Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

1, 0, 0, 26 13.79%
1, 0, 0, 21 13.79%
1, 0, 0, 16 10.34%
1, 0, 0, 14 10.34%
1, 0, 0, 13 24.14%
1, 0, 0, 13 10.34%
1, 0, 0, 11 17.24%

Relationships

Parent process
Related files

PE structurePE file structure

Show functions
Import table
advapi32.dll
ConvertStringSecurityDescriptorToSecurityDescriptorA, DeregisterEventSource, ReportEventA, RegisterEventSourceA, SetServiceStatus, StartServiceA, OpenServiceA, CloseServiceHandle, CreateServiceA, OpenSCManagerA, DeleteService, QueryServiceStatus, ControlService, RegisterServiceCtrlHandlerA, StartServiceCtrlDispatcherA, RegCloseKey, RegSetValueExA, RegOpenKeyExA, RegCreateKeyExA, RegDeleteValueA, RegDeleteKeyA, InitializeSecurityDescriptor
kernel32.dll
CreateFileA, FlushFileBuffers, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, GetConsoleMode, GetConsoleCP, SetFilePointer, GetLocaleInfoA, SetEvent, CreateEventA, Sleep, MultiByteToWideChar, GetLastError, LocalFree, lstrlenA, FormatMessageA, GetModuleFileNameA, SetConsoleCtrlHandler, WinExec, GetWindowsDirectoryA, CloseHandle, CreateNamedPipeA, HeapValidate, IsBadReadPtr, RtlUnwind, ResumeThread, CreateThread, ExitThread, InterlockedIncrement, InterlockedDecrement, GetProcAddress, GetModuleHandleA, ExitProcess, GetCommandLineA, HeapFree, GetVersionExA, HeapAlloc, GetProcessHeap, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapReAlloc, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, SetLastError, RaiseException, WriteFile, GetStdHandle, LoadLibraryA, InitializeCriticalSection, WideCharToMultiByte, LCMapStringA, LCMapStringW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, DebugBreak, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, LoadLibraryW, GetStringTypeA, GetStringTypeW, SetEnvironmentVariableA, CompareStringW, CompareStringA, VirtualQuery, GetTimeZoneInformation, GetLocaleInfoW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, FreeLibrary, FatalAppExitA, GetCurrentThread, InterlockedExchange, GetTimeFormatA, GetDateFormatA
ole32.dll
CoCreateInstance, CoUninitialize, CoInitializeEx, CoSetProxyBlanket, CoInitializeSecurity
rpcrt4.dll
RpcServerListen, RpcServerRegisterIf, RpcServerRegisterAuthInfoA, RpcServerUseProtseqEpA, RpcServerUnregisterIf, RpcMgmtStopServerListening, NdrServerCall2
setupapi.dll
SetupDiEnumDeviceInfo, SetupDiGetClassDevsA, SetupDiDestroyDeviceInfoList, SetupDiCallClassInstaller, SetupDiSetClassInstallParamsA, SetupDiClassGuidsFromNameA, SetupDiGetDeviceRegistryPropertyA
shlwapi.dll
SHDeleteKeyA, SHCopyKeyA
user32.dll
wsprintfW

raregistry.exe

Ralink RalinkRegistryWriter by Ralink Technology Corporation (Signed)

Remove raregistry.exe
Version:   1, 0, 0, 13
MD5:   583608ee65aabf971117a61aee4bcaae
SHA1:   d5b754e356fc6e0c3a7bf9cc36bb0882cbbc15e8
SHA256:   1fde8d46bcd58cb476b3e86c025438995111003dafb985cfe64138aedc4b78ce

What is raregistry.exe?

This is software installed with various versions of the Ralink wireless adapter software that uses the Ralink chipset. It is used for operation and setup of teh installed drivers in order to perform a number of registry registration actions.

Overview

raregistry.exe runs as a service under the name Ralink Registry Writer (RalinkRegistryWriter) with extensive SYSTEM privileges (full administrator access). It is installed with a couple of know programs including TP-LINK Wireless Utility published by TP-LINK, Hama Wireless LAN Adapter from Hama and Hama Wireless LAN Adapter by Hama. The file is digitally signed by Ralink Technology Corporation which was issued by the VeriSign certificate authority (CA).

