PUA_FUSIONCORE.GC

August 04, 2017

Analysis by: Byron Jon Gelera

ALIASES:

Riskware/FusionCore (Fortinet); not-a-virus:RiskTool.Win32.FusionCore.b (Kaspersky)

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Potentially Unwanted Application
Destructiveness: No
Encrypted: No
In the wild: Yes

OVERVIEW

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

TECHNICAL DETAILS

File Size: 19,002,008 bytes

File Type: EXE

Memory Resident: No

Initial Samples Received Date: 05 Jul 2017

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This Potentially Unwanted Application adds the following folders:

%All Users Profile%\Start Menu\Programs\Freemake
%Start Menu%\Programs\Freemake\Uninstall
%Program Files%\Freemake
%All Users Profile%\Application Data\Freemake
%Program Files%\Common Files\Freemake Shared\ProductUpdater

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It drops the following files:

%All Users Profile%\Start Menu\Programs\Freemake\Freemake Audio Converter.lnk
%All Users Profile%\Desktop\Freemake Audio Converter.lnk
%Start Menu%\Programs\Freemake\Uninstall\Uninstall Freemake Audio Converter.lnk
%Program Files%\Freemake\Freemake Audio Converter\Uninstall\unins000.dat
%Program Files%\Freemake\Freemake Audio Converter\Uninstall\unins000.exe
%Program Files%\Freemake\Freemake Audio Converter\Uninstall\icon.ico
%Program Files%\Freemake\COM\1.1\msvcr100.dll
%Program Files%\Freemake\COM\1.1\msvcp100.dll
%Program Files%\Freemake\COM\1.1\avcodec-54.dll
%Program Files%\Freemake\COM\1.1\avdevice-54.dll
%Program Files%\Freemake\COM\1.1\avformat-54.dll
%Program Files%\Freemake\COM\1.1\avutil-52.dll
%Program Files%\Freemake\COM\1.1\avresample-1.dll
%Program Files%\Freemake\COM\1.1\swscale-2.dll
%Program Files%\Freemake\COM\1.1\avfilter-3.dll
%Program Files%\Freemake\COM\1.1\xvidcore.dll
%Program Files%\Freemake\COM\1.1\id3lib.dll
%Program Files%\Freemake\COM\1.1\libdvdnav.dll
%Program Files%\Freemake\COM\1.1\libdvdcss-2.dll
%Program Files%\Freemake\COM\1.1\FMMediaFormats.dll
%Program Files%\Freemake\COM\1.1\FMTransformBase.dll
%Program Files%\Freemake\COM\1.1\FMMediaSource.dll
%Program Files%\Freemake\COM\1.1\FMVideoConverter.dll
%Program Files%\Freemake\COM\1.1\FMMediaUtils.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FMProfileManager.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FMiTunesLib.dll
%Program Files%\Freemake\Freemake Audio Converter\FMWeb\Downloader\FmUpdater.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\Autofac.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\Autofac.xml
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FmUpdater.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\Freemake.CustomControls.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\Freemake.Effects.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\Freemake.Themes.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon.dll.config
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\GAnalytics.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\GoCartMonad.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\Newtonsoft.Json.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\Newtonsoft.Json.xml
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\NLog.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\nunit.framework.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\nunit.framework.xml
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\SmartThreadPool.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\cs\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\da\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\de-DE\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\el-GR\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\es-ES\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\fr-fR\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Profiles\FMCommonCodecProfiles.xml
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Profiles\FmDownloaderProfiles.xml
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\Adv.xml
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\AdvVersion
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\AudioConverter.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\AudioConverterOn.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\installPremium.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\installPremiumDown.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\installPremiumOver.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\Mp3Jam.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\Mp3JamOn.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\MusicBox.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\MusicBoxOn.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\VideoConverter.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\VideoConverterOn.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\VideoDownloader.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\VideoDownloaderOn.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\Youtube2Mp3Converter.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\FreemakeCommon\Resources\Youtube2Mp3ConverterOn.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\hu\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\it\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ja-JP\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\nl\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\pl\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\pt-BR\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ru-RU\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\sk\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\uk\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\vi\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\zh-CN\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\zh-TW\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\cs\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\cs\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\da\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\da\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\de-DE\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\de-DE\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\el-GR\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\el-GR\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\es-ES\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\es-ES\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\fr-FR\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\fr-FR\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\hu\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\hu\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\it\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\it\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\ja-JP\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\ja-JP\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\nl\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\nl\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\pl\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\pl\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\pt-BR\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\pt-BR\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\ru-RU\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\ru-RU\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\sk\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\sk\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\uk\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\uk\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\vi\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\vi\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\zh-CN\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\zh-CN\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\zh-TW\FreemakeAudioConverter.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Languages\zh-TW\FreemakeCommon.resources.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAC.exe
%Program Files%\Freemake\Freemake Audio Converter\FmStarter\FreemakeAC.exe
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter.exe
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Resources\how_to_FAC.xml
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Resources\ImagesBranding\full_screen_logo_br.png
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Resources\ImagesBranding\full_screen_logo_de.png
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Resources\ImagesBranding\full_screen_logo_en.png
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Resources\ImagesBranding\full_screen_logo_es.png
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Resources\ImagesBranding\full_screen_logo_fr.png
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Resources\ImagesBranding\full_screen_logo_it.png
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Resources\ImagesBranding\full_screen_logo_ja.png
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Resources\ImagesBranding\full_screen_logo_ru.png
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAudioConverter\Resources\ImagesBranding\small_logo.png
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\Autofac.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\Autofac.xml
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\BrowserPlugin.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\FMDownloader.GlobalSettings.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\FMDownloader.Interface.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\FMProfileManager.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\FmUpdater.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\Freemake.CustomControls.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\Freemake.Effects.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\Freemake.Themes.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\FreemakeCommon.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\FreemakeConverterCommon.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\GAnalytics.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\GoCartMonad.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\Newtonsoft.Json.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\Newtonsoft.Json.xml
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\NLog.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\SmartThreadPool.dll
%Program Files%\Freemake\Freemake Audio Converter\FMCommon\ConverterCommon\System.Data.SQLite.dll
%Program Files%\Freemake\Freemake Audio Converter\FreemakeAC.exe.config
%Program Files%\Freemake\Freemake Audio Converter\NLog.config
%Program Files%\Freemake\Freemake Audio Converter\SetupUpdate.exe
%All Users Profile%\Application Data\Freemake\FreemakeUtilsService\Statistics\Targets\FAC_Statistics.ini
%All Users Profile%\Application Data\Freemake\FreemakeUtilsService\Statistics\Targets\Icons\fac.ico
%Program Files%\Freemake\Freemake Audio Converter\Uninstall\FreemakeUOs.exe
%Program Files%\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
%Program Files%\Common Files\Freemake Shared\ProductUpdater\FMUpdater.dll
%Program Files%\Common Files\Freemake Shared\ProductUpdater\Newtonsoft.Json.dll
%Program Files%\Common Files\Freemake Shared\ProductUpdater\GoCartMonad.dll
%Program Files%\Common Files\Freemake Shared\ProductUpdater\GAnalytics.dll
%Program Files%\Freemake\dotNetFx40_Client_setup.exe

