How to find which processes have initiated a connection
Apologies if this question seems foolish - I am a little out of my depth trying to track down some apparent malware that MalwareBytes, Bitdefender Total Security and other virus scans don't catch.
My DNS cache shows that something on my laptop is connecting to undesirable websites, so is there a way I can use Wireshark to identify what program (etc.) is responsible. If I sit and wait long enough, I can see the connections appearing on Wireshark, but I don't see anything informative in the packet description (example below from the first in the series).
I have tried NetStat -b to see processes associated with active connections, but none of the foreign addresses it shows are the ones I am looking for. (Maybe I was too slow and didn't catch it?) So, how can I see what is invoking the unwanted connection?
Thanks.
[Edit - typos]
[Edit 2 - removed Wireshark output]
If you're on Windows, discussion here might help:
Identify windows process behind short lived ephemeral port
@Chuckc - Thanks. Process Monitor points to a VPN service as being the culprit. Though why it should be downloading from IP addresses with suspicious names when the VPN isn't even active is a bit of a mystery.
Are you able to name the VPN service?
@grahamb - Bitdefender: bdvpnservice.exe
I am suspicious because it was accessing Sportsballhub.net and Amandahugnkiss.org, both at 104.18.22.107.