home

ramdiskws.exe

SOFTPERFECT PTY. LTD.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘RAMDiskForWorkstations’.
Publisher:
SoftPerfect Research  (signed by SOFTPERFECT PTY. LTD.)

Description:
SoftPerfect RAM Disk (64-bit)

Version:
3.3.2.0

MD5:
999082d9231af1ca3b3da7351cf56d92

SHA-1:
ce78d60ce387a99c221ff14e5adeacec19d15c42

SHA-256:
a2f7052ed258c0d1bba11b76ff418d1676d0dd584b99c05e277e00ebca25fa68

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/23/2024 9:48:14 AM UTC  (today)

File size:
3.2 MB (3,388,024 bytes)

Product version:
3.3.2.0

Copyright:
2009-2012 SoftPerfect Research

File type:
Executable application (Win64 EXE)

Common path:
C:\Program Files\softperfect ram disk\ramdiskws.exe

Digital Signature
Signed by:
SOFTPERFECT PTY. LTD.

Authority:
GlobalSign nv-sa

Valid from:
9/17/2012 9:59:41 PM

Valid to:
12/17/2015 9:59:41 PM

Subject:
CN=SOFTPERFECT PTY. LTD., O=SOFTPERFECT PTY. LTD., L=KENSINGTON PARK, S=SOUTH AUSTRALIA, C=AU

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121D3E3CF8CC5546295D1696F43CEF8BA42

File PE Metadata
Compilation timestamp:
11/6/2012 9:24:27 PM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

Entry address:
0x27BC90

Entry point:
55, 48, 83, EC, 20, 48, 8B, EC, 90, 48, 8D, 0D, F8, 3B, FF, FF, E8, 7B, 52, D9, FF, 48, 8D, 0D, E0, 00, 00, 00, E8, BF, AF, DB, FF, 48, 8B, 0D, F0, 54, 03, 00, 88, 01, 48, 8B, 05, E7, 54, 03, 00, 80, 38, 00, 74, 0D, E8, C5, 39, FF, FF, 84, C0, 0F, 85, 88, 00, 00, 00, E8, C8, 3A, FF, FF, 84, C0, 75, 7F, 48, 8B, 05, 5D, 58, 03, 00, 48, 8B, 08, E8, 35, 39, F9, FF, 48, 8B, 05, 4E, 58, 03, 00, 48, 8B, 08, B2, 01, E8, 64, 65, F9, FF, 48, 8B, 05, 3D, 58, 03, 00, 48, 8B, 00, 48, 8B, 0D, 9B, 54, 03, 00, 80, 39, 00...
 
[+]

Entropy:
5.9227

Code size:
2.5 MB (2,600,448 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
RAMDiskForWorkstations

Command:
"C:\Program Files\softperfect ram disk\ramdiskws.exe" \hide


Scan ramdiskws.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.