Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	19.59%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.29%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.58%
6.2.9200.16384 (win8_rtm.120725-1247)	9.94%
6.2.9200.16384 (win8_rtm.120725-1247)	68.42%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.58%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.58%

Relationships

Parent process

svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Related files

PE file structure

Show functions

Import table

api-ms-win-core-com-l1-1-0.dll

CoFreeUnusedLibrariesEx, CoInitializeEx, CoInitializeSecurity, CoReleaseServerProcess, CoAddRefServerProcess, CoTaskMemFree, CoUninitialize, CoCreateInstance, CoRegisterClassObject, CoImpersonateClient, CoRevokeClassObject, CoTaskMemAlloc, CoRevertToSelf

api-ms-win-core-com-l1-1-1.dll

CoFreeUnusedLibrariesEx, CoRevertToSelf, CoReleaseServerProcess, CoTaskMemFree, CoIncrementMTAUsage, CoImpersonateClient, CoUninitialize, CoInitializeSecurity, CoTaskMemAlloc, CoInitializeEx, CoCreateInstance, CoDecrementMTAUsage, CoRevokeClassObject, CoAddRefServerProcess, CoRegisterClassObject

api-ms-win-core-errorhandling-l1-1-1.dll

UnhandledExceptionFilter, SetErrorMode, GetLastError, SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0.dll

CloseHandle

api-ms-win-core-heap-l1-2-0.dll

HeapFree, HeapAlloc, GetProcessHeap, HeapSetInformation

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalFree

api-ms-win-core-interlocked-l1-2-0.dll

InterlockedCompareExchange, InterlockedDecrement, InterlockedExchange, InterlockedIncrement

api-ms-win-core-libraryloader-l1-1-1.dll

FreeLibrary, GetModuleHandleA, LoadLibraryExW, GetProcAddress

api-ms-win-core-libraryloader-l1-2-0.dll

GetModuleHandleA, GetProcAddress, FreeLibrary, LoadLibraryExW

api-ms-win-core-processthreads-l1-1-1.dll

SetProcessMitigationPolicy, SetProcessShutdownParameters, GetProcessMitigationPolicy, OpenProcessToken, GetCurrentThread, GetCurrentProcess, OpenThreadToken, GetStartupInfoW, GetCurrentProcessId, GetCurrentThreadId, SetThreadToken, TerminateProcess

api-ms-win-core-processthreads-l1-1-2.dll

GetCurrentProcessId, GetStartupInfoW, GetProcessMitigationPolicy, TerminateProcess, GetCurrentThread, SetProcessMitigationPolicy, GetCurrentThreadId, SetProcessShutdownParameters, SetThreadToken, GetCurrentProcess, OpenThreadToken, OpenProcessToken

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0.dll

RegQueryValueExW, RegOpenKeyExW, RegCloseKey

api-ms-win-core-synch-l1-2-0.dll

CreateEventW, Sleep, WaitForSingleObject

api-ms-win-core-sysinfo-l1-2-0.dll

GetSystemTimeAsFileTime, GetTickCount

api-ms-win-core-sysinfo-l1-2-1.dll

GetTickCount, GetSystemTimeAsFileTime

api-ms-win-core-winrt-error-l1-1-0.dll

RoGetErrorReportingFlags, RoSetErrorReportingFlags

api-ms-win-core-winrt-error-l1-1-1.dll

RoOriginateError, RoSetErrorReportingFlags, RoGetErrorReportingFlags, RoOriginateErrorW

api-ms-win-core-winrt-l1-1-0.dll

RoGetActivationFactory, RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0.dll

WindowsCreateString, WindowsDeleteString

api-ms-win-security-base-l1-2-0.dll

AccessCheck, MapGenericMask, GetLengthSid, CopySid, GetKernelObjectSecurity, PrivilegeCheck, GetTokenInformation

api-ms-win-security-sddl-l1-1-0.dll

ConvertSidToStringSidW

msvcrt.dll

DllMain

ntdll.dll

NtQueryValueKey, NtClose, RtlNtStatusToDosError, RtlEqualUnicodeString, NtOpenKey, NtQueryKey, RtlInitUnicodeString

RuntimeBroker.exe

Runtime Broker by Microsoft Corporation (Signed)

Remove RuntimeBroker.exe

Version:	6.3.9600.16384 (winblue_rtm.130821-1623)
MD5:	8998a4837a47f16f27000c0a61efc90d
SHA1:	c81964ee406584fa6c7804709a073aaec95d3223

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is RuntimeBroker.exe?

