msvcp140.dll: genuine Microsoft library or a malware loader using its name?

What msvcp140.dll does

msvcp140.dll holds the C++ Standard Library for programs built with Visual Studio 2015 and later: strings, containers, streams, threads. Instead of carrying that code, a program loads this file when it starts. The 140 in the name is the toolset version, 14.0, which every Visual Studio release from 2015 to 2022 still uses.

Windows does not ship the file in System32 by itself. The Visual C++ Redistributable puts it there, and many programs also keep a private copy next to their .exe. That habit is what attackers rely on: Windows searches a program's own folder before System32, so whatever file named msvcp140.dll sits there is the one that gets loaded.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of msvcp140.dll

The questions are where the file is, who signed it and which program loads it. A library never shows in Task Manager under its own name, so use these checks instead.

1. List every copy and where it sits. Run this in PowerShell. Copies in Windows, Program Files and a game's folder are normal. Look hard at copies under AppData, Temp, Downloads or ProgramData, especially recent ones.

   Get-ChildItem -Path C:\ -Filter msvcp140.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Check the signature of a copy you are unsure about. Status must be Valid and the signer must be Microsoft. NotSigned, HashMismatch or another company's name means the file is not a genuine Microsoft build. The 2024 Cobalt Strike case used a Microsoft file whose code had been changed, which breaks the signature exactly like this.

   Get-AuthenticodeSignature "C:\path\to\msvcp140.dll" | Format-List Status, SignerCertificate

3. See which program loads it. In Process Explorer (Microsoft Sysinternals) open Find, Find Handle or DLL, and type msvcp140.dll. Each result shows the process and the full path of the copy it loaded. A program running from a Temp or AppData folder that loads its own msvcp140.dll is the side-loading pattern.
4. Look at what sits next to it. Side-loading needs a legitimate .exe in the same folder: in the reported cases a Java launcher (jp2launcher.exe) and a Cisco Webex service module (ptService.exe). An .exe you never installed, in a folder with a random or misleading name, together with msvcp140.dll, is a strong sign.
5. Compare the checksum. Use the file check on this page. A match tells you which version you have; the signature check above tells you whether it is genuine. Neither clears the folder: one reported package shipped the genuine, signed msvcp140.dll as a dependency of the program it abused.

A valid Microsoft signature proves the file is genuine. It says nothing about the program sitting next to it, which is the part an attacker controls.

Do you need msvcp140.dll?

Keep the copies in Windows and in programs you installed: without them those programs stop starting. Remove only a copy that failed the checks above, and remove what came with it.

1. Leave System32, SysWOW64 and program folders alone. These copies belong to the Visual C++ Redistributable or to the program itself. If one of them is damaged, repair the redistributable or reinstall the program instead of deleting the file.
2. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds before deleting anything by hand.
3. Run the offline scan. Malware that is loaded into a running program can hide while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

4. Delete the suspicious folder, not only the DLL. If a copy failed the signature check and sits next to an unknown .exe in Temp, AppData, Downloads or ProgramData, delete the whole folder. Deleting the DLL alone leaves the launcher that loads it.
5. Remove what starts it again. Open Task Scheduler and look for tasks that run a program from ProgramData, AppData or Temp, and check Settings, Apps, Startup. In the 2025 NetSupport RAT case the loader created a scheduled task that started the remote access tool at every sign-in.
6. Change passwords if a remote access tool or a stealer was involved. Both reported 2024 and 2025 cases ended in a remote access tool or an information stealer. Change passwords from a clean device, starting with e-mail and banking, and sign out of other sessions.

Warning signs

How attackers have used msvcp140.dll

Three published cases, each with the report it comes from. Two used a fake or altered msvcp140.dll to run their code; one shipped the genuine file because the abused program needed it.

MITRE ATT&CK lists this as Hijack Execution Flow: DLL (T1574.001). The lesson for a home PC is the folder, not the name: a genuine msvcp140.dll can be part of an attack, and a fake one keeps the same name.

Programs that have been made to load a fake msvcp140.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted msvcp140.dll. Usually the attacker copies the program into another folder and puts a fake msvcp140.dll next to it: Windows looks in the program's own folder first. A msvcp140.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine msvcp140.dll belongs: C:\Windows\System32C:\Windows\SysWOW64C:\Program Files

Source: the HijackLibs entry for msvcp140.dll, 3 public reports.

Known versions of msvcp140.dll

A public DLL catalogue lists 54 versions of msvcp140.dll, from 14.0.22816.0 to 14.26.28804.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix msvcp140.dll errors on uGetFix

Questions people ask