96f7d944862c06da57ef1f7b8e41c0a5a002be5bbd06ae78f8d8cb8b94c578fd

Analysis

user interaction
yes
max time kernel
84s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AngryBirdsInstaller_4.0.0.exe
Size 74.3MB
Sample260705-e31p6ac15n
SHA256 96f7d944862c06da57ef1f7b8e41c0a5a002be5bbd06ae78f8d8cb8b94c578fd
MD5 12d7d3b6da2b4ef5dc837effc7cb3a1f
SHA1 479714c71d49df7b2ca16bc6c44a6216a008eae4
SHA512 5ca5fb7f44a1f5e6e0ffaec1b5a8b9b0453f2b54c8dd1b37538eb1bb7b6d8004e57fbe7f64350ee10f26d80e5d05a00df3107144c9db5b73ec8d99276958785b
SSDEEP 1572864:v9DSitI+s+Z6ED6orHKY7sgNnErhO7LQ7BZ:FSCd6HojTNnErAIB
TLSH
T11B083301A3E9812AF4B71F30ACBB52A24A39BC51BD31D50F5794261E3971A64DFB4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4612	AngryBirds.exe
3700	AngryBirds.exe

Loads dropped DLL 21 IoCs

pid	Process
904	AngryBirdsInstaller_4.0.0.exe
904	AngryBirdsInstaller_4.0.0.exe
3280	MsiExec.exe
3280	MsiExec.exe
3280	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
904	AngryBirdsInstaller_4.0.0.exe
1772	MsiExec.exe
3280	MsiExec.exe
4612	AngryBirds.exe
4612	AngryBirds.exe
4612	AngryBirds.exe
4612	AngryBirds.exe
3700	AngryBirds.exe
3700	AngryBirds.exe
3700	AngryBirds.exe
3700	AngryBirds.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4292	msiexec.exe
8	4292	msiexec.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\accordion_empty_pull.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\piglette oink a6.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\1024x768_pc\ACHIEVEMENTS_SHEET_1.pvr	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\1024x768_pc\BACKGROUNDS_GE_1.pvr	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\surf\LevelS034.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\Globe_Bird_Special_Activation_1.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\fonts\1024x768\FONT_SHOP_AMOUNT.pvr	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\menus\shop\HistoryScrollFrame.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_09_THEME_9.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_09_THEME_9.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack9\LevelP4_432.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\greenBuff.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\commands.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\gamescorescreen_score_count_loop.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\rock collision a4.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\1024x768_pc\EGGDEFENDER_CUTSCENES_STORY_EGG_DEFENDER2.pvr	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack9\LevelP4_440.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\iap\iap_config.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\shaders\gl2\commons\functions.sh	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\pigs_electrocuted_04.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_16_THEME_16.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\flowerBuffBlue.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\ui_components\Rect.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\mighty_eagle_fly.mp3	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\1024x768_pc\MENU_SHOP_1.pvr	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_20_THEME_20_GROUND_2.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack4\LevelP2_96.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\menus\shop\Scroller.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\bird 03 select.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_20_EGG_SIGN.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\blackbird\BlackBird_24.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack9\LevelP4_439.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_20_PARALLAX_3_20.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_22_THEME_GROUND_TEXTURE_22.pvr	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\menus\PowerupReminder.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\ui_components\ScrollFrame2.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\vehicles\EggDefender_12\EggDefender_12_W1_V1.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\pig_hi-hat_2.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\rock damage a1.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\iphone\leaderboards.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\unlock_codes.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\menus\level_selection_free.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\vehicles\EggDefender_3\EggDefender_3_W4_V1.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\mightymouse.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack11\LevelP4_474.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\iap\shop_eagle_window.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\vehicles\EggDefender_13\EggDefender_13_W5_V1.scripts.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_20_EGG_SIGN.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\eggdefender\EggDefender_classic_12.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\surf\LevelS031.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\piano-fis.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\base\INGAME_BAD_PIGGIES_2.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack5\LevelP2_72.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\surf\LevelS004.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\menus\default_credits.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\music\ambient_white_dryforest.mp3	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\1024x768_pc\CUTSCENES_STORY_2.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\TUTORIALS_SHEET_1.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\menus\MessageBox.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_04_PARALLAX_4.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack17\LevelP6_10.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack17\LevelP6_21.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\menus\NotificationsFrame.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\special group.wav	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB0BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB478.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC004.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}\AngryBirds.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF75.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEBB.tmp	msiexec.exe
File created	C:\Windows\Installer\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}\AngryBirds.exe	msiexec.exe
File created	C:\Windows\Installer\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}\icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDBA.tmp	msiexec.exe
File created	C:\Windows\Installer\e58aebb.msi	msiexec.exe
File created	C:\Windows\Installer\e58aeb9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}\icon.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}	msiexec.exe
File opened for modification	C:\Windows\Installer\e58aeb9.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AngryBirdsInstaller_4.0.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AngryBirds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AngryBirds.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\GameUX	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\GameUX\GamesToFindOnWindowsUpgrade	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft	MsiExec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Rovio Entertainment Ltd\\Angry Birds 4.0.0\\install\\0BBDA25\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\ProductIcon = "C:\\Windows\\Installer\\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}\\icon.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Rovio Entertainment Ltd\\Angry Birds 4.0.0\\install\\0BBDA25\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1BA90510BB489BA41A2483FA0ABBAD52	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\PackageCode = "AA191C5CA649A894FAB402009F67E7FC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EDE61A217CD2D9D43B7A1E47939554A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EDE61A217CD2D9D43B7A1E47939554A7\1BA90510BB489BA41A2483FA0ABBAD52	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\ProductName = "Angry Birds"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\PackageName = "AngryBirdsClassic_4.0.0_PRODUCTIONCLOUD_rovio_DISTRIBUTION.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{69308589-E982-4D78-BF69-EACE042D5498}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1BA90510BB489BA41A2483FA0ABBAD52\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\Version = "67108864"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2148	msiexec.exe
2148	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4292	msiexec.exe
Token: SeSecurityPrivilege	2148	msiexec.exe
Token: SeCreateTokenPrivilege	4292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4292	msiexec.exe
Token: SeLockMemoryPrivilege	4292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4292	msiexec.exe
Token: SeMachineAccountPrivilege	4292	msiexec.exe
Token: SeTcbPrivilege	4292	msiexec.exe
Token: SeSecurityPrivilege	4292	msiexec.exe
Token: SeTakeOwnershipPrivilege	4292	msiexec.exe
Token: SeLoadDriverPrivilege	4292	msiexec.exe
Token: SeSystemProfilePrivilege	4292	msiexec.exe
Token: SeSystemtimePrivilege	4292	msiexec.exe
Token: SeProfSingleProcessPrivilege	4292	msiexec.exe
Token: SeIncBasePriorityPrivilege	4292	msiexec.exe
Token: SeCreatePagefilePrivilege	4292	msiexec.exe
Token: SeCreatePermanentPrivilege	4292	msiexec.exe
Token: SeBackupPrivilege	4292	msiexec.exe
Token: SeRestorePrivilege	4292	msiexec.exe
Token: SeShutdownPrivilege	4292	msiexec.exe
Token: SeDebugPrivilege	4292	msiexec.exe
Token: SeAuditPrivilege	4292	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4292	msiexec.exe
Token: SeChangeNotifyPrivilege	4292	msiexec.exe
Token: SeRemoteShutdownPrivilege	4292	msiexec.exe
Token: SeUndockPrivilege	4292	msiexec.exe
Token: SeSyncAgentPrivilege	4292	msiexec.exe
Token: SeEnableDelegationPrivilege	4292	msiexec.exe
Token: SeManageVolumePrivilege	4292	msiexec.exe
Token: SeImpersonatePrivilege	4292	msiexec.exe
Token: SeCreateGlobalPrivilege	4292	msiexec.exe
Token: SeCreateTokenPrivilege	4292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4292	msiexec.exe
Token: SeLockMemoryPrivilege	4292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4292	msiexec.exe
Token: SeMachineAccountPrivilege	4292	msiexec.exe
Token: SeTcbPrivilege	4292	msiexec.exe
Token: SeSecurityPrivilege	4292	msiexec.exe
Token: SeTakeOwnershipPrivilege	4292	msiexec.exe
Token: SeLoadDriverPrivilege	4292	msiexec.exe
Token: SeSystemProfilePrivilege	4292	msiexec.exe
Token: SeSystemtimePrivilege	4292	msiexec.exe
Token: SeProfSingleProcessPrivilege	4292	msiexec.exe
Token: SeIncBasePriorityPrivilege	4292	msiexec.exe
Token: SeCreatePagefilePrivilege	4292	msiexec.exe
Token: SeCreatePermanentPrivilege	4292	msiexec.exe
Token: SeBackupPrivilege	4292	msiexec.exe
Token: SeRestorePrivilege	4292	msiexec.exe
Token: SeShutdownPrivilege	4292	msiexec.exe
Token: SeDebugPrivilege	4292	msiexec.exe
Token: SeAuditPrivilege	4292	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4292	msiexec.exe
Token: SeChangeNotifyPrivilege	4292	msiexec.exe
Token: SeRemoteShutdownPrivilege	4292	msiexec.exe
Token: SeUndockPrivilege	4292	msiexec.exe
Token: SeSyncAgentPrivilege	4292	msiexec.exe
Token: SeEnableDelegationPrivilege	4292	msiexec.exe
Token: SeManageVolumePrivilege	4292	msiexec.exe
Token: SeImpersonatePrivilege	4292	msiexec.exe
Token: SeCreateGlobalPrivilege	4292	msiexec.exe
Token: SeCreateTokenPrivilege	4292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4292	msiexec.exe
Token: SeLockMemoryPrivilege	4292	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
904	AngryBirdsInstaller_4.0.0.exe
4292	msiexec.exe
4292	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1312	OpenWith.exe
1876	OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4292	904	AngryBirdsInstaller_4.0.0.exe	86
PID 2148 wrote to memory of 3280	2148	msiexec.exe	89
PID 2148 wrote to memory of 728	2148	msiexec.exe	105
PID 2148 wrote to memory of 1772	2148	msiexec.exe	110
PID 3280 wrote to memory of 4612	3280	MsiExec.exe	112

