vcruntime140_1.dll: genuine Visual C++ file or malware using its name?

What vcruntime140_1.dll does

When a C++ program hits an error it is written to handle, the runtime has to unwind the program's state and find the code that deals with it. For 64-bit programs built with Visual Studio 2019 and later, that work is done by __CxxFrameHandler4, and vcruntime140_1.dll is the file that holds it. The file is tiny, with three exported functions, and it relies on vcruntime140.dll for everything else.

It arrives with the x64 Visual C++ Redistributable, which installs it into System32, and many programs also keep a private copy next to their .exe so they run on PCs without the runtime. That is why a search of a disk turns up several copies, and why Winbindex alone indexes 88 builds of it inside Windows images and Microsoft apps.

The same habit makes it a convenient disguise. A program loads whatever vcruntime140_1.dll sits in its own folder before the one in System32. A replacement placed there can forward the three real functions to a genuine copy under another name, so nothing visibly breaks, while its own startup code runs inside a trusted, signed process.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of vcruntime140_1.dll

A library has no window and does not show in Task Manager under its own name. The questions are where the copy sits, who signed it, what sits next to it and which program loads it.

1. List every copy and its folder. Run this in PowerShell. Copies in System32 and in Program Files folders of programs you installed are expected. A copy in SysWOW64 is not a Microsoft file, since no 32-bit build exists. Copies in ProgramData, Temp, Downloads or AppData need the next checks.

   Get-ChildItem -Path C:\ -Filter vcruntime140_1.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Check the signature. Status must be Valid and the certificate a Microsoft one: Microsoft Windows Software Compatibility Publisher on the redistributable's file, Microsoft Corporation on some bundled copies. NotSigned or any other name means the file is not Microsoft's.

   Get-AuthenticodeSignature "C:\path\to\vcruntime140_1.dll" | Format-List Status, SignerCertificate

3. Look for a vcruntime140_2.dll beside it. Microsoft's runtime has no file of that name. In the documented 2026 attack the genuine library was renamed vcruntime140_2.dll and the fake forwarded its calls there. Finding the pair in one folder is a reason to scan at once.

   Get-ChildItem -Path C:\ -Filter vcruntime140_2.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName

4. Compare size and checksum. The current official file, version 14.51.36247.0, is 50,112 bytes. Older genuine builds differ in size. Use the file check on this page: a match with a Microsoft build clears the copy, whatever folder it is in.
5. See which program loads it. In Process Explorer (Microsoft Sysinternals) open Find, Find Handle or DLL, and type vcruntime140_1.dll. The result shows the full path of the copy each process loaded. A signed updater or helper loading it from ProgramData or a user folder, instead of from its install folder, is a warning sign.

A valid Microsoft signature and a known checksum prove the file is genuine. They say nothing about the program next to it: a genuine copy can sit in a malware folder because the abused program needs it.

Do you need vcruntime140_1.dll?

Yes, if you run 64-bit programs: most built in the last years stop starting without it. Keep the genuine copies and deal only with one that fails the checks above, together with whatever came with it.

1. Leave the genuine copies alone. The signed copy in System32 belongs to the Visual C++ Redistributable, and copies in program folders belong to those programs. Deleting them breaks programs and removes nothing harmful.
2. Do not uninstall the redistributable to get rid of it. Removing Microsoft Visual C++ 2015-2022 Redistributable (x64) from Settings, Apps, Installed apps takes the file out of System32, and many 64-bit programs stop working. A suspicious copy is never the System32 one installed by that package.
3. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds before deleting anything by hand.
4. Run the offline scan. Code that runs inside a signed program can hide while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

5. Remove the whole folder, not only the DLL. If the copy sat in ProgramData, Temp or AppData with a signed .exe and other DLLs, delete that whole folder. Then check Task Scheduler, Settings, Apps, Startup and Installed apps for anything that starts from it, and for remote management tools you never installed.
6. Treat a confirmed fake as a break-in. Side-loaded loaders give attackers remote control. Change passwords from a clean device, starting with e-mail and work accounts, sign out of other sessions, and tell your IT department if the PC is a work one.

Warning signs

How attackers have used vcruntime140_1.dll

One published case, with the report it comes from. The attackers replaced vcruntime140_1.dll in the folder of a signed program so that the program ran their loader.

MITRE ATT&CK lists this as Hijack Execution Flow: DLL (T1574.001). On your own PC the name proves nothing either way: the folder, the signature and the files next to the copy decide.

Programs that have been made to load a fake vcruntime140_1.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted vcruntime140_1.dll. Usually the attacker copies the program into another folder and puts a fake vcruntime140_1.dll next to it: Windows looks in the program's own folder first. A vcruntime140_1.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine vcruntime140_1.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine vcruntime140_1.dll is signed by: Microsoft Windows Software Compatibility Publisher, a signature in the file itself (Properties, Digital Signatures)

Source: the HijackLibs entry for vcruntime140_1.dll, 1 public report.

Known versions of vcruntime140_1.dll

A public DLL catalogue lists 7 versions of vcruntime140_1.dll, from 14.22.27821.0 to 14.27.29111.0, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix vcruntime140_1.dll errors on uGetFix

Questions people ask