home

setup_product_4065.exe

Free ISO Mount

Rspark LLC

Part of the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application setup_product_4065.exe, “Free ISO Mount Setup” by Rspark has been detected as adware by 2 anti-malware scanners. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from dl.revenyou.com and multiple other hosts.
Publisher:
Rspark LLC  (signed and verified)

Product:
Free ISO Mount

Description:
Free ISO Mount Setup

Version:
1.0.0.0

MD5:
113fad589da6718483a2a7c91efc0a98

SHA-1:
a26467f16cf922897d16e08f1468466ebee01220

SHA-256:
cc09ba6ae4344028c701000fea0df477dbf22b43fef1d6b900c72f4bbf5eb435

Scanner detections:
2 / 68

Status:
Adware

Analysis date:
1/24/2025 5:36:31 AM UTC  (today)

Scan engine
Detection
Engine version

IKARUS anti.virus
Trojan.Win32.Lampa
t3scan.2.2.29

Reason Heuristics
PUP.Installer.Rspark.S
14.4.7.1

File size:
658.8 KB (674,600 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013.

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup_product_4065.exe

Digital Signature
Signed by:
Rspark LLC

Authority:
DigiCert Inc

Valid from:
11/25/2013 4:00:00 AM

Valid to:
1/26/2015 4:00:00 PM

Subject:
CN=Rspark LLC, O=Rspark LLC, L=Seattle, S=Washington, C=US

Issuer:
CN=DigiCert High Assurance Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0969FC9F3451C04483AE5CCEADE9FC13

File PE Metadata
Compilation timestamp:
12/8/2013 12:09:41 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:YDVsFXLz2UI2zNSLv9Rkc8egcBrx/rNbGMRD2rBg:i+2azsPa1W

Entry address:
0x5EE4

Entry point:
E8, B3, 15, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 58, 0D, 41, 00, 89, 0D, 54, 0D, 41, 00, 89, 15, 50, 0D, 41, 00, 89, 1D, 4C, 0D, 41, 00, 89, 35, 48, 0D, 41, 00, 89, 3D, 44, 0D, 41, 00, 66, 8C, 15, 70, 0D, 41, 00, 66, 8C, 0D, 64, 0D, 41, 00, 66, 8C, 1D, 40, 0D, 41, 00, 66, 8C, 05, 3C, 0D, 41, 00, 66, 8C, 25, 38, 0D, 41, 00, 66, 8C, 2D, 34, 0D, 41, 00, 9C, 8F, 05, 68, 0D, 41, 00, 8B, 45, 00, A3, 5C, 0D, 41, 00, 8B, 45, 04, A3, 60, 0D, 41, 00, 8D, 45, 08, A3, 6C, 0D, 41...
 
[+]

Entropy:
6.1803

Code size:
44 KB (45,056 bytes)

The file setup_product_4065.exe has been seen being distributed by the following 17 URLs.