C:\Users\Admin\AppData\Local\Temp\AngryBirdsInstaller_4.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\AngryBirdsInstaller_4.0.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\system32\msiexec.exe
  /i "C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\AngryBirdsClassic_4.0.0_PRODUCTIONCLOUD_rovio_DISTRIBUTION.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\AngryBirdsInstaller_4.0.0.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 79253DB91CD85D4E79E6EBB4674A5198 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe
    "C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AA62A75648C5E261E789C2E60683FEC0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:728
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C27A0B4E4BA232C38A830610727B1CB4 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4968

C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe
"C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58aeba.rbs

Path C:\Config.Msi\e58aeba.rbs
Size 430KB
SHA256 14d209404d32f56aa1d7c890159e4d368d948f93233e667821f7b69093e58d11
MD5 d02906d3357ce5975f46719c9ff068c9
SHA1 464118b3948b5c2b005945fba4f09426bd159fcb
SHA512 7ffec6b5e1b559418c8ae4ce1792b90e58cb3486555a519a0c05b80b8d389469532b659cf50f9e4249772a32509a226041fce2fc94c8d6fd631650fe2703e695
SSDEEP 6144:ejVf/porSSbfAQ02nJsK0uvjedgv0Zs9WXtkhU2b4RVfG2wA/19U/jCa09t+AQ54:WKsfhwAt9wjCawt+AQ5nn4
TLSH
T170944250AA25F6D9F32F5F3733C14E19481E9C243A70123D729C8F6E8FD1D21A96D98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AngryBirds.exe

Path C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe
Size 1.7MB
SHA256 495a994ce55aa12a7052b24afc6513f9229fc7d804a549e1512e1e2077bd81c4
MD5 c8014f54a31d03444eb1939f66182693
SHA1 fbe9d8106397937c12051695d9dfa71d7fb6b165
SHA512 5c20c0f938751295274bea94d31b296c06dc981b0ccd01378665671b4931ff83964ff46dbf88143624012a0dad517d71817fc575170f65d72487bad813b63c4a
SSDEEP 49152:LDEkjzoUB1cGvcrnHe1dnyjggQvtoZdMXRgZRXVE5QTGZ0w:LDEQNzcwWnGdytQvtoZdMXRgZRXV
TLSH
T104858D31FA41C076F9D241B6DDBC2B6F592CAA31176925C3F3C80D4D6DB42E22A3469B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46DE64130271B61D13A0FAFD9465377C_84EBB610FC8D8EF3B7713A6E829172A4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\46DE64130271B61D13A0FAFD9465377C_84EBB610FC8D8EF3B7713A6E829172A4
Size 2KB
SHA256 569f4d6ae2a89ad2d65ee2943fd3dadea24aca08610914460a39390a8d195404
MD5 e7943b237adc2d9ee1010b73cdce25b4
SHA1 1ea4b24771fefcc2b99baf6ecbab45729b4f3805
SHA512 58bf325433eda155901cf777ce5305077b26479ed38f7679ff6cffaf206a5a953b7307cb40b12795c4ea20e9505dcc3547d93ceedf2975fe059a84eb89694d20
TLSH
T14441ECEE558448F03E434F44EFF5D6360C34637430D31476E8A4DDC764DA768161A84E
MD5 SHA1 SHA512 TLSH

Submit Download

BBB768C456D9E2DCD3EF595C400D483D_64C05B9EB32FC3D0CE6CB126561EEBFF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BBB768C456D9E2DCD3EF595C400D483D_64C05B9EB32FC3D0CE6CB126561EEBFF
Size 1KB
SHA256 25db8a6c7385bd85e89a2e75bd46a1d2189c5032570d08b79e9dd86d04647a25
MD5 21163a0091108b99efdc4283f837bc7d
SHA1 9838c4d81b42550cda2cf135a5e108e0123cdca9
SHA512 20da43cc5a2f69c53ae9ec87a76f4f2a7f3e602051d34698d15d37fd7f5dd4b7c3bc9facb50e95b9ac7c2615a451e55acefe8df18b0a47c305be97a033ec4f8c
TLSH
T17F410ACB732454316F53CF4869B6D4369D39F34416D2017AA8EDC8D364053991D59C9F
MD5 SHA1 SHA512 TLSH

