Download RAMMap — Physical Memory Analyzer

Yes, RAMMap is completely safe. It is developed by Mark Russinovich at Microsoft and distributed as part of the official Sysinternals suite. Microsoft signs the executable, and the download comes directly from download.sysinternals.com, which is Microsoft-owned infrastructure.

The RAMMap v1.62 ZIP file is just 706 KB and contains a clean, portable executable. Multiple antivirus engines on VirusTotal consistently return zero detections for the official download. RAMMap runs as a read-only analysis tool by default — it reads your memory state without modifying system files, registry entries, or startup configuration. The only write action it performs is when you explicitly choose one of the “Empty” menu options to flush a memory list.

• Download only from Microsoft’s official Sysinternals page or from our download section
• The ZIP contains RAMMap.exe (32-bit) and RAMMap64.exe (64-bit) — no installer, no bundled software
• No internet connection required after download — it works fully offline
• Does not install drivers, services, or background processes

Pro tip: If Windows SmartScreen shows a warning on first launch, right-click the EXE, go to Properties, and check “Unblock” at the bottom of the General tab. This happens because the file was downloaded from the internet, not because of any security issue.

For a full breakdown of what RAMMap does, see our features section.

The official RAMMap download is hosted on Microsoft’s Sysinternals page at learn.microsoft.com/en-us/sysinternals/downloads/rammap. The actual ZIP file downloads from download.sysinternals.com/files/RAMMap.zip, which is a Microsoft-controlled CDN.

A common mistake is downloading RAMMap from third-party software aggregator sites like Softonic, CNET Download, or random file-hosting mirrors. These repackaged versions sometimes bundle adware, browser toolbars, or modified installers that the original does not include. The official version is a plain ZIP with no installer at all — if you see an .exe installer wrapper, it is not the genuine Microsoft release.

• Go to the Microsoft Sysinternals downloads page or use our direct download link
• Verify the file size is approximately 706 KB (the ZIP) — significantly larger files suggest repackaging
• The ZIP should contain RAMMap.exe and RAMMap64.exe with no additional files except a EULA text

Pro tip: You can also get RAMMap through the Sysinternals Live service by navigating to live.sysinternals.com/RAMMap.exe in your browser or File Explorer. This always serves the latest version without needing to download a ZIP.

Check our Getting Started guide for step-by-step download and extraction instructions.

Yes, RAMMap v1.62 works on Windows 11 without any compatibility issues. It supports all Windows 11 builds including 23H2 and 24H2, running natively on both Intel/AMD and ARM-based processors through emulation.

RAMMap officially supports Windows Vista and every Windows release after it, including Windows 7, 8, 8.1, 10, and 11. On the server side, it runs on Windows Server 2008 and later. The tool reads physical memory information through standard Windows kernel APIs that have remained consistent across these versions, so there are no special compatibility patches or workarounds needed.

• Works on Windows 11 Home, Pro, Enterprise, and Education editions
• No installation required — extract and run RAMMap64.exe for 64-bit systems
• Requires administrator privileges to read physical memory data
• Compatible with Windows 11 on ARM devices (Surface Pro X, etc.) through x86 emulation

Pro tip: On Windows 11, right-click RAMMap64.exe and select “Run as administrator” for full access. Without admin rights, some memory categories will show incomplete data or zero values.

See our system requirements for the complete compatibility list.

No, RAMMap is a Windows-only utility. It relies on Windows kernel APIs for physical memory analysis, so there is no macOS or Linux version and Microsoft has not announced plans to port it.

RAMMap uses the Windows Memory Manager APIs to query physical page frame data, standby lists, working sets, and driver-locked memory. These APIs exist only on the Windows NT kernel, making a direct port impossible. Mark Russinovich built the Sysinternals suite specifically for Windows internals analysis, and that scope has not changed since the tools joined Microsoft in 2006.

• macOS alternative: Use Activity Monitor (built-in) for basic memory stats, or vm_stat and memory_pressure in Terminal for detailed breakdowns
• Linux alternative: Use /proc/meminfo, free -h, vmstat, or smem for per-process physical memory reporting
• Cross-platform option: Process Hacker (Windows) or htop (Linux/macOS) for general memory monitoring

Pro tip: If you need RAMMap on a Mac, you can run it inside a Windows virtual machine using Parallels Desktop, VMware Fusion, or UTM. The VM’s memory will be analyzed rather than the host Mac’s memory, but this still works for testing and learning.

