Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

6.3.9600.16384 (winblue_rtm.130821-1623) 19.59%
6.3.9600.16384 (winblue_rtm.130821-1623) 0.29%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.58%
6.2.9200.16384 (win8_rtm.120725-1247) 9.94%
6.2.9200.16384 (win8_rtm.120725-1247) 68.42%
6.2.8400.0 (winmain_win8rc.120518-1423) 0.58%
6.2.8400.0 (winmain_win8rc.120518-1423) 0.58%

Relationships

Parent process
Related files

PE structurePE file structure
Show functions
Import table
api-ms-win-core-com-l1-1-0.dll
CoFreeUnusedLibrariesEx, CoInitializeEx, CoInitializeSecurity, CoReleaseServerProcess, CoAddRefServerProcess, CoTaskMemFree, CoUninitialize, CoCreateInstance, CoRegisterClassObject, CoImpersonateClient, CoRevokeClassObject, CoTaskMemAlloc, CoRevertToSelf
api-ms-win-core-com-l1-1-1.dll
CoFreeUnusedLibrariesEx, CoRevertToSelf, CoReleaseServerProcess, CoTaskMemFree, CoIncrementMTAUsage, CoImpersonateClient, CoUninitialize, CoInitializeSecurity, CoTaskMemAlloc, CoInitializeEx, CoCreateInstance, CoDecrementMTAUsage, CoRevokeClassObject, CoAddRefServerProcess, CoRegisterClassObject
api-ms-win-core-errorhandling-l1-1-1.dll
UnhandledExceptionFilter, SetErrorMode, GetLastError, SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0.dll
CloseHandle
api-ms-win-core-heap-l1-2-0.dll
HeapFree, HeapAlloc, GetProcessHeap, HeapSetInformation
api-ms-win-core-heap-obsolete-l1-1-0.dll
LocalFree
api-ms-win-core-interlocked-l1-2-0.dll
InterlockedCompareExchange, InterlockedDecrement, InterlockedExchange, InterlockedIncrement
api-ms-win-core-libraryloader-l1-1-1.dll
FreeLibrary, GetModuleHandleA, LoadLibraryExW, GetProcAddress
api-ms-win-core-libraryloader-l1-2-0.dll
GetModuleHandleA, GetProcAddress, FreeLibrary, LoadLibraryExW
api-ms-win-core-processthreads-l1-1-1.dll
SetProcessMitigationPolicy, SetProcessShutdownParameters, GetProcessMitigationPolicy, OpenProcessToken, GetCurrentThread, GetCurrentProcess, OpenThreadToken, GetStartupInfoW, GetCurrentProcessId, GetCurrentThreadId, SetThreadToken, TerminateProcess
api-ms-win-core-processthreads-l1-1-2.dll
GetCurrentProcessId, GetStartupInfoW, GetProcessMitigationPolicy, TerminateProcess, GetCurrentThread, SetProcessMitigationPolicy, GetCurrentThreadId, SetProcessShutdownParameters, SetThreadToken, GetCurrentProcess, OpenThreadToken, OpenProcessToken
api-ms-win-core-profile-l1-1-0.dll
QueryPerformanceCounter
api-ms-win-core-registry-l1-1-0.dll
RegQueryValueExW, RegOpenKeyExW, RegCloseKey
api-ms-win-core-synch-l1-2-0.dll
CreateEventW, Sleep, WaitForSingleObject
api-ms-win-core-sysinfo-l1-2-0.dll
GetSystemTimeAsFileTime, GetTickCount
api-ms-win-core-sysinfo-l1-2-1.dll
GetTickCount, GetSystemTimeAsFileTime
api-ms-win-core-winrt-error-l1-1-0.dll
RoGetErrorReportingFlags, RoSetErrorReportingFlags
api-ms-win-core-winrt-error-l1-1-1.dll
RoOriginateError, RoSetErrorReportingFlags, RoGetErrorReportingFlags, RoOriginateErrorW
api-ms-win-core-winrt-l1-1-0.dll
RoGetActivationFactory, RoActivateInstance
api-ms-win-core-winrt-string-l1-1-0.dll
WindowsCreateString, WindowsDeleteString
api-ms-win-security-base-l1-2-0.dll
AccessCheck, MapGenericMask, GetLengthSid, CopySid, GetKernelObjectSecurity, PrivilegeCheck, GetTokenInformation
api-ms-win-security-sddl-l1-1-0.dll
ConvertSidToStringSidW
msvcrt.dll
DllMain
ntdll.dll
NtQueryValueKey, NtClose, RtlNtStatusToDosError, RtlEqualUnicodeString, NtOpenKey, NtQueryKey, RtlInitUnicodeString

RuntimeBroker.exe

Runtime Broker by Microsoft Corporation (Signed)

Remove RuntimeBroker.exe
Version:   6.2.8400.0 (winmain_win8rc.120518-1423)
MD5:   cb5810c10ff13891627481049ff705b6
SHA1:   7b199b41bffe10def7b0397ab2e98fedbc06c684
SHA256:   df9a590eca5504d4d62dc44c8540c2a056ca540132188a5cbd67bd27629f6b09
This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is RuntimeBroker.exe?