http://dl.revenyou.com/Files//Setup_product_4065.exe

http://files.downloadnow.com/s/software/14/48/60/.../isomount_setup.exe

http://software.thaiware.com/download_url.php?id=8861

http://files.downloadnow-2.com/s/software/14/50/11/.../isomount_setup.exe

http://d3s8yh4ki1ad1i.cloudfront.net/jjbgfajcnqpbmfbnkp-oomclhcbpuvgtidc

http://www.reporting-download.com/.../?appid=76060148&r=5&s=YHAK5yirnuphcmtj92IhRedkRDzpTpAUpaiGrLjv6eXVyQL0KM0EYULkdRADOAxczVh4X5FdnTl6hCWjw9dUJA6RiYZqX0HTCIDeG5ENx4rGkxPmhK9FI0N7uViQmXJnYfTWVVJy7GhVCfwFlNiZZ4A4ubqQ1xVG9V08U7Tp07FQYP7lKZ8tmjjTRPzky8wOyKm860A9qMLKuE0dn1l1C5Fmd8R5lQtXkVmzE4b15Ox1MdnEZx3wIKtq4xBbMGgEbGoNW1YPtSqqMvd4ZyZT1oZZllb8r0YlghgrY5QwfWfnD7jICJXdnAEQdjKkSV54VARZaDfleNM3Yo5q8Fw6I5qI0VGvQuUqO2G2Y4a6TJAYzYYuXXBEgFlHe6e1iDPyZeEvhLSug4oskCX7CnD4mh4wlRVLY2j7Pdg9Q6zDPNJARjx5t8J7nZ4FPbyWfArn9WhiuHCVmk1Ym7weobA1oDjCAi6WWIpR0d02kCUxgsCRWchOFtrvrZY21ZVuEX82eJvtONHZCIxKL570Ax1ur74ATnToL7Li2MxtsEm8HaaXtkgkClkxzvxg0ut4OyDvgxHjz6GEFvLNk30uY3t66IjUdqk5OHsY7eogrAawVAcPiqaK789yTb3BwHMvw7Kf9sQz8lAgz8TwohLrknKgVbdU6YA6Rx69uYUgLT7exfigieNvbDQ3w4fNRNJYhFD1rCe2zg1QLlElxtP0at74vm3ox3iLtzEZl92VptgKeOpgR4RK7ltraqtANZ2ZmDhAFHRRoVehIXRnkQBIh8VmYZ0BDAzwFWe4cjF8EMe2RrogpWfCyyD3qJapJkhfEaRfHO9ialkBRbR2SyambxOWiCrPQqJvogls89ZLcDa9d79TyZvwUmkz4f3kFNeZr7ttor5IyhA3mYrnzR9J0K1ZfuBeWw9fhl95xPIKCek

http://www.reporting-download.com/.../?appid=76060148&r=4&s=eHzWARd660dZ1rT4leBZ6ThrLj91Op0snFrgXbmvQ6dYWPFQ4TEAJGEqWNbs1xLSfQyicQ2HyMeKXoSQa3SrZ7v8nqNRD4B0WD2HTCqCjGdv8ieoTE8JM0NBPhkZXIgzPQ7ZyGWAvU1Cxpz30mWXC43fhGuKl04EwutRewA5itWRMVb6GcJptBDBEie1CF3K13RdVAfYmC4Yfi8xv6er1Gpk0kxLzlLBuWbcIGk4TNtc1fSvlxBp60DOgRUkXwyREroOiBAbxbowIifpF5ZhyWeKmrx25EsAGKWy3449p7dUTxHgj49TpCgPomXB5Y1CDX4ykIFXnOnzH9cWph3gSaT5e3wD2I0wmWHhVZiHnP099DYcNyMiBYmbWGkYy98leOKL7qChAFHiWBEmYFsY1I0mRwHLQavkLUOo2Aw1JYqcQjH8btlFSmqzHxe5z7DDzDdacCJqIbZxNw31jywpS05n6maRSHSVPDs7vsoR8870iwCJXYKsDcuaGaGMaSvS4MiSXdvcpfg8xgLihxigzNO3nLv9GDvKb0EIcmIG8ianrPFkBeexj4WjWuX4QfqHr3AE8SoRBVBESUkdgCr5pEN5NtGuOGPIkNjUKltHiZtThtSfXci9a8nuZWssxfflYvmoHPpOAhLz3y8hw2BDtrMJxT7chxBOzHntpaGzVukSutq7hduVYVhh8cvZN2vsqs4xSLhbmsTQlOmo6oj0qP6hsWXMHKRpEalnZAEVO8W3AEmdTqJelhbwBCeYlYiQX7Czt5BjHraZgtj2oeE9MeIcnUGTo1ETqhtiz14kdUqyP1Qz4wDM1R4DCYfQZro4HV1V4ZPlamHPX6S7ZglBbqcp85Aq6hedYWVq07vlPqmoXrXF3pxFXAvchnoy8U1ke4UVOIW0nZq9Lvm4rNerz5swjOxRrcJ4ehWoyrd

