e9aaaaf2be8958f955891714f6a5d21b2b9b9087bb528270b3e7669d13bb96dc

Analysis

user interaction
yes
max time kernel
151s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AngryBirdsInstaller_3.3.2.exe
Size 101.5MB
Sample260819-het49afk2s
SHA256 e9aaaaf2be8958f955891714f6a5d21b2b9b9087bb528270b3e7669d13bb96dc
MD5 cb5df88a594771390e546ddbcdc19ad3
SHA1 0979f0d235837df6e2e28977d7a7c785689735b3
SHA512 fe485677f13bc92543646021316f3d4d7dc1dabbcd4fdf8d38cb60401c2d6e3195c4e11fc9fb807d445877fabb4b1bd4c616b77d60dff3097afe28ffd7ec02ea
SSDEEP 3145728:ethH8MpiQ1aFHUGtqR55LymgUws9nNjsy4h:ethcMkA6UjR3WMwsVdg
TLSH
T102383301A3E48129F4F75F30ADBA52A24A397C51BD34E51F53502A1E3971AA4EFB4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3736	AngryBirds.exe

Loads dropped DLL 19 IoCs

pid	Process
4616	AngryBirdsInstaller_3.3.2.exe
4616	AngryBirdsInstaller_3.3.2.exe
2284	MsiExec.exe
2284	MsiExec.exe
2284	MsiExec.exe
1660	MsiExec.exe
1660	MsiExec.exe
1660	MsiExec.exe
1660	MsiExec.exe
1660	MsiExec.exe
4616	AngryBirdsInstaller_3.3.2.exe
3592	MsiExec.exe
2284	MsiExec.exe
3736	AngryBirds.exe
3736	AngryBirds.exe
3736	AngryBirds.exe
3736	AngryBirds.exe
3736	AngryBirds.exe
3736	AngryBirds.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	908	msiexec.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\THEME_18_PARALLAX_1_18.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\PC_retina\THEME_01_COMPOSPRITES.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\PC_retina\THEME_09_THEME_9.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\birdday2\Level980.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack16\LevelP6_3.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\fonts\2048x1536\FONT_LS_SMALL.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack19\Level766.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack8\LevelP3_311.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\loadgroups.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\superSeedActivationBurst.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\subsystems\eggdefender\RMFClassic_BubbleGun.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\bellows_03.mp3	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\THEME_05_THEME_GROUND_5.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\surf\LevelS014.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\menus\cutscene.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\vehicles\EggDefender_9\EggDefender_9_W2_V1.scripts.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\BUTTONS_SHEET_2.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\vehicles\EggDefender_13\EggDefender_13_W5_V1.scripts.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack16\LevelP6_11.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\subsystems\notifications.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\fonts\2048x1536\FONT_HIGHSCORE_CHINESE.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\rubyBreak.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\shaders\gl2\commons\varyings.sh	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\CUTSCENES_STORY_3_MIDDLE.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\THEME_17_COMPOSPRITES.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\MENU_MIGHTY_EAGLE_1.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\PC_retina\CUTSCENES_STORY_3_BEGINNING.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack1\Level14.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack7\LevelP3_216.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\subsystems\eggdefender\EggDefenderGadget_BubbleGun.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\balloon_inflate_01.mp3	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\quake_smoke.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\vehicles\EggDefender_3\EggDefender_3_W1_V1.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\THEME_01_THEME_GROUND_1.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\PC_retina\ID_LOCALIZATION.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\PC_retina\CURSORS_SHEET_1.pvr	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\PC_retina\MENU_ELEMENTS_1.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\menus\splashes.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\goldeneggs1\LevelGE_17.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\green3\Level1247.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\particleList.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\jewel_break_01b.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\pink_collision_02.mp3	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\confettisBlueSilver.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\piglette oink a2.wav	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\THEME_06_PARALLAX_6_2.png	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\THEME_06_THEME_6.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\iap\shop_ads_off_window.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\vehicles\EggDefender_16\EggDefender_16_W1_V5.scripts.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\vehicles\EggDefender_8\EggDefender_8_W1_V1.scripts.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\LEVELSELECTION_SHEET_ALEX.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\goldeneggs1\LevelGE_3.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\green2\Level953.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack2\Level41.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack3\Level59.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\pack7\LevelP3_304.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\surf\LevelS015.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\surf\LevelS044.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\music\ambient_white_dryforest.mp3	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\audio\sfx\kingpig\KingPigLaugh02.mp3	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\PC_retina\CUTSCENES_COMPOSPRITES.dat	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\levels\birdday2\Level976.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts\particles\diamond_shine.lua	msiexec.exe
File created	C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\scripts_common\menus\daily_reward.lua	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSICBD3.tmp	msiexec.exe
