// Decompiled with JetBrains decompiler // Type: gs // Assembly: XobniService, Version=1.8.3.7917, Culture=neutral, PublicKeyToken=6298d2d1fcfb5d85 // MVID: EA9F7D71-4A8D-4739-A320-5F01FC76E972 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Patched.mf-01164dae267b1f13c988de64e7fce38753b97528a3dc3fe730e191fc953c65ba.exe using Microsoft.Win32; using System; using System.Collections.Generic; using System.Diagnostics; using System.Web; using XobniLogging; internal static class gs { internal static a? a(object A_0) where a : struct => A_0 == null ? new a?() : new a?((a) A_0); internal static string a(IEnumerable> A_0) { List stringList = new List(); foreach (KeyValuePair keyValuePair in A_0) stringList.Add(HttpUtility.UrlEncode(keyValuePair.Key) + "=" + HttpUtility.UrlEncode(keyValuePair.Value)); return string.Join("&", stringList.ToArray()); } internal static bool? b() { try { return new bool?(Process.GetProcessesByName("OUTLOOK").Length > 0); } catch (InvalidOperationException ex) { ady.a(Level.Exception, "IsOutlookRunning", (Exception) ex); return new bool?(); } } internal static string a() { using (RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("Software\\Xobni")) return registryKey == null ? (string) null : registryKey.GetValue("InstallDir") as string; } }