Random tmp files trying to connect to internet, blocked by simplewall

Edit: it's NordVPN doing silly stuff

Hi!

For some time I get random tmp files trying to connect, but then they disappear.

- They try to connect to tcp://104.18.21.226 - example paths "C:\windows\temp\is-q6m5h.tmp\tib44yw0.tmp", "C:\windows\temp\is-hk0rm.tmp\galiq3vb.tmp", "C:\windows\temp\is-54a8v.tmp\2qbduiqu.tmp" - not signed - no antywirus (Windows Defender) detection - simplewall notes say "System app"

Is this some kind of app trying to update or check for internet access or something more spicy?