Windows Runtime Broker, part of Windows 8 is a separate process that handles the security permission of separated processes like sensors or cameras. Access to Windows APIs is monitored at runtime by the Runtime Broker, which prevents programs from violating core security of Windows.

About RuntimeBroker.exe (from Microsoft Corporation)

“Windows Runtime, or WinRT, is a cross-platform application architecture on the Windows 8 operating system. WinRT supports development in C++/CX (Component Extensions, a language based on C++) and the ”

Details

File name:	runtimebroker.exe
Publisher:	Microsoft Corporation
Product name:	Runtime Broker
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\runtimebroker.exe
File version:	6.3.9600.16384 (winblue_rtm.130821-1623)
Product version:	6.3.9600.16384
Size:	29.22 KB (29,920 bytes)
Build date:	8/22/2013 4:47 AM
Certificate
Issued to:	Microsoft Corporation
Authority (CA):	Microsoft Corporation
Expiration date:	Tuesday, July 9, 2013
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00722626%	0.028634%
Kernel CPU:	0.00308508%	0.013761%
User CPU:	0.00414118%	0.014873%
Kernel CPU time:	594 ms/min	100,923,805ms/min
CPU cycles:	98,877/sec	17,470,203/sec
Memory
Private memory:	4.95 MB	21.59 MB
Private (maximum):	11.67 MB
Private (minimum):	300 KB
Non-paged memory:	4.95 MB	21.59 MB
Virtual memory:	80.26 MB	140.96 MB
Virtual memory (peak):	105.97 MB	169.69 MB
Working set:	2.41 MB	18.61 MB
Working set (peak):	12.86 MB	37.95 MB
Page faults:	25,187/min	2,039/min
I/O
I/O read transfer:	18 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	535 Bytes/sec	448.09 KB/min
I/O other operations:	5/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	185	600
GUI GDI count:	9	103
GUI GDI peak:	9	142
GUI USER count:	4	49
GUI USER peak:	9	71

Process properties

Integrety level:	Medium
Platform:	32-bit
Command line:	C:\Windows\System32\runtimebroker.exe -embedding
Owner:	User
Parent process:	svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Threads

Averages

combase.dll
Total CPU:	0.00178349%	0.272967%
Kernel CPU:	0.00064854%	0.107585%
User CPU:	0.00113495%	0.165382%
CPU cycles:	51,809/sec	5,741,424/sec
Memory:	1.3 MB	1.16 MB
RuntimeBroker.exe (main module)
Total CPU:	0.00032386%
Kernel CPU:	0.00016193%
User CPU:	0.00016193%
CPU cycles:	9,081/sec
Memory:	36 KB
MsSpellCheckingFacility.dll
Total CPU:	0.00018688%
Kernel CPU:	0.00018688%
User CPU:	0.00000000%
CPU cycles:	3,670/sec
Memory:	632 KB

Distribution by Windows OS

OS version	distribution
Windows 8	30.00%
Windows 8 Pro	20.00%
Windows 8.1	18.50%
Windows 8.1 Pro	9.00%
Windows 8 Pro with Media Center	7.00%
Windows 8 Single Language	6.00%
Windows 8.1 Pro with Media Center	2.50%
Windows 8.1 Single Language	2.50%
Windows 8 Enterprise	1.00%
Windows 8 Enterprise N	0.50%
Windows 8.1 Enterprise Evaluation	0.50%
Windows 8.1 Enterprise	0.50%
Windows 8 Enterprise Evaluation	0.50%
Windows 8.1 Pro Preview	0.50%
Windows 8.1 Pro Preview with Media Center	0.50%
Windows 8 Pro N	0.50%

Distribution by country

United States installs about 45.69% of Runtime Broker.

Distribution by PC manufacturer

PC Manufacturer	distribution
Hewlett-Packard	19.84%
ASUS	15.56%
Toshiba	15.56%
Acer	12.06%
Dell	10.89%
Lenovo	10.89%
Sony	7.78%
Intel	3.11%
Samsung	1.17%
Alienware	0.78%
Medion	0.78%
GIGABYTE	0.78%
American Megatrends	0.39%
Packard Bell	0.39%

Remove Adware and Spyware Programs, FREE Download!