ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 2 August 2008, 16:08:33
Processing time: 4 min 7 sec
Submitted sample:

File MD5: 0x9699AA21B3A34E82F5C498CDF1BE95DC
File SHA-1: 0xAA84B1D07EE0753B1E3568E3B83855CBEB1EBFD1
Filesize: 1,439,353 bytes

Summary of the findings:

What's been found	Severity Level
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%DesktopDir%\VirtualCamera.lnk	724 bytes	MD5: 0x3A068F3335AF7E0F1381FE36F1288361 SHA-1: 0x54010B4131C9895EF14B8A18264D14231A0D8E60
2	%Temp%\nsisos.dll	5,632 bytes	MD5: 0x69806691D649EF1C8703FD9E29231D44 SHA-1: 0xE2193FCF5B4863605EEC2A5EB17BF84C7AC00166
3	%Programs%\MorningSound Home Page.lnk	762 bytes	MD5: 0x504C006152A66EF30CE3B7823E5D5FF9 SHA-1: 0x43C9F5B0E2CC30B2A6CD7F24A144D585BC73F81C
4	%Programs%\Uninstall VirtualCamera.lnk	1,421 bytes	MD5: 0xE0C8C5E596FD4F109E6189E26726DB63 SHA-1: 0xDB986DFEE7DD9531C5183BB65679072F3BDB9F1C
5	%Programs%\VirtualCamera Help.lnk	762 bytes	MD5: 0xFD8FA7136378563F94E688EEC8F0CD29 SHA-1: 0x415EFA46715D692BF548E55CCC8EFB48FF4951E0
6	%Programs%\VirtualCamera.lnk	730 bytes	MD5: 0xB671BACE0AFE109567263236A750F6E9 SHA-1: 0x0189451CC093D481BFDE81F153A34684CBD83EA7
7	%ProgramFiles%\VirtualCamera\driver\atl71.dll	89,088 bytes	MD5: 0x8F2097E8B174F38178570C611464935F SHA-1: 0x86476819229F4BF00F32E5F0969E19C5B61D1B2A
8	%ProgramFiles%\VirtualCamera\driver\vcsetup.exe	45,056 bytes	MD5: 0xD6125785ED74EE4385A610902A6A1D7B SHA-1: 0x4750E8DC502A9B7E709CEF21AA4658E8459AA725
9	%ProgramFiles%\VirtualCamera\driver\VirtualCam.inf	3,671 bytes	MD5: 0xF4924F723FCE32DAD21BED10477A3245 SHA-1: 0x5BD1FEA39BE44790B17DC54744E6EE238042AD5E
10	%ProgramFiles%\VirtualCamera\driver\VirtualCam.sys	192,512 bytes	MD5: 0xB6EF92C628D993C5F777807ED76A7568 SHA-1: 0xA88A135DEAFE3BF92976B2740C9405A1EF2D656B
11	%ProgramFiles%\VirtualCamera\FILE_ID.DIZ	300 bytes	MD5: 0x78CC8BDDF1E6EB4ED17CBBA89A54EEE0 SHA-1: 0xBF2BE6AAE56B52F41B91E9676F674B00EEE67D88
12	%ProgramFiles%\VirtualCamera\Language\chs.ini	7,046 bytes	MD5: 0xDDBAC2C2487064B5BF6347F311019B2F SHA-1: 0xB11EEA707D4BADD24CA34735B44E0EE57D8D971B
13	%ProgramFiles%\VirtualCamera\Language\cht.ini	7,088 bytes	MD5: 0xDE7E1854A69C786BF81E8FBF26009BD7 SHA-1: 0x20D59F341949462EDB87F1B897B87BFD9FCD4691
14	%ProgramFiles%\VirtualCamera\Language\enu.ini	8,584 bytes	MD5: 0xEB50DDE94709E8BA41A98998365777F6 SHA-1: 0xFC37D41CAD78FE4717AAE9A9D19373EA0DE9B323
15	%ProgramFiles%\VirtualCamera\Language\esp.ini	9,961 bytes	MD5: 0x2E052B8EB99632573B5B4AF791E4B351 SHA-1: 0x9BADEBEB6B028C7BC8F4008959EE7A5A22F1EE1E
16	%ProgramFiles%\VirtualCamera\Language\fin.ini	8,828 bytes	MD5: 0x3FBCA6217BAB9AAB7B34A324E2AF9F24 SHA-1: 0x5BA2E3A1F0D07EDB0C07E5608F58FFA12771A649
17	%ProgramFiles%\VirtualCamera\Language\fra.ini	9,437 bytes	MD5: 0x341B08A9C677E540D52733412A61F5C2 SHA-1: 0x049021F43F166E097A10C72C829E93B10C546F32
18	%ProgramFiles%\VirtualCamera\Language\ger.ini	9,219 bytes	MD5: 0xEB50612DD5DDF3FDAAAE866DF089C8F1 SHA-1: 0xA4C55E4B3024ABD3F822945474A8B5D1B7FCD1E4
19	%ProgramFiles%\VirtualCamera\Language\hin.ini	10,558 bytes	MD5: 0x839BEEB653992A818E825A11C114816B SHA-1: 0x081E1AE5C1E24F51A3B5A5BCEEEDCD409DB964EB
20	%ProgramFiles%\VirtualCamera\Language\nld.ini	9,380 bytes	MD5: 0x6B6305F508509485C87ABEB9AC569064 SHA-1: 0xDE75B39EF16A4E75A88AB6D30BCA60E0C1D781D6
21	%ProgramFiles%\VirtualCamera\Language\ptg.ini	9,325 bytes	MD5: 0x51D5F2362F8F79230FF20D5E97F6E1A3 SHA-1: 0x9DBBDDE185F97D38D05AB1F85BDE7AE52F01BF47
22	%ProgramFiles%\VirtualCamera\Language\rom.ini	8,869 bytes	MD5: 0x039652286A6596AD0010A8A5FE51FC3E SHA-1: 0x136BE635A245835458D91CB8BCE9EE9AC366B8DF
23	%ProgramFiles%\VirtualCamera\Language\trk.ini	8,524 bytes	MD5: 0x1F41A7FCEA7BC1208707B1E1A3612FC7 SHA-1: 0x25CCAA5AE74523B092AF78D3D3489CC85A9F4CA9
24	%ProgramFiles%\VirtualCamera\License.rtf	4,194 bytes	MD5: 0x75ECDE48445B2365FDD1D2F89A8017A0 SHA-1: 0xB9DF945AC8443CA249DBFC89B6794AC20F36117B
25	%ProgramFiles%\VirtualCamera\logo.swf	36,457 bytes	MD5: 0xA1D83DB56ED35697764B855413FD427A SHA-1: 0xE5CFD0838B146CD11B11EC4EB7DF52EFF0A9F48F
26	%ProgramFiles%\VirtualCamera\readme.txt	8,793 bytes	MD5: 0x4B76ABBB4A9F93B7C2C32FE83FDBEFBC SHA-1: 0xC7F4D89E0047AECF1EE107B6AB0E55E2B9F38A73
27	%ProgramFiles%\VirtualCamera\RealMediaSplitter.ax	356,352 bytes	MD5: 0x05B85D191C4331CD959A226574BED1F1 SHA-1: 0x756319C94650AC6AA975289C247479F4EF43AE9D
28	%ProgramFiles%\VirtualCamera\uninst.exe	113,469 bytes	MD5: 0x2477D98DFDE40370C14CFAA66E8F5493 SHA-1: 0x2E59E01F36D089B9594AFFB5ED27F2CE49D7F43A
29	%ProgramFiles%\VirtualCamera\VCamera.exe	638,976 bytes	MD5: 0x787AB498C0F13C804347663B2165D5E5 SHA-1: 0x30CBA80433C5568852F8F82C8C456E7D7467A66E
30	%ProgramFiles%\VirtualCamera\VirtualCamera.chm	514,170 bytes	MD5: 0x0E9E83E80541EC4BA99B9DDB5FE332E1 SHA-1: 0x54DD9F9B6BFBEB03110C9E66DDD3817C66783DA9
31	%ProgramFiles%\VirtualCamera\VirtualCamera.url	54 bytes	MD5: 0x240786721ED80D6821E896E735E0CDCB SHA-1: 0xA480664F4DA9814311CDB212533EE327191CF7A2
32	%ProgramFiles%\VirtualCamera\VirtualCameraMenu.dll	86,016 bytes	MD5: 0xC5258112ABDFF017DB37460B73F473CB SHA-1: 0x70E58C14E207C58AAA6B28ABC8FC14D984291D05
33	[file and pathname of the sample #1]	1,439,353 bytes	MD5: 0x9699AA21B3A34E82F5C498CDF1BE95DC SHA-1: 0xAA84B1D07EE0753B1E3568E3B83855CBEB1EBFD1
34	%Windir%\vcamera.INI	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709

