diff --git a/README.md b/README.md
index 547b990..e520793 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,2 @@
 # OffensiveCpp
-This repo contains C/C++ snippets that can be handy in specific offensive scenarios.
+This repo contains collection of C/C++ snippets that can be handy in specific offensive scenarios.
diff --git a/Sandbox Evasion/UTC_time_zone.c b/Sandbox Evasion/UTC_time_zone.c
new file mode 100644
index 0000000..366ad46
--- /dev/null
+++ b/Sandbox Evasion/UTC_time_zone.c	
@@ -0,0 +1,30 @@
+/*
+    Checks if time zone is Coordinated Universal Time (UTC), C
+    Module written by Brandon Arvanaghi 
+    Website: arvanaghi.com 
+    Twitter: @arvanaghi
+*/
+
+#include "Windows.h"
+#include "stdio.h"
+
+int main(int argc, char** argv[]) {
+	TIME_ZONE_INFORMATION timeZone;
+	DWORD ret = GetTimeZoneInformation(&timeZone);
+
+	if (ret == TIME_ZONE_ID_INVALID) {
+		printf("Unable to retrieve time zone informaiton, exiting.\n");
+		getchar();
+		exit(-1);
+	} else {
+		if (!wcscmp(L"Coordinated Universal Time", timeZone.DaylightName) || !wcscmp(L"Coordinated Universal Time", timeZone.StandardName)) {
+			wprintf(L"The time zone is Coordinated Universal Time (UTC), do not proceed.\n");
+		} else {
+			wprintf(L"The time zone is %s. Proceed!\n", timeZone.DaylightName);
+		}
+	}
+
+	getchar();
+	return 0;
+
+}
diff --git a/Sandbox Evasion/check_all_DLL_names.c b/Sandbox Evasion/check_all_DLL_names.c
new file mode 100644
index 0000000..e33a936
--- /dev/null
+++ b/Sandbox Evasion/check_all_DLL_names.c	
@@ -0,0 +1,72 @@
+/*
+    Checks all DLL names loaded by each process, C
+    Module written by Brandon Arvanaghi 
+    Website: arvanaghi.com 
+    Twitter: @arvanaghi
+*/
+
+#include <windows.h>
+#include <stdio.h>
+#include <psapi.h>
+
+#define numSandboxDLLs 7
+
+WCHAR* sandboxDLLs[numSandboxDLLs] = { L"sbiedll.dll", L"dbghelp.dll", L"api_log.dll", L"dir_watch.dll", L"pstorec.dll", L"vmcheck.dll", L"wpespy.dll" };
+
+int main(void) {
+	DWORD loadedProcesses[1024];
+	DWORD cbNeeded;
+	DWORD cProcesses;
+	unsigned int i;
+
+	// Get all PIDs
+	if (!EnumProcesses(loadedProcesses, sizeof(loadedProcesses), &cbNeeded)) {
+		printf("[---] Could not get all PIDs, exiting.\n");
+		getchar();
+		exit(-1);
+	}
+
+	// Calculate how many PIDs returned
+	cProcesses = cbNeeded / sizeof(DWORD);
+
+	// Check all loaded DLLs
+	HANDLE hProcess;
+	int evidenceCount = 0;
+	for (i = 0; i < cProcesses; i++) {
+		HMODULE hMods[1024];
+
+		// Get a handle to the process.
+		hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, loadedProcesses[i]);
+		if (hProcess != NULL) {
+
+			// Get a list of all the modules in this process.
+			if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded)) {
+				for (int i = 0; i < (cbNeeded / sizeof(HMODULE)); i++) {
+					TCHAR szModName[MAX_PATH];
+					// Get the full path to the module's file.
