I have ExpressVPN installed and keep getting strange warnings from Malwarebytes anti-malware.
First odd fact is that XVPND.exe is always running, even after a reboot. I have set ExpressVPN to not auto start at boot. There is no systray icon whatsoever. So first of all, does anyone have any clue why that file is running and listening on port 2015 (TCP)?
Second I keep getting warnings from Malwarebytes anti-malware that XVPND.exe connects to malicious IP-adresses (e.g. 126.96.36.199). When looking up that IP it seems to belong to a Canadian e-commerce service: Yesup Ecommerce Solutions Inc.
I would like to monitor the .exe to see what other connections it makes, any suggestions on how to (on Windows)?