Versions

d2fb2	37.50%
f1a65	37.50%
326ea	12.50%
ff809	12.50%

(Note, the developer publishes each variation of this file with the same version, but the hashes are unique.)

ramsaverpro.exe

Remove ramsaverpro.exe

Warning 12 antivirus scanners has detected malware in various versions of ramsaverpro.exe.

Overview

There are 4 versions of ramsaverpro.exe in the wild, the latest version being . ramsaverpro.exe is run as a standard windows process with the logged in user's account privileges. By adding a startup entry to the run registry key, the file will be executed when the user logs into Windows. The average file size is about 473.94 KB. During the process's lifecycle, the typical CPU resource utilization is about 0.0007% including both foreground and background operations, the average private memory consumption is about 3.62 MB with the maximum memory reaching around 16.05 MB. Addionally, typically read and write I/O disk operations is about 153.56 KB per minute for reads and 0 Bytes per minute for writes.

Details

File name:	ramsaverpro.exe
Typical file path:	C:\Program Files\wintools software\ram saver professional\ramsaverpro.exe

Behaviors

(Note, the behaviors below are for all versions of ramsaverpro.exe, select a unique version for details.)

Startup files (user) run

Runs under the registry key 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'RAMSaverPro' → C:\Program Files\WinTools Software\RAM Saver Professional\ramsaverpro.exe

Malware detections

Based on 40+ industry antivirus scanners, 12 of them detected the following malware.

Antivirus engine	Engine version	Detection	File version
CAT Quick Heal	7.13.12.00	(Suspicious) - DNAScan	d2fb2444b62a54a6e1a22bf1734ca26a
CAT Quick Heal	9.13.12.00	(Suspicious) - DNAScan	f1a654729537ea23d89bcd27f91f7199
CAT Quick Heal	10.13.12.00	(Suspicious) - DNAScan	326ea0fa980d962140474d82d2c572bf
Clam AntiVirus	0.97.3.0	PUA.Packed.ASPack	326ea0fa980d962140474d82d2c572bf
Emsisoft Anti-Malware	5.1.0.11	Win32.SuspectCrc!IK	326ea0fa980d962140474d82d2c572bf
eSafe	7.0.17.0	Suspicious File	326ea0fa980d962140474d82d2c572bf
Ikarus	T3.1.5.6.0	DDoS.Win32.Nitol	f1a654729537ea23d89bcd27f91f7199
Ikarus	T3.1.1.109.0	Win32.SuspectCrc	326ea0fa980d962140474d82d2c572bf
McAfee Gateway Anti-Malware	v2013-dat	Heuristic.LooksLike.Win32.Suspicious.C	f1a654729537ea23d89bcd27f91f7199
McAfee Gateway Anti-Malware	v2010.1E-dat	Heuristic.LooksLike.Win32.Suspicious.J	326ea0fa980d962140474d82d2c572bf
Trend Micro HouseCall	9.700.0.1001	TROJ_GEN.F47V0109	d2fb2444b62a54a6e1a22bf1734ca26a
Trend Micro HouseCall	9.700-1001	TROJ_GEN.F47V1227	f1a654729537ea23d89bcd27f91f7199

All file variations of ramsaverpro.exe

MD5	SHA-1	File size
d2fb2444b62a54a6e1a22bf1734ca26a	af87d365ca115803e905febc73fd98c7f8013323	442 KB
f1a654729537ea23d89bcd27f91f7199	83cb96389963c8fc6218615c4839883c476ce9ff	441.5 KB
326ea0fa980d962140474d82d2c572bf	051dcc7ed29994ede32cf1818a6405f21928ce1a	588 KB
ff80970a48acc872b318ded4c7063e72	96261ab4fff766fcd011411769dc2842dc5810e6	424.26 KB