SHA-256 on record
sha256, shown defanged for safety: 9191101893e419eac4be02d416e4eed405ba2055441f36e564f09c19cb26271c
Ownership assessment
Ownership does not apply to a file hash.
A hash identifies an exact sequence of bytes. It has no registrar, no hosting provider and no owner, so the ownership classes we apply to domains and addresses are not meaningful here. What matters for a file is which campaigns it was seen in and who reported it — both are recorded below.
Using it
A hash is the most durable thing on this site. Unlike a domain, it never changes hands: matching bytes are matching bytes, on any date.
Campaigns referencing this file
Where this came from
Reported by Datadog Security Labs on 2026-02-10
Tech impersonators: ClickFix and MacOS infostealers
Recorded as sha256, shown defanged for safety: 9191101893e419eac4be02d416e4eed405ba2055441f36e564f09c19cb26271c · Sample · extracted by Machine-extracted, human-reviewed
Observation timeline
No checks are recorded for this file. It has not been through enrichment, which means nobody has looked at whether it still resolves, where it points, or whether it has been taken down.
An empty timeline is a statement about our coverage and nothing else. It is not evidence that the file is inactive, and it is not evidence that it is live. The dated observations from published sources, further up this page, are the only claims we are making.
What to do with this
Match this against your file inventory or endpoint telemetry. A match means these exact bytes, on any date; a miss proves little, because a rebuilt sample carries a different hash.
Found an error? Tell us — disputed entries come down the same working day, before we decide whether the dispute is right.
Cite as
ClickFixReport, “9191101893e419eac4be02d416e4eed405ba2055441f36e564f09c19cb26271c”, indicator ID 04a4a0b6-9edb-481d-9613-d6f5bb8ac927, retrieved 2026-08-29.
https://clickfixreport.com/hashes/9191101893e419eac4be02d416e4eed405ba2055441f36e564f09c19cb26271c
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.