For Windows users, head to our download section to get RAMMap v1.62.

RAMMap has minimal system requirements: any Windows PC from Vista onward with at least 512 MB of RAM can run it. The tool itself uses very little memory and disk space.

The RAMMap ZIP download is 706 KB, and the extracted executables total under 2 MB. When running, RAMMap typically uses 15-40 MB of RAM depending on how much physical memory your system has and which tabs you have open. The Physical Pages tab on a 32 GB system can push usage higher (around 80-100 MB) because it maps every individual page. CPU usage stays near zero except during refresh operations.

• OS: Windows Vista, 7, 8, 8.1, 10, or 11 (any edition). Windows Server 2008 and later.
• CPU: Any x86 or x64 processor. ARM through emulation on Windows 11.
• RAM: No practical minimum beyond what Windows itself requires (512 MB+)
• Disk: Under 2 MB for the extracted files. No installation writes to disk.
• Permissions: Administrator rights required for full memory analysis

Pro tip: If you are analyzing a server with 128 GB or more RAM, avoid opening the Physical Pages tab unless you have a specific reason. It enumerates every single physical page, which can take 30-60 seconds and temporarily spike RAMMap’s own memory use to 500+ MB.

View the full requirements table on our system requirements page.

Yes, RAMMap is 100% free. There is no paid version, no premium tier, no trial period, and no feature restrictions. You get the full tool at zero cost.

RAMMap is part of the Sysinternals suite, which Microsoft has offered for free since acquiring the tools from Winternals Software in 2006. The suite includes over 70 utilities (Process Explorer, Process Monitor, Autoruns, and others), all distributed at no charge. RAMMap is licensed under the Microsoft Sysinternals Software License Terms, which permit free use for personal, educational, and commercial purposes. There is no registration, no account creation, and no telemetry reporting.

• Free for personal, business, and enterprise use
• No ads, no bundled software, no upsell prompts
• No sign-up or Microsoft account required
• Redistributable within the terms of the Sysinternals license (you can share the ZIP freely)

Pro tip: IT administrators who need multiple Sysinternals tools can download the entire suite as a single ZIP (about 45 MB) from the Sysinternals download page, rather than grabbing each utility individually.

Grab your free copy from our download section.

Yes, RAMMap is licensed for corporate and enterprise use at no cost. The Sysinternals license allows deployment across business workstations and servers without purchasing separate licenses.

Many IT departments and system administrators rely on Sysinternals tools as standard diagnostic utilities. RAMMap is particularly useful on production servers where you need to understand physical memory allocation without installing monitoring agents. Since it is portable (no installation), it does not conflict with change management policies that restrict software installations on managed endpoints. Microsoft’s own support engineers use Sysinternals tools during escalated support cases.

• Deploy to any number of machines without per-seat licensing
• Portable format means no registry changes, no services installed, no Group Policy conflicts
• Can be placed on a network share and run directly from there
• Compatible with application whitelisting tools like AppLocker and WDAC when properly configured

Pro tip: Place RAMMap on a shared network drive at \servertoolssysinternals or use the Sysinternals Live path (\live.sysinternals.comtools) to always access the latest version without manual updates across your fleet.

Learn more about RAMMap’s capabilities in our features overview.

RAMMap requires no installation. You download a ZIP file, extract it, and run the executable directly. The entire process takes under a minute.

Because RAMMap is a portable application, it does not write to your registry, create Start Menu shortcuts, or add background services. You can run it from any folder, including a USB drive or a network share. The ZIP file is 706 KB and extracts to under 2 MB. Both 32-bit (RAMMap.exe) and 64-bit (RAMMap64.exe) versions are included in the same archive.

1. Download RAMMap.zip from our download section or the official Microsoft Sysinternals page
2. Right-click the ZIP file and select “Extract All” (or use 7-Zip, WinRAR, etc.)
3. Open the extracted folder and find RAMMap64.exe (for 64-bit Windows, which covers most modern PCs)
4. Right-click RAMMap64.exe, select “Run as administrator” — this is required for full memory data
5. Accept the Sysinternals license agreement on first launch (one-time prompt)
6. RAMMap opens showing the Use Counts tab with your current physical memory breakdown

Pro tip: Pin the extracted folder to Quick Access in File Explorer or create a desktop shortcut to RAMMap64.exe. To always run as admin, right-click the shortcut, go to Properties > Advanced, and check “Run as administrator.”

