ucrtbase.dll: genuine Universal C Runtime, or a copy that does not belong?

What ucrtbase.dll does, and why a stray copy is a warning sign

ucrtbase.dll is the Universal C Runtime, often called the UCRT. It holds the standard C library: opening and reading files, allocating memory, handling text, dates, locales and maths. Until Visual C++ 2013 every compiler version shipped its own runtime file, such as msvcr120.dll. Since Visual C++ 2015 Microsoft keeps the C part in this one shared library and makes it a component of Windows itself, included in Windows 10, Windows 11 and Windows Server 2016 and later.

Programs also reach it under other names. Files such as api-ms-win-crt-runtime-l1-1-0.dll are small forwarders: a program asks for them, and Windows passes the calls on to ucrtbase.dll. The Visual C++ 2015-2022 Redistributable adds the compiler-specific files on top, such as vcruntime140.dll, and relies on ucrtbase.dll underneath. On Windows Vista, 7, 8 and 8.1 the runtime came as update KB2999226 through Windows Update.

Microsoft documents one rule that makes stray copies easy to judge: on Windows 10 and Windows 11 the Universal C Runtime in the system folder is always used, even if a program brings its own copy and even if that copy is newer. A ucrtbase.dll next to a program therefore does nothing useful on these releases. Some older installers still leave one behind for Windows 7 compatibility, which is harmless if it is a signed Microsoft build.

A copy that is not a Microsoft build is a different matter. Malware authors give their files the names of common Windows libraries so that a glance at a folder or a process's module list shows nothing unusual. A ucrtbase.dll that sits outside the Windows folders, matches no Microsoft hash and carries no Microsoft signature is not the C runtime, whatever its Properties say.

ucrtbased.dll, with a d at the end, is a different file: the debug build that comes with Visual Studio. It is not part of Windows and Microsoft does not allow it to be redistributed, so it belongs only on developers' PCs.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell the genuine ucrtbase.dll from a fake

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32, C:\Windows\SysWOW64 and their downlevel subfolders are Windows' copies, as are the copies Windows keeps in C:\Windows\WinSxS. A copy next to an installed program can be a leftover from an older installer. A copy in Downloads, Temp, AppData or another user folder has no normal reason to exist.

   Get-ChildItem C:\ -Recurse -Filter ucrtbase.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field, version and size. Right-click the file, Properties, Details. The genuine file says Microsoft® C Runtime Library, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. Genuine builds are about 0.9 to 1.4 MB. A fake can copy the text fields, so these only rule a file out, never in.
3. The digital signature. Windows' copy is signed by Microsoft, often through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned, HashMismatch or another signer means it is not Microsoft's file.

   Get-AuthenticodeSignature 'C:\path\to\ucrtbase.dll' | Format-List Status, SignatureType, SignerCertificate

4. Which copy a program loads. Open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type ucrtbase.dll and press Search. Almost every running program appears. The path column should read System32 or SysWOW64 for each; a process that loads ucrtbase.dll from a user folder is the one to investigate.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the 289 known Microsoft builds. A match proves a Microsoft file. A file in a user folder that does not match is not the Universal C Runtime.
6. Scan the PC. Run Microsoft Defender's full scan, and the offline scan if a detection keeps coming back. Scan especially when a non-matching copy sits in AppData or Temp, or when a program you do not recognise loads it.

A match to a Microsoft build proves the file is Microsoft's, wherever it sits. A non-matching file in System32 can also be a genuine build from an update newer than the index, so check its signature before drawing conclusions. A non-matching, unsigned copy outside the Windows folders is the case that needs action.

Warning signs and what they mean

Everyday questions about ucrtbase.dll

Get-AuthenticodeSignature C:\Windows\System32\ucrtbase.dll

ucrtbase.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 289 Microsoft builds in total are known.

Known versions of ucrtbase.dll

A public DLL catalogue lists 34 versions of ucrtbase.dll, from 10.0.10137.0 to 10.0.18362.815, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix ucrtbase.dll errors on uGetFix

Questions people ask