Suspicious 91% chrome 118 installs Download

McLaren 750S Spider Wallpapers New Tab 3.5.0

IndexedDB deletion, bit.ly links

“Take the top down and accelerate your browsing with the McLaren 750S Spider New Tab Extension! A powerful Google search bar awaits in every…”

Gameograf new-tab and search takeover manifestGameograf promotional new-tab potentially unwanted extension

Evidence

Chrome new tab page override manifest.json · lines 1–26
1{
2"update_url": "https://clients2.google.com/service/update2/crx",
3
4 "author": "Gameograf",
5 "manifest_version": 3,
6 "name": "__MSG_appName__",
7 "default_locale": "en",
8 "version": "3.5.0",
9 "description": "__MSG_appDesc__",
10 "chrome_url_overrides": {
11 "newtab": "index.html"
12 },
13 "background": {
14 "service_worker": "/js/bg.js"
15 },
16
17 "permissions": [
18 "search"
19 ],
⋯7 lines
Gameograf promotional host URL bg.js · lines 1–21
1chrome.runtime.onInstalled.addListener(function() {
2
3 chrome.tabs.create({
4 url: "https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install"
5 });
6
7 chrome.tabs.create({ url: chrome.runtime.getURL("index.html") });
8});
9
10if (chrome.runtime.setUninstallURL) {
11 chrome.runtime.setUninstallURL('https://gameograf.com/?utm_source=uninstall&utm_medium=link&utm_campaign=bg&utm_content=uninstall');
12} else {
13 console.warn("setUninstallURL not supported in this browser.");
14}
15
16indexedDB.databases().then((dbs) => {
17 dbs.forEach((db) => {
18 indexedDB.deleteDatabase(db.name);
19 console.log(`Deleted IndexedDB database: ${db.name}`);
20 });
21});
Uses URL-encoded HTTP form content jquery-3.7.1.min.js · lines 1–2
1/*! jQuery v3.7.1 | (c) OpenJS Foundation and other contributors | jquery.org/license */
2!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!= …
References DOM appendChild method jquery-3.7.1.min.js · line 2
2:695… c:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n||C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?n[i.call(e)]||"object":typeof e}var t="3.7.1",l=/H …
Computed property access with addition jquery-3.7.1.min.js · line 2
2:1387… ae.call(this)},get:function(e){return null==e?ae.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=ce.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return ce.each(this,e)},map:function(n){return this.pushStack(ce.map(this,fu …

Showing the top 5 files — 3 more files (14 regions) not shown.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.