Program file
msvcr120.dll: genuine Visual C++ 2013 library, or part of a malware kit?
msvcr120.dll is Microsoft's C runtime library for programs built with Visual Studio 2013. Copies in System32, SysWOW64 and the folders of programs you installed are normal. Malware packages have shipped the genuine file next to a trusted program and a malicious DLL, so a copy in Temp, Downloads or AppData tells you to look at its neighbours.
Prefer to check it yourself? The manual checks follow.
A msvcr120.dll signed by Microsoft, in C:\Windows\System32, C:\Windows\SysWOW64 or the folder of a program or game you installed, is a normal runtime library from the Visual C++ 2013 Redistributable. It is not a process and uses no CPU by itself. Programs carry private copies, so finding several is expected.
In the published cases the msvcr120.dll inside a malware package was the genuine, signed Microsoft file. It was there because the legitimate program the attackers abused needed it, while the malicious code sat in another DLL in the same folder. A clean signature on msvcr120.dll does not clear that folder.
- Publisher
- Microsoft Corporation
- Description in the file
- Microsoft® C Runtime Library
- Installed by
- Microsoft Visual C++ 2013 Redistributable (version 12), and by programs and games that carry their own copy
- Last official version
- 12.0.40664.0, read from Microsoft's x64 and x86 installers on 14 October 2026: 963,240 bytes (x64) and 971,072 bytes (x86). There is no ARM64 build
- Genuine folders
- C:\Windows\System32 (64-bit copy), C:\Windows\SysWOW64 (32-bit copy on 64-bit Windows), and the installation folders of programs that bring their own
- Signed by
- Microsoft Corporation
- Also inside Windows images
- Winbindex indexes 7 Microsoft builds in Windows 10 images from release 1703 to 22H2, versions 12.00.21005.1, 12.00.30501.0 and 12.00.30519.0
- Runs as a process
- No. It is a library loaded into the programs that need it
- Seen in attacks as
- A genuine dependency packed next to a side-loaded malicious DLL (Matanbuchus 3.0 loader in 2026, KilllSomeOne attacks in 2020)
What msvcr120.dll does
msvcr120.dll holds the C runtime for programs built with Visual Studio 2013: memory management, file access, strings and maths. Instead of carrying that code, a program loads this file when it starts. The 120 in the name is the toolset version, 12.0. Its C++ companion is msvcp120.dll, and the two usually travel together.
Windows does not put the file in System32 by itself: the Visual C++ 2013 Redistributable does. Microsoft lists Visual C++ 2013 as no longer supported but still links its final installers. Because the runtime is old and separate from the 2015-2022 one, many programs keep a private copy next to their .exe, and Windows searches a program's own folder before System32.
About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.
How to check a copy of msvcr120.dll
The questions are where the file is, who signed it, which program loads it and what else is in that folder. A library never shows in Task Manager under its own name, so use these checks instead.
- List every copy and where it sits. Run this in PowerShell. Copies in Windows, Program Files and game folders are normal. Look hard at copies under AppData, Temp, Downloads or ProgramData, especially recent ones.
Get-ChildItem -Path C:\ -Filter msvcr120.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime - Check the signature of a copy you are unsure about. Status must be Valid and the signer Microsoft Corporation. NotSigned, HashMismatch or another company's name means the file is not an unmodified Microsoft build and should be treated as malicious.
Get-AuthenticodeSignature "C:\path\to\msvcr120.dll" | Format-List Status, SignerCertificate - Check the other DLLs in the same folder. This is the step that matters most for msvcr120.dll. In the reported kits it was genuine and the malicious file was its neighbour: SystemStatus.dll in 2026, x32bridge.dll in 2020. Run the signature check on every DLL in the folder; one unsigned DLL beside a signed .exe is the side-loading pattern.
