home

kemyar1qhrn5df54rm3juz1t636003889699673675_1.exe

getPlus+

NOS Microsystems Limited

This is a setup program which is used to install the application. The file has been seen being downloaded from download.rockwellautomation.com and multiple other hosts.
Publisher:
NOS Microsystems Ltd.  (signed by NOS Microsystems Limited)

Product:
getPlus+(R)

Version:
2,0,7,61

MD5:
b088e9f57401a9135aeffe02a61feab4

SHA-1:
260b6990b014a552e52f2408539c792cf9e30efb

SHA-256:
a45193f32ade283c34ebb38ee865f7363aec018c2457a957007351a3b95a9900

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
7/3/2025 10:30:34 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
HW32.Packed
1.3.0.8042

Rising Antivirus
Malware.XPACK-HIE/Heur!1.9C48
23.00.65.16530

File size:
355 KB (363,520 bytes)

Product version:
2,0,7,61

Copyright:
Copyright (C) 2016 by NOS Microsystems Ltd.

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\kemyar1qhrn5df54rm3juz1t636003889699673675_1.exe

Digital Signature
Signed by:
NOS Microsystems Limited

Authority:
thawte, Inc.

Valid from:
7/10/2015 2:00:00 AM

Valid to:
7/18/2016 1:59:59 AM

Subject:
CN=NOS Microsystems Limited, OU=SECURE APPLICATION DEVELOPMENT, O=NOS Microsystems Limited, L=London, S=London, C=GB

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
64C3DB2EEB1D93852B84FBD4F6C7B73D

File PE Metadata
Compilation timestamp:
9/12/2012 12:22:04 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.12

CTPH (ssdeep):
6144:0TUaZ+JsexgHZEo3jqKm+1tW4UFMbHSwa6pvgYzGVpoiC:tawJyHZTm+1tnUFuSKvgqGvFC

Entry address:
0x11F512

Entry point:
50, E8, 00, 00, 00, 00, 5B, 81, EB, B8, 08, 00, 00, 8D, 93, 00, F0, BF, FF, B9, 60, 4C, 05, 00, 2B, D9, 8B, C3, 81, EB, 00, 90, 0C, 00, 81, EB, 00, 10, 00, 00, 8B, AB, C0, 00, 00, 00, 03, EB, 4D, 80, 7D, 00, CC, 74, F9, 83, ED, 03, 66, 81, 7D, FE, FF, 25, 75, 08, 01, 55, 00, 83, ED, 06, EB, F0, 01, 94, 01, 68, 05, 00, 00, 01, 94, 01, D6, 05, 00, 00, 01, 94, 01, FC, 06, 00, 00, 01, 94, 01, 9C, 08, 00, 00, 50, 51, B8, 51, 02, CC, 00, 50, 6A, 40, E8, 91, 00, 00, 00, 59, 5A, 0B, C0, 75, 03, 58, EB, 78, 8B, E8...
 
[+]

Code size:
342.1 KB (350,304 bytes)

The file kemyar1qhrn5df54rm3juz1t636003889699673675_1.exe has been seen being distributed by the following 23 URLs.

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=m5zoudgchgobodtxlrtt2atq636130845561006072

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=mw1qs2ydmaxd20jol4u1cogu636110940724918018

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=wy2ikjd0wrkv0jfqzb1lvusw636090048577661334

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=m42y0feiiugneh3ritwc1ert636108530845969010

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=gfdp5p0150hh0coqciawbsrs636106992863085966

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=vtmc0qmxenpfkukkhvbonjrq636039697920136832

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=3offjx1wv2henmrayqubxqxr636136114997261192

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=xgox02qcrcua3bel31wwlovn636105181812960304

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=b52znjw1vphw02py5wd2l5pe636149906264695154

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=glesm4dthx5ootgy0jtvuj2g636120881226877982

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=m5ilzm3cnsksnjx1nmx1pcob636123662097091529

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=hhmlbe4nqhts3vi5cxxdwvgl636104934444738337

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=00tk5gzo1t1ewdekflesmvan636138019116649757

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=lg53im1aelzg4mpoxbab2ycf636068670341229525

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=eyi5smphgbioay4mlvbq3yap636050597623880001

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=x2ocpwssbapgicxiycyott3c636024803591957511

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=w1gsrd5pm3m3bk4i314y1g4t636083457213432979

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=lfejf0nokb145cyisuiejd11636076396609637059

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=nlrp3rqkfwq425xtb1wxn421636119381705281202

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=elketrnqzmt3oxchz2bxzudx636107413933951014

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=syebwrmlrarpii2qoguyty2l636034322888979895

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=43igm15v4ledhqx0bn4ojx0b636068909696418457

https://download.rockwellautomation.com/.../DownloadFile.ashx?sessionid=1a32q0whptvfjnea5yvohr2i636007364808199174

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.