Other System Modifications

This Potentially Unwanted Application adds the following registry keys:

HKEY_LOCAL_MACHINE\Software\Freemake

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
FreemakeAudioConverter

HKEY_CURRENT_USER\Software\Freemake

HKEY_CURRENT_USER\SOFTWARE\Freemake\
FreemakeAudioConverter

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
ProductUpdater = %Program Files%\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
AppPaths
DotNetInstallation = %Program Files%\Freemake\dotNetFx40_Client_setup.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
AppPaths
FreemakeAudioConverter = %Program Files%\Freemake\Freemake Audio Converter\FreemakeAC.exe

HKEY_CURRENT_USER\Software\Freemake\
UninstallPaths
Freemake Audio Converter = %Program Files%\Freemake\Freemake Audio Converter\Uninstall\unins000.exe

HKEY_CURRENT_USER\Software\Freemake\
FreemakeAudioConverter
Culture = en-US

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
FreemakeAudioConverter
FileVersion = 1.1.8.9

HKEY_CURRENT_USER\Software\Freemake\
FreemakeAudioConverter
FreemakeVideoConverter_alreadyShowNum = 0

HKEY_CURRENT_USER\Software\Freemake\
FreemakeAudioConverter
FreemakeMusicBox_alreadyShowNum = 0

