DragonDoll hides behind a Chrome update, using AES-256-CBC and RSA-OAEP to protect C2 traffic. It registers devices, gets a client UUID, and can support overlay file retrieval and Socket.IO-based persistence. #DragonDoll #SocketIO #ChromeUpdate