| K7 Detection Name | Affected OS | Prevalence | AV Definition Version |
|---|---|---|---|
| Exploit ( 005d0ad51 ) | Windows | Low | 14.67.60292 |
| MD5 | be124a5a91ac956bc23d3cdb364c07e7 |
| SHA256 | f90842f0eadd024e7665c709e0661fe53a6ce0a2d6c64177fed8ece092cdfa9a |
| File Size | 4,154,368 bytes |
| Packer Information | N/A |
| First Seen | 29-07-2026 |
| Last Seen | 14-10-2026 |
| Aliases | Agent.JKZ |
Behavior Details
1. Services & Scheduled Tasks Created:
Service: ks44339c
Service: ks44339cs
Service: WSearch
Task/Service Command: “sc.exe” delete ks44339c
Task/Service Command: “sc.exe” delete ks44339cs
Task/Service Command: “sc.exe” create ks44339c binpath= “C:\Windows\Help\csrss.exe -s” displayName= “WMI Performance Adaptor” start= auto
Task/Service Command: “sc.exe” description ks44339c “Provides performance library information from Windows Management Instromentation”
Task/Service Command: “sc.exe” create ks44339cs binpath= “C:\Windows\system\csrss.exe -p” displayName= “WMI Performance Adaptnr” start= auto
Task/Service Command: “sc.exe” description ks44339cs “Provides performance library information from Windows Management Instromentations”
Removal Instructions
1. Update K7 security to the latest version.
2. Restart the machine.