Submit Download

46DE64130271B61D13A0FAFD9465377C_84EBB610FC8D8EF3B7713A6E829172A4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\46DE64130271B61D13A0FAFD9465377C_84EBB610FC8D8EF3B7713A6E829172A4
Size 466B
SHA256 1414889dd34d022fa9bb7584d37beff82ba432f77b9cb196b039bfc001bd4fbf
MD5 f8b86af3b325e82bde1a8f713f6c7fb5
SHA1 fca6c150d2436c93c7a3de0b682b2708f0ece978
SHA512 0de0c5cf19de6d6ad84c43a8b4bd1f5c532a1ef1a37dcef43f40ba6424b48492042f3d11f20a0e19088a8226852e365f813dfd37161c1e1483a58dd9c9923959
TLSH
T136F02B2425F5401DF0FBD63C86D194F1CD39F125741462BA6BF11B47BE04F009ED2626
MD5 SHA1 SHA512 TLSH

Submit Download

BBB768C456D9E2DCD3EF595C400D483D_64C05B9EB32FC3D0CE6CB126561EEBFF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BBB768C456D9E2DCD3EF595C400D483D_64C05B9EB32FC3D0CE6CB126561EEBFF
Size 444B
SHA256 7344d3ce416a54cdcbe0c5b92bc27abc7faf5c371b7a9afe27c7e2795400f54b
MD5 b01e55fd3ac47ecbb9a3aa3fe2b3ff6e
SHA1 4a42d0d1a72b0e607f6295dbb94c79e2ce4e8aeb
SHA512 4c718edb4d4c4092ad81dd4a7074089a2c3801e118ef9ca1a27965394efb0ae127aa6da8ba9034579fcf2437521218f6cdd39b9ce8445508c96caa250207548c
TLSH
T12CF0221824F5023AF03BE93B83DAABA38929F20236002A710BE34B14AA19F406C3181C
MD5 SHA1 SHA512 TLSH

Submit Download

MSI74FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI74FC.tmp
Size 77KB
SHA256 19989417f3f411c8a02aa09f1dd51a7febc530f0f27c8d3f7dd195ba224e6fba
MD5 7452f56af87d0912c3a06206dc77c0a6
SHA1 5ff38786b61d5061ef0a09a670b98e5d3b961b1d
SHA512 e07a612edeb6078f9ed639018a1e22e30dc4b8bf9820f1dadbf405722f32f5e2348ca5585c1d054e857b0644c9d824b44dd64ec4a8d424c2e78aeddc1bc351b9
SSDEEP 1536:0+aeAAphyIulPMPxXEt2SJekrv7qMePdX58l:04AkyFlkPxUymv7qMI6
TLSH
T13C734B1272F49075F1A729717FFAD655C3B7F8A568B2841B8B520C471AA0D82EB26333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Angry Birds.gdf

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\Angry Birds.gdf
Size 6.1MB
SHA256 0523638bacd7f74092c9cce466967d6697dd5f6b6dc3234f738394dfbc7934bc
MD5 421b79ac2cf97ae41213f74cb435a27c
SHA1 c0dfe80394154fb89171c31e2f35a926b86a8520
SHA512 dd9ef5527da8d06d5e21c99e5500440bbc453358549cb901b116defca22f2d488c8d367fa41670d7e44f81dae1b5f39df29bf68fba4e3e5b9f9c640e73e8785b
SSDEEP 49152:MKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK:
TLSH
T1B2560242A394902FCC6B4971E85D0456C63DBC51F829692B97903A1E37F293BAF4CF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AngryBirdsClassic_4.0.0_PRODUCTIONCLOUD_rovio_DISTRIBUTION.msi

