ClearFake / ClickFix — Everything.exe WindowsCodecs.dll sideload chain, C2 hosts

ClickFix chain delivered from compromised websites through a fake CAPTCHA. The visitor pastes a PowerShell one-liner that fingerprints the machine (MachineGuid, volume serial, computer name) and beacons to king.allwwewrestlers.com, which returns an AES-encrypted next stage keyed on that fingerprint. The stage drops a signed copy of the Everything file-search tool that sideloads a trojanized WindowsCodecs.dll (sha256 7c3c4d709bd1146dd1f3e910526894625393230f983b9b02737d4cf62326c41d), which reflectively loads a backdoor (sha256 a22e25b0573366112236a2f519cec8f8129ea54c413572ae29be2ed31efcf5e2) with screen capture and download-and-execute. The backdoor resolves its C2 from a Telegram channel bio (t.me/s/molerkorstarstot, giving pidor.catalogotrader.com), falling back to an Ethereum contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E, giving frog.britishboxing.net). The C2 names are subdomains of older, unrelated-looking domains.