SHA-256 on record
sha256, shown defanged for safety: 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25
Ownership assessment
Ownership does not apply to a file hash.
A hash identifies an exact sequence of bytes. It has no registrar, no hosting provider and no owner, so the ownership classes we apply to domains and addresses are not meaningful here. What matters for a file is which campaigns it was seen in and who reported it — both are recorded below.
Using it
A hash is the most durable thing on this site. Unlike a domain, it never changes hands: matching bytes are matching bytes, on any date.
Campaigns referencing this file
Where this came from
Reported by Cisco Talos on 2026-09-08
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Recorded as sha256, shown defanged for safety: 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25 · Sample · extracted by Machine-extracted, human-reviewed
Observation timeline
No checks are recorded for this file. It has not been through enrichment, which means nobody has looked at whether it still resolves, where it points, or whether it has been taken down.
An empty timeline is a statement about our coverage and nothing else. It is not evidence that the file is inactive, and it is not evidence that it is live. The dated observations from published sources, further up this page, are the only claims we are making.
What to do with this
Match this against your file inventory or endpoint telemetry. A match means these exact bytes, on any date; a miss proves little, because a rebuilt sample carries a different hash.
Found an error? Tell us — disputed entries come down the same working day, before we decide whether the dispute is right.
Cite as
ClickFixReport, “1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25”, indicator ID e669b19b-8355-4577-85d7-7773e18d6a90, retrieved 2026-10-11.
https://clickfixreport.com/hashes/1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.