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\AngryBirdsClassic_4.0.0_PRODUCTIONCLOUD_rovio_DISTRIBUTION.msi
Size 3.1MB
SHA256 8484fd14d9c04c9dad0664f2eb298fa89f9aa9548e2f2d6219ab7ebf4a716d47
MD5 61e3a570599b183608c9a9ac5020f09d
SHA1 dd64ae2006383936e58f1106ea6b84d2cfb87aed
SHA512 0e15207b9faf811ccde8397b885b0a3a3415ed6d67223f67d01f72ec39810ac1707b56fead3d77c6b62539810e4cbafda33a71f11dc61b5ad60aa53c798c34e0
SSDEEP 98304:GY5AEvMZ/RnzIv3tKeandz1YHKfVDnszq:RvIzIvdyV
TLSH
T1C1E5BF1AF1D48636D99603384247871389FC9838DA66451AEADFC20D3FD75E4B3BB6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BeachAmbience.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\BeachAmbience.mp3
Size 1.5MB
SHA256 b8c5315331f8cd9356f9d6ddf968212f7c748b1ac4590f237a299393ba36609e
MD5 660edad23278f78998b0298b6e51f144
SHA1 dd9f7113b4c20ab9161a98e75859fdd4b6d47484
SHA512 baed531d4a33b001714f19330dcf1b11aa7fb097eb801fcb340f8f2f39606afb5f0d10ed9592d692b6ddfec803c29980dbfcab2f19bd555b0dc9ce1d4f3a3210
SSDEEP 24576:bBy1kzitdDqFIQ/mch7xGao3LbfgBD9gNUqGB/bTM4TKR3jzZvJ7TEYRlNwSYcRe:ZivVci3ojgNUqw/nM4TKtzTE4qcRe
TLSH
T111653351D389FE03D500E3B9AFE34209E114FF463F503EA25E19CF9691DA06A7B58B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RainAmbience.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\RainAmbience.mp3
Size 868KB
SHA256 d5fb460d03b8a0e74ac075abf1821d3ccef4651f3583a55c207ed5f505bf95ca
MD5 fb50b71d122bc9366e227b2035296ed4
SHA1 b90f1940988077be06784da3959957720138d462
SHA512 63e6a58f31853a453ab561ca47bb8ff30e87f51611c68444de2cdb0646b0a3185b383fac0c6cfc8dee0cf1dfff8a701142cb828a8bf68567c84ab339cd6c1800
SSDEEP 24576:6/hkuCAW1TLOlpOm78mMLbaB5u3rL7CJHAJZMcdt:6YFE77caBmmJHAJZ1
TLSH
T1DC152362BA02CCFD99D6082013F35DD695F5EB5F314A32A299F48F8393B964337291C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab_cave_ambient.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ab_cave_ambient.mp3
Size 934KB
SHA256 d93725def68b368ebafaadf4710b2a53d5af2fd5d331b58798fbcb29f9b6f6f8
MD5 0218e9a045ac80e705b0031f43918380
SHA1 aa500947c21adc3d4879d5abb7d7796d57cdfa8f
SHA512 57217ee2acc83f9871ceb48fced8a6414e9b77e7b969f9fe921cd7c8a32dfff1837607a9ccc38f291948d6b0e4a12ba61072bff29656f4c9af6e818e218c2a63
SSDEEP 24576:pCTVLhwl2M+hHNR+tGL1piQ0kzU1RwB28la5c:8B9wsbWtGL1pLEo28M5c
TLSH
T100152311EDA6E159EE1653F04E1EDBC2D4DFF4342C2329E8368ED7A4B1E9061F9D1206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambience_blackbird_01.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambience_blackbird_01.wav
Size 5.5MB
SHA256 637056094f63e8a6db85748d6b5af19c2d578405eba7fe0cb6501736a10271c6
MD5 5531822396b6f4aa9ab7b647c9c323ac
SHA1 58b190be84dfaaba08fa212275b93f6e15a54bd7
SHA512 68b0c7d500cba99f55148526eea272d7ff05b675225c7b7eac2a5f5f9dfa7ef114a9caaa4ad4c557afbaa9572015be49844b1228311fc54a4f152ab3e4910e7f
SSDEEP 98304:ENXsLnlPg+hFjbFMFXS1h9Cr9HrJ9CJp+98TaN3CFBBMM+7qTANEml//DWyBw8GN:PpPPhFjbFMdS1h9StCr+NSl3+pNnlDzu
TLSH
T199460203FBB352D4A676E4A3AD8D00825E41B68E8D4161BF726FC51BB1D3620D9D73B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambience_waterfall.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambience_waterfall.mp3
Size 665KB
SHA256 4ad5805317a25bd1fdbb94ba60017997045c1988fe7ad524516ef0d28b5366b0
MD5 aa1475bb90d34ebc38faa505bc2c5d6b
SHA1 910e01850e0c7a8699073b60a1bcebacd259099b
SHA512 aeae45f323168495c74b5478ad3085a798d55afc6687ff8c17ad88087271a3b04a470f1932d923a9b33ef3aa431400e0853ca512e18f65aa75a4f0e71035cfb0
SSDEEP 12288:f2kVyagFo1buI3i1LZ8x3Gp6ijhVEK3nPfmnJLeDtsXfelsEw5r:ia9Uqx3G4ZwnnmJ6BsXfUsEwB
TLSH
T1F0E42329175EA7B6E780B77B3B87067956430BC0EA07742CD3D877211FE9BB1878A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_city.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambient_city.mp3
Size 955KB
SHA256 7a3c2fd920b89dd824478c1da55dbe90a8144c92a7ff40e91986a441f9b2f0b1
MD5 124baff841c82642385089c9a27148bb
SHA1 b429654684b9e49c2a094afe4e3b468ce1c5865b
SHA512 e1a3a63265a8fbe044e3028489e52898fc976d4d06629d0bfa4faf61ef9cd5d4dcf5ec77824aa5cf6e3d0134d21379cc387786a0df101338b9679683c4d2d96c
SSDEEP 24576:dxHOSXn9t3DgiwOfHmFbNZZ1Kv3tCHPme78/Mv33pIb:nHtXfhg/Z1eCHPme78/SnpIb
TLSH
T14B2523E72A4A17BBB2D7AEFF1CE317A6CC5559D4504AB6E005C22E51ACB726F03340C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_construction.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambient_construction.mp3
Size 882KB
SHA256 78230eaa24ac157753c414488d2fa2cb68dee6e38db5ea7d9514eadf8a6f7630
MD5 19676b269e7580035c49bacc7241156c
SHA1 4044c9e6b32a8de3ae8a7935e0da3c38a45e7aef
SHA512 b20bbfa69418fb9d20f4f000b7167cd5a69bf07421252c096a8a0957a2bd2db476c2a60efc211264ef8ed52e580ba51b1f8a1ee944fa549499937dcfee322302
SSDEEP 12288:SQIqsKzFDw5HooSnBhdFkNVG2qGRbqDj/AIJOrWDIAOTkw+W4mBBJyiRzzP6WTnT:SksK12HqBfCC2knLFIvX+WdvTnCg
TLSH
T1EC152349CA14590AE13C1BF43F4F1BD8AE580DD1A0D69FDD25ACEFBA64E56D8DCC2402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_green_jungleish.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambient_green_jungleish.mp3
Size 1.6MB
SHA256 d48cfc8546dce9d7e23d0d28cf9008005ec0f4121337e7555b176f6aa8c0f6d5
MD5 c921cafcfe46985dc888a4b71ff8510d
SHA1 7cd85b011fa5ca67fe27c8747fc25ca170be9b07
