Program file
xinput1_3.dll: Microsoft's controller library or a replacement hiding under its name?
xinput1_3.dll is Microsoft's XInput 1.3 controller library from the DirectX June 2010 runtime. The copies in System32 and SysWOW64 are normal. A copy inside a game folder is the one to look at: games load it before the Windows copy, so cracks, trainers and mod loaders put their own code there under the same name.
Prefer to check it yourself? The manual checks follow.
An xinput1_3.dll signed by Microsoft Corporation in C:\Windows\System32 or C:\Windows\SysWOW64 is the genuine XInput 1.3 library, put there by the DirectX End-User Runtimes (June 2010). It is not a process and uses no CPU by itself: a game loads it to read an Xbox controller. Windows does not ship it, so finding it means a game or the DirectX installer added it.
A game looks for xinput1_3.dll in its own folder first, which makes the name a common hook for anything that wants to run inside a game. A copy in a game folder that is not signed by Microsoft is a replacement: often a mod or controller tool you chose, sometimes code that came with a crack, repack or trainer. That is the copy to check.
- Publisher
- Microsoft Corporation
- Description in the file
- Microsoft Common Controller API
- Installed by
- Microsoft DirectX End-User Runtimes (June 2010), directx_Jun2010_redist.exe, and by games that run that installer from their own DirectX or _CommonRedist folder
- Official version
- 9.18.944.0, the final build of XInput 1.3, read from Microsoft's installer on 14 October 2026
- Size of the genuine file
- 107,368 bytes (x64) and 81,768 bytes (x86)
- Genuine folders
- C:\Windows\System32 (64-bit copy), C:\Windows\SysWOW64 (32-bit copy on 64-bit Windows). A copy in a game folder is normal only if it is the same signed Microsoft file
- Signed by
- Microsoft Corporation
- Part of Windows
- No. Windows 10 and 11 include xinput1_4.dll and xinput9_1_0.dll, never xinput1_3.dll
- Runs as a process
- No. It is a library loaded into games that use a controller
What xinput1_3.dll does
XInput is Microsoft's interface for Xbox controllers on Windows. xinput1_3.dll is version 1.3 of it: a game calls it to read buttons, sticks and triggers, set vibration and ask for the battery level. Microsoft shipped it with the DirectX SDK and its end-user runtime, the last time in June 2010. Windows itself has the newer XInput 1.4 and the reduced XInput 9.1.0, so a game built against 1.3 needs this separate file.
Because the file is small, has a well-known set of functions and is loaded by nearly every older PC game at startup, it is a favourite name for replacement DLLs. A replacement placed in the game folder is loaded instead of the Windows copy. It can pass every controller call on to the real library, so the game works normally, and run its own code at the same time. Mod loaders and controller emulators use this openly. Malicious files can use the same trick.
About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.
How to check a copy of xinput1_3.dll
The questions are where the file is, who signed it and how it got there. A library never shows in Task Manager under its own name, so use these checks instead.
- List every copy and where it sits. Run this in PowerShell. Copies in System32 and SysWOW64 are the runtime's. Copies in game folders need the signature check. Copies in Downloads, Temp or AppData, outside any game, are the ones to look at hardest.
Get-ChildItem -Path C:\ -Filter xinput1_3.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime - Check the signature. Status must be Valid and the signer Microsoft Corporation. NotSigned or another name means the file is not Microsoft's: a replacement. HashMismatch means a Microsoft file that was changed after signing, which a legitimate mod has no reason to do.
Get-AuthenticodeSignature "C:\path\to\xinput1_3.dll" | Format-List Status, SignerCertificate - Compare the size and checksum. The genuine 9.18.944.0 file is 107,368 bytes (x64) or 81,768 bytes (x86). Use the file check on this page: a match with the official build means the copy is Microsoft's, whatever folder it is in.
- Look at what sits next to it in the game folder. A mod loader usually comes with a plugins or scripts folder and files ending in .asi or .ini. A crack or trainer often brings an unfamiliar .exe, files dated the day you unpacked the download, and a readme telling you to copy everything over the game. Ask yourself whether you put that copy there.
- See which program loads it. Start the game, then in Process Explorer (Microsoft Sysinternals) open Find, Find Handle or DLL, and type xinput1_3.dll. The result shows the full path of the copy each process loaded. A program that is not a game loading its own xinput1_3.dll from a user folder is a strong warning sign.
A valid Microsoft signature proves the file is genuine. An unsigned replacement is not automatically malware, since mods and controller tools are unsigned too; it means the file's safety depends entirely on where you got it.
Check your xinput1_3.dll
Choose the xinput1_3.dll you are unsure about. Its SHA-256 and SHA-1 checksums are calculated in your browser and compared with the 11 versions of the file known from a public DLL catalogue.
The file stays on your computer. Nothing is uploaded: the checksum is computed locally.
Do you need xinput1_3.dll?
Keep the copies in System32 and SysWOW64: older games that use a controller stop starting without them. Remove only a replacement you cannot account for, and remove what came with it.
