home

yosetup_rc.exe

RepkaSoft

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This is installed with YoWindow. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
RepkaSoft  (signed and verified)

MD5:
71379c51684037e817f58aa1f4ac9103

SHA-1:
0ab0c6a46ec5efce0db3b905431f7cd3916ea534

SHA-256:
c89634a78c1785c1f9825fdbaaad5dd3dc460d4389d1e9e6a393111342641e31

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/8/2024 6:19:45 PM UTC  (today)

File size:
11.6 MB (12,208,968 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\yosetup_rc.exe

Digital Signature
Signed by:
RepkaSoft

Authority:
VeriSign, Inc.

Valid from:
9/2/2013 1:00:00 AM

Valid to:
12/3/2015 12:59:59 AM

Subject:
CN=RepkaSoft, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=RepkaSoft, L=Saint-Petersburg, S=Russian Federation, C=RU

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4C4114980DB0E6BB385F90F6249443C7

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:BJ2GpJgV8vjIrbby4aiKdFemJb375UKKdQAV8XDxPQCDcEfwRZp892JW3k292s:j2aWgkrvDie83VUKKdTV8TxPQCLQ62wt

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file yosetup_rc.exe has been discovered within the following program.

YoWindow  by RepkaSoft
Publisher's description - “YoWindow is a full featured weather program with beautiful graphics. The magic of YoWindow is living landscapes that reflect the weather. Just like in your window. In YoWindow you can even scroll time forward to see the weather forecast.”
yowindow.com
2% remove it
 
Powered by Should I Remove It?

The file yosetup_rc.exe has been seen being distributed by the following 14 URLs.

http://gsf-cf.softonic.com/0ab/0c6/.../yosetup.exe

http://www.filepuma.com/file/1421171914c6176/yowindow_free_4.0.2/.../0/

http://www.filepuma.com/down/1424710210c6176/yowindow_free_4.0.2/.../0/

http://www.filepuma.com/file/1424710210c6176/yowindow_free_4.0.2/.../0/

http://down.filepuma.com/files/meteorology/.../YoWindow_Free_v4.0.2.exe

http://www.filepuma.com/down/1411975520c6176/yowindow_free_4.0.2/.../0/

http://www.filepuma.com/file/1411975520c6176/yowindow_free_4.0.2/.../0/

http://deploy.yowindow.com/.../yosetup.exe

http://repkasoft.com/wimo/.../yosetup.exe

http://shopper.mycommerce.com/softsell/visitor.cgi?vendor=24149&affiliate=5300&linkid=tryandbuy_CD134156&action=site&ref=http://repkasoft.com/wimo/.../yosetup.exe&ClickID=by1fkgzkys1mv1qn6nln6zlmndskvmugdggk

https://www.regnow.com/softsell/visitor.cgi?vendor=24149&affiliate=5300&linkid=tryandbuy_CD134156&action=site&ref=http://repkasoft.com/wimo/.../yosetup.exe&ClickID=by1fkgzkys1mv1qn6nln6zlmndskvmugdggk

http://www.filepuma.com/file/1407105402c6176/yowindow_free_4.0.2/.../0/

http://yowindow.com/.../yosetup.exe

http://yowindow.com/wimo/.../yosetup.exe

Scan yosetup_rc.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.