SHA512 a2ec698f59b03e11212537bc8c177d2bac3ba99c600febfdaa415dab8706035967263e2543152614ca65be9b7ed3b75986386a0a64d0888c29e79ee3e9da751f
SSDEEP 49152:aOh+ac5ndD/V5J4v3L3d6nTcKMKdzO4tctx:Rhdc5dR5J4v3Ynaf4Kf
TLSH
T15A753347CB414017F2CB53B49F53060BCE1A8AE6AB4AB6EE5CDA07E6D273658CFC5904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_red_savannah.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambient_red_savannah.mp3
Size 758KB
SHA256 79c23296d2c44f1958d15a1a7a5db87463aebf1bc90070355cb98264e4d57901
MD5 6c1b3a8858c4d7245fa8d087f7ec853f
SHA1 c62d8a30080bad54335e46ca80d83cc003d7daf1
SHA512 c3be7ba0702dfeede42ed548aa12c84e8703a026c637de7ce1fd412c428b2ddeff8646e5d3fb94e9f9ef3f2a94cbc0b8b7dea2d1d945c5d41f24f26ba6046212
SSDEEP 12288:4hHrOaKL+8o4GUnITqfYjacSKnXBsJzRyXBIUqYDXU5i3G6rgeI9la71hYclxFbe:iqaMhAj5BYCBhjJrgXl2XYSPbuH
TLSH
T179F423D1DB20427AF95D25309CB3BEE9C800ABB16543FADD84E51F88E247929F3E1316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_white_dryforest.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambient_white_dryforest.mp3
Size 652KB
SHA256 eb90dc799591de5930090b2449702b850bd8644d140777172707b4f7eba8dde1
MD5 ebc99ab860cd70a6e508fb4307dab139
SHA1 ffd3c03f91da68228f2e9ba1b334492addc90aa5
SHA512 63a4cf5b6223aa8944a2584277bf5cf86fbcf344d66ccda20f1cc8c5ccbb5e3e5f918d194fdd9916997798d2ab788dcd745b76fbfc20f9e79d3bd33d28878e7a
SSDEEP 12288:r1z/Tkq0tiEjZygE3B8csNgvAhEq8LTcBptUI4w10RINiyXUvR/R1vQt4Jwa:JzbkqupAMckgvA2q8P6tUI4i3E5/R6O9
TLSH
T145E412E26F950679F54C30B8CFAA76A3DD09C3B11544EBCA65CD8B139097881A3F4BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birds_boss.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\birds_boss.mp3
Size 146KB
SHA256 e57bfbe37f79e791283161780b24817ecf261334add75e0554d9679dcf737c63
MD5 e72d737bda7f80c3aa7e904ee42b54da
SHA1 f6b88e9ac9e0b2d143dbf5973576665baae53214
SHA512 a03d979dd1daf51a1a72078d20142ffbfbe145163aaea7477a85131fac35a1ca8ee620a499d3981d6d701bd574dd92fc61da7ce61c4a3c309ea234e2f59fe426
SSDEEP 3072:FeCHfDhmJ08ah3CxA7icVVOsDaJZemy/teQJAK:MCHfD8J0TPHosDa3em+YKAK
TLSH
T164E30199A7431424F0566A7E772BAF60C201EC6D4C06EAE1C1E4A312B2FF58D77E5368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birds_intro.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\birds_intro.mp3
Size 357KB
SHA256 199a9d5d6d8a39fa0578e6568e356c98cb9761ec1316bddd588c3013a01f2b8f
MD5 c66153a18f314aa9af6c698a6a215417
SHA1 bc8eae465ee784f8966d0788db0de219d6ddbe31
SHA512 3ee614876befe0a2fd93bd1e1620cbacf950034d4b4d5b84f10a8d0e3c205f750fdd8bc0d3ff805192479efca4c5c147d9475f5cfd783145652bc55a3e9cf17c
SSDEEP 6144:l++XuYrpsncEWvQnFaLKH5MPANnMBkUWLF7r6f32sm0GBnHUGfAn8:l+sVwcEWvWaK2YBUz2RflHUl8
TLSH
T19B74224457637EB7F8402A745F226279E7929FAB4A62E0E2DAC467319133201F3D731B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birds_outro.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\birds_outro.mp3
Size 292KB
SHA256 7719b486d88b26345d28c08875206f557af38ec33ef92005154fd3a0fa974f2e
MD5 e9234e661ff22c4420697387c9def44f
SHA1 9ea5508d6b89d09b8a6a89ac8ba5264283a0c5cd
SHA512 7b6f6f12ba8c05e825543e1f01374f4fd4ce03a65f7cecb65d1eff1ddd89286ea05d0f468f20d5593d28190a8236c5fb54c29badc04f75b7693526a121e4afcd
SSDEEP 6144:deD82tmmf9Rs2mRugmu89JxfB/yP8IPDMhDkiOI3xlsVMtjn4gM:4D8u2Ruhu8HL/IPAhAidLCuM
TLSH
T1BB5423842D8D29C0F8E2F6364D2B38A3E5070E585481C555735BB320B2D75BABBF9E78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birthday_ambience.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\birthday_ambience.mp3
Size 693KB
SHA256 a672d6c0f3abfab6427721b550c700380854e89b88e21c97644322af4dd3622f
MD5 561234feed51b118619e032561971ae9
SHA1 802527c1206dec18a51510411bc11ef672593021
SHA512 f826dd3035814f0c2744be9b38d00b19614f0bb5c13a17cf487d870e00cd8e8eadded4579d9f70f5e09cd8034ddcedd6a2a3b18f338119cc019af0915b074d91
SSDEEP 12288:IUB9vUYlLDfffaDKtxR00+V4PLzyD566QekWuyeHSpvPCU0mDjY7:IUB98YlLDf//0GC6pWuy4eX1v6
TLSH
T1F5E42332EA983A35F1CD52B59D62B342B21A17FAB3473850B9456B4013EF43B33BB915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funky_theme.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\funky_theme.mp3
Size 1.7MB
SHA256 6c52b0d9438cc379fe16818604c818c60e2f3ea3727754c92a9ebfef1533514c
MD5 8685fe14227131550e7067fc7ed25179
SHA1 756400eb47a1a6dc05bfb5f1b4a8b6969d1f8e23
SHA512 09097a5e9835e370dcacb660d3946193dcf4bd3b9cdd4613309ec46d41341c240ab990c15414dba0e5dce5c8cecf94bf03cb7493c7dd93b282a64d926abc3cbe
SSDEEP 49152:N/GFZI8BmuVw/pgj4iFPNDGJSRhF0RP84e8Hl/q:xUFMuVLFPNSJSRhuG8Hl/q
TLSH
T16E85230FCB106226F7085BB4CE5733A8DF596BA00A4771D85A147B6970B31C8FBE4B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game_complete.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\game_complete.mp3
Size 283KB
SHA256 966a98b93f7c6bb23b77f64501efb03b6edafce184bae7764d538dffd695c2d5
MD5 716b8fae5dbf608787d96b55e8882e3b
SHA1 b9268e5f587a2de6e4eead56bd1208ef222f4915
SHA512 dbae1ca4176349ecf7edb9e4f420177121aaab021f48e0985c38f7e3d2aa98e576e2cbbe74441f707507285ba3018bfc31f4bd21e97f277d6db13619ebc64c9e
SSDEEP 6144:OTmrAU6wP/V9Vdu42atxnTjc8Gf17msuFykBYkfgju0ISUdcuEfLK:O+AsNu42aTTI8E17Fu0FkL0IVEm
TLSH