+					if (GetModuleFileNameEx(hProcess, hMods[i], szModName, sizeof(szModName) / sizeof(TCHAR))) {
+						for (int j = 0; j<numSandboxDLLs; ++j) {
+							if (wcsstr(szModName, sandboxDLLs[j])) {
+								CHAR processName[MAX_PATH];
+								GetProcessImageFileNameA(hProcess, &processName, MAX_PATH);
+								printf("Process name: %s\n", processName);
+								wprintf(L"\t DLL loaded: %s\n", szModName);
+								
+								++evidenceCount;
+							}
+						}
+					}
+				}
+			}
+			CloseHandle(hProcess);
+		} // if hProcess != NULL 	
+	} // for each process
+
+	if (evidenceCount == 0) {
+		printf("No sandbox-indicative DLLs were discovered loaded in any accessible running process. Proceed!\n");
+	}
+
+	getchar();
+	return 0;
+}
+
diff --git a/Sandbox Evasion/check_all_process_names.c b/Sandbox Evasion/check_all_process_names.c
new file mode 100644
index 0000000..73d8b80
--- /dev/null
+++ b/Sandbox Evasion/check_all_process_names.c	
@@ -0,0 +1,62 @@
+/*
+    Checks all loaded process names, C
+    Module written by Brandon Arvanaghi
+    Website: arvanaghi.com 
+    Twitter: @arvanaghi
+*/
+
+#include "stdio.h"
+#include "Windows.h"
+#include "tlhelp32.h"
+
+#define numSandboxProcesses 21
+
+WCHAR* sandboxProcesses[numSandboxProcesses] = { L"vmsrvc", L"tcpview", L"wireshark", L"visual basic", L"fiddler", L"vmware", L"vbox", L"process explorer", L"autoit", L"vboxtray", L"vmtools", L"vmrawdsk", L"vmusbmouse", L"vmvss", L"vmscsi", L"vmxnet", L"vmx_svga", L"vmmemctl", L"df5serv", L"vboxservice", L"vmhgfs" };
+
+// Main
+int wmain(int argc, wchar_t *argv[]) {
+	HANDLE hProcessSnap;
+	HANDLE hProcess;
+	PROCESSENTRY32 pe32;
+	DWORD dwPriorityClass;
+
+	// Take a snapshot of all processes in the system.
+	hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+	if (hProcessSnap == INVALID_HANDLE_VALUE) {
+		printf("Could not create snapshot, exiting.\n");
+		getchar();
+		exit(-1);
+	}
+
+	// Set the size of the structure before using it.
+	pe32.dwSize = sizeof(PROCESSENTRY32);
+
+	// Retrieve information about the first process, exit if unsuccessful
+	if (!Process32FirstW(hProcessSnap, &pe32)) {
+		printf("Could not retrieve information about processes, exiting.");
+		CloseHandle(hProcessSnap);
+		getchar();
+		exit(-1);
+	}
+
+	// Walk the snapshot of processes, find bad ones
+	int evidenceCount = 0;
+	do {
+
+		for (int i = 0; i < numSandboxProcesses; ++i) {
+			if (wcsstr(pe32.szExeFile, sandboxProcesses[i])) {
+				wprintf(L"%s\n", pe32.szExeFile);
+				++evidenceCount;
+			}
+		}
+
+	} while (Process32NextW(hProcessSnap, &pe32));
+
+	if (evidenceCount == 0) {
+		printf("Proceed!\n");
+	}
+
+	getchar();
+
+	return 0;
+}
diff --git a/Sandbox Evasion/detect_debugging.c b/Sandbox Evasion/detect_debugging.c
new file mode 100644