- Leave the Windows copies alone. The signed copies in System32 and SysWOW64 belong to the DirectX runtime and harm nothing. Deleting them breaks games, not malware.
- Decide about a replacement in a game folder. If you installed a mod loader or controller tool from its own developer's page, the copy is expected. If you did not, or it came with a crack, repack or trainer, move it out of the folder and keep it until the scan below is done.
- Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds before deleting anything by hand.
- Run the offline scan. Code running inside a game process can hide while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.
Start-MpWDOScan - Remove the whole download, not only the DLL. If the replacement came with a crack or trainer, uninstall that game copy or tool from Settings, Apps, Installed apps, delete its folder, and check Settings, Apps, Startup and Task Scheduler for anything that starts from the same folder.
- Change passwords if the copy was malicious. Code that runs inside a game can read what the game can read, including saved logins of game launchers. Change passwords from a clean device, starting with e-mail and game accounts, and sign out of other sessions.
Warning signs
| What you see | What it means |
|---|---|
| xinput1_3.dll in a game folder, not signed by Microsoft, and you never installed a mod or controller tool | A replacement that something else put there. Check where the game copy came from and scan. |
| The signature check shows HashMismatch | A Microsoft file changed after signing. Treat it as malicious. |
| A crack, repack or trainer told you to copy its files, xinput1_3.dll among them, over the game | That copy runs inside the game every time you play. Its safety is only as good as the source of the download. |
| xinput1_3.dll in Downloads, Temp or AppData, next to an .exe that is not a game | No program outside a game has a reason to carry its own XInput library. Check the signature and scan. |
| A site offers xinput1_3.dll as a single download with no source or checksum | You cannot know what the file contains. Take it from Microsoft's installer, or as the verified copy unpacked from it, and compare the checksum. |
| Signed Microsoft copies in System32, SysWOW64 and several game folders | Normal. Games may carry the genuine file in their own folder. |
Known versions of xinput1_3.dll
A public DLL catalogue lists 11 versions of xinput1_3.dll, from 3.4.1.1357 to 9.18.944.0, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.
Every version with its checksums, and how to fix xinput1_3.dll errors on uGetFix
Questions people ask
Is xinput1_3.dll a virus?
No, the genuine xinput1_3.dll is Microsoft's XInput 1.3 controller library and is harmless. It is signed by Microsoft Corporation and sits in System32 and SysWOW64. Because games load it from their own folder first, other programs use the same name for a replacement, from mod loaders to code bundled with cracks. The name proves nothing, so check the signature and the folder of the copy you are worried about.
Why is there an xinput1_3.dll in my game folder?
Some games ship the genuine file next to their .exe, which is harmless if it is signed by Microsoft. Mod loaders and controller emulators put their own library there under the same name so the game loads it. Cracks, repacks and trainers sometimes do the same. Check the signature: Microsoft means genuine, anything else means a replacement whose origin you need to know.
Can a crack or trainer hide malware in xinput1_3.dll?
Yes, the method works. A replacement xinput1_3.dll can forward every controller call to the real library, so the game runs normally, while it runs its own code inside the game. MITRE ATT&CK lists this as DLL hijacking, technique T1574.001. Whether a given crack does it depends on who made it, which is why copies from unofficial game downloads deserve a scan.
My antivirus flagged xinput1_3.dll from a mod. Is that a false alarm?
It can be. Mod loaders that work as a replacement xinput1_3.dll behave like DLL hijacking by design, and scanners sometimes flag them for that. If the loader came from its developer's own page and you installed it on purpose, a detection based on behaviour is likely about the method. If the file came with a crack or you do not remember installing it, trust the detection.
Can I delete xinput1_3.dll?
Not the signed copies in System32 or SysWOW64: older games that use XInput 1.3 would stop starting. You can delete an unsigned copy in a game folder; if a mod or controller tool put it there, that mod stops working and the game falls back to the Windows copy. Delete a copy outside any game folder after a Microsoft Defender scan.
Is it safe to download xinput1_3.dll from a DLL site?
It is a risk you do not need to take. Single-DLL download sites rarely say where a file came from, and a modified xinput1_3.dll would run inside every game that loads it. Microsoft's DirectX End-User Runtimes (June 2010) installer contains the genuine file, version 9.18.944.0, and its size and checksum can be compared with the values on this page.
Windows does not include xinput1_3.dll. How did it get onto my PC?
Almost always through a game. Many games run Microsoft's DirectX June 2010 installer on first start, from a DirectX or _CommonRedist folder, and that puts the genuine file into System32 and SysWOW64. Copies elsewhere were added by a game, a mod, a controller tool or a downloaded crack, and the signature tells you which kind it is.
Sources
- Microsoft Learn: XInput Versions
- Microsoft Download Center: DirectX End-User Runtimes (June 2010)
- MITRE ATT&CK T1574.001: Hijack Execution Flow: DLL
- An open-source mod loader distributed as xinput1_3.dll (GitHub)
- Microsoft Learn: Get-AuthenticodeSignature
Version data read on Oct 14, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…