Notepad.exe Is Using 60% CPU and My Mouse Moved on Its Own—Could This Be Malware?

Runtime Broker is a legitimate Windows process, but malware can use the same filename, so its location and digital signature matter. The genuine file is normally located under the Windows system directories. Don’t assume a copy found elsewhere is safe; verify it with Defender or another trusted offline scanner.

The combination of an unfamiliar process repeatedly returning and the pointer moving without your input is suspicious, although it is not proof by itself. Disconnect the laptop from the internet, back up only important personal documents, and scan it from trusted bootable antivirus media. A clean Windows reinstall is the safest option if you cannot establish what caused the behavior.

A bootable toolkit can scan the drive without starting the installed Windows environment, which is useful when malware may be active. However, that process is fairly advanced, so a clean reinstall may be simpler if you have backups and access to another computer.

For a system you no longer trust, I’d skip relying on System Restore because some malware can survive through restore points. After saving your files, create Windows installation media using another trusted computer, erase the system drive, and perform a clean installation. Make sure you have your BitLocker recovery key before doing anything that could lock you out.