T15F5423D8E680D38BF83B14394C8539854B7A9F507B29BF9AA4F13E4D8DB4490730756E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_0.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_0.mp3
Size 59KB
SHA256 f2e54c5011b25f5f78443b1c474876a2661a2848ce505a1ccf1f9dff05cbf293
MD5 04db30d08d0f7781cbc4753de80fa751
SHA1 89c6aca5383aa25127a64030527fbe82417dca3e
SHA512 0d8c446107991e161522f448f0d1bb68223cd8bb3f21ca44a853001c1916ba727f2e299ac84546b2763ce9686334182b3e637156c99bb36fe73658564fa448c9
SSDEEP 1536:a+tj3+QIfkd+fCK450HEmOq+e4wyS3HpgnqHx:ak3Akd+fl450H9x+83HpECx
TLSH
T13A4302798B0606EED164B131B63E0F064AFE7365BA46F1CA52C74F2E6D3442C26178F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_1.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_1.mp3
Size 116KB
SHA256 f4db91c1308dfb4637557e22788d8f9e4fe30374824ea48dc895a710d9fa2b3a
MD5 35771beda6baf3cab1ea24ba2efb19cd
SHA1 50187fda73231a5863244e9df7f292fbe92d8f72
SHA512 539d613a00652453e4f74f5996005d87fe02796d02cd8dcb7c8fd6e5060818d19d8e4625400785c490668b45cd70571ccb1f03183555be457d7187f7d2a6a20c
SSDEEP 3072:47UiPzs88m51NtkjnOj7tVQz8TbNG66GTIhv:47sQkSj74z8TR2MIZ
TLSH
T137C3126587107ADEF0181C33E12C6E42A598BB6E775532D924E0CBB3BF2C6463F21AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_1_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_1_2.mp3
Size 118KB
SHA256 876f694ae807295baf2e61d88dad37a8e8058ee67c7da2bce393cc8193446815
MD5 a27690acb719d6aafc436b9e4344058d
SHA1 380df6c2a872b91976d415ef7fb3652fb98fdede
SHA512 331e5f1b8c3fe5e8ea15c1fafc5cdd7b5d1b3a8ec6d2d5ab378bb3a833151711dab17c067f9a39053912a32cee3705b7aaeedfb7b13b5276cc8ad5a7ca2936d8
SSDEEP 3072:THjF5RGnIVCO9Fg0CLlfjEy62meq69z2gh2ax:jjnnLklT62Mk2gh2g
TLSH
T1B4C3028613989D0DE0B30870966DD6B0C3B9BB13FABAB55BD3D68B604876A5B3F150C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_2.mp3
Size 119KB
SHA256 afb18b351da719dfdb53b7bc3a5554e707606df3cfcce9e3a19e573302e4b0c9
MD5 2a36d0792447d94efc9b4c3e65b74122
SHA1 3593bb6af36aaa72375a13613a5d2409fa6db421
SHA512 53ac5657981a5ecfcec2c039822b0c94359ee806f0d743c2c64a47bfa579e66e5f52737c795045208fb3014f4483881afef34d863404767ab1372a68d9f7a58e
SSDEEP 3072:26Tegc5TVDv8yFchOzYj+kntaMosO6SlwM6SejJLg6:2Ceg8TVw34Eaknt8hlUSe+6
TLSH
T13BC3128749026C2CD194097315D2FEEE11FBA704322A6F5BEBF8B741347E26465EBB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_3_1.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_3_1.mp3
Size 122KB
SHA256 96f0c4cc6fb1d9f71e2fcccfcc1fdf509676f44279a58916eb03dd64aef3335a
MD5 214c5c49fedee6c2755cc355504b0932
SHA1 6c9d035572e8b233df34f1ec665d11b5b864df47
SHA512 bd973c2289c1f726c222f0cc94a8615993b0a8f3ba91e33b1f5f2cff670cb18a7c8604050f07f6a65748bc7cb7d142a8e1d64325bfbfa93813f180bcbb20e3b5
SSDEEP 3072:FDKFubBypAuN4cgEmuMeX5HZllyJoccoL/Mmu5wlw3A53w1OkV:FcOuaW55u9/o5wl/53wge
TLSH
T1C2C31215EB84678CC54F0430FD988D41BE7BAB6C32606ECE7FF1672098B5FA97898254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_3_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_3_2.mp3
Size 121KB
SHA256 1540bd5cf5a388a24c3b7a130a338b1f415688b41038de7abc9f10e7962f870a
MD5 f9d5825f8a58479271c934a3e73b0cbd
SHA1 53e451d3f0ce36b090fe7d9a4f925fd42ff5b2bc
SHA512 0223ba939bed6454010d3e145bbfb064bfc3a7029725a40c9f92d0b41a10073410619df702a0b6b085328ed57da19285f0f9a8ebe55ab14c5c271e2fe388bea4
SSDEEP 3072:F2ndcS7jqka8v/YocKIb+A6OXhCIKe/zHKGnFdfstQp/VEU4qj9lEPi2P8:4cAjqkpQocKIPX5/TT90RylO8
TLSH
T1E6C312158F1E662EF0496B3288809F3689757FDB3A30B03633E48B467077A74376D94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_4_1.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_4_1.mp3
Size 121KB
SHA256 c5f9d9016859115d99e7e9c873b4fc762d4cea139bc60cad608d9a0f4179813a
MD5 bd5dcfea8407f1a34aad3665506ff069
SHA1 567655424e127a63e3958e8f8e51bc72ec1c19d3
SHA512 d425669f7647aba605d80407a6c2dc86ea9f24c9d1df3a6bee62f381ba5eec4fc01230edabafbcbddf831b0559466c04924d0e6593bf45d8f162e519f7494e22
SSDEEP 3072:pUZ51dUYRTBEFcZbX/IIDUhLgeAoPDcA880AyV7ab:c1deFcdgDLoqDP880Atb
TLSH
T1CFC31228F38E08CEC06988F079DF66A1E9B3FF5D71A439C081F68F229635751791A2D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_4_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_4_2.mp3
Size 118KB
SHA256 d1c5d822ca6fe469d1f37333d3dcc7f945553a78c64fb02e3a68cd9189fda7f6
MD5 9f13e94612c225d0046ba268cefa3772
SHA1 5fd9f794b94b7631f840a646fe102f954964bef8
SHA512 4e0607ceca1ca7f0fc418935e3bc532eadd5dfcf80ec08663dfd29a932ae92d15816df99be798ff69bf5baacba289663ac0d6cf307408ba9cfda643caa75b9ad
SSDEEP 3072:tOGPk9slqXU0Vvy+nrSRpiirVLfnmHgx0flkV3:tXPkV/k3hnmUukV3
TLSH
T1B0C3025A4F47841EF45C523482706B9AC1AB2F557261377F1AFAAB0B89778B1FB104CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_complete.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_complete.mp3
Size 69KB
SHA256 da50606f54269411f16050dae2483ea3c633263f93948372383ff692626d8e5c
MD5 6ee709ad712efd87c4adbdd196047bcf
SHA1 c1f8620d03783a6cd1e1a7e439d20c65ce006faa
SHA512 2653acc7df82694a23aba88bb2767070a75687cbec3be58f5183413e39e6b91a5aa51385a5645e0143ff44260ef1349cad28563512cc8e780a4818e0c2307f4d
SSDEEP 1536:3kTz39GJ+13BvxxwwqmLiHdHjA6EMoMoHJkFD:Uy+1xvxxwwpiaZMopc
TLSH
T1BB630251E615EAB6CBEF977B2CCAA98CA81BEC30380C4B1E4171FB6C347118575DB908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