Windows Runtime Broker, part of Windows 8 is a separate process that handles the security permission of separated processes like sensors or cameras. Access to Windows APIs is monitored at runtime by the Runtime Broker, which prevents programs from violating core security of Windows.

About RuntimeBroker.exe (from Microsoft Corporation)

“Windows Runtime, or WinRT, is a cross-platform application architecture on the Windows 8 operating system. WinRT supports development in C++/CX (Component Extensions, a language based on C++) and the ”

DetailsDetails

File name:runtimebroker.exe
Publisher:Microsoft Corporation
Product name:Runtime Broker
Description:Microsoft® Windows® Operating System
Typical file path:C:\Windows\System32\runtimebroker.exe
File version:6.2.8400.0 (winmain_win8rc.120518-1423)
Product version:6.2.8400.0
Size:33.68 KB (34,488 bytes)
Certificate
Issued to:Microsoft Corporation
Authority (CA):Microsoft Corporation
Expiration date:Tuesday, July 9, 2013
Digital DNA
PE subsystem:Windows GUI
File packed:No
Code language:Microsoft Visual C++
.NET CLR:No
More details

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.00112280%
0.028634%
Kernel CPU:0.00060085%
0.013761%
User CPU:0.00052195%
0.014873%
Kernel CPU time:2,730,041 ms/min
100,923,805ms/min
Memory
Private memory:2.47 MB
21.59 MB
Private (maximum):13.37 MB
Private (minimum):8.96 MB
Non-paged memory:2.47 MB
21.59 MB
Virtual memory:84.7 MB
140.96 MB
Virtual memory (peak):107.52 MB
169.69 MB
Working set:10.65 MB
18.61 MB
Working set (peak):13.53 MB
37.95 MB
Resource allocations
Threads:4
12
Handles:154
600
GUI GDI count:9
103
GUI GDI peak:9
142
GUI USER count:5
49
GUI USER peak:10
71

BehaviorsProcess properties

Integrety level:Medium
Platform:64-bit
Command line:C:\Windows\System32\runtimebroker.exe -embedding
Owner:User
Parent process:svchost.exe (Host Process for Windows Services by Microsoft Corporation)

ResourcesThreads

Averages
 
combase.dll
Total CPU:0.00028361%
0.272967%
Kernel CPU:0.00028361%
0.107585%
User CPU:0.00000000%
0.165382%
CPU cycles:12,556/sec
5,741,424/sec
Memory:1.65 MB
1.16 MB
ntdll.dll
Total CPU:0.00028331%
Kernel CPU:0.00028331%
User CPU:0.00000000%
CPU cycles:7,501/sec
Memory:1.75 MB
RuntimeBroker.exe (main module)
Total CPU:0.00028330%
Kernel CPU:0.00028330%
User CPU:0.00000000%
CPU cycles:8,803/sec
Memory:48 KB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 8 30.00%
Windows 8 Pro 20.00%
Windows 8.1 18.50%
Windows 8.1 Pro 9.00%
Windows 8 Pro with Media Center 7.00%
Windows 8 Single Language 6.00%
Windows 8.1 Pro with Media Center 2.50%
Windows 8.1 Single Language 2.50%
Windows 8 Enterprise 1.00%
Windows 8 Enterprise N 0.50%
Windows 8.1 Enterprise Evaluation 0.50%
Windows 8.1 Enterprise 0.50%
Windows 8 Enterprise Evaluation 0.50%
Windows 8.1 Pro Preview 0.50%
Windows 8.1 Pro Preview with Media Center 0.50%
Windows 8 Pro N 0.50%

Distribution by countryDistribution by country

United States installs about 45.69% of Runtime Broker.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Hewlett-Packard 19.84%
ASUS 15.56%
Toshiba 15.56%
Acer 12.06%
Dell 10.89%
Lenovo 10.89%
Sony 7.78%
Intel 3.11%
Samsung 1.17%
Alienware 0.78%
Medion 0.78%
GIGABYTE 0.78%
American Megatrends 0.39%
Packard Bell 0.39%
Back to top
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE