VC_redist.x86.exe
Sources: 300M+ executions observed in the wild and observed in the EchoTrail lab on Windows 11.
Summary
Microsoft Visual C++ 2015-2022 Redistributable installer (x86) for deploying MSVC runtime libraries
VC_redist.x86.exe is the 2229th most commonly executed Windows program in EchoTrail's dataset, observed 232 times across enterprise environments. It typically runs from C:\ProgramData\... and it is most often launched by VC_redist.x86.exe.
Get this in your tools
The same record for vc_redist.x86.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/vc_redist.x86.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\ProgramData\...51.72%
- C:\Windows\Temp\...21.98%
- C:\...14.22%
- C:\Users\...6.47%
- C:\Program Files (x86)\Razer Chroma SDK\temp1.72%
- C:\Program Files (x86)\IPEVO\Visualizer0.86%
- C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\20150.86%
- C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\20170.86%
- C:\Windows\Temp0.86%
- C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\20190.43%
- C:\Program Files\Citrix\Citrix Workspace 26.3.11.10
- C:\Windows\Temp\{3590B804-1106-4F29-9844-AD79F407F497}\.cr
- C:\Windows\Temp\{5D308D4A-1548-456C-96FD-B3A03F580228}\.be
Top Hashes (SHA256)
- fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd1420.39%
- dafb8b5f4b46bfaf7faa1d0ad05211f5c9855f0005cd603f8b5037b6a708d6b612.83%
- 0c4e1f8b77613fc464ff5eaee31b49217996d987866a1ebcd73a0ca6310d26168.55%
- e9769913773ebf0fbb83f5bfac0f359ce9fcfb14cf89c5dfb2655abcd3d9271d8.55%
- 29cf2f79b42d4c6743025f1532943d3e09c9cc84887ccf6daa7927d70cfe249c4.61%
- 15dc9852a32ea35fc2a3ef99535802dc2d99bd122b3926686e4c75d042c52b7b3.29%
- 00c352fa442302be7195cbda046a0a0362c482fd1b92fd6f294471c62073dc6b2.63%
- 5a0d273208b6126d7f45451732e81bcc1b79c79466caa3ac65c9e00a9fff59302.3%
- 6fd956e5c041ad340431dd4eb9ca98ee3568163dacedce4865e6596ccb10b7211.97%
- dfa88ba4491ac48f49c1b80011eddfd650cc14de43f5a4d3218fb79acb2f2dbc1.97%
- 169b8f7025b301ffce5402c98c07f9e01bbadce52a2961175b777279f92624a7
- dd1a8be03398367745a87a5e35bebdab00fdad080cf42af0c3f20802d08c25d4
Code Signing
Signers by share of executions
- 100%Microsoft CorporationValidEmbedded signature · 1 hash
- Chain
- Microsoft Corporation
- Microsoft Code Signing PCA 2011
- Microsoft Root Certificate Authority 2011
- Valid
- Sep 12, 2024 to Sep 11, 2025
- Hashes
- dd1a8be03398367745a87a5e35bebdab00fdad080cf42af0c3f20802d08c25d4100% of executions, first seen Sep 29, 2026
Full certificate detail on Team.
Process Ancestry
Top Grandparents
- explorer.exe33.75%
- ShoreTelConnect.exe31.25%
- setup.exe12.5%
- ShoreTel.exe3.75%
- msiexec.exe1.25%
Top Parents
- VC_redist.x86.exe50.19%
- vcredist_x86.exe13.11%
- ShoreTelConnect.exe9.36%
- cmd.exe1.5%
- powershell.exe1.12%
- SystemSettings.exe0.75%
- chrome.exe0.37%
- dllhost.exe0.37%
Top Children
- VC_redist.x86.exe98.53%
- vcredist_x86.exe1.47%
Lab record
- Installed from
- winget Citrix.Workspace 26.3.11.10
- Publisher
- Microsoft Corporation
- Persistence
- none
- Network
- none
- Command lines
- 2 patterns (3 launches)
- DLL loads
- 85 patterns (175 loads)
- Registry writes
- 48 patterns (56 writes)
- File writes
- 14 patterns (105 writes)
- HTTP requests
- 0 patterns (0 requests)
- TLS connections
- 0 patterns (0 handshakes)
- Named pipes
- 5 patterns (5 events)
- Process access
- 0 patterns (0 events)
- Driver loads
- 0 patterns (0 loads)
- PowerShell blocks
- 0 patterns (0 blocks)
- Remote threads
- 0 patterns (0 events)
- Audit events
- 1 pattern (2 events)
Full record on Team.
Ask Rocky about VC_redist.x86.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for VC_redist.x86.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.