title_theme.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\title_theme.mp3
Size 1.6MB
SHA256 f2dbbd3062a49eadd26b796a3d65124fe0baa9575010e00da7b6227abb2c8fd5
MD5 b46455b10456ceb62733626adecb9d21
SHA1 5ce4604c641924d3ce47cd66a2c1f6ac198ef60b
SHA512 de762bb23f19baaccd43280018fad96221944f251f7fb56d856b834595cf71190141254bd4280e7e7e8084eebb2496d9a9bb7bbc694fca8de9466140bd80534a
SSDEEP 49152:mVEp5Ktx6zUky+Iyp14e0Wj01apoTkO4noAule2i:lUx6GgpGPMpukO4noAuZ
TLSH
T13E753327A804B827F06845F0DE5175AEBC3A0DD9717636A56D727BA6E832331F20FD84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accordion_break.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\accordion_break.wav
Size 122KB
SHA256 d5217c9b69c36e69659a37ed7625bff291e30c21b7f16c6f5a82fd27908e91d1
MD5 5dfaf665ac21709c3754b6817c53cc06
SHA1 4782a0a59c93fe970b6af9790ed97485e7a58209
SHA512 54ab597d601a9575d28513ca58cdc79069fff97b2e1ad77a8c846ccf5b7b7f6de8c2168f472da9ec55560507e049a3ed9a7b105d1ded51fff8df5b7b181bb923
SSDEEP 3072:D8MmtfmCCYN6J13ktQCwlKzmosSXHk3Id5uccKe/L4:4MuCIIO6VQTXbtcKkL4
TLSH
T179C3DF62F5D30B0456B75621AFA469941ECDF85CBC7469BB9907CE80F283260B7227FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accordion_empty_pull.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\accordion_empty_pull.wav
Size 105KB
SHA256 640393fdd29346c65c20cae8aaaecdc9b2c7a5116b4024304b5de14dd288ff68
MD5 d55f84d183064cbcb9521c647fe03e39
SHA1 5a90a8529a2727a8241bf53c28ce7db882be8294
SHA512 23adca375c2b75094f5332e45c932c1aeb6e014cd60fc8011c363f77ae5b00f7fc88ab1a4999a2fb718af098d3d59dfda07fb08e10d9c9fcb0ea72d0c2270708
SSDEEP 3072:7bc8Epr/yq0BrL/rqGcLqOJne0B5Jpa9LH:7bc8AzGX/OtNJnFB529
TLSH
T1A4B3AD96F1A30758607752759E8489416DCEFD2C7C625ABFA90FCD46B343320BA683BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accordion_empty_push.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\accordion_empty_push.wav
Size 124KB
SHA256 9dcf6356dd30b16806bb6d982cd463c061e8095d5d4184d182f4f36527f19f60
MD5 07924b955b04cc14d6c4da3437ec43f4
SHA1 399841a2a0098fedc3085acc6ff273c06d8c8880
SHA512 ae64d85e2260a8a3e033d08386e09311e1c15589152ecea1fa3cac39290f350b6093a625a455e8c46a053c943ddc2a9575d224a1c726e785d83bdb91763bd50a
SSDEEP 3072:fPrQEupmT9B0caPu1V0QscyMx1Uhtq7C9e44rF36XlVbzlFqh1Vus:fPtVkcD1qjL4rZ6XbbxFqfVus
TLSH
T151C3DF22F0A30B48643796756D9019054DCAFD1D7DA66A7F698FCC94F323730AA613BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alarm_egg_stolen_01.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\alarm_egg_stolen_01.mp3
Size 20KB
SHA256 b75e663c8e91d34741f3d4090008b13dc4728bd8d16db6e34adb19f933d83455
MD5 551bc631bd68110b4010dc3b5a1b9269
SHA1 6636e2497e4596a6e0b762e00e67d4798ef4a8a9
SHA512 c056aa615167790efdc8f3a0494e36f8254135d1b0ea7330e6b99783ef34398b536edb7ada17ececcf91cc2a22cea95fd86ac7b6081cebd96fd2fc32f82299bd
SSDEEP 384:O7u9D+zknlizwpHOJbFGFaewaRW6lo4n4ZhF+bxpoLBy5v/1nQOALr:aoa4VOJbI8qW6e4n43F+dSdy/Kr
TLSH
T15592E1AE860142DDF54576F1A5663106D1FEECA2389F210CEAC54ADC997FC201B15ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alarm_egg_stolen_02.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\alarm_egg_stolen_02.mp3
Size 23KB
SHA256 fda38ca5fde3d5cbfc3e2d9946d98988750800bc970ac204b3690510c5f66924
MD5 6174a020209e861befc80ff5d9dff0d7
SHA1 5d9fc6453531b609a8af7b3faaa859a0d97c4cbf
SHA512 e5b67bffe128f3b8db17560a2815135e5d2f87e490df2f421643bbb4dee9224dc1867ffef4f2f3061bdba89668eff5e7bd968e8a3e99f6a2326bbc97a9967342
SSDEEP 384:zr89OJdJGTOo6fJp5J0aB+BGscPq0xsmE888dnS19LTmqRN8vJ3/ScSF2p3eezgQ:zr89OJGqokJp5JTtPq0Gu9dnS7fqdZpR
TLSH
T191B2D0E0CAF71194C06D73F97AA3582C251AFAD94FA8CCFC62E80235337D8874916B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alarm_egg_stolen_03.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\alarm_egg_stolen_03.mp3
Size 15KB
SHA256 4402d03b3d77652e4bddb92fab3ff62c3d40d88d212d9da9fe8da20dd041506c
MD5 ed9338910448aba841af378b4fc4711f
SHA1 8afb25aac43546d82de1dccaf9a402af45ca735d
SHA512 fc25147699953bb89179e1e9e8a1e420999cada7e65b37af38ad83a3e26a46010113844e1f642eb10df2962fe5a1ea58abd72e1f952f01e1a27206bea240b44a
SSDEEP 384:yNSpBjWp98sVgaPcxROdZsG0gXNDWkdyBJGsLarh6:yNaggBTDBJLarh6
TLSH
T1C062D16648980394E02F4DF485010FC95876D7ADDD19AA7E30C4D5907F9F3D3AC6CE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ball_bounce.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\ball_bounce.wav
Size 28KB
SHA256 11a20f27efdebdc4261004ca6abaa4d6b57b1654f747939fff316739cd9eda83
MD5 5f50a097907cba5e7d8d792465096be6
SHA1 7638e271c30383cf3d2c3c2b9a26e173d72ffefd
SHA512 3413ee82eb9efc0cc0ecf46d10141a98da3b14325eaa9da02ebf8c0712e8aada57a82ffef28b70d7c74e22a7bf594a87fe1fc79f42e3389ad216a210a4571cae
SSDEEP 768:h2uR+KErRsUGbpPrl3XZK0/rfIcUdjNt6jpSS5F:h2spErRsUG9xZK0TINdJA5F
TLSH
T1EED29D52F813591AE67F997BCBA3DA300A663F16BD09510F3240B6816DEF344B35EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_inflate_01.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\balloon_inflate_01.mp3
Size 13KB
SHA256 5765d814f21a63b09d464ac2b0debc14bb13620b676a9b9daef3e8119413e8d5
MD5 d5327288e048105178b68e5859a98090
SHA1 3251e0b2b8146cecfc79e6020db8e53e9db9fd9e
SHA512 139d5adb786657778929b99f7b22333052802c89fdbb4710426134bc0d481064f0d8a45db76718546f06950b29c90b164a2b0fad52ea52da2320a5827b06bb74
SSDEEP 192:/rNlk5gg981/rQUGTINDXP8nNk07os7pVGZzwAmvBb4ewyIthbEcwJKevareGWL1:jNS5d98jND/1xstVGGAmZUewyj/iY5
TLSH
T1CE52D0A4292D399DF6AC47F6522D8F0DE4890EC4C88D9B762422E52000376B7C3E96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_inflate_02.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\balloon_inflate_02.mp3
Size 35KB
SHA256 a586ec1653a052fed10b90d963a0d5ffbbadee565500db378116b3b12441f790
MD5 0e39e1c00cb70e37e2034cbc3f9e51b7
SHA1 ecbc3db66ccd8dbc62d4509b9906cceec5ffd6fa
SHA512 3868b0230b976658cb17cb2591d1c8c7cc225ad07dc63ec94865471ea6f40ddb899a51923b17c1ae15844206543c8e79f563ed55391e48b0e2d4dc93306258e7
SSDEEP 768:bUro/aNSrJIaByav4Cvk8TdNAODAl5c+K+fV4DM7cDCniVLpP0B:Y6rJIaBy1CFy5c+K+d44sciBpP0B
TLSH
T127F2F1D2602410CFDC802F7FFD6A2A478AA7FE9004167EDCEC7785B6A46B5A647A0510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_magic_pop.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\balloon_magic_pop.mp3
Size 24KB
SHA256 4b229be78b89a5fb0f2385ee00aacc8d17b7579b6749cb81fad6ed2f8e69282c
MD5 2de9e72cc867b15c97ce4a7a5de3d757
SHA1 24b545d0b34cd90ea3e95108b7f49ddd479dbeeb
SHA512 4da44e3669302d7f03bb19f4b23b898176de0e6cd0b80858684bd2ab10ea0acde2d9e59837f14357712f36cb82af8291e8750cfe00878778f9e5519b99e8361e
SSDEEP 768:b1bfbQjF1i//V12BAZQ4YtnxZBesgbbNgyYUixYtqNL:xkA3mBp5Resgbe5jYtqx
TLSH
T18DB2D1BED91CC56DCCD96AF080FF584426852FE473A0F6E0A6997483A83B5F2D0984D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_pop.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\balloon_pop.wav
Size 21KB
SHA256 20bc621567696c8892c1b4b4a49b282b14422a1f0f657d4c686029e38938a6e0
MD5 3b7f554efc3e5cc2a6f06251f28acded
SHA1 b94316836ea529536eec9d63bae2095a3a6b12ff
SHA512 61383b08ca9c6c499c0df522180f000c20f46668cb30d8167909b41ff1d0819b621cd48d14fc663687ac30c86a497a6d0f23444956a505d80be84e27a6129152
SSDEEP 384:msAEpHxf5yk2XPIrrbPh0kWXfWNu6MQ6rg58lNR56OD8B+tLoIeKM40RWRH/pdTb:TRokCQbJ0kU2u6/mxQ4KIeKeEv6k
TLSH
T164A2E13890A71D9CDFDF1A3CEF7FB41394429489E8123D2A830D4DA2B54A7447DEA522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bellows_01.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\bellows_01.mp3
Size 6KB
SHA256 4b17dc5f02605080b2c34b6ef4fda74b796048335dc64b25b60c5293fcea6a66
MD5 0b1b7c02c92a566db92d3151c7396be2
SHA1 f7121ef3aeb2a57da83d5eff77f4b9de2976014f
SHA512 171ae2bf3580875bca0adf695f2714395dffeebefc855387db0131a27882fc4d53bbfc7a69ca6e74749715ee2456f0027506654e549dd3be9a6f7b75d1b21176
SSDEEP 96:37B4wlQVg9AqKrSkWDNvgyASZXH01xvd6SJ3RFpCvi/UMCdQnTlx+5qSn6nm+wgH:3Gq2jTePAShU1/6OLCMe+x+J+lAi1
TLSH
T177D16E3C95470059F12B6A373CFCADA1EFB348A9598CEE9C33A0513604776097F95894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\updater.exe
Size 1.7MB
SHA256 49e125d5be812fbc1ea5012964fee9278499796b034674f7cd8155840e4cca3f
MD5 6bcbf649f91684e24a720bea62d40feb
SHA1 0131e07705e50934c8129867120e10a91f4b5d1d
SHA512 6d3aeb8348ee61690f72f75817d977baf84b825957cd24f00395bfe1405991ab2cef73ca8790d9a8a4a91601ed6ee364e7ee56be0948a873df0dcc4354522ac9
SSDEEP 49152:Jz29kv5555555555555555555555555555555555i:Jz29Q555555555555555555555555553
TLSH
T198853A0263E98519F0F75B30A9B257B11A37BC52BC34C74F6A983A1E1D31E40DA26B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decoder.dll

