How to remove runtimebroker.exe

runtimebroker.exe

The module runtimebroker.exe has been detected as Ransom.NSSM

runtimebroker.exe
Remove runtimebroker.exe

File Details

Product Name:

NSSM 32-bit
MD5: ac27de51896a5ba2fd0dda9b7955a201
Size: 383 KB
First Published: 2022-06-10 23:20:06 (3 years ago)
Latest Published: 2025-10-15 23:00:26 (2 months ago)
Status: Ransom.NSSM (on last analysis)
Analysis Date: 2025-10-15 23:00:26 (2 months ago)

Common Places:

%commonappdata%
%system%
%system%
%temp%
%system%
%system%
%system%
%system%
%system%
%system%

Geography:

69.2%
30.8%

OS Version:

Windows 10 100.0%

Analysis

Subsystem: Windows CUI
PE Type: pe
OS Bitness: 32
Image Base: 0x00400000
Entry Address: 0x00013e53

PE Sections:

Name Size of data MD5
.text 114176 b92c191c9f939ce4c12bf8e55319e935
.rdata 18944 422dd3b00b1f4d6105cee02d8e945595
.data 5120 4492984c066180a50b40cbb63640632f
.rsrc 253440 4d49b345cafa44ed90d67e74a2d09a56

More information:

Search on Virustotal
Download GridinSoft Anti-Malware - Removal tool for runtimebroker.exe
copyright for information about runtimebroker.exe