Notes:

%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

The following directories were created:

%ProgramFiles%\VirtualCamera
%ProgramFiles%\VirtualCamera\driver
%ProgramFiles%\VirtualCamera\Language

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
vcamera.exe	%ProgramFiles%\virtualcamera\vcamera.exe	655,360 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	200,704 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\VirtualCameraMenu.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D88EF968-E394-4214-83E4-19938204EBE8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVIFile\shellex\ContextMenuHandlers\RegisterDll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72C7A10F-6F5E-4AB2-AE8E-8BB6B56C251A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72C7A10F-6F5E-4AB2-AE8E-8BB6B56C251A}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72C7A10F-6F5E-4AB2-AE8E-8BB6B56C251A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72C7A10F-6F5E-4AB2-AE8E-8BB6B56C251A}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D405CAF-39CD-4F31-80BC-2DAFAA34B393}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D405CAF-39CD-4F31-80BC-2DAFAA34B393}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D405CAF-39CD-4F31-80BC-2DAFAA34B393}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D405CAF-39CD-4F31-80BC-2DAFAA34B393}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile\ShellEx
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile\ShellEx\ContextMenuHandlers
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile\ShellEx\ContextMenuHandlers\RegisterDll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.IEMenu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.IEMenu\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.IEMenu\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.IEMenu.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.IEMenu.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.VirtualCameraMenu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.VirtualCameraMenu\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.VirtualCameraMenu\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.VirtualCameraMenu.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.VirtualCameraMenu.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0246A1A7-820A-469A-85A7-7B7F01EB808C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirtualCamera

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\VirtualCameraMenu.DLL]

AppID = "{D88EF968-E394-4214-83E4-19938204EBE8}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D88EF968-E394-4214-83E4-19938204EBE8}]

(Default) = "VirtualCameraMenu"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVIFile\shellex\ContextMenuHandlers\RegisterDll]

(Default) = "{82682e01-a7cf-42a8-993a-da1c791517cb}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD}]

FriendlyName = "RealVideo Decoder"
CLSID = "{238D0F23-5DC9-45A6-9BE2-666160C324DD}"
FilterData = 02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00 30 70 69 33 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 30 74 79 33 00 00 00 00 90 00 00 00 A0 00 00 00 31 74 79 33 00 00 00 00 90 00 00 00 B0 00 00 00 32 74 79 33 00 00 00 00 90 00 00 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}]

FriendlyName = "RealMedia Source"
CLSID = "{765035B3-5944-4A94-806B-20EE3415F26F}"
FilterData = 02 00 00 00 00 00 60 00 00 00 00 00 00 00 00 00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}]

FriendlyName = "RealAudio Decoder"
CLSID = "{941A4793-A705-4312-8DFC-C11CA05F397E}"
FilterData = 02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00 30 70 69 33 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 30 74 79 33 00 00 00 00 E0 00 00 00 F0 00 00 00 31 74 79 33 00 00 00 00 E0 00 00 00 00 01 00 00 32 74 79 33 00 00 00 00 E0 00 00 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}]

FriendlyName = "RealMedia Splitter"
CLSID = "{E21BE468-5C18-43EB-B0CC-DB93A847D769}"
FilterData = 02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00 30 70 69 33 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 30 74 79 33 00 00 00 00 50 00 00 00 60 00 00 00 31 70 69 33 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 83 EB 36 E

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}\VersionIndependentProgID]

(Default) = "VirtualCameraMenu.IEMenu"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}\TypeLib]

(Default) = "{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}\ProgID]

(Default) = "VirtualCameraMenu.IEMenu.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}\InprocServer32]

(Default) = "%ProgramFiles%\VirtualCamera\VirtualCameraMenu.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0246A1A7-820A-469A-85A7-7B7F01EB808C}]

(Default) = "VirtualCamera IEMenu Class"
AppID = "{D88EF968-E394-4214-83E4-19938204EBE8}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32]

(Default) = "%ProgramFiles%\VirtualCamera\RealMediaSplitter.ax"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}]

(Default) = "RealVideo Decoder"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32]

(Default) = "%ProgramFiles%\VirtualCamera\RealMediaSplitter.ax"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}]