index 0000000..e25d732
--- /dev/null
+++ b/Sandbox Evasion/detect_debugging.c	
@@ -0,0 +1,25 @@
+/*
+	Checks if process is currently being debugged, C
+	Module written by Brandon Arvanaghi
+	Website: arvanaghi.com
+	Twitter: @arvanaghi
+*/
+
+#include "Windows.h"
+#include "Winternl.h"
+#include "stdio.h"
+
+int main(int argc, char **argv[]) {
+
+	PPEB pPEB = (PPEB)__readfsdword(0x30);
+
+	if (pPEB->BeingDebugged) {
+		printf("A debugger is present, do not proceed.");
+	} else {
+		printf("No debugger is present. Proceed!");
+	}		
+
+	getchar();
+	return 0;
+
+}
\ No newline at end of file
diff --git a/Sandbox Evasion/filepath_existence.c b/Sandbox Evasion/filepath_existence.c
new file mode 100644
index 0000000..672146f
--- /dev/null
+++ b/Sandbox Evasion/filepath_existence.c	
@@ -0,0 +1,52 @@
+/*
+	Filepath existence checker, C
+	Module written by Brandon Arvanaghi
+	Website: arvanaghi.com
+	Twitter: @arvanaghi
+*/
+
+#include <stdio.h>
+#include <io.h>
+#include <tchar.h>
+#include "Shlwapi.h"
+#pragma comment(lib, "Shlwapi.lib")
+
+#define numFiles 32
+
+int main(int argc, char **argv[]) {
+
+	LPCWSTR filePaths[numFiles] = { L"C:\\windows\\Sysnative\\Drivers\\Vmmouse.sys",
+		L"C:\\windows\\Sysnative\\Drivers\\vm3dgl.dll", L"C:\\windows\\Sysnative\\Drivers\\vmdum.dll",
+		L"C:\\windows\\Sysnative\\Drivers\\vm3dver.dll", L"C:\\windows\\Sysnative\\Drivers\\vmtray.dll",
+		L"C:\\windows\\Sysnative\\Drivers\\vmci.sys", L"C:\\windows\\Sysnative\\Drivers\\vmusbmouse.sys",
+		L"C:\\windows\\Sysnative\\Drivers\\vmx_svga.sys", L"C:\\windows\\Sysnative\\Drivers\\vmxnet.sys",
+		L"C:\\windows\\Sysnative\\Drivers\\VMToolsHook.dll", L"C:\\windows\\Sysnative\\Drivers\\vmhgfs.dll",
+		L"C:\\windows\\Sysnative\\Drivers\\vmmousever.dll", L"C:\\windows\\Sysnative\\Drivers\\vmGuestLib.dll",
+		L"C:\\windows\\Sysnative\\Drivers\\VmGuestLibJava.dll", L"C:\\windows\\Sysnative\\Drivers\\vmscsi.sys",
+		L"C:\\windows\\Sysnative\\Drivers\\VBoxMouse.sys", L"C:\\windows\\Sysnative\\Drivers\\VBoxGuest.sys",
+		L"C:\\windows\\Sysnative\\Drivers\\VBoxSF.sys", L"C:\\windows\\Sysnative\\Drivers\\VBoxVideo.sys",
+		L"C:\\windows\\Sysnative\\vboxdisp.dll", L"C:\\windows\\Sysnative\\vboxhook.dll",
+		L"C:\\windows\\Sysnative\\vboxmrxnp.dll", L"C:\\windows\\Sysnative\\vboxogl.dll",
+		L"C:\\windows\\Sysnative\\vboxoglarrayspu.dll", L"C:\\windows\\Sysnative\\vboxoglcrutil.dll",
+		L"C:\\windows\\Sysnative\\vboxoglerrorspu.dll", L"C:\\windows\\Sysnative\\vboxoglfeedbackspu.dll",
+		L"C:\\windows\\Sysnative\\vboxoglpackspu.dll", L"C:\\windows\\Sysnative\\vboxoglpassthroughspu.dll",
+		L"C:\\windows\\Sysnative\\vboxservice.exe", L"C:\\windows\\Sysnative\\vboxtray.exe",
+		L"C:\\windows\\Sysnative\\VBoxControl.exe"};
+
+
+	int evidenceCount = 0;