Get-ChildItem "C:\path\to\folder" -Filter *.dll | Get-AuthenticodeSignature | Format-Table Status, Path -AutoSize - See which program loads it. In Process Explorer (Microsoft Sysinternals) open Find, Find Handle or DLL, and type msvcr120.dll. Each result shows the process and the full path of the copy it loaded. A program running from Temp, AppData or ProgramData with its own msvcr120.dll is worth a closer look.
- Compare the checksum. Use the file check on this page. A match tells you the copy is a known Microsoft build. It does not clear the folder: both reported kits carried genuine runtime files on purpose.
A valid Microsoft signature proves msvcr120.dll itself is genuine. It says nothing about the program and the other DLLs beside it, which are the parts an attacker controls.
Check your msvcr120.dll
Choose the msvcr120.dll you are unsure about. Its SHA-256 and SHA-1 checksums are calculated in your browser and compared with the 13 versions of the file known from a public DLL catalogue.
The file stays on your computer. Nothing is uploaded: the checksum is computed locally.
Do you need msvcr120.dll?
Keep the copies in Windows and in programs you installed: programs built with Visual Studio 2013 stop starting without them. Act only on a folder that failed the checks above, and remove the whole folder, not the runtime file.
- Leave System32, SysWOW64 and program folders alone. These copies belong to the Visual C++ 2013 Redistributable or to the program itself. Deleting them does not remove any threat and only breaks the programs that use them.
- Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds before deleting anything by hand.
- Run the offline scan. Malware loaded into a running program can hide while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.
Start-MpWDOScan - Delete the suspicious folder as a whole. If a folder in Temp, AppData, Downloads or ProgramData holds an .exe you never installed, msvcr120.dll and an unsigned DLL, delete the folder. Deleting only msvcr120.dll leaves the launcher and the malicious DLL in place.
- Remove what starts it again. Open Task Scheduler and look for tasks that run a program from ProgramData, AppData or Temp, and check Settings, Apps, Startup. Also look in Installed apps for an entry you do not recognise: the 2026 case started with an MSI package installed from a web address.
- Change passwords if a remote access tool was involved. The 2026 Matanbuchus case ended in a remote access tool that steals credentials. Change passwords from a clean device, starting with e-mail and banking, and sign out of other sessions.
Warning signs
| What you see | What it means |
|---|---|
| msvcr120.dll and msvcp120.dll in Temp, Downloads, AppData or ProgramData next to an .exe you did not install | The shape of the reported side-loading kits. Check the signature of every DLL in that folder and scan. |
| Another DLL in the same folder is unsigned, or signed by a company that has nothing to do with the .exe | That DLL is the likely payload. msvcr120.dll is there only so the legitimate program can start. |
| msvcr120.dll itself shows NotSigned or HashMismatch | The file is not an unmodified Microsoft build. Treat it as malicious. |
| You pasted a command from a web page that asked you to fix or verify something | That is the ClickFix lure that started the 2026 Matanbuchus infection. Scan at once. |
| A site offers msvcr120.dll as a single download with no source or checksum | You cannot know what such a file contains. Take it from Microsoft's Visual C++ 2013 installer and compare the checksum. |
| Several copies in Program Files and game folders | Normal. Programs and games carry private copies of the 2013 runtime. |
How attackers have used msvcr120.dll
Two published cases, each with the report it comes from. In both, msvcr120.dll was the genuine Microsoft file, packed in because the legitimate program the attackers abused cannot start without it. The malicious code was in another DLL in the same folder.
| Malware | How it used the file | Source |
|---|---|---|
| Matanbuchus 3.0 loader and AstarionRAT (2026) | A ClickFix page got the victim to run a command that installed an MSI package from a remote address. The package used a renamed copy of 7-Zip to unpack a password-protected archive holding a legitimate antivirus core engine (core.exe), the genuine msvcp120.dll and msvcr120.dll, and a malicious SystemStatus.dll, the Matanbuchus 3.0 loader. The intrusion went on to deliver a new remote access tool named AstarionRAT. | Huntress, February 2026 |
| KilllSomeOne side-loading attacks (2020) | One of the side-loading sets described in these targeted attacks combined two clean executables, Mediae.exe and the x32dbg.exe debugger, with the clean msvcp120.dll and msvcr120.dll that x32dbg depends on. The malicious loader was x32bridge.dll, which read its payload from x32bridge.dat in the same folder. | Sophos, November 2020 |
MITRE ATT&CK lists this as Hijack Execution Flow: DLL (T1574.001). For msvcr120.dll the lesson is to check the neighbours: the runtime file in these kits passes every check because it is real.
