Gridinsoft Logo

The RuntimeBroker.exe (Runtime Broker) File Analysis

Updated 2 months ago
Checked by Malaware Check
RuntimeBroker.exe

Technical Analysis

File Name RuntimeBroker.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.210.174
Database Version 2025-03-12 23:00:44 UTC
✓

Clean File

No threats detected by our scanner

0%
Detection Rate
102,832
File Size (bytes)
2025-03-12
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
864daf03da104a8aa3ba7c2ed5ffddbc
SHA1
0811c39fd76395ed47646310bf5ecf57a0ac8ce4
SHA256
579dfced8f02a7e1e6e8df10c400117d3127ead7231776a1e467eb507261e920
SHA512
2c96d780e809c5153e0239dd0d3e4f34a6195b4ae8b651a3299c5a2cff5db779fba4c9d54044444a375e36686d8e86f2d8ac5438b534bbe103dbc4384adf7cc2
ImpHash
d4d98acf3243e0c97c83c6548571a44e

PE Analysis

Basic Information

▼
Image Base 0x140000000
Entry Point 0x140005e10
Compilation Time 2026-12-25 00:32:47
Checksum 0x000225c1 (Actual: 0x000225c1)
OS Version 10.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path RuntimeBroker.pdb
Digital Signature OK
Imports 36 libraries
Exports 0 functions
Resources 2 Resources
Sections 7 Sections

Version Information

▼
CompanyName Microsoft Corporation
FileDescription Runtime Broker
FileVersion 10.0.19041.4355 (WinBuild.160101.0800)
InternalName RuntimeBroker.exe
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename RuntimeBroker.exe
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.19041.4355
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 59,229 bytes 59,392 bytes 6.13 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ DB8D480A3344AC6953CEF18A1D64AFE5
.imrsiv 0x00010000 4 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rdata 0x00011000 22,910 bytes 23,040 bytes 5.04 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 0FA260A97D9B497E4CA205DD17C2F646
.data 0x00017000 3,256 bytes 512 bytes 1.01 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE C44A01605DC1A307054DB0E92AEEC2DD
.pdata 0x00018000 5,076 bytes 5,120 bytes 4.95 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 140D4DD1279D1B87C8D59AB149D942FE
.rsrc 0x0001a000 2,392 bytes 2,560 bytes 4.56 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F9ADBAD9BAC51281F82E113A1E7C13DC
.reloc 0x0001b000 344 bytes 512 bytes 4.03 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0A449CEC708320CE6EF29E182BAFFA42

Resource Analysis

▼
Total Resources: 2 (2,223 bytes)
Resource Type Count Total Size Percentage
RT_VERSION 1 932 bytes
41.9%
RT_MANIFEST 1 1,291 bytes
58.1%

Certificate Chain Analysis

▼
Certificate Information
Product Microsoft® Windows® Operating System
Description Runtime Broker
File Version 10.0.19041.4355 (WinBuild.160101.0800)
Original Name RuntimeBroker.exe
Signing Date 03:45 AM 04/13/2024 (418 days ago)
Verification Status Signed
Signers Microsoft Windows; Microsoft Windows Production PCA 2011; Microsoft Root Certificate Authority 2010
Counter Signers Microsoft Time-Stamp Service; Microsoft Time-Stamp PCA 2010; Microsoft Root Certificate Authority 2010
Internal Name RuntimeBroker.exe
Copyright © Microsoft Corporation. All rights reserved.
Certificate Chain Summary
Microsoft Windows #1 Primary
Validity Period: 2023-11-16 19:20:08 → 2024-11-14 19:20:08
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 04 5F F3 C9 6C 1A 7F F7 DA 1D 00 00 00 00 04 5F
Microsoft Windows Production PCA 2011 #2 Chain
Validity Period: 2011-10-19 18:41:42 → 2026-10-19 18:51:42
Signature Algorithm: sha256RSA
Serial Number: 61 07 76 56 00 00 00 00 00 08
Microsoft Time-Stamp Service #3 Chain
Validity Period: 2023-10-12 19:07:35 → 2025-01-10 19:07:35
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 01 E5 8F 6A C0 F3 3D B4 0B A3 00 01 00 00 01 E5
Microsoft Time-Stamp PCA 2010 #4 Chain
Validity Period: 2021-09-30 18:22:25 → 2030-09-30 18:32:25
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 00 15 C5 E7 6B 9E 02 9B 49 99 00 00 00 00 00 15

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
This file passed all security checks, but stay vigilant. New malware variants appear daily that can evade detection. Always verify files come from official sources and check digital signatures when available.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware