d3dcompiler_47.dll: genuine Microsoft shader compiler, or a copy planted beside a trusted program?

What d3dcompiler_47.dll does, and why so many copies exist

Graphics code that runs on the video card is written as small programs called shaders, in Microsoft's HLSL language. d3dcompiler_47.dll turns that source into bytecode for Direct3D. Windows 10 and Windows 11 include it as a system file and update it with their cumulative updates. Chromium-based browsers use it to draw web pages on the graphics card, Qt and Electron apps use it for their interfaces, and games use it to build or inspect shaders while they run.

Microsoft also gives developers a redistributable copy in the Windows 10 SDK, under Windows Kits\10\Redist\D3D, so that a program can carry the exact compiler it was tested with. That is why one PC can hold dozens of genuine copies: Edge and Chrome keep one in every versioned application folder, and video call, chat and developer tools keep one beside their .exe. Each copy belongs to its program, is signed by Microsoft and is updated by that program's installer, not by Windows.

The same search order makes the name useful to attackers. HijackLibs, a public list of DLLs that Windows programs can be tricked into loading, records d3dcompiler_47.dll as a side-loading target of dwm.exe, the Desktop Window Manager. Copied out of System32 into a folder an attacker controls, the signed dwm.exe loads a d3dcompiler_47.dll that sits next to it, and whatever code that file holds runs inside a trusted Microsoft process. We found no published malware report that names this file, so this is a known possibility rather than a documented campaign.

So the useful question is not whether d3dcompiler_47.dll is dangerous, but which copy you are looking at and which program sits beside it.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a genuine d3dcompiler_47.dll from a planted one

A DLL has no entry in Task Manager, so judge each copy by where it is, who signed it, what it matches and which program loads it.

1. List every copy and its folder. Run this in PowerShell. System32, SysWOW64, WinSxS and the folders of programs you installed are expected. A copy in AppData\Roaming, AppData\Local\Temp, ProgramData, Downloads or the Public folder, beside an .exe you do not recognise, is the one to check.

   Get-ChildItem C:\ -Recurse -Filter d3dcompiler_47.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Version';e={$_.VersionInfo.FileVersion}}

2. Look at the program next to it. A genuine copy sits beside the program that uses it: msedge.exe, chrome.exe, Code.exe, Zoom.exe, a game. A copy next to dwm.exe, or next to any other Windows program outside C:\Windows, is a warning sign on its own: Windows never runs its programs from user folders, and copying them out is how side-loading starts.
3. Check the digital signature. Windows' copy is signed through a catalog, the copies in program folders usually inside the file. PowerShell reads both. Valid with a Microsoft signer means Microsoft published the file. NotSigned, another signer or HashMismatch means it is not the compiler Microsoft built, whatever its description says.

   Get-AuthenticodeSignature 'C:\path\to\d3dcompiler_47.dll' | Format-List Status, SignatureType, SignerCertificate

4. Compare the hash with Microsoft's builds. The checker on this page computes the SHA-256 in your browser and compares it with the 431 Windows builds Winbindex knows. A Windows-folder copy should match. A program-folder copy may not, because programs often ship the SDK build rather than a Windows one, and then the signature decides.
5. See which process loaded it. In Process Explorer from Microsoft Sysinternals choose Find, Find Handle or DLL and type d3dcompiler_47.dll. The results show each process and the path of the copy it loaded. A browser or game loading its own copy is expected; dwm.exe loading anything but C:\Windows\System32\d3dcompiler_47.dll, or any process loading a copy from a user folder, is not.
6. Scan before you delete. Run a Microsoft Defender full scan, then the offline scan if something keeps coming back. A full scan also examines the program that loads the DLL and its startup entries, which deleting the DLL by hand leaves in place.

A valid Microsoft signature proves the DLL is Microsoft's, not that the folder or the program next to it is legitimate. A copied dwm.exe is signed too. Judge the pair: a genuine program in its own install folder with a signed compiler beside it is normal; a Windows program in a user folder is not, whatever DLL sits next to it.

Warning signs and what they mean

Programs that have been made to load a fake d3dcompiler_47.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted d3dcompiler_47.dll. Usually the attacker copies the program into another folder and puts a fake d3dcompiler_47.dll next to it: Windows looks in the program's own folder first. A d3dcompiler_47.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine d3dcompiler_47.dll belongs: C:\Program Files\windows kits\10\bin\<version>\x64C:\Program Files\windows kits\10\bin\<version>\x86C:\Program Files\windows kits\10\redist\d3d\x64C:\Program Files\windows kits\10\redist\d3d\x86C:\Program Files\wiresharkC:\Program Files\LogiOptionsPlusC:\Program Files\cisco systems\cisco jabberC:\Program Files\microsoft\edge\application\<version>C:\Program Files\microsoft\edgewebview\application\<version>C:\Program Files\microsoft\edgecore\application\<version>C:\Program Files\Google\Chrome\Application\<version>C:\Program Files\Island\Island\Application\<version>C:\Program Files\Zoom\binC:\Users\<you>\AppData\Roaming\Zoom\binC:\Users\<you>\AppData\Local\microsoft\teams\stageC:\Users\<you>\AppData\Local\Programs\Microsoft VS CodeC:\Windows\System32C:\Windows\SysWOW64

The genuine d3dcompiler_47.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

Source: the HijackLibs entry for d3dcompiler_47.dll, 1 public report.

Everyday problems with d3dcompiler_47.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

d3dcompiler_47.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 431 Microsoft builds in total are known.

Known versions of d3dcompiler_47.dll

A public DLL catalogue lists 60 versions of d3dcompiler_47.dll, from 6.3.9600.16384 to 10.0.18362.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix d3dcompiler_47.dll errors on uGetFix

Questions people ask