AdvancedIPScanner

Advanced IP Scanner is a scanning tool commonly leveraged by threat actors.

After closing the program it writes three or four files the most important of which is advanced_ip_scanner_MAC.bin which contains a list of IPs and System Names the Program Scanned.

advanced_ip_scanner_Favorites.bin has been observed to behave differently to the other files. When run in portable mode it saves the .bin file beside the .exe rather than in a temp folder.

For performance reasons it is recommended to comment out the recursive Favorites rule with #s. On bigger disks with many files it could add hours on to the triage collection.