| Attribute | Details |
|-----------|---------|
| File Name | kofmsp.dll |
| Full Name | Likely KOFAX MSP (Module/Component) - though "MSP" often stands for Microsoft Print or Managed Service Provider in other contexts, here it is specific to Kofax. |
| Primary Vendor | Kofax, Inc. (now part of Tungsten Automation) |
| Product Association | Kofax Capture, Kofax Express, Kofax Transformation Modules, Kofax VRS (VirtualReScan) |
| Typical Location | C:\Program Files (x86)\Kofax\Capture\Bin\ or similarly under Kofax product directories |
| File Type | Win32 Dynamic Link Library (DLL) |
| Architecture | Usually 32-bit (x86) even on 64-bit Windows |
| Digital Signature | Typically signed by Kofax, Inc. |
kofmsp.dll depends on several other Kofax and system libraries: kofmsp.dll
| Dependency | Purpose |
|------------|---------|
| kfx.dll | Core Kofax imaging foundation |
| kofcx.dll | Kofax common utilities |
| kofccl.dll | CCL (Common Control Library) |
| twain_32.dll / twaindsm.dll | TWAIN data source management |
| wiatwain.dll | WIA-to-TWAIN bridge (older systems) |
| msvcp140.dll, vcruntime140.dll | Visual C++ 2015-2022 redistributables |
| gdi32.dll, user32.dll, ole32.dll | Standard Windows APIs for graphics and COM | | Attribute | Details | |-----------|---------| | File
| Indicator | Suspicious | Malicious |
|-----------|------------|------------|
| Digital signature | Missing or self-signed | Invalid or expired |
| Location | %TEMP%, Downloads, or Roaming | Any non-Kofax folder |
| File size | <100 KB or >5 MB (packed) | Executable behavior detected |
| Process loading it | Unknown process (e.g., svchost.exe) | Script runner, PowerShell |
| High CPU/network | Yes, even when not scanning | Persistent outbound connections | Fix: Update scanner driver to 32-bit version; increase
Recommendation: Always verify the digital signature. Right-click
kofmsp.dll→ Properties → Digital Signatures tab. Legitimate Kofax signatures will show "Kofax, Inc." or "Tungsten Automation."