+	for (int i=0; i < numFiles; ++i) {
+		if (PathFileExists(filePaths[i])) {
+			wprintf(filePaths[i]);
+			wprintf("\n");
+			++evidenceCount;
+		}
+	}
+
+	if (evidenceCount == 0) {
+		printf("No files exist on disk that suggest we are running in a sandbox. Proceed!\n");
+	}
+
+	getchar();
+	return 0;
+}
diff --git a/Sandbox Evasion/hostname.c b/Sandbox Evasion/hostname.c
new file mode 100644
index 0000000..b5b78fb
--- /dev/null
+++ b/Sandbox Evasion/hostname.c	
@@ -0,0 +1,30 @@
+/*
+    Hostname checker, C
+    Module written by Brandon Arvanaghi 
+    Website: arvanaghi.com 
+    Twitter: @arvanaghi
+*/
+
+#include <stdio.h>
+#include <Windows.h>
+
+int wmain(int agrc, wchar_t **argv[]) {
+
+	WCHAR* computerName[3267];
+	DWORD charCount[3267];
+
+	if (!GetComputerNameW(&computerName, &charCount)) {
+		printf("Could not read computer name, exiting.\n");
+		getchar();
+		exit(-1);
+	}
+
+	if (!wcsicmp(computerName, argv[1])) {
+		printf("Proceed!\n");
+	} else {
+		wprintf(L"Hostname: %s", computerName);
+	}
+
+	getchar();
+	return 0;
+}
\ No newline at end of file
diff --git a/Sandbox Evasion/mac_address.c b/Sandbox Evasion/mac_address.c
new file mode 100644
index 0000000..c23cb34
--- /dev/null
+++ b/Sandbox Evasion/mac_address.c	
@@ -0,0 +1,71 @@
+/*
+    MAC address checker, C
+    Most code taken from https://msdn.microsoft.com/en-us/library/windows/desktop/aa366062(v=vs.85).aspx
+    Module written by Brandon Arvanaghi 
+    Website: arvanaghi.com 
+    Twitter: @arvanaghi
+*/
+
+#include <winsock2.h>
+#include <iphlpapi.h>
+#include <stdio.h>
+#pragma comment(lib, "IPHLPAPI.lib")
+
+int main(int argc, char** argv[]) {
+	boolean evidenceOfSandbox;
+	PIP_ADAPTER_INFO pAdapterInfo;
+	PIP_ADAPTER_INFO pAdapter = NULL;
+
+	// First three bytes of known Virtual Machine MAC addresses (e.g. 00-0C-29...)
+	unsigned char badMacAddresses[5][3] = {
+		{ 0x00, 0x0C, 0x29 },
+		{ 0x00, 0x1C, 0x14 },
+		{ 0x00, 0x50, 0x56 },
+		{ 0x00, 0x05, 0x69 },
+		{ 0x08, 0x00, 0x27 }
+	};
+
+	ULONG ulOutBufLen = sizeof(IP_ADAPTER_INFO);
+	pAdapterInfo = (IP_ADAPTER_INFO *)malloc(sizeof(IP_ADAPTER_INFO));
+
+	// Make an initial call to GetAdaptersInfo to get the necessary size into the ulOutBufLen variable
+	if (GetAdaptersInfo(pAdapterInfo, &ulOutBufLen) == ERROR_BUFFER_OVERFLOW) {
+		free(pAdapterInfo);
+		pAdapterInfo = (IP_ADAPTER_INFO *)malloc(ulOutBufLen);
+	}
+
+	if (GetAdaptersInfo(pAdapterInfo, &ulOutBufLen) == NO_ERROR) {
+		pAdapter = pAdapterInfo;
+		while (pAdapter) { // for each adapter
+			for (int i = 0; i < 5; ++i) { // check each row of bad MAC address table
+				if (!memcmp(badMacAddresses[i], pAdapter->Address, 3)) {
+					for (int j = 0; j < pAdapter->AddressLength; ++j) {
+						if (j == (pAdapter->AddressLength - 1)) {
