From the same folks over at the fake expressvpn,
https://expressedvpn.com
Download link: https://my.cloudme.com/v1/ws2/:foryou009/:ExpressVPN/ExpressVPN.zip
The download link revealed the username of the malware REPO, foryou009
it can be found here: CloudMe - The European Sync / Storage Service