http://www.reporting-download.com/.../?appid=76060148&r=3&s=lY5qdgEZHT5PxD0AW99JiTTeK2OAPBy1FuVwH5NMtVn9W4DJhe5sxfcY14FpKwwT9ScSvAVlI7hWl5ue4StSdDLoxmyE5BVtwyAUi6IM5PcHSQEDQ4qmuocRfaDSPtQz5DvcSBkQQJTgqvz4jbxR6ZFPz7HTsYFmgJ9pgKzhXHLxYnDSkZJU7MyhxYzlQp9OgKNhzLVoS6dPNApKNLvaMGgutKdv7DCd3UveDebSIqcXW889GUXBmSbJV5fLTWbyQpjNoYM7fskVqgQ48T3UICiNHDOp5LOAgJvHE0jlkzSnJzPKLdxUXL8YoRSDqM2QEKeHL19pMdtDgfd5EF8dssYsK1O1NfbAxvkRuSIJmAs5IRuQfuvYe1zUJ2mA7okIw8V19VNDaP1i6bhrHATWvGG9IMfTb1FBzBUOGYZz9yy4n8Gx3CHzI8sjaYWSO4YunlJI7jxID4hqBS8Ra2DmBmkTOaQvGEZUvCP6ttZs92CWjlCWWYPKGDHSkPmfu1gGPcyJrA6kCIx1EEtYuBxjRZ7lpLI3y30CK8iy61YOV6vKibN1ZTKenwTiBOYrhSkQoxpXSwaL5kOWPhduN3W9B65zDHjilcvg3NmUFTtmVRAx8POBih8OlwcpZZv1lR51r2MWN4ATjfgrWRKtcpzCFqor2EkQttWI8lTND98mPNcxkcsEJxlW0b6G0XMfI4I3phDDg0GyRUAa91EJFb5jrPsZaOu9bZwC0DlrJuMb4ExpJb9scEoswIGZSmKjANxvFwQIRCxC8ujA0ZrbUZdivkZ32vXLO4ma6ZbDKOg4rNP4dOnY63plXiCeaL7lpVnj4vupSGAMu43EXTO57XS3RjLLgkAFNsg5Ve6cn999pdNbkUjuvBfuKayIXnuIEDsm2CGLB142p7u5hOIehhPWMwgBdbGLx9JPyYo9dvm

http://www.reporting-download.com/.../?appid=76060148&r=2&s=IKFcbMEKP4idxmV8MD16G6TqDiGn8DOWFQAHMV2xcFG5BDW581A5n4NR1upEIRTRhODaXv9v4vbxCVVswgh08cELqCcAwp27rEPpoO2GD7Jaeh4YcgyKzH4Mnc24NNrSVxO7PyU7J6DQJiR7ure5ZHhVL7ABt0gGIFuBuiYIzlH2uzolgBTvvOf8TMqaRomqA1uIKMdaAc2q6vwGarljk2ZvOaeR9yluHZf7nO15i1QXM2bAZCCFCx7KDqT0hzgdKqLsZwhKG2wF9k6JrpTT1verC1mmNbCD8AfPXzgNuQLMu7d2cZ6un9RnxaPR909Oh6DO7ZPj6Ud8L9ngEr3YSnLj7uJvKiCaimXehCnHHpWsctpsGipsp4Ke4LYCHjlwBI2WNHJun0K2gD76wB0UeQLhExLKjREymmfIJlnJYI9jdWM1OVOkRR0Z9rU94jFGDINmGlAKw3gJFs2zNcm6sihaOQhGLuNVMWPswVwaULAFMGVVqNzN4TNK7pGaBhqkNHIMM6eblF19a9PnoFojJEx3PilFNBj9ZoiY5i2E6Gc4qBiDHa6fn2JZW577Ts2aJt2JUeEbVTjvCM8sJPjcgzlzXFVY0TJxbgpqpgXDJpABU6zBBnoeA4KqC9kuhyIQmWtsSJOn88ziLteRrnkf1TR97Zc7ITvCtLMdjVpBZCxxvsNLDtRn1AOq2sXCU9NM53LB6z4s8he53xcls0TKos85cb8gI6Y5jXYVuGlly5eeAtsFj4MfkV407UI1cKZ5efW4REEVmRU8Tmrlt8ouDgxHnO62KRlPvvp7UHR0X9i25kRIa75bk1tD1l79PkUKuyqJJGuXRYbnLtcfMpFukMTYCrelgsbknvZ9BkK5fe3L1LP6Dzex3kvtPWSOYnnaPSut4CHEHP7Pqou51MGl0RTjptC0PVUiTh78BVT

