msvcp110.dll: the Microsoft C++ library, or a hidden copy that malware dropped?

What msvcp110.dll does

msvcp110.dll contains the C++ Standard Library of Visual Studio 2012: strings, containers, streams, threads and exceptions. A C++ program built with that compiler loads it at start instead of carrying the code itself. The 110 is toolset version 11.0. The file in turn loads msvcr110.dll, the C runtime from the same package.

Windows does not install it for programs to use. The Visual C++ 2012 Redistributable puts it into System32 and SysWOW64, and its last release is Update 4. Microsoft lists Visual C++ 2012 as no longer supported but still links those installers. Because the runtime is old and widely needed, its file name looks familiar to most users, and that familiarity is what the 2025 campaign relied on.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of msvcp110.dll

Four facts decide it: the folder, whether the file is hidden, who signed it and which program loads it. A DLL is not listed in Task Manager by its own name, so use these checks instead.

1. List every copy, hidden ones included. Run this in PowerShell. -Force makes it show hidden files too, and the Attributes column tells you which ones are hidden. Copies in Windows, Program Files and game folders are normal. A hidden copy, or one sitting directly in AppData\Roaming, needs the next checks.

   Get-ChildItem -Path C:\ -Filter msvcp110.dll -Recurse -Force -ErrorAction SilentlyContinue | Select-Object FullName, Length, Attributes, LastWriteTime

2. Look at AppData\Roaming itself. The genuine runtime is never installed loose into the root of your Roaming folder. In the 2025 case that is exactly where the malicious copy was written. If this command returns a file, treat it as suspicious until the signature check says otherwise.

   Get-Item -Force "$env:APPDATA\msvcp110.dll" -ErrorAction SilentlyContinue | Format-List FullName, Length, Attributes, CreationTime

3. Check the signature. Status must be Valid and the signer Microsoft Corporation. NotSigned, HashMismatch or any other signer means it is not Microsoft's file, whatever its name and version field say.

   Get-AuthenticodeSignature "C:\path\to\msvcp110.dll" | Format-List Status, SignerCertificate

4. See which program loads it. In Process Explorer (Microsoft Sysinternals) open Find, Find Handle or DLL, and type msvcp110.dll. Each result shows the process and the exact copy it loaded. A program you do not recognise, such as a Launch.exe from a download, loading a copy from AppData is the reported pattern. In that case also look for MSBuild.exe or aspnet_regiis.exe running when you are not developing software.
5. Compare the checksum. Use the file check on this page. A match with a Microsoft build means the copy is genuine. No match, no signature and an AppData location together mean you should treat it as malicious.

A valid Microsoft signature clears that msvcp110.dll. It does not clear the program that dropped or loaded it, so a genuine copy in an unexpected folder still calls for a look at the .exe beside it.

Do you need msvcp110.dll?

Yes, the genuine copies: programs built with Visual Studio 2012 will not start without them. Act only on a copy that failed the checks above, and then on the program that put it there.

1. Keep the copies in System32, SysWOW64 and program folders. They belong to the Visual C++ 2012 Redistributable or to the program itself. Deleting them breaks programs and removes no threat. To remove the runtime properly, uninstall the 2012 redistributable from Settings, Apps, Installed apps once no program needs it.
2. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Let Defender quarantine what it finds before you delete files yourself.
3. Run the offline scan. The 2025 loader injected its stealer into running Windows programs. The offline scan restarts the PC and scans before Windows loads, so injected code has no chance to hide. It takes about 15 minutes.

   Start-MpWDOScan

4. Remove the tool that dropped it. In the reported case the dropper was a Launch.exe from a password-protected ZIP posing as a free VPN or a Minecraft skin changer. Delete that download and its unpacked folder, and uninstall anything it added under Installed apps.
5. Delete the hidden copy in AppData\Roaming. After the scans, if a msvcp110.dll is still in the root of AppData\Roaming and failed the signature check, delete it. It is hidden, so enable Hidden items in File Explorer's View menu, or use PowerShell.

   Remove-Item -Force "$env:APPDATA\msvcp110.dll"

6. Change your passwords. Lumma Stealer, the payload in the reported campaign, steals saved browser passwords, cookies and wallet data. From a clean device, change the passwords of e-mail, banking and other important accounts, and sign out of all other sessions.

Warning signs

How attackers have used msvcp110.dll

One published case, with its report. The malicious file was not Microsoft's library: it was the attackers' own DLL, given the msvcp110.dll name so that it would look like a familiar runtime file.

The report maps the campaign to DLL side-loading and masquerading in MITRE ATT&CK. For a home PC the lesson is the folder: a msvcp110.dll loose and hidden in AppData\Roaming is not part of any Visual C++ package.

Known versions of msvcp110.dll

A public DLL catalogue lists 11 versions of msvcp110.dll, from 11.0.40825.2 to 11.0.61135.400, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix msvcp110.dll errors on uGetFix

Questions people ask