+							printf("%.2X\n", (int)pAdapter->Address[j]);
+						} else {
+							printf("%.2X-", (int)pAdapter->Address[j]);
+						}
+					}
+					evidenceOfSandbox = TRUE;
+				}
+			}
+
+			pAdapter = pAdapter->Next;
+		}
+	} else { // GetAdaptersInfo failed
+		printf("[---] GetAdaptersInfo failed, exiting.\n");
+		exit(-1);
+		getchar();
+	}
+
+	if (pAdapterInfo) {
+		free(pAdapterInfo);
+	}
+		
+	if (!evidenceOfSandbox) {
+		printf("No MAC addresses match known virtual machine MAC addresses. Proceed!\n");
+	}
+
+	getchar();
+	return 0;
+}
diff --git a/Sandbox Evasion/minimum_num_running_processes.c b/Sandbox Evasion/minimum_num_running_processes.c
new file mode 100644
index 0000000..7ec2bca
--- /dev/null
+++ b/Sandbox Evasion/minimum_num_running_processes.c	
@@ -0,0 +1,42 @@
+/*
+	Ensures there are more than N processes currently running on the system (default: 50), C
+	Ensures at least N processes running on the system (defaults to 50)
+	Module written by Brandon Arvanaghi
+	Website: arvanaghi.com
+	Twitter: @arvanaghi
+*/
+
+#include <windows.h>
+#include <stdio.h>
+#include <psapi.h>
+
+int main(int argc, char **argv[]) {
+	int minNumProcesses = 50;
+
+	if (argc > 1) {
+		minNumProcesses = atoi(argv[1]);
+	}
+
+	DWORD loadedProcesses[1024];
+	DWORD cbNeeded;
+	DWORD runningProcesses;
+
+	// Get all PIDs
+	if (!EnumProcesses(loadedProcesses, sizeof(loadedProcesses), &cbNeeded)) {
+		printf("[---] Could not get all PIDs, exiting.\n");
+		getchar();
+		exit(-1);
+	}
+
+	// Calculate how many PIDs returned
+	runningProcesses = cbNeeded / sizeof(DWORD);
+
+	if (runningProcesses >= minNumProcesses) {
+		printf("There are %d processes running on the system, which satisfies the minimum you set of %d. Proceed!\n", runningProcesses, minNumProcesses);
+	} else {
+		printf("Only %d processes are running on the system, which is less than the minimum you set of %d. Do not proceed.\n", runningProcesses, minNumProcesses);
+	}
+
+	getchar();
+	return 0;
+}
diff --git a/Sandbox Evasion/prevent_debugging.c b/Sandbox Evasion/prevent_debugging.c
new file mode 100644
index 0000000..d16e741
--- /dev/null
+++ b/Sandbox Evasion/prevent_debugging.c	
@@ -0,0 +1,25 @@
+/*
+	Prevents a debugger from attaching to this process after it has been loaded, C
+	Module written by Brandon Arvanaghi
+	Website: arvanaghi.com
+	Twitter: @arvanaghi
+*/
+
+#include "Windows.h"
+#include "Winternl.h"
+#include "stdio.h"
+
+int main(int argc, char **argv[]) {
+
+	PPEB pPEB = (PPEB)__readfsdword(0x30);
+
+	// Pretend process is already being debugged by setting PEB's BeingDebugged byte to 1
+	// Only one debugger can attach to a process at a time.
+	pPEB->BeingDebugged = 1;
+
+	printf("The Process Environment Block's \"BeingDebugged\" field is set. Proceed!")