File created	C:\Windows\Installer\{2D89E4C6-FFDF-49DF-A44A-73EF7C600AD6}\AngryBirds.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10B1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F0994448987AC88.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDF8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID636.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{2D89E4C6-FFDF-49DF-A44A-73EF7C600AD6}\AngryBirds.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2D89E4C6-FFDF-49DF-A44A-73EF7C600AD6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7AE.tmp	msiexec.exe
File created	C:\Windows\Installer\e59c8d6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF961F70D2A40C4B11.TMP	msiexec.exe
File created	C:\Windows\Installer\e59c8d4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA4B.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF028FFAA28AC175C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCA6C2473D3986C43.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD5A.tmp	msiexec.exe
File created	C:\Windows\Installer\{2D89E4C6-FFDF-49DF-A44A-73EF7C600AD6}\icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{2D89E4C6-FFDF-49DF-A44A-73EF7C600AD6}\icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c8d4.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AngryBirds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AngryBirdsInstaller_3.3.2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\GameUX	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\GameUX\GamesToFindOnWindowsUpgrade	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Software\Microsoft\Windows	MsiExec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6C4E98D2FDFFFD944AA437FEC706A06D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Rovio Entertainment Ltd\\Angry Birds 3.3.2\\install\\C600AD6\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\ProductName = "Angry Birds"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EDE61A217CD2D9D43B7A1E47939554A7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\PackageCode = "400E6680EF949CD43A97316D24073F88"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\Version = "50528258"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\ProductIcon = "C:\\Windows\\Installer\\{2D89E4C6-FFDF-49DF-A44A-73EF7C600AD6}\\icon.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EDE61A217CD2D9D43B7A1E47939554A7\6C4E98D2FDFFFD944AA437FEC706A06D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\SourceList\PackageName = "AngryBirdsClassic_3.3.2_rovio_DISTRIBUTION.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Rovio Entertainment Ltd\\Angry Birds 3.3.2\\install\\C600AD6\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C4E98D2FDFFFD944AA437FEC706A06D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6C4E98D2FDFFFD944AA437FEC706A06D\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{A5FEF33B-966F-4CF6-8983-F684FDFBC8D0}	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4248	msiexec.exe
4248	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	908	msiexec.exe
Token: SeIncreaseQuotaPrivilege	908	msiexec.exe
Token: SeSecurityPrivilege	4248	msiexec.exe
Token: SeCreateTokenPrivilege	908	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	908	msiexec.exe
Token: SeLockMemoryPrivilege	908	msiexec.exe
Token: SeIncreaseQuotaPrivilege	908	msiexec.exe
Token: SeMachineAccountPrivilege	908	msiexec.exe
Token: SeTcbPrivilege	908	msiexec.exe
Token: SeSecurityPrivilege	908	msiexec.exe
Token: SeTakeOwnershipPrivilege	908	msiexec.exe
Token: SeLoadDriverPrivilege	908	msiexec.exe
Token: SeSystemProfilePrivilege	908	msiexec.exe
Token: SeSystemtimePrivilege	908	msiexec.exe
Token: SeProfSingleProcessPrivilege	908	msiexec.exe
Token: SeIncBasePriorityPrivilege	908	msiexec.exe
Token: SeCreatePagefilePrivilege	908	msiexec.exe
Token: SeCreatePermanentPrivilege	908	msiexec.exe
Token: SeBackupPrivilege	908	msiexec.exe
Token: SeRestorePrivilege	908	msiexec.exe
Token: SeShutdownPrivilege	908	msiexec.exe
Token: SeDebugPrivilege	908	msiexec.exe
Token: SeAuditPrivilege	908	msiexec.exe
Token: SeSystemEnvironmentPrivilege	908	msiexec.exe
Token: SeChangeNotifyPrivilege	908	msiexec.exe
Token: SeRemoteShutdownPrivilege	908	msiexec.exe
Token: SeUndockPrivilege	908	msiexec.exe
Token: SeSyncAgentPrivilege	908	msiexec.exe
Token: SeEnableDelegationPrivilege	908	msiexec.exe
Token: SeManageVolumePrivilege	908	msiexec.exe
Token: SeImpersonatePrivilege	908	msiexec.exe
Token: SeCreateGlobalPrivilege	908	msiexec.exe
Token: SeCreateTokenPrivilege	908	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	908	msiexec.exe
Token: SeLockMemoryPrivilege	908	msiexec.exe
Token: SeIncreaseQuotaPrivilege	908	msiexec.exe
Token: SeMachineAccountPrivilege	908	msiexec.exe
Token: SeTcbPrivilege	908	msiexec.exe
Token: SeSecurityPrivilege	908	msiexec.exe
Token: SeTakeOwnershipPrivilege	908	msiexec.exe
Token: SeLoadDriverPrivilege	908	msiexec.exe
Token: SeSystemProfilePrivilege	908	msiexec.exe
Token: SeSystemtimePrivilege	908	msiexec.exe
Token: SeProfSingleProcessPrivilege	908	msiexec.exe
Token: SeIncBasePriorityPrivilege	908	msiexec.exe
Token: SeCreatePagefilePrivilege	908	msiexec.exe
Token: SeCreatePermanentPrivilege	908	msiexec.exe
Token: SeBackupPrivilege	908	msiexec.exe
Token: SeRestorePrivilege	908	msiexec.exe
Token: SeShutdownPrivilege	908	msiexec.exe
Token: SeDebugPrivilege	908	msiexec.exe
Token: SeAuditPrivilege	908	msiexec.exe
Token: SeSystemEnvironmentPrivilege	908	msiexec.exe
Token: SeChangeNotifyPrivilege	908	msiexec.exe
Token: SeRemoteShutdownPrivilege	908	msiexec.exe
Token: SeUndockPrivilege	908	msiexec.exe
Token: SeSyncAgentPrivilege	908	msiexec.exe
Token: SeEnableDelegationPrivilege	908	msiexec.exe
Token: SeManageVolumePrivilege	908	msiexec.exe
Token: SeImpersonatePrivilege	908	msiexec.exe
Token: SeCreateGlobalPrivilege	908	msiexec.exe
Token: SeCreateTokenPrivilege	908	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	908	msiexec.exe
Token: SeLockMemoryPrivilege	908	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4616	AngryBirdsInstaller_3.3.2.exe
908	msiexec.exe
908	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
908	msiexec.exe
4248	msiexec.exe
2284	MsiExec.exe
1660	MsiExec.exe
3592	MsiExec.exe
4688	OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 908	4616	AngryBirdsInstaller_3.3.2.exe	89
PID 4248 wrote to memory of 2284	4248	msiexec.exe	91
PID 4248 wrote to memory of 1660	4248	msiexec.exe	93
PID 4248 wrote to memory of 3592	4248	msiexec.exe	94
PID 2284 wrote to memory of 3736	2284	MsiExec.exe	96

C:\Users\Admin\AppData\Local\Temp\AngryBirdsInstaller_3.3.2.exe
"C:\Users\Admin\AppData\Local\Temp\AngryBirdsInstaller_3.3.2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\system32\msiexec.exe
  /i "C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\AngryBirdsClassic_3.3.2_rovio_DISTRIBUTION.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\AngryBirdsInstaller_3.3.2.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:908

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CF016B8315CC73D407CC4F218663679E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe
    "C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3736
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3637F146EE15C05D812D371182637E6A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1660
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D81202D99E5EBBF4910AE16032238CE8 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:3592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c8d5.rbs

Path C:\Config.Msi\e59c8d5.rbs
Size 439KB
SHA256 87a8ec552d344384f47d1ea6d6d6408f12254a834d639232aa74d5da6d9635b1
MD5 8b41c1c6f4b25c1a57bfc43c48705cef
SHA1 c791c385587545ffccfbd311af14ffb25460f312
SHA512 75f708f0d053703ee18a27ed4ab6ac77df49df092e8fdd64363542d0f9b2b056fa5527e180533935881e647cd9a1ba03a2806b8379db532b872de4b448d35ed2
SSDEEP 6144:cp0QzsUkkpaE1SVIKhc3CVkb23enVqx8nLoxwvO9wc2iC/kJWZYtAt4ReH0PCfGf:6fhwAt9wjCawt+AQ5nnh
TLSH
T107A44350AA25F2D9F32F5F7333C14E19481E9C243A74123D728C8FAE8FD1D21A96D95A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AngryBirds.exe

Path C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\AngryBirds.exe
Size 1.4MB
SHA256 ce808aa03628ccc11edf5e12626d9ed8b6a928850656cf3e54ff4f6c8e9bf869
MD5 4443e04c51906048571a387283399303
SHA1 1bfd49ef604d96dc0b2e590732ff24f06eca18a2
SHA512 b867ebadc9bc0f810aa307ebedae0d7f091537a351398bb015182c7fcfbbd2ea7f139559b79308f38ef23b956fb81024482b60f5c4120ce0920a08d014bb44f2
SSDEEP 24576:f+E+rVIaCqTtJGsy6MFZlEGB5BptCsssgB6D71yrAIJVIT7IW+S5ZjDAj:GEqVC+zq6MFZjBptLsGD71yA0VITcen8
TLSH
T12965AE71BA01C031E6D28172C97C2B6F4D2D6A72076A54D7F3C81D59BE647F2663838B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PARALLAX_CRANES_ELEMENTS_1.png

