CFIREMASTER.EXE – Trojan SuspiciousFile removal

CFIREMASTER.EXE size: 24576 bytes
CFIREMASTER.EXE hash: EF60CA3FD131977D69583AE1C7AC4A02

Created files:

C:\Windows\System32\cfire.exe
C:\Windows\System32\cfiremaster.exe

Autostart registry keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\cfire: C:\Windows\System32\cfire.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\cfiremaster: C:\Windows\System32\cfiremaster.exe

Detected by UnHackMe:

CFIREMASTER.EXE
Default location: %SYSDIR%\CFIREMASTER.EXE

Dropper information:
MD5: 6e94c150375eb9899128c828d4fa5ae0
File size: 26112 bytes