Files named nircmd.exe

104.155.125.196 · nircmd.exe

/downloads/ekstra/

Belgium · GOOGLE-CLOUD-PLATFORM

SHA1: c5967b86ef51a4bb5d6f4f2740a32a9c38fad91c
SHA256: cf29b37e1ff595120c23245a6e43a15c5c7bf3e59f0f675456b255d402f4bae7
application/x-msdos-program
45.00KB
2024-09-30 09:57:29 +0000 UTC
sterenapp.dsignage360.com · nircmd.exe

/PC/

· CLOUDFLARENET

Yara HackTool_Producers From Florian Roth

Download archived sample
The password is "infected"

SHA1: 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA256: 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
application/x-msdos-program
117.00KB
2025-04-21 15:52:39 +0000 UTC
sterenapp.dsignage360.com · nircmd.exe

/PC/32Bits/

· CLOUDFLARENET

SHA1: c5967b86ef51a4bb5d6f4f2740a32a9c38fad91c
SHA256: cf29b37e1ff595120c23245a6e43a15c5c7bf3e59f0f675456b255d402f4bae7
application/x-msdos-program
45.00KB
2025-05-07 09:33:32 +0000 UTC
tv.infiniteserver.com.br · nircmd.exe

/Backup/18-12-2024/Downloads/Waifu2x-Extension-GUI-v3.120.01-Win64/waifu2x-extension-gui/nircmd-x64/

Finland · Hetzner Online GmbH

Yara HackTool_Producers From Florian Roth

Download archived sample
The password is "infected"

SHA1: 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA256: 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
application/octet-stream
117.00KB
2024-12-18 18:10:12 +0000 UTC
ftp.arimis.com · nircmd.exe

/LocalUser/Guest@arimis/NirCmd/

United States · PAXIO-SFBA

SHA1: ac3957738117f9987683d95f0726e21d60788aab
SHA256: 04943e39b8434a98cfd1b858cd5926f5a6a4bd54fefed77cb8a1476a1a787800
application/x-msdownload
28.00KB
2014-07-08 23:37:54 +0000 UTC
ftp.arimis.com · nircmd.exe

/LocalUser/Guest@arimis/NirCmd/

United States · PAXIO-SFBA

SHA1: ac3957738117f9987683d95f0726e21d60788aab
SHA256: 04943e39b8434a98cfd1b858cd5926f5a6a4bd54fefed77cb8a1476a1a787800
application/x-msdownload
28.00KB
2014-07-08 23:37:54 +0000 UTC
share.kaz62.ru · nircmd.exe

/

Russia · Jsc Kvant-telekom

Yara HackTool_Producers From Florian Roth

Download archived sample
The password is "infected"

SHA1: 20cd453fcac9d9960b0076715d985a55784a6b53
SHA256: 7160db2b7a6680480e64f0845512d203a575f807831faf9a652aaef0988f876c
application/octet-stream
116.50KB
2024-01-09 14:57:35 +0000 UTC
share.kaz62.ru · nircmd.exe

/

Russia · Jsc Kvant-telekom

Yara HackTool_Producers From Florian Roth

Download archived sample
The password is "infected"

SHA1: 20cd453fcac9d9960b0076715d985a55784a6b53
SHA256: 7160db2b7a6680480e64f0845512d203a575f807831faf9a652aaef0988f876c
application/octet-stream
116.50KB
2024-01-09 14:57:35 +0000 UTC
104.155.125.196 · nircmd.exe

/downloads/ekstra/

Belgium · GOOGLE-CLOUD-PLATFORM

SHA1: c5967b86ef51a4bb5d6f4f2740a32a9c38fad91c
SHA256: cf29b37e1ff595120c23245a6e43a15c5c7bf3e59f0f675456b255d402f4bae7
application/x-msdos-program
45.00KB
2024-09-30 09:57:29 +0000 UTC
updates.dsignage360.com · nircmd.exe

/PC/

· CLOUDFLARENET

Yara HackTool_Producers From Florian Roth

Download archived sample
The password is "infected"