http://www.reporting-download.com/.../?appid=76060148&r=1&s=ZiLlZwKosIfqf1Wk5IGpdm04mguLbLZaqoi3eAQOKkReLvOEDJNs60nK4AMLf3hssAYpD1vkC7a72OqXZpsmYUnbDqHADLjOhgy9Q3WDcqk4oAghBmImhbbgDcJHN6VPh3FefsOi6pD01OgKNl8a9A8EoNITTYHjSqPfecqPygAf8W14NWZ3iiGqMD23hdZWYVWSW6NLOySz5E15iX7HCqAHPifgzhIMQsSMmaxT7oEz7zZsLQymiR4MJ9BOC1A6EMN60QxSddyz2bj9jHG9iswpgtgEIXFtjeSzN68mLSXruMI9LivtV6PwjXh71XqvAGUM9LCn2zZVHLIzJ2gZKlf0VHOHQaZOGRnklWY7BOpXl4TPZ4TFA8dh48gvzFeE4zrW37emq4zyFUtSx2vDtA7JTKEZcBYz1PN0yXQpEnKHHIIsrCXvJE8inSZT45eWn0yFVxKhp0rPESj6xPiPP8MMptmjRnQrVFMGzUZyLVM5dIq5MZTibifrvzZf0ObjUC7hmRo04CuGFXXqqyAr9ejlTUme3WlRY60MAtCp5QCeH4DaePluW7vncjHHFW0Qs2soiFhzx2SYMcOq7N8U2M2KO3P8lu3uGpzzuIvdHK8fj8zx4t1NMCQJGych7hLT0q3v35CYYe7H58pg4UrdIazS8jrvmydmGIiNgM1X1lqKifw8EjJmUwXqbK01HJXs0Hde1s0Sz1ozDL2l4zoRLawpm87pKWgzHD5G9AxtlE12Ysqpsna9s0oKHykOJEgnHFBu6EXVLLvhimUq0HrXt5oMvfzCrgi2jwT7gk8iilAQfXmOtFTgsLb8SBgWiU4tstMLC7FJfarzyxh3rWfvN0MH5CLYgd7Ruioezz0OXTjcYwVlefIiA5tWtB8V0EPx4vnrqoJ4DLhPJRJ1m5F6cTXgGzjahk3Q377R8fB

http://d3s8yh4ki1ad1i.cloudfront.net/icglgkfbfpigrgljji

http://www.reporting-download.com/.../?appid=76060148&r=3&s=NC5tbk2imzXtpdPGFaDoHHBqpSYgAJTezgkqVcbJYr1r8SWvlxu42cSilnEw9yj88wnusAA3kRxcyEocCqxgHqbIbrpCBRj3OtfMOZlE1jujRjgm2sN9K4TMPG7G4NWpvpt9khjw522mraNWUi0bS6H8vAKTiUtBNYr9SaT7XwUhuWKGRLCjNNBfBr0jo1rNSo9ya0kQjh2qQ3IcEjSdtSokR59mJkN9bN4v10uCXbcLHCIJqTY9HdtlNTcoLPyTITtmficSOX4IjRZI4AT0v5d0XZzHmelFZyHSzxYb2dk94vFksRqOd6U00wQ6IDGo8gGfjEhRc6L0al1SsoJT6qQFW5D2BobCcecPuPPtP6g6sbS47KKLACc1eGETWDeTURjNnpDr0pa4WMXXernlEGnYL74K92Re6QdOTDQv6hjaz5bejGDTNksFkK5T0eQgQ6uUAqKCfgih0CdfdAlIj3GIHvBAJpD4rKXHBaKvqexT9cy28gmiXQSOwjP11c5cjjbpjGYG45qSsSDEhg4HJaNp0TK39rqgxs1nEmXq2fmOjWob7zsXvWsVouLFTubfFk4CXZIWuAPj3LZW5CYpim7b0jU4x2xtdt2JhwSrIKmPv8zL5MiPMr3zpURha1tpQrXHYforT4eSU9cnEHScwChLzAy54T8iVT3rwLvKPalpT2w5XmkKo7d3SwUjkKSOAB3qjEEY3mH6KbXVxSzTVSKepS4MT07e4LQYKkziNc6KLUjkwTumVDWJgOfBhjQnxeTBHJyPivRqQPQiqlGX7kWgVVhGViRgNL5456s2rqFDv7V1gQAn65ekcquGrIhvBfioEzOIM0t404MvuNENUkSDXfUNquFd29NTURDRkFd8Gq5APF8N9e7lWPYi0HSPizPOFXXmrtS7d1gzXbBYTeevRGxioBOfONKHI3Y

