Checked for AVG security software presence
Checked for Avira security software presence
Checked for BitDefender security software presence
Checked for BullGuard security software presence
Checked for CCleaner software presence
Checked for Comodo security software presence
Checked for Eset security software presence
Checked for Ewido security software presence
Checked for Process Explorer software presence
Checked for RegRun software presence
Checked for security software presence
Checked for The Cleaner software presence
Checked for Wireshark software presence
Checked if user is admin
Connected to WWW
Created process: C:\Users\-\AppData\Roaming\AWVS 12.EXE
Created process: C:\Users\-\AppData\Roaming\BUILD_2019-02-22_12-39.EXE
Created process: C:\Windows\system32\cmd.exe, "C:\Windows\system32\cmd.exe" /c del C:\Users\-\AppData\Roaming\BUILD_~1.EXE >> NUL
Created process: C:\Windows\System32\cmd.exe, "C:\Windows\System32\cmd.exe" /C net.exe start foundation y
Created process: C:\Windows\System32\cmd.exe, "C:\Windows\System32\cmd.exe" /C net.exe stop foundation
Created process: C:\Windows\System32\cmd.exe, "C:\Windows\System32\cmd.exe" /C sc create foundation binPath= "C:\ProgramData\Microsofts HeIp\wsus.exe -service" type= own start= auto error= ignore
Created process: C:\Windows\System32\cmd.exe, "C:\Windows\System32\cmd.exe" /C sc delete foundation
Created process: C:\Windows\system32\net.exe, net.exe start foundation y
Created process: C:\Windows\system32\net.exe, net.exe stop foundation
Created process: C:\Windows\system32\sc.exe, sc create foundation binPath= "C:\ProgramData\Microsofts HeIp\wsus.exe -service" type= own start= auto error= ignore
Created process: C:\Windows\system32\sc.exe, sc delete foundation
Created process: null, C:\Windows\system32\net1 start foundation y , null
Created process: null, C:\Windows\system32\net1 stop foundation, null
Defined file type created: C:\ProgramData\Microsofts HeIp\wsus.exe
Defined file type created: C:\Users\-\AppData\Roaming\AWVS 12.EXE
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\foundation\ImagePath = C:\ProgramData\Microsofts HeIp\wsus.exe -service
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\foundation\Start = 00000002
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\foundation\Type = 00000010
Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001
Got input locale identifiers
Got volume information
Internet connection: C:\Sandbox\-\DefaultBox\user\current\AppData\Roaming\BUILD_2019-02-22_12-39.EXE Connects to "146.0.77.63" on port 80 (TCP - HTTP)
Slept over 2 minutes
Traces of Max++
Transfered files from and/or to internet