For more detailed guidance, visit our Getting Started section.

RAMMap is fully portable. There is no installer, no setup wizard, and no installation process. You extract the ZIP and run the EXE directly.

This makes RAMMap ideal for USB toolkit drives, network diagnostic shares, and locked-down corporate machines where software installation is restricted. It writes nothing to the Windows registry, creates no folders in Program Files or AppData, and leaves no trace on the system after you close it. The only file RAMMap creates is an optional memory snapshot (.rmm file) if you save one through File > Save.

• The ZIP contains RAMMap.exe (32-bit, ~380 KB) and RAMMap64.exe (64-bit, ~530 KB)
• Run from any location: desktop, Downloads folder, USB drive, network share
• No system modifications — no services, no drivers, no scheduled tasks
• Delete the folder to “uninstall” — nothing else to clean up

Pro tip: System administrators can host RAMMap on a network share or use Microsoft’s Sysinternals Live service (\live.sysinternals.comtoolsRAMMap64.exe) to run it without even downloading a file. Just type that UNC path into File Explorer’s address bar.

Download the portable ZIP from our download section.

This is normal behavior, not a crash. After you select Empty > Empty Standby List, RAMMap needs to re-scan the entire physical memory state, which can take 30-60 seconds on systems with 16 GB or more RAM. During this re-scan, Windows may show the “Not Responding” label in the title bar.

When you empty the standby list, Windows moves all cached pages from the Standby list to the Free list. RAMMap then has to enumerate every physical page frame again to update its display. On a 32 GB machine, that means scanning millions of page entries. The tool has not frozen — it is processing. The “Not Responding” text appears because Windows marks any application that stops processing window messages for more than 5 seconds as unresponsive.

• Wait 30-60 seconds — RAMMap will come back and show the updated memory state
• Alternatively, close RAMMap immediately after using the Empty menu, then reopen it for a fresh view
• On servers with 64 GB+ RAM, the re-scan can take up to 2 minutes. Be patient.
• Do not click inside the RAMMap window during the scan — this can trigger additional “Not Responding” prompts from Windows

Pro tip: If you regularly need to clear the standby list without the GUI delay, use the command-line EmptyStandbyList.exe tool (a separate Sysinternals-community utility) or run RAMMap64.exe -Et to empty and close in one step.

For more on the Empty menu options, check our features overview.

That is exactly how Windows memory management works. The standby list refilling is not a bug — it is the operating system using free RAM productively by caching recently accessed file data for faster retrieval.

Windows treats unused physical memory as wasted memory. When you read files, launch programs, or browse the web, the OS keeps that data in the standby list so it can serve it again quickly without reading from the slower SSD or hard drive. If an application needs more RAM, Windows instantly discards standby pages to free space. The system is designed to keep the standby list as full as possible. Emptying it with RAMMap forces the OS to reload everything from disk the next time you access those files, which actually slows things down temporarily.

• High standby memory (even 70-80% of total RAM) is normal and healthy on an idle Windows system
• Windows automatically releases standby pages when applications request more memory
• Clearing the standby list repeatedly hurts performance by forcing more disk reads
• The only time manual clearing helps is when a specific driver or app bug prevents Windows from reclaiming standby pages under pressure (rare, usually fixed by driver updates)

Pro tip: Instead of emptying the standby list, use RAMMap’s Processes tab to identify which process is actually consuming the most active (committed) memory. That is usually the real culprit behind sluggishness, not standby cache.

Learn how to read the Use Counts tab properly in our Getting Started guide.

A blank or white RAMMap window usually means the EXE is blocked by Windows security or your antivirus. The fix takes about 30 seconds.

When you download files from the internet, Windows adds an “Alternate Data Stream” (ADS) mark-of-the-web flag that can cause applications to run in a restricted mode. Some antivirus programs (especially Kaspersky, Bitdefender, and Avast) may also sandbox or block Sysinternals tools because they access low-level kernel memory data. Additionally, running RAMMap without administrator privileges will result in missing data or a stalled interface.

