vcruntime140.dll: Microsoft's runtime library or a side-loaded fake?

What vcruntime140.dll does

vcruntime140.dll holds the lowest layer of the Visual C++ runtime: memory copy and fill, C++ exception handling and type information. Almost every program built with Visual Studio 2015 or later imports it, and so does msvcp140.dll, Microsoft's C++ library. 64-bit programs often load its companion vcruntime140_1.dll as well. The 140 stands for toolset version 14.0.

Because the file is tiny and nearly universal, programs routinely ship it in their own folder. Windows searches a program's folder before System32, so whatever file named vcruntime140.dll sits beside the .exe is the one that gets loaded. Attackers rely on exactly that, and on the fact that nobody is surprised to see the name.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of vcruntime140.dll

Three questions decide it: where the file is, who signed it and which program loads it. A library never appears in Task Manager under its own name, so use these checks.

1. List every copy with its folder and date. Copies under Windows\System32, Windows\SysWOW64, Program Files, WindowsApps and game folders are normal. Look closely at copies under AppData, Temp, Downloads, ProgramData or C:\Windows\Tasks, especially recent ones.

   Get-ChildItem -Path C:\ -Filter vcruntime140*.dll -Recurse -Force -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Check the signature of a copy you are unsure about. Status must be Valid and the signer a Microsoft certificate. NotSigned, HashMismatch or another company's name means it is not an unmodified Microsoft build. The 2022 APT29 case used an altered vcruntime140.dll, which fails exactly this check.

   Get-AuthenticodeSignature "C:\path\to\vcruntime140.dll" | Format-List Status, SignerCertificate

3. See which program loads it. In Process Explorer (Microsoft Sysinternals) open Find, Find Handle or DLL, and type vcruntime140.dll. Each result shows the process and the full path of the copy it loaded. A process started from Temp, AppData or C:\Windows\Tasks that loads its own copy is the side-loading pattern.
4. Look at the .exe next to it. Side-loading needs a legitimate program in the same folder. In the reported cases it was a renamed Adobe-signed helper (Agenda.exe), a VMware component (vmnat.exe), SQL Server's sqlwriter.exe in C:\Windows\Tasks, and a Cisco Webex module. A program that does not belong in that folder is the sign.
5. Compare the size and checksum. Use the file check on this page. The current x64 file is 178,616 bytes; the builds that ship inside Windows range from about 80 to 180 KB. A match tells you the version, the signature tells you the file is genuine, and neither clears the program beside it.

A valid Microsoft signature proves this one file is genuine. In 2024 a malicious archive carried the real, signed vcruntime140.dll because the program it abused needed it, so always judge the folder, not only the file.

Do you need vcruntime140.dll?

Yes, in its normal places: without it most programs built with Visual Studio stop starting. Remove only a copy that failed the checks above, together with what came with it.

1. Keep System32, SysWOW64 and program folders as they are. Those copies belong to the Visual C++ Redistributable, to Windows apps or to the programs themselves. Deleting one breaks the program it serves and does nothing for security.
2. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Let it quarantine what it finds before you delete anything by hand.
3. Run the offline scan. Code loaded into a trusted program can hide while Windows runs. The offline scan restarts the PC and scans before Windows starts, in about 15 minutes.

   Start-MpWDOScan

4. Delete the whole suspicious folder. If a copy failed the signature check and sits beside an unexpected .exe in Temp, AppData, Downloads, ProgramData or C:\Windows\Tasks, remove that folder. Deleting only the DLL leaves the launcher and any second DLL it loads.
5. Remove what starts it again. Check Task Scheduler for tasks that run a program from those folders, and the Run key in the registry. In the 2024 WINELOADER case the attackers added a scheduled task called MS SQL Writer, or alternatively a Run entry with the same name.

   Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Run

6. Change passwords from a clean device. The reported cases ended in remote access tools, Cobalt Strike or an information stealer. Change e-mail, banking and work passwords from another device and sign out of other sessions.

Warning signs

How attackers have used vcruntime140.dll

Four published cases, each with the report it comes from. Three used a fake or altered vcruntime140.dll to run their code; one shipped the genuine file because the abused program needed it.

MITRE ATT&CK lists this as Hijack Execution Flow: DLL (T1574.001). For a home PC the lesson is the folder and the program next to the file: the name vcruntime140.dll proves nothing either way.

Programs that have been made to load a fake vcruntime140.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted vcruntime140.dll. Usually the attacker copies the program into another folder and puts a fake vcruntime140.dll next to it: Windows looks in the program's own folder first. A vcruntime140.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine vcruntime140.dll belongs: C:\Windows\System32

Source: the HijackLibs entry for vcruntime140.dll, 3 public reports.

Known versions of vcruntime140.dll

A public DLL catalogue lists 49 versions of vcruntime140.dll, from 14.0.22013.1 to 14.28.29304.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix vcruntime140.dll errors on uGetFix

Questions people ask