home

wdfcoinstaller01009.dll

WDF Coinstaller

Promelement, LLC

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The module wdfcoinstaller01009.dll by Promelement has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
Microsoft Corporation  (signed by Promelement, LLC)

Product:
Microsoft® Windows® Operating System

Description:
WDF Coinstaller

Version:
1.9.7600.16385 (win7_rtm.090713-1255)

MD5:
892158986bb7d682b7a5b5ab442e4473

SHA-1:
a6aa98ab512ff9e0497e3f970136bc273f659b0d

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/18/2024 2:08:08 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Promelement.Installer (M)
16.2.27.22

File size:
1.4 MB (1,459,784 bytes)

Product version:
1.9.7600.16385

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
WdfCoInstaller.dll

File type:
Dynamic link library (Win32 DLL)

Language:
Language Neutral

Common path:
C:\documents and settings\fdtg\bureau\gpg\v1.1405\drivers\fastboot\i386\wdfcoinstaller01009.dll

Digital Signature
Signed by:
Promelement, LLC

Authority:
DigiCert Inc

Valid from:
1/22/2013 1:00:00 AM

Valid to:
1/29/2014 1:00:00 PM

Subject:
CN="Promelement, LLC", O="Promelement, LLC", L=Chelyabinsk, S=Chelyabinsk, C=RU

Issuer:
CN=DigiCert High Assurance Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0FDBA32CE8DC0EF00F7C962DB173BC55

File PE Metadata
Compilation timestamp:
7/14/2009 1:49:43 AM

OS version:
6.1

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
9.0

CTPH (ssdeep):
24576:ajG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRAO:+GtN2h1120R7m4XShYVxfBwrC21fXS4

Entry address:
0xDE43

Entry point:
8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 0E, 05, 00, 00, 5D, E9, 89, FD, FF, FF, CC, CC, CC, CC, CC, 3B, 0D, 10, 00, 01, 02, 75, 03, C2, 00, 00, E9, 89, 05, 00, 00, CC, CC, CC, CC, CC, CC, FF, 25, AC, 11, 00, 02, CC, CC, CC, CC, CC, CC, FF, 25, A8, 11, 00, 02, CC, CC, CC, CC, CC, CC, 68, EA, DE, 00, 02, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 10, 00, 01, 02, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF...
 
[+]

Code size:
57 KB (58,368 bytes)

Remove wdfcoinstaller01009.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.