DetailsDetails

File name:raregistry.exe
Publisher:Ralink Technology, Corp.
Product name:Ralink RalinkRegistryWriter
Description:RalinkRegistryWriter
Typical file path:C:\Program Files\tenda\common\raregistry.exe
Original name:RalinkRegistryWriter.exe
File version:1, 0, 0, 13
Size:181.28 KB (185,632 bytes)
Certificate
Issued to:Ralink Technology Corporation
Authority (CA):VeriSign
Digital DNA
PE subsystem:Windows Console
File packed:No
.NET CLR:No
More details

ResourcesPrograms

The following programs will install this file
Addon
1% remove
ADDON Technology Ltd.
9% remove
Conceptronic
1% remove
Hama
9% remove
Ralink
7% remove
The software provides the installation utilities for Ralink RT2870 802.11 WirelessLAN Card including software and drivers.
Ralink
6% remove
The software provides the installation utilities for Ralink RT2860 802.11 WirelessLAN Card including software and drivers.
Ralink
3% remove
Ralink
6% remove
This software package contains the required software and driver to connect the Ralink RT7x Wireless LAN Card device to the PC.
Rosewill Corp.
1% remove
This is the software driver package that connects the N150PCx Wireless LAN Card to the PC and provides software management functionality.
Rosewill Corp.
6% remove
This is the software driver package that connects the N150PC Wireless LAN Card to the PC and provides software management functionality.
Rosewill Corp.
7% remove
This is the software driver package that connects the RNX-N250PC Wireless LAN Card to the PC and provides software management functionality.
Sitecom
12% remove
This is the 300N software driver and utilities required for managing and connecting the Sitecom networking device to the PC. Uninstalling this driver may cause the hardware to stop functioning properly (only remove this package if you no longer have the Sitecom networking device connected to your PC).
SUMVISION
4% remove
SUMVISION
4% remove
SUMVISION
7% remove
Sweex
6% remove
This is the software driver and additional utilities required for managing and connecting the device to the PC.
Tenda
1% remove
TOTOLink
3% remove
TP-LINK
10% remove
TP-LINK Wireless Utility is a configuration application that is included with most wireless devices and designed to configure the wireless adapter and connections.
TP-LINK
9% remove

BehaviorsBehaviors

Services
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
  • 'RalinkRegistryWriter'

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.00193922%
0.028634%
Kernel CPU:0.00094834%
0.013761%
User CPU:0.00099088%
0.014873%
Kernel CPU time:301 ms/min
100,923,805ms/min
CPU cycles:73,228/sec
17,470,203/sec
Memory
Private memory:2.85 MB
21.59 MB
Private (maximum):5.18 MB
Private (minimum):2.26 MB
Non-paged memory:2.85 MB
21.59 MB
Virtual memory:32.77 MB
140.96 MB
Virtual memory (peak):36.03 MB
169.69 MB
Working set:2.42 MB
18.61 MB
Working set (peak):5.52 MB
37.95 MB
Page faults:3,204/min
2,039/min
I/O
I/O read transfer:14 Bytes/sec
1.02 MB/min
I/O read operations:1/sec
343/min
I/O write transfer:0 Bytes/sec
274.99 KB/min
I/O write operations:1/sec
227/min
I/O other transfer:4 Bytes/sec
448.09 KB/min
I/O other operations:1/sec
1,671/min
Resource allocations
Threads:5
12
Handles:119
600
GUI GDI count:4
103
GUI USER count:2
49

BehaviorsProcess properties

Integrety level:Undefined
Platform:32-bit
Command lines:
  • "C:\Program Files\tp-link\common\raregistry.exe"
  • "C:\Program Files\ralink\common\raregistry.exe"
Owner:SYSTEM
Windows Service
Service name:RalinkRegistryWriter
Display name:Ralink Registry Writer
Type:Win32OwnProcess
Parent process:services.exe (Services and Controller app by Microsoft)

ResourcesThreads

Averages
 
ntdll.dll
Total CPU:0.05845025%
0.272967%
Kernel CPU:0.00000000%
0.107585%
User CPU:0.05845025%
0.165382%
CPU cycles:228,670/sec
5,741,424/sec
Memory:1.23 MB
1.16 MB
sechost.dll
Total CPU:0.00050693%
Kernel CPU:0.00034964%
User CPU:0.00015730%
CPU cycles:16,101/sec
Memory:100 KB
RaRegistry.exe (main module)
Total CPU:0.00048629%
Kernel CPU:0.00032899%
User CPU:0.00015730%
CPU cycles:7,174/sec
Memory:180 KB
advapi32.dll (Advanced Windows 32 Base API by Microsoft)
Total CPU:0.00002880%
Kernel CPU:0.00000000%
User CPU:0.00002880%
Memory:620 KB

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Ultimate 31.03%
Windows 7 Home Premium 24.14%
Microsoft Windows XP 24.14%
Windows 7 Professional 13.79%
Windows Vista Home Premium 3.45%
Windows Vista Ultimate 3.45%

Distribution by countryDistribution by country

United States installs about 48.28% of Ralink RalinkRegistryWriter.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Dell 31.25%
Toshiba 12.50%
Acer 12.50%
ASUS 12.50%
Intel 12.50%
Gateway 12.50%
Hewlett-Packard 6.25%
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE