96f7d944862c06da57ef1f7b8e41c0a5a002be5bbd06ae78f8d8cb8b94c578fd

Analysis

user interaction
yes
max time kernel
78s
max time network
69s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AngryBirdsInstaller_4.0.0.exe
Size 74.3MB
Sample260705-e31p6ac15n
SHA256 96f7d944862c06da57ef1f7b8e41c0a5a002be5bbd06ae78f8d8cb8b94c578fd
MD5 12d7d3b6da2b4ef5dc837effc7cb3a1f
SHA1 479714c71d49df7b2ca16bc6c44a6216a008eae4
SHA512 5ca5fb7f44a1f5e6e0ffaec1b5a8b9b0453f2b54c8dd1b37538eb1bb7b6d8004e57fbe7f64350ee10f26d80e5d05a00df3107144c9db5b73ec8d99276958785b
SSDEEP 1572864:v9DSitI+s+Z6ED6orHKY7sgNnErhO7LQ7BZ:FSCd6HojTNnErAIB
TLSH
T11B083301A3E9812AF4B71F30ACBB52A24A39BC51BD31D50F5794261E3971A64DFB4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1732	AngryBirds.exe

Loads dropped DLL 18 IoCs

pid	Process
4476	AngryBirdsInstaller_4.0.0.exe
4476	AngryBirdsInstaller_4.0.0.exe
4372	MsiExec.exe
4372	MsiExec.exe
4372	MsiExec.exe
2400	MsiExec.exe
2400	MsiExec.exe
2400	MsiExec.exe
2400	MsiExec.exe
2400	MsiExec.exe
4476	AngryBirdsInstaller_4.0.0.exe
1436	MsiExec.exe
4372	MsiExec.exe
1732	AngryBirds.exe
1732	AngryBirds.exe
1732	AngryBirds.exe
1732	AngryBirds.exe
1732	AngryBirds.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1640	msiexec.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\1024x768_pc\GREEN_UPSELL_COMPOSPRITES.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\powerups\PowerupTutorial.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_22_THEME_MIDDLEWALL_TEXTURE_22.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack7\LevelP3_160.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\base\INGAME_EXPLOSIONS.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\green3\Level1084.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\wood collision a5.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\1024x768_pc\MENU_GAMECENTER_1.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\FILM_ELEMENTS_SHEET_0.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\eggdefender\EggDefender_classic_6.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\special egg explosion.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\ipad-free\achievements.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\subsystems\eggdefender\EggDefenderCamera.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\pig_hi-hat_2.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\birdday3\Level1899.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\blocks\BlockEvents.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\particleList.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\ui_components\PageIndicatorDots.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack10\LevelP4_455.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\cannonBallParticleTop.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_07_THEME_7.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\bird 05 collision a2.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\wood destroyed a2.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack14\LevelP5_342.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack15\LevelP6_28.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack3\Level18.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\bird misc a8.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\fonts\2048x1536\FONT_HIGHSCORE_CHINESE.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\1024x768_pc\LEVELSELECTION_LOCALIZATION.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack1\Level23.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\surf\LevelS045.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\shaders\gl2\composite-spotlight.fx	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\BACKGROUNDS_LS_1.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_02_PARALLAX_2.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\blackbird\BlackBird_23.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\eggdefender\EggDefender_classic_4.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\goldeneggs1\LevelGE_5.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack2\Level85.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\bird 02 collision a2.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\1024x768_pc\SHOP_TUTORIALS_LOCALIZATION.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_10_PARALLAX_CAVE.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_15_THEME_GROUND_15.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_16_PARALLAX_1_16.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\birdday3\Level1903.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack1\Level17.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\menus\sequencer.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\1024x768_pc\LEVELSELECTION_SHEET_ALEX.pvr	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\BACKGROUNDS_GE_1.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\themes_pc\THEME_20_PARALLAX_3_20.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\amethystBreak.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\subsystems\Mattel.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\shaders\gl2\composite-shockwave.fx	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\shaders\gl2\pixelShaders\pp-blend.ps	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\wood destroyed a1.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack8\LevelP3_312.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\birds_bomb_shockwave_01.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\pink_collision_03.mp3	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\subsystems\eggdefender\RMFClassic.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\vehicles\EggDefender_13\EggDefender_13_W5_V1.scripts.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\vehicles\EggDefender_9\EggDefender_9_W3_V1.scripts.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\piglette collision a3.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\boomerang_swish.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\fonts\1024x768\FONT_HIGHSCORE_CHINESE.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\base\INGAME_BOMB_BIRD_UPDATE_ANIMATION.dat	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI38AC.tmp	msiexec.exe
File created	C:\Windows\Installer\e593464.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI35CC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI40DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4225.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}\AngryBirds.exe	msiexec.exe
File created	C:\Windows\Installer\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}\icon.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD2BC4D4EEA53BBFB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e593464.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF978E3B08D99F8807.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2E34B7B9F6EDCA4F.TMP	msiexec.exe
File created	C:\Windows\Installer\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}\AngryBirds.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}\icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72EA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3949.tmp	msiexec.exe
File created	C:\Windows\Installer\e593466.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9F3596072A39AB65.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3744.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AngryBirds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AngryBirdsInstaller_4.0.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\GameUX	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\GameUX\GamesToFindOnWindowsUpgrade	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft	MsiExec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1BA90510BB489BA41A2483FA0ABBAD52\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\ProductName = "Angry Birds"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EDE61A217CD2D9D43B7A1E47939554A7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Rovio Entertainment Ltd\\Angry Birds 4.0.0\\install\\0BBDA25\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\ProductIcon = "C:\\Windows\\Installer\\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}\\icon.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EDE61A217CD2D9D43B7A1E47939554A7\1BA90510BB489BA41A2483FA0ABBAD52	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\PackageCode = "AA191C5CA649A894FAB402009F67E7FC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\Version = "67108864"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1BA90510BB489BA41A2483FA0ABBAD52	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\PackageName = "AngryBirdsClassic_4.0.0_PRODUCTIONCLOUD_rovio_DISTRIBUTION.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BA90510BB489BA41A2483FA0ABBAD52\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Rovio Entertainment Ltd\\Angry Birds 4.0.0\\install\\0BBDA25\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	msiexec.exe
4692	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1640	msiexec.exe
Token: SeSecurityPrivilege	4692	msiexec.exe
Token: SeCreateTokenPrivilege	1640	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1640	msiexec.exe
Token: SeLockMemoryPrivilege	1640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1640	msiexec.exe
Token: SeMachineAccountPrivilege	1640	msiexec.exe
Token: SeTcbPrivilege	1640	msiexec.exe
Token: SeSecurityPrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeLoadDriverPrivilege	1640	msiexec.exe
Token: SeSystemProfilePrivilege	1640	msiexec.exe
Token: SeSystemtimePrivilege	1640	msiexec.exe
Token: SeProfSingleProcessPrivilege	1640	msiexec.exe
Token: SeIncBasePriorityPrivilege	1640	msiexec.exe
Token: SeCreatePagefilePrivilege	1640	msiexec.exe
Token: SeCreatePermanentPrivilege	1640	msiexec.exe
Token: SeBackupPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeShutdownPrivilege	1640	msiexec.exe
Token: SeDebugPrivilege	1640	msiexec.exe
Token: SeAuditPrivilege	1640	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1640	msiexec.exe
Token: SeChangeNotifyPrivilege	1640	msiexec.exe
Token: SeRemoteShutdownPrivilege	1640	msiexec.exe
Token: SeUndockPrivilege	1640	msiexec.exe
Token: SeSyncAgentPrivilege	1640	msiexec.exe
Token: SeEnableDelegationPrivilege	1640	msiexec.exe
Token: SeManageVolumePrivilege	1640	msiexec.exe
Token: SeImpersonatePrivilege	1640	msiexec.exe
Token: SeCreateGlobalPrivilege	1640	msiexec.exe
Token: SeCreateTokenPrivilege	1640	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1640	msiexec.exe
Token: SeLockMemoryPrivilege	1640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1640	msiexec.exe
Token: SeMachineAccountPrivilege	1640	msiexec.exe
Token: SeTcbPrivilege	1640	msiexec.exe
Token: SeSecurityPrivilege	1640	msiexec.exe
Token: SeTakeOwnershipPrivilege	1640	msiexec.exe
Token: SeLoadDriverPrivilege	1640	msiexec.exe
Token: SeSystemProfilePrivilege	1640	msiexec.exe
Token: SeSystemtimePrivilege	1640	msiexec.exe
Token: SeProfSingleProcessPrivilege	1640	msiexec.exe
Token: SeIncBasePriorityPrivilege	1640	msiexec.exe
Token: SeCreatePagefilePrivilege	1640	msiexec.exe
Token: SeCreatePermanentPrivilege	1640	msiexec.exe
Token: SeBackupPrivilege	1640	msiexec.exe
Token: SeRestorePrivilege	1640	msiexec.exe
Token: SeShutdownPrivilege	1640	msiexec.exe
Token: SeDebugPrivilege	1640	msiexec.exe
Token: SeAuditPrivilege	1640	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1640	msiexec.exe
Token: SeChangeNotifyPrivilege	1640	msiexec.exe
Token: SeRemoteShutdownPrivilege	1640	msiexec.exe
Token: SeUndockPrivilege	1640	msiexec.exe
Token: SeSyncAgentPrivilege	1640	msiexec.exe
Token: SeEnableDelegationPrivilege	1640	msiexec.exe
Token: SeManageVolumePrivilege	1640	msiexec.exe
Token: SeImpersonatePrivilege	1640	msiexec.exe
Token: SeCreateGlobalPrivilege	1640	msiexec.exe
Token: SeCreateTokenPrivilege	1640	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1640	msiexec.exe
Token: SeLockMemoryPrivilege	1640	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4476	AngryBirdsInstaller_4.0.0.exe
1640	msiexec.exe
1640	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	msiexec.exe
4692	msiexec.exe
4372	MsiExec.exe
2400	MsiExec.exe
1436	MsiExec.exe
2800	OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1640	4476	AngryBirdsInstaller_4.0.0.exe	88
PID 4692 wrote to memory of 4372	4692	msiexec.exe	90
PID 4692 wrote to memory of 2400	4692	msiexec.exe	91
PID 4692 wrote to memory of 1436	4692	msiexec.exe	93
PID 4372 wrote to memory of 1732	4372	MsiExec.exe	95

C:\Users\Admin\AppData\Local\Temp\AngryBirdsInstaller_4.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\AngryBirdsInstaller_4.0.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\system32\msiexec.exe
  /i "C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\AngryBirdsClassic_4.0.0_PRODUCTIONCLOUD_rovio_DISTRIBUTION.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\AngryBirdsInstaller_4.0.0.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1640

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 493E83055B65E4BBA01709E88EB96E46 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe
    "C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 748648CEEBC5B58E5FEBDAECEA229B5A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2400
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9C5195FB921E22F3AF1CFB15E9C1141 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:1436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e593465.rbs

Path C:\Config.Msi\e593465.rbs
Size 430KB
SHA256 63e425b0c1b6a9443a066968ebfc8757fae2884d3ee9c1575b5aaede53f691cf
MD5 93b2bff5ec68828484f2fa14007612f2
SHA1 41533158a27224f5c0139330ecbd88dce5f61bd4
SHA512 52c3ef4ad341cca416d2252b02ebade7ff1e88ce5ddf1045ed608e3cccbc36f2a1e4618104680b2b4613df1dc2bfd8c5a466d159f78f8239c5be1f3eccf61cdc
SSDEEP 6144:CjVf/porSSbfAQ02nJsK0uvjedgv0Zs9WXtkhU2b4RVfG2wA/19U/jCa09t+AQ56:CKsfhwAt9wjCawt+AQ5nn6
TLSH
T117944250AA25F6D9F32F5F3733C14E19481E9C243A70123D729C8F6E8FD1D21A96D98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AngryBirds.exe

Path C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe
Size 1.7MB
SHA256 495a994ce55aa12a7052b24afc6513f9229fc7d804a549e1512e1e2077bd81c4
MD5 c8014f54a31d03444eb1939f66182693
SHA1 fbe9d8106397937c12051695d9dfa71d7fb6b165
SHA512 5c20c0f938751295274bea94d31b296c06dc981b0ccd01378665671b4931ff83964ff46dbf88143624012a0dad517d71817fc575170f65d72487bad813b63c4a
SSDEEP 49152:LDEkjzoUB1cGvcrnHe1dnyjggQvtoZdMXRgZRXVE5QTGZ0w:LDEQNzcwWnGdytQvtoZdMXRgZRXV
TLSH
T104858D31FA41C076F9D241B6DDBC2B6F592CAA31176925C3F3C80D4D6DB42E22A3469B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.ini

Path C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\updater.ini
Size 414B
SHA256 62f687f4a7f465ff9c89a9d938e359b43bb65c1d53e1768e15582f165a63ba55
MD5 634436543dcd9c82a874907226b07c0e
SHA1 421bda5b5b65a655e8fe3498e7011c6592fa4936
SHA512 08abf74de2ed7c67fc228f454f1cfbef1769402dd7f48a04e8751f4bd9fa101f5d89eed8508b4ef38db4c0a9fb7d23a9b5085b48eeb0cd527b81abd698864396
TLSH
T11DE0AB92199AFACEA3595FA312A6490C4892AC083FA1273EB0915D8C9AC2C105547557
MD5 SHA1 SHA512 TLSH

Submit Download

MSIDEE2.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIDEE2.tmp
Size 77KB
SHA256 19989417f3f411c8a02aa09f1dd51a7febc530f0f27c8d3f7dd195ba224e6fba
MD5 7452f56af87d0912c3a06206dc77c0a6
SHA1 5ff38786b61d5061ef0a09a670b98e5d3b961b1d
SHA512 e07a612edeb6078f9ed639018a1e22e30dc4b8bf9820f1dadbf405722f32f5e2348ca5585c1d054e857b0644c9d824b44dd64ec4a8d424c2e78aeddc1bc351b9
SSDEEP 1536:0+aeAAphyIulPMPxXEt2SJekrv7qMePdX58l:04AkyFlkPxUymv7qMI6
TLSH
T13C734B1272F49075F1A729717FFAD655C3B7F8A568B2841B8B520C471AA0D82EB26333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Angry Birds.gdf

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\Angry Birds.gdf
Size 6.1MB
SHA256 0523638bacd7f74092c9cce466967d6697dd5f6b6dc3234f738394dfbc7934bc
MD5 421b79ac2cf97ae41213f74cb435a27c
SHA1 c0dfe80394154fb89171c31e2f35a926b86a8520
SHA512 dd9ef5527da8d06d5e21c99e5500440bbc453358549cb901b116defca22f2d488c8d367fa41670d7e44f81dae1b5f39df29bf68fba4e3e5b9f9c640e73e8785b
SSDEEP 49152:MKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK:
TLSH
T1B2560242A394902FCC6B4971E85D0456C63DBC51F829692B97903A1E37F293BAF4CF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AngryBirdsClassic_4.0.0_PRODUCTIONCLOUD_rovio_DISTRIBUTION.msi

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\AngryBirdsClassic_4.0.0_PRODUCTIONCLOUD_rovio_DISTRIBUTION.msi
Size 3.1MB
SHA256 8484fd14d9c04c9dad0664f2eb298fa89f9aa9548e2f2d6219ab7ebf4a716d47
MD5 61e3a570599b183608c9a9ac5020f09d
SHA1 dd64ae2006383936e58f1106ea6b84d2cfb87aed
SHA512 0e15207b9faf811ccde8397b885b0a3a3415ed6d67223f67d01f72ec39810ac1707b56fead3d77c6b62539810e4cbafda33a71f11dc61b5ad60aa53c798c34e0
SSDEEP 98304:GY5AEvMZ/RnzIv3tKeandz1YHKfVDnszq:RvIzIvdyV
TLSH
T1C1E5BF1AF1D48636D99603384247871389FC9838DA66451AEADFC20D3FD75E4B3BB6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BeachAmbience.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\BeachAmbience.mp3
Size 1.5MB
SHA256 b8c5315331f8cd9356f9d6ddf968212f7c748b1ac4590f237a299393ba36609e
MD5 660edad23278f78998b0298b6e51f144
SHA1 dd9f7113b4c20ab9161a98e75859fdd4b6d47484
SHA512 baed531d4a33b001714f19330dcf1b11aa7fb097eb801fcb340f8f2f39606afb5f0d10ed9592d692b6ddfec803c29980dbfcab2f19bd555b0dc9ce1d4f3a3210
SSDEEP 24576:bBy1kzitdDqFIQ/mch7xGao3LbfgBD9gNUqGB/bTM4TKR3jzZvJ7TEYRlNwSYcRe:ZivVci3ojgNUqw/nM4TKtzTE4qcRe
TLSH
T111653351D389FE03D500E3B9AFE34209E114FF463F503EA25E19CF9691DA06A7B58B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RainAmbience.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\RainAmbience.mp3
Size 868KB
SHA256 d5fb460d03b8a0e74ac075abf1821d3ccef4651f3583a55c207ed5f505bf95ca
MD5 fb50b71d122bc9366e227b2035296ed4
SHA1 b90f1940988077be06784da3959957720138d462
SHA512 63e6a58f31853a453ab561ca47bb8ff30e87f51611c68444de2cdb0646b0a3185b383fac0c6cfc8dee0cf1dfff8a701142cb828a8bf68567c84ab339cd6c1800
SSDEEP 24576:6/hkuCAW1TLOlpOm78mMLbaB5u3rL7CJHAJZMcdt:6YFE77caBmmJHAJZ1
TLSH
T1DC152362BA02CCFD99D6082013F35DD695F5EB5F314A32A299F48F8393B964337291C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab_cave_ambient.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ab_cave_ambient.mp3
Size 934KB
SHA256 d93725def68b368ebafaadf4710b2a53d5af2fd5d331b58798fbcb29f9b6f6f8
MD5 0218e9a045ac80e705b0031f43918380
SHA1 aa500947c21adc3d4879d5abb7d7796d57cdfa8f
SHA512 57217ee2acc83f9871ceb48fced8a6414e9b77e7b969f9fe921cd7c8a32dfff1837607a9ccc38f291948d6b0e4a12ba61072bff29656f4c9af6e818e218c2a63
SSDEEP 24576:pCTVLhwl2M+hHNR+tGL1piQ0kzU1RwB28la5c:8B9wsbWtGL1pLEo28M5c
TLSH
T100152311EDA6E159EE1653F04E1EDBC2D4DFF4342C2329E8368ED7A4B1E9061F9D1206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambience_blackbird_01.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambience_blackbird_01.wav
Size 5.5MB
SHA256 637056094f63e8a6db85748d6b5af19c2d578405eba7fe0cb6501736a10271c6
MD5 5531822396b6f4aa9ab7b647c9c323ac
SHA1 58b190be84dfaaba08fa212275b93f6e15a54bd7
SHA512 68b0c7d500cba99f55148526eea272d7ff05b675225c7b7eac2a5f5f9dfa7ef114a9caaa4ad4c557afbaa9572015be49844b1228311fc54a4f152ab3e4910e7f
SSDEEP 98304:ENXsLnlPg+hFjbFMFXS1h9Cr9HrJ9CJp+98TaN3CFBBMM+7qTANEml//DWyBw8GN:PpPPhFjbFMdS1h9StCr+NSl3+pNnlDzu
TLSH
T199460203FBB352D4A676E4A3AD8D00825E41B68E8D4161BF726FC51BB1D3620D9D73B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambience_waterfall.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambience_waterfall.mp3
Size 665KB
SHA256 4ad5805317a25bd1fdbb94ba60017997045c1988fe7ad524516ef0d28b5366b0
MD5 aa1475bb90d34ebc38faa505bc2c5d6b
SHA1 910e01850e0c7a8699073b60a1bcebacd259099b
SHA512 aeae45f323168495c74b5478ad3085a798d55afc6687ff8c17ad88087271a3b04a470f1932d923a9b33ef3aa431400e0853ca512e18f65aa75a4f0e71035cfb0
SSDEEP 12288:f2kVyagFo1buI3i1LZ8x3Gp6ijhVEK3nPfmnJLeDtsXfelsEw5r:ia9Uqx3G4ZwnnmJ6BsXfUsEwB
TLSH
T1F0E42329175EA7B6E780B77B3B87067956430BC0EA07742CD3D877211FE9BB1878A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_city.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambient_city.mp3
Size 955KB
SHA256 7a3c2fd920b89dd824478c1da55dbe90a8144c92a7ff40e91986a441f9b2f0b1
MD5 124baff841c82642385089c9a27148bb
SHA1 b429654684b9e49c2a094afe4e3b468ce1c5865b
SHA512 e1a3a63265a8fbe044e3028489e52898fc976d4d06629d0bfa4faf61ef9cd5d4dcf5ec77824aa5cf6e3d0134d21379cc387786a0df101338b9679683c4d2d96c
SSDEEP 24576:dxHOSXn9t3DgiwOfHmFbNZZ1Kv3tCHPme78/Mv33pIb:nHtXfhg/Z1eCHPme78/SnpIb
TLSH
T14B2523E72A4A17BBB2D7AEFF1CE317A6CC5559D4504AB6E005C22E51ACB726F03340C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_construction.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambient_construction.mp3
Size 882KB
SHA256 78230eaa24ac157753c414488d2fa2cb68dee6e38db5ea7d9514eadf8a6f7630
MD5 19676b269e7580035c49bacc7241156c
SHA1 4044c9e6b32a8de3ae8a7935e0da3c38a45e7aef
SHA512 b20bbfa69418fb9d20f4f000b7167cd5a69bf07421252c096a8a0957a2bd2db476c2a60efc211264ef8ed52e580ba51b1f8a1ee944fa549499937dcfee322302
SSDEEP 12288:SQIqsKzFDw5HooSnBhdFkNVG2qGRbqDj/AIJOrWDIAOTkw+W4mBBJyiRzzP6WTnT:SksK12HqBfCC2knLFIvX+WdvTnCg
TLSH
T1EC152349CA14590AE13C1BF43F4F1BD8AE580DD1A0D69FDD25ACEFBA64E56D8DCC2402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_green_jungleish.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambient_green_jungleish.mp3
Size 1.6MB
SHA256 d48cfc8546dce9d7e23d0d28cf9008005ec0f4121337e7555b176f6aa8c0f6d5
MD5 c921cafcfe46985dc888a4b71ff8510d
SHA1 7cd85b011fa5ca67fe27c8747fc25ca170be9b07
SHA512 a2ec698f59b03e11212537bc8c177d2bac3ba99c600febfdaa415dab8706035967263e2543152614ca65be9b7ed3b75986386a0a64d0888c29e79ee3e9da751f
SSDEEP 49152:aOh+ac5ndD/V5J4v3L3d6nTcKMKdzO4tctx:Rhdc5dR5J4v3Ynaf4Kf
TLSH
T15A753347CB414017F2CB53B49F53060BCE1A8AE6AB4AB6EE5CDA07E6D273658CFC5904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_red_savannah.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambient_red_savannah.mp3
Size 758KB
SHA256 79c23296d2c44f1958d15a1a7a5db87463aebf1bc90070355cb98264e4d57901
MD5 6c1b3a8858c4d7245fa8d087f7ec853f
SHA1 c62d8a30080bad54335e46ca80d83cc003d7daf1
SHA512 c3be7ba0702dfeede42ed548aa12c84e8703a026c637de7ce1fd412c428b2ddeff8646e5d3fb94e9f9ef3f2a94cbc0b8b7dea2d1d945c5d41f24f26ba6046212
SSDEEP 12288:4hHrOaKL+8o4GUnITqfYjacSKnXBsJzRyXBIUqYDXU5i3G6rgeI9la71hYclxFbe:iqaMhAj5BYCBhjJrgXl2XYSPbuH
TLSH
T179F423D1DB20427AF95D25309CB3BEE9C800ABB16543FADD84E51F88E247929F3E1316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_white_dryforest.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\ambient_white_dryforest.mp3
Size 652KB
SHA256 eb90dc799591de5930090b2449702b850bd8644d140777172707b4f7eba8dde1
MD5 ebc99ab860cd70a6e508fb4307dab139
SHA1 ffd3c03f91da68228f2e9ba1b334492addc90aa5
SHA512 63a4cf5b6223aa8944a2584277bf5cf86fbcf344d66ccda20f1cc8c5ccbb5e3e5f918d194fdd9916997798d2ab788dcd745b76fbfc20f9e79d3bd33d28878e7a
SSDEEP 12288:r1z/Tkq0tiEjZygE3B8csNgvAhEq8LTcBptUI4w10RINiyXUvR/R1vQt4Jwa:JzbkqupAMckgvA2q8P6tUI4i3E5/R6O9
TLSH
T145E412E26F950679F54C30B8CFAA76A3DD09C3B11544EBCA65CD8B139097881A3F4BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birds_boss.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\birds_boss.mp3
Size 146KB
SHA256 e57bfbe37f79e791283161780b24817ecf261334add75e0554d9679dcf737c63
MD5 e72d737bda7f80c3aa7e904ee42b54da
SHA1 f6b88e9ac9e0b2d143dbf5973576665baae53214
SHA512 a03d979dd1daf51a1a72078d20142ffbfbe145163aaea7477a85131fac35a1ca8ee620a499d3981d6d701bd574dd92fc61da7ce61c4a3c309ea234e2f59fe426
SSDEEP 3072:FeCHfDhmJ08ah3CxA7icVVOsDaJZemy/teQJAK:MCHfD8J0TPHosDa3em+YKAK
TLSH
T164E30199A7431424F0566A7E772BAF60C201EC6D4C06EAE1C1E4A312B2FF58D77E5368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birds_intro.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\birds_intro.mp3
Size 357KB
SHA256 199a9d5d6d8a39fa0578e6568e356c98cb9761ec1316bddd588c3013a01f2b8f
MD5 c66153a18f314aa9af6c698a6a215417
SHA1 bc8eae465ee784f8966d0788db0de219d6ddbe31
SHA512 3ee614876befe0a2fd93bd1e1620cbacf950034d4b4d5b84f10a8d0e3c205f750fdd8bc0d3ff805192479efca4c5c147d9475f5cfd783145652bc55a3e9cf17c
SSDEEP 6144:l++XuYrpsncEWvQnFaLKH5MPANnMBkUWLF7r6f32sm0GBnHUGfAn8:l+sVwcEWvWaK2YBUz2RflHUl8
TLSH
T19B74224457637EB7F8402A745F226279E7929FAB4A62E0E2DAC467319133201F3D731B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birds_outro.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\birds_outro.mp3
Size 292KB
SHA256 7719b486d88b26345d28c08875206f557af38ec33ef92005154fd3a0fa974f2e
MD5 e9234e661ff22c4420697387c9def44f
SHA1 9ea5508d6b89d09b8a6a89ac8ba5264283a0c5cd
SHA512 7b6f6f12ba8c05e825543e1f01374f4fd4ce03a65f7cecb65d1eff1ddd89286ea05d0f468f20d5593d28190a8236c5fb54c29badc04f75b7693526a121e4afcd
SSDEEP 6144:deD82tmmf9Rs2mRugmu89JxfB/yP8IPDMhDkiOI3xlsVMtjn4gM:4D8u2Ruhu8HL/IPAhAidLCuM
TLSH
T1BB5423842D8D29C0F8E2F6364D2B38A3E5070E585481C555735BB320B2D75BABBF9E78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birthday_ambience.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\birthday_ambience.mp3
Size 693KB
SHA256 a672d6c0f3abfab6427721b550c700380854e89b88e21c97644322af4dd3622f
MD5 561234feed51b118619e032561971ae9
SHA1 802527c1206dec18a51510411bc11ef672593021
SHA512 f826dd3035814f0c2744be9b38d00b19614f0bb5c13a17cf487d870e00cd8e8eadded4579d9f70f5e09cd8034ddcedd6a2a3b18f338119cc019af0915b074d91
SSDEEP 12288:IUB9vUYlLDfffaDKtxR00+V4PLzyD566QekWuyeHSpvPCU0mDjY7:IUB98YlLDf//0GC6pWuy4eX1v6
TLSH
T1F5E42332EA983A35F1CD52B59D62B342B21A17FAB3473850B9456B4013EF43B33BB915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funky_theme.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\funky_theme.mp3
Size 1.7MB
SHA256 6c52b0d9438cc379fe16818604c818c60e2f3ea3727754c92a9ebfef1533514c
MD5 8685fe14227131550e7067fc7ed25179
SHA1 756400eb47a1a6dc05bfb5f1b4a8b6969d1f8e23
SHA512 09097a5e9835e370dcacb660d3946193dcf4bd3b9cdd4613309ec46d41341c240ab990c15414dba0e5dce5c8cecf94bf03cb7493c7dd93b282a64d926abc3cbe
SSDEEP 49152:N/GFZI8BmuVw/pgj4iFPNDGJSRhF0RP84e8Hl/q:xUFMuVLFPNSJSRhuG8Hl/q
TLSH
T16E85230FCB106226F7085BB4CE5733A8DF596BA00A4771D85A147B6970B31C8FBE4B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game_complete.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\game_complete.mp3
Size 283KB
SHA256 966a98b93f7c6bb23b77f64501efb03b6edafce184bae7764d538dffd695c2d5
MD5 716b8fae5dbf608787d96b55e8882e3b
SHA1 b9268e5f587a2de6e4eead56bd1208ef222f4915
SHA512 dbae1ca4176349ecf7edb9e4f420177121aaab021f48e0985c38f7e3d2aa98e576e2cbbe74441f707507285ba3018bfc31f4bd21e97f277d6db13619ebc64c9e
SSDEEP 6144:OTmrAU6wP/V9Vdu42atxnTjc8Gf17msuFykBYkfgju0ISUdcuEfLK:O+AsNu42aTTI8E17Fu0FkL0IVEm
TLSH
T15F5423D8E680D38BF83B14394C8539854B7A9F507B29BF9AA4F13E4D8DB4490730756E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_0.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_0.mp3
Size 59KB
SHA256 f2e54c5011b25f5f78443b1c474876a2661a2848ce505a1ccf1f9dff05cbf293
MD5 04db30d08d0f7781cbc4753de80fa751
SHA1 89c6aca5383aa25127a64030527fbe82417dca3e
SHA512 0d8c446107991e161522f448f0d1bb68223cd8bb3f21ca44a853001c1916ba727f2e299ac84546b2763ce9686334182b3e637156c99bb36fe73658564fa448c9
SSDEEP 1536:a+tj3+QIfkd+fCK450HEmOq+e4wyS3HpgnqHx:ak3Akd+fl450H9x+83HpECx
TLSH
T13A4302798B0606EED164B131B63E0F064AFE7365BA46F1CA52C74F2E6D3442C26178F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_1.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_1.mp3
Size 116KB
SHA256 f4db91c1308dfb4637557e22788d8f9e4fe30374824ea48dc895a710d9fa2b3a
MD5 35771beda6baf3cab1ea24ba2efb19cd
SHA1 50187fda73231a5863244e9df7f292fbe92d8f72
SHA512 539d613a00652453e4f74f5996005d87fe02796d02cd8dcb7c8fd6e5060818d19d8e4625400785c490668b45cd70571ccb1f03183555be457d7187f7d2a6a20c
SSDEEP 3072:47UiPzs88m51NtkjnOj7tVQz8TbNG66GTIhv:47sQkSj74z8TR2MIZ
TLSH
T137C3126587107ADEF0181C33E12C6E42A598BB6E775532D924E0CBB3BF2C6463F21AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_1_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_1_2.mp3
Size 118KB
SHA256 876f694ae807295baf2e61d88dad37a8e8058ee67c7da2bce393cc8193446815
MD5 a27690acb719d6aafc436b9e4344058d
SHA1 380df6c2a872b91976d415ef7fb3652fb98fdede
SHA512 331e5f1b8c3fe5e8ea15c1fafc5cdd7b5d1b3a8ec6d2d5ab378bb3a833151711dab17c067f9a39053912a32cee3705b7aaeedfb7b13b5276cc8ad5a7ca2936d8
SSDEEP 3072:THjF5RGnIVCO9Fg0CLlfjEy62meq69z2gh2ax:jjnnLklT62Mk2gh2g
TLSH
T1B4C3028613989D0DE0B30870966DD6B0C3B9BB13FABAB55BD3D68B604876A5B3F150C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_2.mp3
Size 119KB
SHA256 afb18b351da719dfdb53b7bc3a5554e707606df3cfcce9e3a19e573302e4b0c9
MD5 2a36d0792447d94efc9b4c3e65b74122
SHA1 3593bb6af36aaa72375a13613a5d2409fa6db421
SHA512 53ac5657981a5ecfcec2c039822b0c94359ee806f0d743c2c64a47bfa579e66e5f52737c795045208fb3014f4483881afef34d863404767ab1372a68d9f7a58e
SSDEEP 3072:26Tegc5TVDv8yFchOzYj+kntaMosO6SlwM6SejJLg6:2Ceg8TVw34Eaknt8hlUSe+6
TLSH
T13BC3128749026C2CD194097315D2FEEE11FBA704322A6F5BEBF8B741347E26465EBB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_3_1.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_3_1.mp3
Size 122KB
SHA256 96f0c4cc6fb1d9f71e2fcccfcc1fdf509676f44279a58916eb03dd64aef3335a
MD5 214c5c49fedee6c2755cc355504b0932
SHA1 6c9d035572e8b233df34f1ec665d11b5b864df47
SHA512 bd973c2289c1f726c222f0cc94a8615993b0a8f3ba91e33b1f5f2cff670cb18a7c8604050f07f6a65748bc7cb7d142a8e1d64325bfbfa93813f180bcbb20e3b5
SSDEEP 3072:FDKFubBypAuN4cgEmuMeX5HZllyJoccoL/Mmu5wlw3A53w1OkV:FcOuaW55u9/o5wl/53wge
TLSH
T1C2C31215EB84678CC54F0430FD988D41BE7BAB6C32606ECE7FF1672098B5FA97898254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_3_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_3_2.mp3
Size 121KB
SHA256 1540bd5cf5a388a24c3b7a130a338b1f415688b41038de7abc9f10e7962f870a
MD5 f9d5825f8a58479271c934a3e73b0cbd
SHA1 53e451d3f0ce36b090fe7d9a4f925fd42ff5b2bc
SHA512 0223ba939bed6454010d3e145bbfb064bfc3a7029725a40c9f92d0b41a10073410619df702a0b6b085328ed57da19285f0f9a8ebe55ab14c5c271e2fe388bea4
SSDEEP 3072:F2ndcS7jqka8v/YocKIb+A6OXhCIKe/zHKGnFdfstQp/VEU4qj9lEPi2P8:4cAjqkpQocKIPX5/TT90RylO8
TLSH
T1E6C312158F1E662EF0496B3288809F3689757FDB3A30B03633E48B467077A74376D94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_4_1.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_4_1.mp3
Size 121KB
SHA256 c5f9d9016859115d99e7e9c873b4fc762d4cea139bc60cad608d9a0f4179813a
MD5 bd5dcfea8407f1a34aad3665506ff069
SHA1 567655424e127a63e3958e8f8e51bc72ec1c19d3
SHA512 d425669f7647aba605d80407a6c2dc86ea9f24c9d1df3a6bee62f381ba5eec4fc01230edabafbcbddf831b0559466c04924d0e6593bf45d8f162e519f7494e22
SSDEEP 3072:pUZ51dUYRTBEFcZbX/IIDUhLgeAoPDcA880AyV7ab:c1deFcdgDLoqDP880Atb
TLSH
T1CFC31228F38E08CEC06988F079DF66A1E9B3FF5D71A439C081F68F229635751791A2D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_4_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_4_2.mp3
Size 118KB
SHA256 d1c5d822ca6fe469d1f37333d3dcc7f945553a78c64fb02e3a68cd9189fda7f6
MD5 9f13e94612c225d0046ba268cefa3772
SHA1 5fd9f794b94b7631f840a646fe102f954964bef8
SHA512 4e0607ceca1ca7f0fc418935e3bc532eadd5dfcf80ec08663dfd29a932ae92d15816df99be798ff69bf5baacba289663ac0d6cf307408ba9cfda643caa75b9ad
SSDEEP 3072:tOGPk9slqXU0Vvy+nrSRpiirVLfnmHgx0flkV3:tXPkV/k3hnmUukV3
TLSH
T1B0C3025A4F47841EF45C523482706B9AC1AB2F557261377F1AFAAB0B89778B1FB104CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_complete.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\level_complete.mp3
Size 69KB
SHA256 da50606f54269411f16050dae2483ea3c633263f93948372383ff692626d8e5c
MD5 6ee709ad712efd87c4adbdd196047bcf
SHA1 c1f8620d03783a6cd1e1a7e439d20c65ce006faa
SHA512 2653acc7df82694a23aba88bb2767070a75687cbec3be58f5183413e39e6b91a5aa51385a5645e0143ff44260ef1349cad28563512cc8e780a4818e0c2307f4d
SSDEEP 1536:3kTz39GJ+13BvxxwwqmLiHdHjA6EMoMoHJkFD:Uy+1xvxxwwpiaZMopc
TLSH
T1BB630251E615EAB6CBEF977B2CCAA98CA81BEC30380C4B1E4171FB6C347118575DB908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

title_theme.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\music\title_theme.mp3
Size 1.6MB
SHA256 f2dbbd3062a49eadd26b796a3d65124fe0baa9575010e00da7b6227abb2c8fd5
MD5 b46455b10456ceb62733626adecb9d21
SHA1 5ce4604c641924d3ce47cd66a2c1f6ac198ef60b
SHA512 de762bb23f19baaccd43280018fad96221944f251f7fb56d856b834595cf71190141254bd4280e7e7e8084eebb2496d9a9bb7bbc694fca8de9466140bd80534a
SSDEEP 49152:mVEp5Ktx6zUky+Iyp14e0Wj01apoTkO4noAule2i:lUx6GgpGPMpukO4noAuZ
TLSH
T13E753327A804B827F06845F0DE5175AEBC3A0DD9717636A56D727BA6E832331F20FD84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accordion_break.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\accordion_break.wav
Size 122KB
SHA256 d5217c9b69c36e69659a37ed7625bff291e30c21b7f16c6f5a82fd27908e91d1
MD5 5dfaf665ac21709c3754b6817c53cc06
SHA1 4782a0a59c93fe970b6af9790ed97485e7a58209
SHA512 54ab597d601a9575d28513ca58cdc79069fff97b2e1ad77a8c846ccf5b7b7f6de8c2168f472da9ec55560507e049a3ed9a7b105d1ded51fff8df5b7b181bb923
SSDEEP 3072:D8MmtfmCCYN6J13ktQCwlKzmosSXHk3Id5uccKe/L4:4MuCIIO6VQTXbtcKkL4
TLSH
T179C3DF62F5D30B0456B75621AFA469941ECDF85CBC7469BB9907CE80F283260B7227FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accordion_empty_pull.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\accordion_empty_pull.wav
Size 105KB
SHA256 640393fdd29346c65c20cae8aaaecdc9b2c7a5116b4024304b5de14dd288ff68
MD5 d55f84d183064cbcb9521c647fe03e39
SHA1 5a90a8529a2727a8241bf53c28ce7db882be8294
SHA512 23adca375c2b75094f5332e45c932c1aeb6e014cd60fc8011c363f77ae5b00f7fc88ab1a4999a2fb718af098d3d59dfda07fb08e10d9c9fcb0ea72d0c2270708
SSDEEP 3072:7bc8Epr/yq0BrL/rqGcLqOJne0B5Jpa9LH:7bc8AzGX/OtNJnFB529
TLSH
T1A4B3AD96F1A30758607752759E8489416DCEFD2C7C625ABFA90FCD46B343320BA683BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accordion_empty_push.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\accordion_empty_push.wav
Size 124KB
SHA256 9dcf6356dd30b16806bb6d982cd463c061e8095d5d4184d182f4f36527f19f60
MD5 07924b955b04cc14d6c4da3437ec43f4
SHA1 399841a2a0098fedc3085acc6ff273c06d8c8880
SHA512 ae64d85e2260a8a3e033d08386e09311e1c15589152ecea1fa3cac39290f350b6093a625a455e8c46a053c943ddc2a9575d224a1c726e785d83bdb91763bd50a
SSDEEP 3072:fPrQEupmT9B0caPu1V0QscyMx1Uhtq7C9e44rF36XlVbzlFqh1Vus:fPtVkcD1qjL4rZ6XbbxFqfVus
TLSH
T151C3DF22F0A30B48643796756D9019054DCAFD1D7DA66A7F698FCC94F323730AA613BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alarm_egg_stolen_01.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\alarm_egg_stolen_01.mp3
Size 20KB
SHA256 b75e663c8e91d34741f3d4090008b13dc4728bd8d16db6e34adb19f933d83455
MD5 551bc631bd68110b4010dc3b5a1b9269
SHA1 6636e2497e4596a6e0b762e00e67d4798ef4a8a9
SHA512 c056aa615167790efdc8f3a0494e36f8254135d1b0ea7330e6b99783ef34398b536edb7ada17ececcf91cc2a22cea95fd86ac7b6081cebd96fd2fc32f82299bd
SSDEEP 384:O7u9D+zknlizwpHOJbFGFaewaRW6lo4n4ZhF+bxpoLBy5v/1nQOALr:aoa4VOJbI8qW6e4n43F+dSdy/Kr
TLSH
T15592E1AE860142DDF54576F1A5663106D1FEECA2389F210CEAC54ADC997FC201B15ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alarm_egg_stolen_02.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\alarm_egg_stolen_02.mp3
Size 23KB
SHA256 fda38ca5fde3d5cbfc3e2d9946d98988750800bc970ac204b3690510c5f66924
MD5 6174a020209e861befc80ff5d9dff0d7
SHA1 5d9fc6453531b609a8af7b3faaa859a0d97c4cbf
SHA512 e5b67bffe128f3b8db17560a2815135e5d2f87e490df2f421643bbb4dee9224dc1867ffef4f2f3061bdba89668eff5e7bd968e8a3e99f6a2326bbc97a9967342
SSDEEP 384:zr89OJdJGTOo6fJp5J0aB+BGscPq0xsmE888dnS19LTmqRN8vJ3/ScSF2p3eezgQ:zr89OJGqokJp5JTtPq0Gu9dnS7fqdZpR
TLSH
T191B2D0E0CAF71194C06D73F97AA3582C251AFAD94FA8CCFC62E80235337D8874916B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alarm_egg_stolen_03.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\alarm_egg_stolen_03.mp3
Size 15KB
SHA256 4402d03b3d77652e4bddb92fab3ff62c3d40d88d212d9da9fe8da20dd041506c
MD5 ed9338910448aba841af378b4fc4711f
SHA1 8afb25aac43546d82de1dccaf9a402af45ca735d
SHA512 fc25147699953bb89179e1e9e8a1e420999cada7e65b37af38ad83a3e26a46010113844e1f642eb10df2962fe5a1ea58abd72e1f952f01e1a27206bea240b44a
SSDEEP 384:yNSpBjWp98sVgaPcxROdZsG0gXNDWkdyBJGsLarh6:yNaggBTDBJLarh6
TLSH
T1C062D16648980394E02F4DF485010FC95876D7ADDD19AA7E30C4D5907F9F3D3AC6CE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ball_bounce.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\ball_bounce.wav
Size 28KB
SHA256 11a20f27efdebdc4261004ca6abaa4d6b57b1654f747939fff316739cd9eda83
MD5 5f50a097907cba5e7d8d792465096be6
SHA1 7638e271c30383cf3d2c3c2b9a26e173d72ffefd
SHA512 3413ee82eb9efc0cc0ecf46d10141a98da3b14325eaa9da02ebf8c0712e8aada57a82ffef28b70d7c74e22a7bf594a87fe1fc79f42e3389ad216a210a4571cae
SSDEEP 768:h2uR+KErRsUGbpPrl3XZK0/rfIcUdjNt6jpSS5F:h2spErRsUG9xZK0TINdJA5F
TLSH
T1EED29D52F813591AE67F997BCBA3DA300A663F16BD09510F3240B6816DEF344B35EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_inflate_01.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\balloon_inflate_01.mp3
Size 13KB
SHA256 5765d814f21a63b09d464ac2b0debc14bb13620b676a9b9daef3e8119413e8d5
MD5 d5327288e048105178b68e5859a98090
SHA1 3251e0b2b8146cecfc79e6020db8e53e9db9fd9e
SHA512 139d5adb786657778929b99f7b22333052802c89fdbb4710426134bc0d481064f0d8a45db76718546f06950b29c90b164a2b0fad52ea52da2320a5827b06bb74
SSDEEP 192:/rNlk5gg981/rQUGTINDXP8nNk07os7pVGZzwAmvBb4ewyIthbEcwJKevareGWL1:jNS5d98jND/1xstVGGAmZUewyj/iY5
TLSH
T1CE52D0A4292D399DF6AC47F6522D8F0DE4890EC4C88D9B762422E52000376B7C3E96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_inflate_02.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\balloon_inflate_02.mp3
Size 35KB
SHA256 a586ec1653a052fed10b90d963a0d5ffbbadee565500db378116b3b12441f790
MD5 0e39e1c00cb70e37e2034cbc3f9e51b7
SHA1 ecbc3db66ccd8dbc62d4509b9906cceec5ffd6fa
SHA512 3868b0230b976658cb17cb2591d1c8c7cc225ad07dc63ec94865471ea6f40ddb899a51923b17c1ae15844206543c8e79f563ed55391e48b0e2d4dc93306258e7
SSDEEP 768:bUro/aNSrJIaByav4Cvk8TdNAODAl5c+K+fV4DM7cDCniVLpP0B:Y6rJIaBy1CFy5c+K+d44sciBpP0B
TLSH
T127F2F1D2602410CFDC802F7FFD6A2A478AA7FE9004167EDCEC7785B6A46B5A647A0510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_magic_pop.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\balloon_magic_pop.mp3
Size 24KB
SHA256 4b229be78b89a5fb0f2385ee00aacc8d17b7579b6749cb81fad6ed2f8e69282c
MD5 2de9e72cc867b15c97ce4a7a5de3d757
SHA1 24b545d0b34cd90ea3e95108b7f49ddd479dbeeb
SHA512 4da44e3669302d7f03bb19f4b23b898176de0e6cd0b80858684bd2ab10ea0acde2d9e59837f14357712f36cb82af8291e8750cfe00878778f9e5519b99e8361e
SSDEEP 768:b1bfbQjF1i//V12BAZQ4YtnxZBesgbbNgyYUixYtqNL:xkA3mBp5Resgbe5jYtqx
TLSH
T18DB2D1BED91CC56DCCD96AF080FF584426852FE473A0F6E0A6997483A83B5F2D0984D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_pop.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\balloon_pop.wav
Size 21KB
SHA256 20bc621567696c8892c1b4b4a49b282b14422a1f0f657d4c686029e38938a6e0
MD5 3b7f554efc3e5cc2a6f06251f28acded
SHA1 b94316836ea529536eec9d63bae2095a3a6b12ff
SHA512 61383b08ca9c6c499c0df522180f000c20f46668cb30d8167909b41ff1d0819b621cd48d14fc663687ac30c86a497a6d0f23444956a505d80be84e27a6129152
SSDEEP 384:msAEpHxf5yk2XPIrrbPh0kWXfWNu6MQ6rg58lNR56OD8B+tLoIeKM40RWRH/pdTb:TRokCQbJ0kU2u6/mxQ4KIeKeEv6k
TLSH
T164A2E13890A71D9CDFDF1A3CEF7FB41394429489E8123D2A830D4DA2B54A7447DEA522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bellows_01.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\bellows_01.mp3
Size 6KB
SHA256 4b17dc5f02605080b2c34b6ef4fda74b796048335dc64b25b60c5293fcea6a66
MD5 0b1b7c02c92a566db92d3151c7396be2
SHA1 f7121ef3aeb2a57da83d5eff77f4b9de2976014f
SHA512 171ae2bf3580875bca0adf695f2714395dffeebefc855387db0131a27882fc4d53bbfc7a69ca6e74749715ee2456f0027506654e549dd3be9a6f7b75d1b21176
SSDEEP 96:37B4wlQVg9AqKrSkWDNvgyASZXH01xvd6SJ3RFpCvi/UMCdQnTlx+5qSn6nm+wgH:3Gq2jTePAShU1/6OLCMe+x+J+lAi1
TLSH
T177D16E3C95470059F12B6A373CFCADA1EFB348A9598CEE9C33A0513604776097F95894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bellows_02.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\bellows_02.mp3
Size 7KB
SHA256 c2e42f41cb39d4944b818eb5987353e61d269b16bfee8bee77c9d8d88366ae1c
MD5 f3a6f801239ff7c51e84034907f87cac
SHA1 66da333049942aebd913fab42e68e2ae664497af
SHA512 3761f17d21ee52c2c216d9fd871994f9bd2f846f7a04f9d9ab7dd8c25d11215b943da16d22df9329d20a44a01afe35e22b8de89a85928d872f80b920f075e02d
SSDEEP 192:pHLtWQVMfGXt36H9Lx72zOaDkTAjvhe8NfC:hLzVMfG936HO1TheEfC
TLSH
T1EDE1BF2A494C2BACC8B13735E0B313566899FE0E82646ADF12FF74305BF22526C1BC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bellows_03.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\bellows_03.mp3
Size 6KB
SHA256 34cb950d71922b17d312daaf394a0832fe72aac8b0acf5ec0c4dd841d0f26c55
MD5 31a1fcc31791448bbbc95b138dcd4b4b
SHA1 e180afa92733e231c082c2a79a8d0224fa6bd05a
SHA512 1b83588e695c150c9d892e9dcc788cb21a356300977dbc99094c21143113513b350626dd58c97e3fdbd3b38ada3ab0331f5583342947133e01e307c99fe4e2db
SSDEEP 192:Np8X7dAo/RVj8biV7LbiLR3frNMc8+ohyDWG:Np7cV5tiL1zn8+ohy5
TLSH
T1AAE18DAA4E8E561FF94453BAFF69CBC9C3D2CE50A380569E5A4B3324653F041C30A84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigbrother_awakens.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\bigbrother_awakens.wav
Size 128KB
SHA256 cf4fd7f867688053aaa6f1974b66b0fa5b9c939f8ae6c71f9347eceeb121a75b
MD5 0d84a97a00d3ce03e1ad16b6ac62ee1c
SHA1 45ce5189f7090725ec530099cb4df213de883ea3
SHA512 bacffe97808154297cdad0283e7ec320162d40b92513996e89523616bb3d12b131eb67bfee23e7b6cef3b7d44770eb6582172ceecd9847593853f7b2cecbb2bb
SSDEEP 3072:pkaC7vcFySHCzg4Uy2++opMTj5ys1SHyMVzM8TW:qazPCzLj1pMf5yssHykw8T
TLSH
T13DD3E593F5438A10C82B0F394D32AF65067BBC29BF5B921B30497E196E733D25B216D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigbrother_fly.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\data\audio\sfx\bigbrother_fly.wav
Size 74KB
SHA256 66d86a11b1d8c0babe769aeca16152a5326302d335a3b09c8248cf3d9dd07996
MD5 7300008a3f5028d5ad8a8dd1131cd927
SHA1 280a662770ded32ba41e1ab3ad71c574d2320e3c
SHA512 166f08876d93147e517a4150732a4a94cbf040a2d52792dd4b31edc1ce6507e448c8fe092d1564a72291c9aa633d22d52d4d63e883d67b216e328ac4676b913a
SSDEEP 1536:ptkcXJKT0NrK/dhjMj6pE/FK+xnpQTMktTp6f0/1goc:n7XJIerY5MYebWPtTI0dc
TLSH
T16B73C012F0415652C9328A358A55D581C7437D0F6D221A8F3A8CFF4EA6F7244ADEBF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\0BBDA25\updater.exe
Size 1.7MB
SHA256 49e125d5be812fbc1ea5012964fee9278499796b034674f7cd8155840e4cca3f
MD5 6bcbf649f91684e24a720bea62d40feb
SHA1 0131e07705e50934c8129867120e10a91f4b5d1d
SHA512 6d3aeb8348ee61690f72f75817d977baf84b825957cd24f00395bfe1405991ab2cef73ca8790d9a8a4a91601ed6ee364e7ee56be0948a873df0dcc4354522ac9
SSDEEP 49152:Jz29kv5555555555555555555555555555555555i:Jz29Q555555555555555555555555553
TLSH
T198853A0263E98519F0F75B30A9B257B11A37BC52BC34C74F6A983A1E1D31E40DA26B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decoder.dll

