» KaPFA.sys
Overview
Analysis
File Details
Behaviors (1)

KaPFA.sys

Kaseya Agent

Kaseya Development, LLC

It runs as a Windows 64-bit kernel mode device driver named “KAPFA”.

File name:

KaPFA.sys

Publisher:

Kaseya (signed by Kaseya Development, LLC)

Product:

Kaseya Agent

Description:

Kaseya Agent Protected File Access Driver

Version:

6.1.0.0 built by: WinDDK

MD5:

d56e819e822f3d5cbe3589b31a85714c

SHA-1:

1a0dfc6d6c349b473e4d8757045bebf662ad5f63

SHA-256:

83383f676134109f8291d49f04bf20666e190b5c0b3b2da3652e03dd833af798

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

2/25/2025 12:29:56 PM UTC (today)

File size:

30.1 KB (30,792 bytes)

Product version:

6.1.0.0

Original file name:

KaPFA.sys

File type:

Driver (Win64 SYS)

Language:

English (United States)

Common path:

C:\Windows\System32\drivers\kapfa.sys

Digital Signature

Signed by:

Kaseya Development, LLC

Authority:

GlobalSign nv-sa

Valid from:

5/19/2010 4:52:49 AM

Valid to:

5/19/2013 4:52:46 AM

Subject:

CN="Kaseya Development, LLC", O="Kaseya Development, LLC", S=CA, C=US

Issuer:

CN=GlobalSign ObjectSign CA, OU=ObjectSign CA, O=GlobalSign nv-sa, C=BE

Serial number:

01000000000128AEB0200E

File PE Metadata

OS bitness:

Win64

CTPH (ssdeep):

768:l+o0IxP14mGc0I4vm31Ww13lFZ/LueiYl:oVIxPuKD11FZ/yeiYl

Driver

Display name:

KAPFA

Type:

Kernel device driver (KernelDriver)

Scan KaPFA.sys - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.