HKEY_CURRENT_USER\Software\Freemake\
FreemakeAudioConverter
FreemakeVideoDownloader_alreadyShowNum = 0

HKEY_CURRENT_USER\Software\Freemake\
FreemakeAudioConverter
FreemakeYouTubeToMP3Boom_alreadyShowNum = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
Products
FAC = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
AppPaths
DotNetInstallation = %Program Files%\Freemake\dotNetFx40_Client_setup.exe

HKEY_CURRENT_USER\Software\Freemake\
FreemakeAudioConverter
UpdateWindowClosedByCross = False

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
FreemakeAudioConverter\SystemSettings
InstallationTimeStamp = {Installation Time}

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake
GUID = {2E95AE93-ED0B-4540-8282-4A1AFA8EF994}

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
FreemakeAudioConverter
LastNotificationPopupTime = {Time}

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
FreemakeAudioConverter\SystemSettings
FirstRunTimeStamp = {Time}

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
FreemakeAudioConverter
StaticticsInstalled = {value}

HKEY_CURRENT_USER\Software\Freemake
NumRun = {value}

HKEY_CURRENT_USER\Software\Freemake
TotalRun = {value}

HKEY_CURRENT_USER\Software\Freemake
CurRev = {value}

HKEY_LOCAL_MACHINE\SOFTWARE\Freemake\
FreemakeAudioConverter
InstallationCount = {value}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
Inno Setup: Setup Version = 5.5.3 (u)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
Inno Setup: App Path = %Program Files%\Freemake

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
InstallLocation = %Program Files%\Freemake\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
Inno Setup: Icon Group = Freemake

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
Inno Setup: User = {user name}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
Inno Setup: Language = en

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
DisplayName = Freemake Audio Converter version 1.1.8

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
DisplayIcon = %Program Files%\Freemake\Freemake Audio Converter\Uninstall\icon.ico

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
UninstallString = "%Program Files%\Freemake\Freemake Audio Converter\Uninstall\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
QuietUninstallString = "%Program Files%\Freemake\Freemake Audio Converter\Uninstall\unins000.exe" /SILENT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
DisplayVersion = 1.1.8

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
Publisher = Ellora Assets Corporation

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
URLInfoAbout = {URL}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
HelpLink = {Help URL}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
URLUpdateInfo = {URL}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
NoModify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
NoRepair = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
InstallDate = {Date}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
MajorVersion = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Freemake Audio Converter_is1
MinorVersion = 1

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

http://rp.{BLOCKED}r.com/?v={value}&subver={value}&pcrc={value}
http://os.{BLOCKED}r.com/FusionFreemake/?v={value}&c={value}&t={value}
http://img.{BLOCKED}r.com/img/Jimomoromoj/Jimomoromoj_logo.png
http://cdneu.{BLOCKED}r.com/ofr/Solululadul/asgnd.cis
http://cdnus.{BLOCKED}r.com/ofr/Solululadul/asgnd.cis
http://cdneu.{BLOCKED}r.com/ofr/Gigigiyiwig/Gigigiyiwig_a.cis
http://cdnus.{BLOCKED}r.com/ofr/Gigigiyiwig/Gigigiyiwig_a.cis
http://cdneu.{BLOCKED}r.com/ofr/Solululadul/icut.cis
http://cdnus.{BLOCKED}r.com/ofr/Solululadul/icut.cis

SOLUTION

Minimum Scan Engine: 9.850

SSAPI PATTERN File: 1.861.00

SSAPI PATTERN Date: 03 Aug 2017

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\Software
- Freemake
In HKEY_CURRENT_USER\Software
- Freemake
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- Freemake Audio Converter_is1

Step 4

Delete this registry value

[ Learn More ]

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- ProductUpdater = %Program Files%\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe

Step 5

Search and delete this folder

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.

%All Users Profile%\Start Menu\Programs\Freemake
%Start Menu%\Programs\Freemake\Uninstall
%Program Files%\Freemake
%All Users Profile%\Application Data\Freemake
%Program Files%\Common Files\Freemake Shared\ProductUpdater

Step 6

Search and delete this file

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%All Users Profile%\Desktop\Freemake Audio Converter.lnk

Step 7

Scan your computer with your Trend Micro product to delete files detected as PUA_FUSIONCORE.GC. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.

PUA_FUSIONCORE.GC

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters