Suspicious AVScan Process Making Outbound Public Network Connection

Kaung Khant Ko@kaungkhantko

•updated today•3•0•5

Detects the execution of an application named avscan.exe from suspicious writable directories such as Users Public, ProgramData, or AppData Local, followed by an outbound public network connection within a one-hour window.