http://www.reporting-download.com/.../?appid=76060148&r=2&s=vtU9ygwVtZEIrQFt82kLxWlYXVzybn9F8OP8EWu9n9SOAGbBECw3NwzxGQSNKfHOqYQ7msrWMcqMGe1aEiAUE6IwinCcR5SJ4H1TuIhx4nEUS0liP4KDaQLkBVzTB76iiqeRAdS5kzRDq47Wpzx3crHN0WWo14gtCvmTxmlxwWC0eQzrs2ZD96cf9571MMLqjwCWdFnJZcSMyrQ97oNo6lmpjXZcpbtc52egnC4DaKBFFGZaV4ivCEpQRKNlVRXe2bntAEdo3ohmrUrffOxvdbitogs4fXvN9Hd0aY9XBSHIbhU8p14UzBreaStEVLrpNWxqdyRIfWWdKd3Bh2liD9BUtXPyK4RWukYdKKlD6blsKQgFziB8jjQhKaVmlQlEsvHRSbhNkZNFxICxqLAdXa1c1HRzTV8ENlv15Xj0BQBTzqig27ALfeDcgo7giQqK9O1fX2OiWQWKGCMAyYeWVChfNxUrgDHGniEKatAFLLhe0fSwQvADPRTQTSTWUOv5Z0wvIQrFKxyTNQnfHHx9JGMiIrjyunQpaPHrrMqSTVmgrbGHkO99XTcgvi1yw6X2qcNfBijv5bkpkLhAjNVxcHDEcFQCzZOmTQ0yPqrtS0tOUP9yjGrdPDFDYN3ZtaPUrUXPGVGQ3mOBDg9ag7z50I3u6GmqbHZ51uJ6LAUgcRmGzBWiXABSEkNBN0Ezd0QBk88s7CqGjSe3M0FejYJZghCvM8z0JzOTDYO7zNSsDeinYooUF2a6SfpJK86Odgk5ASAS0IoC74TH0GamqFhwR1SDneX5yN2LXk3ud7B2Og83apfSbzrJH42Rqt97WU7MsxxwF4PjEcFh1ltDl63vsEbCujfbL7W024W6YTaqB7VdCLBGzID0XqyJspvbOMZncVbOrO9zl4H7RF3NfZfQo2sgpWHDweo4q5LGFss

http://www.reporting-download.com/.../?appid=76060148&r=1&s=bCORNY6uTCLMQmtvRFtsRM0Ls0bvDKiftwy0B2uKUex6lu3kzGXeAG0C28IDISfXeFyQSRgd5z5BkfCZPIUbzgcV18hpv0xbb1NHIj1To3Pr7oNen9icF3CDIThFSUojQX9mUWmzX9bqZ7cFMNPsCYMzAl4fOT7bTAv7wfaV8UUBmQhAUweunaYz1ICIsS6ms41aGhHPwlA7vQbTKFaxTBkhfxPk3vs2Eka6dLS5VhtJUybaC9vksqgO8JrJopyNSexTqqtyCit2a2vOcJ6OjQzfeC1GJHZRPNG3eWCs1XusQDDv2ZcrQTzk2Fmu0rtVYEC7HvEBKudFKtQ19ZAUwRQnD5ysPwEsPF0cINpTjFwU1vbQ2Os4PaisKWnyHh5y9TknZCD1yU1lJ14wofK2wZG4kBROh6zeptc0bzobrpCY2bSAAOm8GmFFpLbWOfSHnWfQyvfIHXoudQE4HM1HTSTrZBMs56b7s7S490JWEqeKjXyAlOVscNgWr2tt4msTd6LbQAE8wqTTMBCkv3CCUTxZqLNnj5OwI8QXBbihzNBJRwyS48aV8ybLhSx9NZYbwoG7InRqV3xFaoy65kPvgN2Wf8re0yCNJ4JexjJnTB5gLXOf79bEl9EDNtPbK7t7kiuZQu7wxxpapsIdV7xSL771U8Pakcs0wdHrPVNkVHnHVCpbn6yA8Zbre1EndNGgi8sHIM1SX9YThrt24uQjN6YnhBQZaBjcY1luy0KImXiX40YMFD6JEBGdHCycsiQEKiNUZcdUnp7hoE3HnYNkZTyXYo1VqtVKc9N7j6IdXkasrSYOO6k3KlxJV2LfkeqBJkpjopO2utpEtrNy13N5EoYqFtAoKtLzm4LuikpKWmnH9w25shZdAgm4s9url0S0HhoXT701HKKyCbovu7Bft1rGMX3BbSDu4eveZRv

http://www.reporting-download.com/.../?appid=76060148

http://download.cnet.com/.../?appid=76060148

http://software-files-a.cnet.com/s/software/13/81/51/.../isomount_setup.exe

Remove setup_product_4065.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.