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 4.0.0\install\decoder.dll
Size 120KB
SHA256 2e3ffa1acb15fb256694b7373e7725d926a322aef076bf1d2725290f5be8bf6a
MD5 87c5bb06d9cddad535194e787dabf848
SHA1 76292101513fc137f5c70dc335f9f924388a252c
SHA512 9837dae4c5abcd39d1bff1781bc053b70d2831d94001c8ffc0a59b086e6824eb4145c6be9538da9dfd0eb8010d6ee9c027c83981144b8e7d35540eed186c1ca7
SSDEEP 3072:AHLohTAI0NkxvLIe9R7Lw1UDm+qnWFGm+T:go+5yxzIebLXS
TLSH
T1D3C39E3133C1C072F11F113E8806E7B99B6F7AA1C9A09A8B7FA40A655F35291DF39356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3949.tmp

Path C:\Windows\Installer\MSI3949.tmp
Size 270KB
SHA256 4337cdfe01a45f6691cf883b57d5663788fda9a368a1eac989cb16e31f049ac0
MD5 50a3d9c4c3b6afda98bd6b0c60363175
SHA1 d69ab1b8c51b0282c3b2a02e179bf27128905835
SHA512 4824cd07d207608798b17210d196b8fd77ab3f75d3331449cea21c77dd3084deef67feeda029ab2e5f81bdbda1fdfbdb2af7fa753cdcf6292a5702454c232edc
SSDEEP 6144:lrR6lMr1Zx214pFEQgNwrvaE8cd4kmQiJSYI43smCvR:lrR62rFBnE5NwbIcuLQiJSYI43bq
TLSH
T115447E1230E4C934D69F5B38AB6C8B75A2F8F5715BA1C803F3D45E1C9BB2A838525F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI40DC.tmp

Path C:\Windows\Installer\MSI40DC.tmp
Size 193KB
SHA256 2fa1395f005a32d8147e7a21395c0125c473765302882e8c2509be30b738d634
MD5 02fa966a1c078bc9aee5c6c4f93df743
SHA1 97d91368491a0ba84a38d1668e0c2e7e3f96bd59
SHA512 ba6bc968eb9bab3107ae885714cc2eb3f3a0f8c6e70f7ab7527e6ae93bdc99a054441bfe3e6a3c490193608597898c7d1cdf643437ef887aead3e2c6b6e627cc
SSDEEP 3072:MfG2dK29/1prU/jrCFICa+TEqF16M+bh8vQ5nv5hTmwqp8A6:MfG2wA/19U/jCa09t+AQ5nzEz6
TLSH
T106148D2332E8C037D26F16308556D77155B9B8B25A25D90BBB948E1E9FB1AC3DE31B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4476-26-0x0000000002F90000-0x0000000002F91000-memory.dmp

Download

memory/4476-0-0x0000000002F90000-0x0000000002F91000-memory.dmp

Download