vlc.exe

Top Paths

• C:\Program Files (x86)\VideoLAN\VLC62.57%
• C:\Program Files\VideoLAN\VLC37.43%

Top Hashes (SHA256)

• 1b8342c0048e13b323224c48caa9aec2952f3a93ed732c85f16091647591067550.28%
• 31f5e43e9283cf2469d8b3e51e7c28c132c6ecb0dab855df52cbf21d5394ae0b13.37%
• 309cde62f0f3744d89999ffe832b481da071252f833a1e6661216c59a290d47f5.84%
• 4b4a513cc62817d95dfa84139f1217a6af43bc2d1dbfb4dddc991ed5796e32d33.77%
• 607ea9d9621f8b124c89acf674072fcbc29c4a7655bf4c625a86a54f9756226a3.2%
• f2efe28873a596b0916edea1ee49add13de0905c1cf8db6c3c937f3be515b5bb2.82%
• 5c7edfad96fe400b5c08d5c49eacf61cc446566f40a24d7a66b36a18e08c968c2.45%
• 9a984ef9e04faa6b7299249efe32319e61f179210fc8c327a44b3e44326e7caf2.26%
• 1fcd04fe1a3d519c7d585216b414cd947d16997d77d81a2892821f588c6309372.07%
• 0b025b0990a19230c211c57bdabfdfde55c86ccdbf34743090089a5f3b6799901.88%
• bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389

Top Grandparents

• userinit.exe73.2%
• explorer.exe11.05%
• svchost.exe10.5%
• winlogon.exe4.97%
• OpenWith.exe0.28%
• cmd.exe

Top Parents

• explorer.exe83.67%
• OpenWith.exe6.97%
• OUTLOOK.EXE6.97%
• iexplore.exe0.92%
• sihost.exe0.73%
• chrome.exe0.37%
• rundll32.exe0.37%
• cmd.exe
• powershell.exe

Top Children

• WerFault.exe9.09%

What does vlc.exe normally do?

VLC is a desktop multimedia player; normal use is a user launching vlc.exe from Explorer, a shortcut, or a file association to play local media or a network stream. In the lab the winget-sourced installer (vlc-3.0.23-win64.exe, signed by VideoLAN, run silently with /S from powershell.exe) unpacked NSIS temp DLLs (System.dll, nsExec.dll under %TEMP%\nsr*.tmp), wrote the product tree under C:\Program Files\VideoLAN\VLC, spawned vlc-cache-gen.exe against the plugins directory, and registered the ActiveX control with regsvr32 /s axvlc.dll (the SysWOW64 copy re-launching the 64-bit regsvr32). It created a large number of HKCR media file-type/association keys (.mp1, .ape, .dts, .ifo, .asx, etc.) and no autoruns or services. vlc.exe itself was launched from cmd.exe and once as "vlc.exe -I dummy vlc://quit"; VLC generated no network traffic of its own in the run (installer downloads came from powershell.exe reaching get/download.videolan.org and mirrors.ocf.berkeley.edu, and the remaining traffic was Windows telemetry/Store background tasks).

When is vlc.exe suspicious?

vlc.exe or libvlc.dll running from a non-standard directory (%APPDATA%, %TEMP%, %PUBLIC%, ProgramData, user Downloads) instead of C:\Program Files\VideoLAN\VLC, especially where libvlc.dll is unsigned, size-anomalous, or newer than vlc.exe. A signed vlc.exe whose child processes are cmd.exe, powershell.exe, rundll32.exe, or which injects into or spawns network beacons — VLC legitimately spawns only vlc-cache-gen.exe/conhost and browser/updater handoffs. Command lines containing --sout, :sout=#standard{access=http/udp/rtp}, screen://, dshow://, --extraintf/-I luaintf, --lua-config, --lua-intf http, or an http:// URL as input on a server or workstation with no media use case. Parents such as WinRAR/7-Zip extraction paths, Outlook, browsers writing to disk then immediately executing, ISO/LNK-launched vlc.exe, or scheduled tasks/Run keys pointing at vlc.exe — the legitimate installer created no autoruns. Also flag regsvr32 registering axvlc.dll or other DLLs from outside the VideoLAN install path, and VLC processes on servers, DCs, or in SYSTEM sessions.

How do attackers abuse vlc.exe?

VLC's signed vlc.exe is one of the most heavily abused DLL side-loading hosts: it loads libvlc.dll from its own directory with no path or signature validation, and Chinese-nexus actors (Mustang Panda/TA416 with PlugX, and clusters tracked as Cicada/APT10 dropping a custom Cobalt Strike-style loader) routinely drop a legitimate copy of vlc.exe alongside a trojanized libvlc.dll into %APPDATA% or a USB/archive payload directory so the malicious code executes under a valid VideoLAN signature and inherits application-allowlisting trust. Attackers also weaponize VLC's own feature set: the Lua interface (--extraintf luaintf, --lua-intf http, custom .lua files dropped into the lua/intf plugin folder) provides scriptable code execution and a lightweight HTTP control channel; the stream-output chain (--sout, transcode/duplicate/std modules) plus the screen://, dshow:// and qtcapture inputs turns VLC into a screen/webcam/microphone recorder that can push captured media directly to an attacker HTTP/UDP/RTP listener, and VLC's URL inputs can be used to pull remote content for ingress. Commodity crimeware distributes fake "VLC setup" bundles and cracked/skins packages via SEO poisoning and malvertising, and malware commonly masquerades as vlc.exe in user-writable paths for persistence. Plugin/cache poisoning is also possible: writing a rogue plugin DLL into the plugins tree and re-running vlc-cache-gen.exe causes it to be loaded on next start.

Detection guidance

Baseline vlc.exe to C:\Program Files\VideoLAN\VLC (or Program Files (x86)) and alert on any execution of an image named vlc.exe, or any load of libvlc.dll/libvlccore.dll/axvlc.dll, from another directory; pair Sysmon Event ID 1 with Event ID 7 to catch a signed vlc.exe loading an unsigned or Authenticode-mismatched libvlc.dll — this is the highest-fidelity single detection. Hunt process command lines for --sout, :sout=, screen://, dshow://, --extraintf, luaintf, --lua-intf, --lua-config, and remote URL inputs, and correlate any VLC process making outbound TCP/UDP to non-CDN destinations, since the lab baseline showed no VLC-originated network traffic. Alert on VLC child processes other than vlc-cache-gen.exe/conhost.exe, on VLC appearing under Run keys, scheduled tasks, or service ImagePaths (the legitimate install registered none), and on regsvr32 invocations for axvlc.dll outside a genuine install window. Monitor writes of DLL or .lua files into the VideoLAN plugins/lua directories by non-installer processes, and treat vlc.exe execution on servers, hypervisors, or domain controllers as inherently anomalous.

MITRE ATT&CK techniques

References

• https://www.videolan.org/vlc/
• https://www.videolan.org/