SHA1: 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA256: 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
application/x-msdos-program
117.00KB
2025-10-17 10:43:52 +0000 UTC
107.191.110.128 · nircmd.exe

/wss/

United States · RAMNODE

SHA1: 919250240e4cf978603ddf6944719fe35acdb668
SHA256: 11f02159cd9e001e9c8eb6ab3875132f77b9e9e8af981d45d182ec71ce68c5ad
application/octet-stream
43.00KB
2019-02-25 20:31:59 +0000 UTC
107.191.110.128 · nircmd.exe

/wss-files/

United States · RAMNODE

SHA1: 919250240e4cf978603ddf6944719fe35acdb668
SHA256: 11f02159cd9e001e9c8eb6ab3875132f77b9e9e8af981d45d182ec71ce68c5ad
application/octet-stream
43.00KB
2019-02-25 20:31:59 +0000 UTC
107.191.110.128 · nircmd.exe

/

United States · RAMNODE

SHA1: 919250240e4cf978603ddf6944719fe35acdb668
SHA256: 11f02159cd9e001e9c8eb6ab3875132f77b9e9e8af981d45d182ec71ce68c5ad
application/octet-stream
43.00KB
2016-02-18 19:32:23 +0000 UTC
mirror.ideaz.sk · nircmd.exe

/Software/English/NirCmd/64bit/

Slovakia · Trestel SK, a.s.

Yara HackTool_Producers From Florian Roth

Download archived sample
The password is "infected"

SHA1: 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA256: 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
application/octet-stream
117.00KB
2024-04-23 12:52:34 +0000 UTC
mirror.ideaz.sk · nircmd.exe

/Software/English/NirCmd/32bit/

Slovakia · Trestel SK, a.s.

SHA1: c5967b86ef51a4bb5d6f4f2740a32a9c38fad91c
SHA256: cf29b37e1ff595120c23245a6e43a15c5c7bf3e59f0f675456b255d402f4bae7
application/octet-stream
45.00KB
2024-04-23 12:52:40 +0000 UTC
mirror.ideaz.sk · nircmd.exe

/Software/English/NirCmd/64bit/

Slovakia · Trestel SK, a.s.

Yara HackTool_Producers From Florian Roth

Download archived sample
The password is "infected"

SHA1: 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA256: 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
application/octet-stream
117.00KB
2024-04-23 12:52:34 +0000 UTC
mirror.ideaz.sk · nircmd.exe

/Software/English/NirCmd/32bit/

Slovakia · Trestel SK, a.s.

SHA1: c5967b86ef51a4bb5d6f4f2740a32a9c38fad91c
SHA256: cf29b37e1ff595120c23245a6e43a15c5c7bf3e59f0f675456b255d402f4bae7
application/octet-stream
45.00KB
2024-04-23 12:52:40 +0000 UTC
sterenapp.dsignage360.com · nircmd.exe

/PC/

· CLOUDFLARENET

Yara HackTool_Producers From Florian Roth

Download archived sample
The password is "infected"

SHA1: 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA256: 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
application/x-msdos-program
117.00KB
2025-04-21 15:52:39 +0000 UTC
sterenapp.dsignage360.com · nircmd.exe

/PC/32Bits/

· CLOUDFLARENET

SHA1: c5967b86ef51a4bb5d6f4f2740a32a9c38fad91c
SHA256: cf29b37e1ff595120c23245a6e43a15c5c7bf3e59f0f675456b255d402f4bae7
application/x-msdos-program
45.00KB
2025-05-07 09:33:32 +0000 UTC
share.kaz62.ru · nircmd.exe

/

Russia · Jsc Kvant-telekom

Yara HackTool_Producers From Florian Roth

Download archived sample
The password is "infected"

SHA1: 20cd453fcac9d9960b0076715d985a55784a6b53
SHA256: 7160db2b7a6680480e64f0845512d203a575f807831faf9a652aaef0988f876c
application/octet-stream
116.50KB
2024-01-09 14:57:35 +0000 UTC