1. Right-click the RAMMap64.exe file, select Properties, and check “Unblock” on the General tab. Click Apply.
2. Right-click RAMMap64.exe again and select “Run as administrator” — the tool needs elevated privileges
3. If your antivirus blocks it, add an exclusion for the RAMMap folder in your AV settings
4. Try downloading a fresh copy directly from Microsoft’s Sysinternals page — older versions may have bugs on newer Windows builds
5. On Windows 11, make sure you are running RAMMap64.exe (not the 32-bit RAMMap.exe)

Pro tip: If none of these work, try running RAMMap from an elevated Command Prompt: open cmd as admin, navigate to the RAMMap folder, and type RAMMap64.exe. Any error messages will appear in the console window, making the issue easier to diagnose.

For download and extraction steps, see our Getting Started section.

RAMMap does not have an auto-update feature. To update, download the latest ZIP from the official Sysinternals page and replace your existing files. The current version is 1.62, released on February 4, 2026.

Because RAMMap is portable, updating is straightforward: download the new ZIP, extract it to the same folder (overwriting the old files), and you are done. There are no settings to migrate, no profiles to back up, and no databases to convert. Your saved .rmm snapshot files remain compatible across versions. Sysinternals tools do not follow a regular release schedule; updates happen when Microsoft addresses bugs or adds features, which can be months or years apart.

1. Check the current version by opening RAMMap and clicking Help > About
2. Visit the download section or the Microsoft Sysinternals page to see the latest version number
3. Download the new RAMMap.zip if a newer version is available
4. Extract and overwrite the files in your existing RAMMap folder
5. Delete any old shortcuts and create new ones if needed

Pro tip: Subscribe to the Sysinternals Blog RSS feed or follow @MarkRussinovich on Twitter/X for update announcements. You can also use the Sysinternals Live path (\live.sysinternals.comtools) which always serves the latest version automatically.

Get the latest version from our download page.

RAMMap v1.62 (released February 4, 2026) includes bug fixes, improved compatibility with recent Windows 11 builds, and refinements to how memory categories are reported in the Use Counts tab.

Microsoft does not publish detailed changelogs for individual Sysinternals tools the way most commercial software does. Updates typically address compatibility with new Windows kernel changes, fix display bugs in memory reporting, and improve stability on systems with very large amounts of RAM (64 GB+). Previous notable updates include v1.61 which fixed memory category reporting on Windows Server 2022, and v1.60 which added improved support for large page sizes.

• Check the version number through Help > About inside RAMMap
• The Sysinternals Blog at techcommunity.microsoft.com occasionally announces major updates
• Older versions remain functional on their supported OS versions but may misreport certain memory categories on newer Windows builds

Pro tip: If you work in IT and need to audit which RAMMap version your team is running, the EXE file properties (right-click > Properties > Details tab) show the exact version number, which you can query remotely via PowerShell: Get-Item \servertoolsRAMMap64.exe | Select VersionInfo.

Download the latest v1.62 from our download section.

RAMMap and Resource Monitor serve different purposes. Resource Monitor shows real-time per-process memory usage, while RAMMap shows how Windows allocates physical memory at the hardware level. Use both together for a complete picture.

Resource Monitor (built into Windows since Vista, accessible via resmon.exe) excels at showing you which process is using how much committed, working set, shareable, and private memory in real time. It also monitors CPU, disk, and network per-process. RAMMap goes deeper: it shows physical page-level allocation broken down by type (Active, Standby, Modified, Zeroed, Free), which no other built-in Windows tool reveals. This distinction matters when diagnosing standby list issues, metafile bloat, driver-locked memory, or non-paged pool growth.

• Use Resource Monitor when: You need to find which process is consuming the most RAM right now, or track real-time memory changes
• Use RAMMap when: Task Manager shows high memory usage but processes do not add up, or you need to investigate standby cache, metafile, or kernel pool usage
• Use both when: Troubleshooting a suspected memory leak — Resource Monitor identifies the process, RAMMap shows where the physical pages went

Pro tip: A frequent scenario: Task Manager reports 90% RAM usage but process totals only reach 60%. Open RAMMap and check the Metafile and Mapped File rows in Use Counts — file server workloads, antivirus, and Windows Search often fill these categories invisibly.