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\decoder.dll
Size 120KB
SHA256 2e3ffa1acb15fb256694b7373e7725d926a322aef076bf1d2725290f5be8bf6a
MD5 87c5bb06d9cddad535194e787dabf848
SHA1 76292101513fc137f5c70dc335f9f924388a252c
SHA512 9837dae4c5abcd39d1bff1781bc053b70d2831d94001c8ffc0a59b086e6824eb4145c6be9538da9dfd0eb8010d6ee9c027c83981144b8e7d35540eed186c1ca7
SSDEEP 3072:AHLohTAI0NkxvLIe9R7Lw1UDm+qnWFGm+T:go+5yxzIebLXS
TLSH
T1D3C39E3133C1C072F11F113E8806E7B99B6F7AA1C9A09A8B7FA40A655F35291DF39356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

MSIB4F6.tmp

Path C:\Windows\Installer\MSIB4F6.tmp
Size 270KB
SHA256 4337cdfe01a45f6691cf883b57d5663788fda9a368a1eac989cb16e31f049ac0
MD5 50a3d9c4c3b6afda98bd6b0c60363175
SHA1 d69ab1b8c51b0282c3b2a02e179bf27128905835
SHA512 4824cd07d207608798b17210d196b8fd77ab3f75d3331449cea21c77dd3084deef67feeda029ab2e5f81bdbda1fdfbdb2af7fa753cdcf6292a5702454c232edc
SSDEEP 6144:lrR6lMr1Zx214pFEQgNwrvaE8cd4kmQiJSYI43smCvR:lrR62rFBnE5NwbIcuLQiJSYI43bq
TLSH
T115447E1230E4C934D69F5B38AB6C8B75A2F8F5715BA1C803F3D45E1C9BB2A838525F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBEBB.tmp

Path C:\Windows\Installer\MSIBEBB.tmp
Size 193KB
SHA256 2fa1395f005a32d8147e7a21395c0125c473765302882e8c2509be30b738d634
MD5 02fa966a1c078bc9aee5c6c4f93df743
SHA1 97d91368491a0ba84a38d1668e0c2e7e3f96bd59
SHA512 ba6bc968eb9bab3107ae885714cc2eb3f3a0f8c6e70f7ab7527e6ae93bdc99a054441bfe3e6a3c490193608597898c7d1cdf643437ef887aead3e2c6b6e627cc
SSDEEP 3072:MfG2dK29/1prU/jrCFICa+TEqF16M+bh8vQ5nv5hTmwqp8A6:MfG2wA/19U/jCa09t+AQ5nzEz6
TLSH
T106148D2332E8C037D26F16308556D77155B9B8B25A25D90BBB948E1E9FB1AC3DE31B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-0-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/904-32-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/4968-4101-0x00000274548B0000-0x0000027454FD9000-memory.dmp

Download

memory/4968-4102-0x00000274548B0000-0x0000027454FD9000-memory.dmp

Download