» KaPFA.sys
Overview
Analysis
File Details
Behaviors (1)

KaPFA.sys

Kaseya Agent

Kaseya Development, LLC

It runs as a Windows 64-bit kernel mode device driver named “KAPFA”.

File name:

KaPFA.sys

Publisher:

Kaseya (signed by Kaseya Development, LLC)

Product:

Kaseya Agent

Description:

Kaseya Agent Protected File Access Driver

Version:

6.2.0.3 built by: WinDDK

MD5:

652dd32a7b6f78a78508206849e9e159

SHA-1:

696426aef9af76b3db89644de5aa9ad8905bdee8

SHA-256:

35f59db51abd9f6cf04e061f92bafe5f09beebeaf230d16a5f5e00c92fa4d07f

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

2/25/2025 12:53:54 PM UTC (today)

File size:

32.7 KB (33,512 bytes)

Product version:

6.2.0.3

Original file name:

KaPFA.sys

File type:

Driver (Win64 SYS)

Language:

English (United States)

Common path:

C:\Windows\System32\drivers\kapfa.sys

Digital Signature

Signed by:

Kaseya Development, LLC

Authority:

GlobalSign nv-sa

Valid from:

5/19/2010 4:52:49 AM

Valid to:

5/19/2013 4:52:46 AM

Subject:

CN="Kaseya Development, LLC", O="Kaseya Development, LLC", S=CA, C=US

Issuer:

CN=GlobalSign ObjectSign CA, OU=ObjectSign CA, O=GlobalSign nv-sa, C=BE

Serial number:

01000000000128AEB0200E

File PE Metadata

OS bitness:

Win64

CTPH (ssdeep):

384:nfWwkvik2WDMLJBHPzBUa5bG10VIIqk52uc0+dnMe0m3YMEfvhOnV+4iqSRNLxrv:fWwkvnDWB9XqIqZ0+Ce335vCnLSRiL

Driver

Display name:

KAPFA

Type:

Kernel device driver (KernelDriver)

Scan KaPFA.sys - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.