(Default) = "RealMedia Source"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}\VersionIndependentProgID]

(Default) = "VirtualCameraMenu.VirtualCameraMenu"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}\TypeLib]

(Default) = "{0a2a3407-35fe-44be-9dbc-c5c1ef6d9a7c}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}\ProgID]

(Default) = "VirtualCameraMenu.VirtualCameraMenu.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}\InprocServer32]

(Default) = "%ProgramFiles%\VirtualCamera\VirtualCameraMenu.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82682e01-a7cf-42a8-993a-da1c791517cb}]

(Default) = "VirtualCameraMenu Class"
AppID = "{D88EF968-E394-4214-83E4-19938204EBE8}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32]

(Default) = "%ProgramFiles%\VirtualCamera\RealMediaSplitter.ax"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}]

(Default) = "RealAudio Decoder"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32]

(Default) = "%ProgramFiles%\VirtualCamera\RealMediaSplitter.ax"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}]

(Default) = "RealMedia Splitter"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72C7A10F-6F5E-4AB2-AE8E-8BB6B56C251A}\TypeLib]

(Default) = "{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72C7A10F-6F5E-4AB2-AE8E-8BB6B56C251A}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72C7A10F-6F5E-4AB2-AE8E-8BB6B56C251A}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72C7A10F-6F5E-4AB2-AE8E-8BB6B56C251A}]

(Default) = "IIEMenu"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D405CAF-39CD-4F31-80BC-2DAFAA34B393}\TypeLib]

(Default) = "{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D405CAF-39CD-4F31-80BC-2DAFAA34B393}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D405CAF-39CD-4F31-80BC-2DAFAA34B393}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D405CAF-39CD-4F31-80BC-2DAFAA34B393}]

(Default) = "IVirtualCameraMenu"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile\ShellEx\ContextMenuHandlers\RegisterDll]

(Default) = "{82682e01-a7cf-42a8-993a-da1c791517cb}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}]

0 = "0,4,,2E524D46"
Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}\1.0\0\win32]

(Default) = "%ProgramFiles%\VirtualCamera\VirtualCameraMenu.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\VirtualCamera\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A2A3407-35FE-44BE-9DBC-C5C1EF6D9A7C}\1.0]

(Default) = "VirtualCameraMenu 1.0 TypeLib"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.IEMenu\CurVer]

(Default) = "VirtualCameraMenu.IEMenu.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.IEMenu\CLSID]

(Default) = "{0246A1A7-820A-469A-85A7-7B7F01EB808C}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.IEMenu]

(Default) = "VirtualCamera IEMenu Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.IEMenu.1\CLSID]

(Default) = "{0246A1A7-820A-469A-85A7-7B7F01EB808C}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.IEMenu.1]

(Default) = "VirtualCamera IEMenu Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.VirtualCameraMenu\CurVer]

(Default) = "VirtualCameraMenu.VirtualCameraMenu.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.VirtualCameraMenu\CLSID]

(Default) = "{82682e01-a7cf-42a8-993a-da1c791517cb}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.VirtualCameraMenu]

(Default) = "VirtualCameraMenu Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.VirtualCameraMenu.1\CLSID]

(Default) = "{82682e01-a7cf-42a8-993a-da1c791517cb}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirtualCameraMenu.VirtualCameraMenu.1]

(Default) = "VirtualCameraMenu Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0246A1A7-820A-469A-85A7-7B7F01EB808C}]

(Default) = "VirtualCamera IEMenu Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

{D88EF968-E394-4214-83E4-19938204EBE8} = "MorningSound VirtualCameraMenu DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirtualCamera]

DisplayName = "VirtualCamera"
UninstallString = "%ProgramFiles%\VirtualCamera\uninst.exe"
DisplayIcon = "%ProgramFiles%\VirtualCamera\VCamera.exe"
DisplayVersion = "1.2.1 beta build 0311"
NSIS:StartMenuDir = ""
URLInfoAbout = "http://www.soundmorning.com/"
Publisher = "MorningSound Software"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asf]

(Default) = "AVIFile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp]

(Default) = "jpegfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gif]

(Default) = "jpegfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ico]

(Default) = "jpegfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.png]

(Default) = "jpegfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.swf]

(Default) = "AVIFile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wmv]

(Default) = "AVIFile"

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex objects were created:

VIRTUAL_CAMERA_MUTEX
AMResourceMutex2
VideoRenderer

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.