+
+	getchar();
+	return 0;
+
+}
\ No newline at end of file
diff --git a/Sandbox Evasion/processors.c b/Sandbox Evasion/processors.c
new file mode 100644
index 0000000..7386fc9
--- /dev/null
+++ b/Sandbox Evasion/processors.c	
@@ -0,0 +1,30 @@
+/*
+	Minimum number of Processors, C
+	Module written by Brandon Arvanaghi
+	Website: arvanaghi.com
+	Twitter: @arvanaghi
+*/
+
+#include <Windows.h>
+#include <stdio.h>
+
+int main(int argc, char **argv[]) {
+	int minProcessors = 2;
+	if (argc > 1) {
+		minProcessors = atoi(argv[1]);
+	}
+
+	SYSTEM_INFO systemInfo;
+	GetSystemInfo(&systemInfo);
+	int numProcessors = systemInfo.dwNumberOfProcessors;
+
+	if (numProcessors >= minProcessors) {
+		printf("Number of processors: %d\n", numProcessors);
+		printf("Proceed!\n");
+	} else {
+		printf("Number of processors: %d\n", numProcessors);
+	}
+	
+	getchar();
+	return 0;
+}
\ No newline at end of file
diff --git a/Sandbox Evasion/ram.c b/Sandbox Evasion/ram.c
new file mode 100644
index 0000000..b46a5a0
--- /dev/null
+++ b/Sandbox Evasion/ram.c	
@@ -0,0 +1,26 @@
+/*
+	Minimum number of browsers, C
+	Module written by Brandon Arvanaghi
+	Website: arvanaghi.com
+	Twitter: @arvanaghi
+*/
+
+#include <Windows.h>
+#include <stdio.h>
+
+int main() {
+	MEMORYSTATUSEX memStat;
+
+	memStat.dwLength = sizeof(memStat);
+	GlobalMemoryStatusEx(&memStat);
+
+	if ((float)memStat.ullTotalPhys / 1073741824 > 1) {
+		printf("The RAM of this host is at least 1 GB in size. Proceed!\n");
+	} else {
+		printf("Less than 1 GB of RAM exists on this system. Do not proceed.\n");
+	}
+
+	getchar();
+	return 0;
+}
+
diff --git a/Sandbox Evasion/registry.c b/Sandbox Evasion/registry.c
new file mode 100644
index 0000000..94ece34
--- /dev/null
+++ b/Sandbox Evasion/registry.c	
@@ -0,0 +1,69 @@
+/*
+	Windows Registry key and value checker, C
+	Module written by Brandon Arvanaghi
+	Website: arvanaghi.com
+	Twitter: @arvanaghi
+*/
+
+#include <Windows.h>
+#include <stdio.h>
+#include <Shlwapi.h>
+#pragma comment(lib, "Shlwapi.lib")
+
+int main() {
+	HKEY hKey;
+	int evidenceOfSandbox = 0;
+
+	const char *sandboxStrings[5] = { "VMWare", "virtualbox", "vbox", "qemu", "xen" };
+
+	const char *HKLM_Keys_To_Check_Exist[7] = { "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0\\Identifier",
+		"SYSTEM\\CurrentControlSet\\Enum\\SCSI\\Disk&Ven_VMware_&Prod_VMware_Virtual_S",
+		"SYSTEM\\CurrentControlSet\\Control\\CriticalDeviceDatabase\\root#vmwvmcihostdev",
+		"SYSTEM\\CurrentControlSet\\Control\\VirtualDeviceDrivers",
+		"SOFTWARE\\VMWare, Inc.\\VMWare Tools",
+		"SOFTWARE\\Oracle\\VirtualBox Guest Additions",
+		"HARDWARE\\ACPI\\DSDT\\VBOX_" };
+
+	const char *HKLM_Keys_With_Values_To_Parse[6][2] = {
+	{ "SYSTEM\\ControlSet001\\Services\\Disk\\Enum", "0" },
+	{ "HARDWARE\\Description\\System", "SystemBiosInformation" },
+	{ "HARDWARE\\Description\\System", "VideoBiosVersion" },
+	{ "HARDWARE\\Description\\System\\BIOS", "SystemManufacturer" },
+	{ "HARDWARE\\Description\\System\\BIOS", "SystemProductName" },
+	{ "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0", "Logical Unit Id 0" }
+	};
+
+	for (int i = 0; i < 7; ++i) {