Known versions of msvcr120.dll
A public DLL catalogue lists 13 versions of msvcr120.dll, from 12.0.21005.1 to 12.0.40664.0, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.
Every version with its checksums, and how to fix msvcr120.dll errors on uGetFix
Questions people ask
Is msvcr120.dll a virus?
No, the genuine msvcr120.dll is Microsoft's Visual C++ 2013 C runtime library and is harmless. It lives in System32, SysWOW64 and the folders of programs that use it. Malware kits have carried the genuine file, in 2026 and in 2020, because the legitimate program they abused needed it. So a signed copy can still sit in a malicious folder: check where it is and what lies next to it.
Why is there a msvcr120.dll in my Temp or AppData folder?
Some installers unpack a program with its runtime into Temp while they run and remove it afterwards, so a short-lived copy can be harmless. A copy that stays, next to an .exe you do not recognise and another DLL, matches the side-loading kits described in the reports. Check the signatures of every DLL in that folder, see in Process Explorer which program loads them, and run a Microsoft Defender full scan.
My msvcr120.dll is signed by Microsoft. Does that mean the folder is safe?
No, it clears only that one file. In both published cases the msvcr120.dll in the malicious folder was genuine and signed. The attack worked through a different DLL that the legitimate program loaded from the same folder: SystemStatus.dll in 2026 and x32bridge.dll in 2020. Check the other DLLs and the .exe beside it as well.
Can I delete msvcr120.dll?
Not the copies in System32, SysWOW64 or the folders of programs you installed: every program built with Visual Studio 2013 that uses them would stop starting. If a folder in Temp, AppData, Downloads or ProgramData fails the checks on this page, delete that whole folder after a Microsoft Defender scan, not only msvcr120.dll.
Which versions of msvcr120.dll are genuine?
The last version Microsoft published for Visual C++ 2013 is 12.0.40664.0, signed by Microsoft Corporation. Winbindex also indexes builds 12.00.21005.1, 12.00.30501.0 and 12.00.30519.0 inside Windows 10 images, and older 2013 packages installed earlier builds. The version number alone proves nothing, because a fake can copy it. The signature check and the checksum comparison on this page are what count.
How did a malware kit with msvcr120.dll get onto my PC?
In the 2026 case the victim pasted a command from a fake verification page, which installed an MSI package from the internet and unpacked the kit. In the 2020 attacks the files arrived as part of targeted intrusions. Cracked software, fake game mods and DLL files downloaded one by one carry the same risk, because they put an unknown program and its DLLs into one folder.
Does Microsoft Defender detect these kits?
Defender recognises known malicious files by their content, whatever they are called, so it looks at the malicious DLL, not at the genuine msvcr120.dll beside it. A new loader variant can go unrecognised for a while. That is why the folder and signature checks on this page matter: an unsigned DLL beside a signed program in a user folder is suspicious even before any scanner knows the file.
Sources
- Microsoft Learn: Latest supported Visual C++ Redistributable downloads (Visual C++ 2013 listed as unsupported)
- Winbindex, the Windows binaries index: msvcr120.dll
- MITRE ATT&CK T1574.001: Hijack Execution Flow: DLL
- Huntress: A New RAT and a Hands-on-Keyboard Intrusion, Matanbuchus 3.0 and AstarionRAT (16 February 2026)
- Sophos: A new APT uses DLL side-loads to “KilllSomeOne” (4 November 2020)
- Microsoft Learn: Get-AuthenticodeSignature
Version data read on Oct 14, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…