See what makes RAMMap unique in our features section.

Process Explorer focuses on processes and their resource usage, while RAMMap focuses on physical memory allocation system-wide. They are complementary tools from the same Sysinternals suite, not replacements for each other.

Process Explorer (also by Mark Russinovich) is an advanced Task Manager replacement that shows process trees, DLL loading, handle lists, GPU usage, and per-process memory details including private bytes, working set, and virtual size. It answers “what is this process doing?” RAMMap answers “where did all my physical RAM go?” by categorizing every page of physical memory into types like Process Private, Mapped File, Metafile, Paged Pool, Nonpaged Pool, Driver Locked, and more. You cannot get this system-wide physical memory breakdown from Process Explorer.

• Process Explorer strengths: Process tree view, DLL inspection, handle search, VirusTotal integration, real-time GPU/CPU/disk per process
• RAMMap strengths: Physical page-level analysis, standby list management, file-to-RAM mapping, priority summary, snapshot comparison
• Overlap: Both show per-process working set sizes, but RAMMap adds the physical memory context that Process Explorer lacks

Pro tip: For a thorough memory investigation, run Process Explorer to identify the suspicious process, then switch to RAMMap’s File Summary tab to see which files that process has cached in physical memory. This two-tool workflow is what Microsoft’s own support engineers recommend in escalation guides.

Explore RAMMap’s unique analysis capabilities on our features page.

RAMMap’s Empty menu has five options, each targeting a different memory list. They let you manually flush cached or buffered memory for testing and troubleshooting. Most users only need “Empty Standby List” and should leave the others alone.

These options interact directly with the Windows Memory Manager. They are designed for diagnostics, not daily maintenance. Using them aggressively or on a schedule can hurt performance because Windows has to rebuild cache from scratch. Here is what each one does:

• Empty Working Sets: Trims the active working set of every running process, pushing pages to the Standby or Modified lists. Applications will briefly slow down as they fault pages back in. Useful for testing cold-start behavior.
• Empty System Working Set: Trims the system cache working set only. Rarely needed. Affects file system cache performance.
• Empty Modified Page List: Forces all dirty (modified) pages to be written to the pagefile or their backing files on disk, then moves them to Standby. Can cause a brief I/O spike on busy systems.
• Empty Standby List: Clears all standby (cached) pages, moving them to the Free list. The most commonly used option. Temporarily frees RAM but destroys useful cache.
• Empty Priority 0 Standby List: Clears only the lowest-priority standby pages, preserving higher-priority cache. A gentler alternative to nuking the entire standby list.

Pro tip: Try “Empty Priority 0 Standby List” first instead of clearing everything. It removes the least useful cached data while keeping frequently accessed files in memory. This is often enough to resolve stuttering in games without the disk I/O penalty of a full standby flush.

For a walkthrough of each tab and menu, see our Getting Started guide.

RAMMap can save your current physical memory state to a .rmm snapshot file through File > Save. You can later open that file to review historical memory data or compare it side-by-side with a live scan.

Snapshots capture everything RAMMap displays: Use Counts totals, per-process working sets, file summary data, priority distributions, and physical page maps. The snapshot file size depends on your total RAM — expect roughly 5-15 MB for a 16 GB system and 20-40 MB for a 64 GB system. Snapshots are useful when you suspect a memory leak that builds over hours or days: take a snapshot when the system is healthy, take another when it starts misbehaving, and compare the two.

1. Click File > Save to create a snapshot of the current memory state
2. Choose a filename with a timestamp (e.g., rammap-2026-03-08-baseline.rmm) for easy identification
3. When you want to compare, open the old snapshot via File > Open, then launch a second RAMMap instance showing live data
4. Place both windows side by side and compare Use Counts, Processes, or File Summary tabs
5. Look for significant growth in Process Private, Metafile, Driver Locked, or Nonpaged Pool between snapshots

Pro tip: Set up a Task Scheduler job that runs RAMMap64.exe -Ss snapshot_%date%.rmm every few hours on production servers. This gives you a timeline of memory states to review when troubleshooting intermittent memory pressure issues after the fact.

Learn more about RAMMap’s analysis capabilities in our features section.