+		if (RegOpenKeyExA(HKEY_LOCAL_MACHINE, HKLM_Keys_To_Check_Exist[i], 0, KEY_READ, &hKey) == ERROR_SUCCESS) {
+			printf("%s\n", HKLM_Keys_To_Check_Exist[i]);
+			RegCloseKey(hKey);
+			++evidenceOfSandbox;
+		}
+	}
+
+	for (int i = 0; i < 6; ++i) {
+		HKEY hKey;
+		TCHAR buff[1024] = { 0 };
+		DWORD buffSize = 1024;
+		if (RegOpenKeyExA(HKEY_LOCAL_MACHINE, HKLM_Keys_With_Values_To_Parse[i][0], 0, KEY_READ, &hKey) == ERROR_SUCCESS) {
+			if (RegQueryValueExA(hKey, HKLM_Keys_With_Values_To_Parse[i][1], NULL, NULL, (LPBYTE)buff, &buffSize) == ERROR_SUCCESS) {
+				for (int j = 0; j < 5; ++j) {
+					if (StrStrIA(buff, sandboxStrings[j]) != NULL) {
+						printf("%s\\%s --> %s \n", HKLM_Keys_With_Values_To_Parse[i][0], HKLM_Keys_With_Values_To_Parse[i][1], buff);
+						++evidenceOfSandbox;
+					}
+				}
+			}
+			RegCloseKey(hKey);
+		}
+	}
+	
+	if (evidenceOfSandbox == 0) {
+		printf("Proceed!\n");
+	}
+
+	getchar();
+
+	return 0;
+}
+
diff --git a/Sandbox Evasion/usb.c b/Sandbox Evasion/usb.c
new file mode 100644
index 0000000..bcaf42d
--- /dev/null
+++ b/Sandbox Evasion/usb.c	
@@ -0,0 +1,50 @@
+/*
+	Minimum number of USB devices ever mounted, C
+	Module written by Brandon Arvanaghi
+	Website: arvanaghi.com
+	Twitter: @arvanaghi
+*/
+
+#include <Windows.h>
+#include <stdio.h>
+
+int main(int argc, char **argv[]) {
+	HKEY hKey;
+	// Baseline number of USBs ever mounted
+	int MinimumUsbHistory = 2;
+	// To store actual number of USBs ever mounted
+	DWORD numUsbDevices = 0;
+
+	// If user supplies a different baseline
+	if (argc > 1) {
+		MinimumUsbHistory = atoi(argv[1]);
+	}
+
+	if (RegOpenKeyExA(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Enum\\USBSTOR", 0, KEY_READ, &hKey) == ERROR_SUCCESS) {
+
+		// Get number of subkeys, which corresponds to history of mounted USB devices
+		if (RegQueryInfoKeyA(hKey, NULL, NULL, NULL, &numUsbDevices, NULL, NULL, NULL, NULL, NULL, NULL, NULL) == ERROR_SUCCESS) {
+			// Do nothing
+		} else {
+			printf("[---] Unable to query subkey HKLM::SYSTEM\\ControlSet001\\Enum\\USBSTOR\n");
+			getchar();
+			exit(-1);
+		}
+	} else {
+		printf("[---] Unable to open subkey HKLM::SYSTEM\\ControlSet001\\Enum\\USBSTOR\n");
+		getchar();
+		exit(-1);
+	}
+
+
+	if (numUsbDevices >= MinimumUsbHistory) {
+		printf("Number of USB devices ever mounted: %d\n", numUsbDevices);
+		printf("Proceed!\n");
+	} else {
+		printf("Number of USB devices ever mounted: %d\n", numUsbDevices);
+	}
+
+	getchar();
+	return 0;
+}
+
diff --git a/Sandbox Evasion/username.c b/Sandbox Evasion/username.c
new file mode 100644
index 0000000..f33a132
--- /dev/null
+++ b/Sandbox Evasion/username.c	
@@ -0,0 +1,30 @@
+/*
+    Username checker, C
+    Module written by Brandon Arvanaghi 
+    Website: arvanaghi.com 
+    Twitter: @arvanaghi
+*/
+
+#include <stdio.h>
+#include <Windows.h>
+
+int wmain(int agrc, wchar_t **argv[]) {
+
+	WCHAR* username[3267];
+	DWORD charCount[3267];
+
+	if (!GetUserName(username, charCount)) {
+		printf("Could not read username, exiting.\n");
+		getchar();
+		exit(-1);
+	}
+
+	if (!wcsicmp(username, argv[1])) {
+		printf("Proceed!\n");
+	} else {
+		wprintf(L"Username: %s", username);
+	}
+
+	getchar();
+	return 0;
+}
\ No newline at end of file