Within the files actually present in the bundle (,,,,) this behaves as the advertised Russian-market unblocker: it fetches a remote config ([domain withheld] with a [domain withheld] mirror), installs a PAC script via chrome.proxy.settings.set (:3200), supplies proxy credentials only when webRequest.onAuthRequired reports isProxy and the challenger host:port matches the backend-issued proxy (:3082-3104), and binds a device with to its own endpoint (:2811) - exactly the CWS-disclosed 'Personally identifiable information, Authentication information'. Chrome-stats Likelihood and the low publisher risk corroborate benign; the 0.93 ML score, the malext-feed label and permhash peers contradict it, but the feed entry self-describes as a bulk import rather than a code review and the ML counters mostly sit in files not supplied. Confidence is capped at low because the decoded lists, and through - 7 JS files absent from the bundle, including which runs at document_start on *://*.[domain withheld] - and two hygiene issues are noted but deliberately not filed as findings: conflicting-extension from management.getAll are sent to GA4 via trackUserAction (:2659), and the webRequest. handlers forward request URLs and initiators to the publisher's Sentry (:4347, 4432), though their URL filter E comes from an unset build-time env var (:3776).