify whether this is actually malicious.
Have you already tried the Q&A Assist suggestions? In addition, instead of looking only at IPs, it’s more useful to identify which process is making those connections:
Step 1: Map connections to processes
- Open Command Prompt (Admin)
- Run:
netstat -abno - Look at the process name shown above each connection
- If you see known processes like “svchost.exe,” “msedge.exe,” or “chrome.exe,” that is typically expected.
- If you see unknown or random-looking names, that’s worth investigating.
Step 2: Confirm using Resource Monitor
- Press Windows + R > type “resmon” > Enter
- Go to the “Network” tab
- Expand “Processes with Network Activity”
This gives a clearer, real-time view of which apps are using the network.
Based on your concern about financial accounts, I strongly recommend this action:
Run an offline malware scan (deep scan)
- Open “Windows Security”
- Go to “Virus & threat protection”
- Select “Scan options”
- Choose “Microsoft Defender Offline scan” > “Scan now”
This runs outside normal Windows and is effective against hidden threats.
Also, here's a couple of quick checks:
- Check “Startup apps” (Task Manager > Startup) and disable anything unfamiliar
- Make sure Windows Update is fully up to date
- If you’ve ever installed remote support software you didn’t fully trust, consider removing it
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.