Let me start.
Whenever you click on the "vote", the telegram page loads.
STEP 1. telegram-page.html (naming for simplicity, actually named "/pnbZeA4")
This telegram page is regular "document" request that loads bunch of js files:
- 4vt095smidla.js.
See screen 1.
STEP 2. telegram-client-preloader.js (actually named "/4vt095smidla.js")
This preloader loads telegram client loader and bunch of other .js files
See screen 2.
STEP 3. telegram-webworker-loader.js (actually named "/9nnoq789wklc.js").
This loader registers WebWorker that runs telegram client js. This webworker runs in separate thread so we actually don't see opened sockets to Telegram.
See screen 3
STEP 4 telegram-client-webworker.js (actually named "/vmu7hv3hxb8g.js") starts communication with telegram using websockets.
To see it in webtools, go to edge://inspect/#workers, and click "inspect" on all workers you will see
See screen 4, 5, 6
Attaching deobfuscated files (some of them are so large that I need to do it locally)
Whenever you click on the "vote", the telegram page loads.
STEP 1. telegram-page.html (naming for simplicity, actually named "/pnbZeA4")
This telegram page is regular "document" request that loads bunch of js files:
- 4vt095smidla.js.
See screen 1.
STEP 2. telegram-client-preloader.js (actually named "/4vt095smidla.js")
This preloader loads telegram client loader and bunch of other .js files
See screen 2.
STEP 3. telegram-webworker-loader.js (actually named "/9nnoq789wklc.js").
This loader registers WebWorker that runs telegram client js. This webworker runs in separate thread so we actually don't see opened sockets to Telegram.
See screen 3
STEP 4 telegram-client-webworker.js (actually named "/vmu7hv3hxb8g.js") starts communication with telegram using websockets.
To see it in webtools, go to edge://inspect/#workers, and click "inspect" on all workers you will see
See screen 4, 5, 6
Attaching deobfuscated files (some of them are so large that I need to do it locally)
🤯4