ClickFix v8 — Suspicious named pipes: CPFATP_ (CLR profiler abuse) / Sessions

Durable RSA-1024 CAPI C2 handshake public key (modulus). Cross-wave anchor.

Embedded CAPI PUBLICKEYBLOB carrying the DURABLE RSA-1024 C2 handshake key (e=65537). Client RSA-wra

Embedded RSA-1024 C2 handshake public key (CAPI RSA1 blob, e=65537). Client RSA-wraps the AES sessio

Fires on any WP-002 chain component (prologue OR durable imphash OR embedded C2 key).

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.