SHA-256 on record
sha256, shown defanged for safety: 7a8250904e6f079e1a952b87e55dc87e467cc560a2694a142f2d6547ac40d5e1
Ownership assessment
Ownership does not apply to a file hash.
A hash identifies an exact sequence of bytes. It has no registrar, no hosting provider and no owner, so the ownership classes we apply to domains and addresses are not meaningful here. What matters for a file is which campaigns it was seen in and who reported it — both are recorded below.
Using it
A hash is the most durable thing on this site. Unlike a domain, it never changes hands: matching bytes are matching bytes, on any date.
Campaigns referencing this file
Where this came from
Reported by Unit 42, Palo Alto Networks on 2025-10-08
The ClickFix Factory: First Exposure of IUAM ClickFix Generator
Recorded as sha256, shown defanged for safety: 7a8250904e6f079e1a952b87e55dc87e467cc560a2694a142f2d6547ac40d5e1 · Sample · extracted by Machine-extracted, human-reviewed
Observation timeline
No checks are recorded for this file. It has not been through enrichment, which means nobody has looked at whether it still resolves, where it points, or whether it has been taken down.
An empty timeline is a statement about our coverage and nothing else. It is not evidence that the file is inactive, and it is not evidence that it is live. The dated observations from published sources, further up this page, are the only claims we are making.
What to do with this
Match this against your file inventory or endpoint telemetry. A match means these exact bytes, on any date; a miss proves little, because a rebuilt sample carries a different hash.
Found an error? Tell us — disputed entries come down the same working day, before we decide whether the dispute is right.
Cite as
ClickFixReport, “7a8250904e6f079e1a952b87e55dc87e467cc560a2694a142f2d6547ac40d5e1”, indicator ID 7e28e08a-6ea1-4f87-8ddb-6025c029121e, retrieved 2026-08-07.
https://clickfixreport.com/hashes/7a8250904e6f079e1a952b87e55dc87e467cc560a2694a142f2d6547ac40d5e1
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.