Path C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\data\images\pc\PARALLAX_CRANES_ELEMENTS_1.png
Size 46KB
SHA256 4e7a2ed3081c9104668dab24d593e2eea0890cf6a51257fbdaedebe49fe6284e
MD5 9de40e75db760fb9272200f3b6427270
SHA1 0637da48efece6e65d1fc8c79e839a20feb2c282
SHA512 6b27c2505254f5592211b7565b61ede94421a033db93616c66078167b634665554a2e754b87b7072f457bc0b4e168284abd0d1e5e659bdef234dfb5c891149be
SSDEEP 768:VWrh6IiAGCEBXarEMRywrzWO76LepOy3Z0y9CIHLH0nnXK740/CEuTsLUN:VWl6IiI4InWu6Lvk9CI0nhMCbVN
TLSH
T188230216428D47AAB29237C538A6F98A88851F14D1F06F6B36E0FDA2B17A5E07315DC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.ini

Path C:\Program Files (x86)\Rovio Entertainment Ltd\Angry Birds\updater.ini
Size 414B
SHA256 dfe680fd1bee51e02f80c769e8e1e1c5c984257ceca5bad7ac72dac8e90c0cd4
MD5 1017f315b2843526e756e9a5e088a157
SHA1 a8afe8328b3a7e0ce3367078230212837d234579
SHA512 1da15bbcd3932d69dc69279ec48176443d4a2a71de7a199d1e72e730d774eb960db86475bccbc27de1ff4c396a8c612308560bc0bf141f86cc57626f12bfe251
TLSH
T16BE0AB92199AFB8EA3595FA322A6490C48529D083FA1273EF0914D8C9AC2C10654745B
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5C3F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5C3F.tmp
Size 77KB
SHA256 19989417f3f411c8a02aa09f1dd51a7febc530f0f27c8d3f7dd195ba224e6fba
MD5 7452f56af87d0912c3a06206dc77c0a6
SHA1 5ff38786b61d5061ef0a09a670b98e5d3b961b1d
SHA512 e07a612edeb6078f9ed639018a1e22e30dc4b8bf9820f1dadbf405722f32f5e2348ca5585c1d054e857b0644c9d824b44dd64ec4a8d424c2e78aeddc1bc351b9
SSDEEP 1536:0+aeAAphyIulPMPxXEt2SJekrv7qMePdX58l:04AkyFlkPxUymv7qMI6
TLSH
T13C734B1272F49075F1A729717FFAD655C3B7F8A568B2841B8B520C471AA0D82EB26333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Angry Birds.gdf

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\Angry Birds.gdf
Size 6.1MB
SHA256 e083ca0d48054f511e08357fd13ba3b71227a6d3fc742a0776175241ddd63305
MD5 0938e1f55a78d8638e3f78a1d14c054d
SHA1 66e9e4618c733a6187a1be1b8f61e69a8ed58706
SHA512 b8d492c106340eabab9c02edce9f1076958d12e3c097f66acc6f94795c5720ee189e08e20898c73a7251aaa46bdd02036ee13af854c4ed90746a14ca4b69f989
SSDEEP 49152:MKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK:
TLSH
T108560242A394902FCC6B4931E85D0456C63DBC51F829692B97903A1E37F693BAF4CF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AngryBirdsClassic_3.3.2_rovio_DISTRIBUTION.msi

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\AngryBirdsClassic_3.3.2_rovio_DISTRIBUTION.msi
Size 3.1MB
SHA256 45b8b47d58617b869f656d739bb184d01b03553ce9973ae2fb091595ae939888
MD5 eb559529ea7a63fdc1f84e09f64c7881
SHA1 f50112f874e8d7a13f935103592ff55da8895c82
SHA512 031d44957df283393731a14a6841601bacc525f118731cc6c308dde37d86327db61e1eb15581f9dc5bbe60da1106ce88cfae018aaab1e7f675fde819b31efd09
SSDEEP 98304:tYAAEkMZoRnzIY3tKeandbMYHqfVDuyzh:Pk9zIYdy5
TLSH
T1D4E5BF0AF1D49636D99603384647875389FC8838DA66451AFADFC20D3FD35E4A3BB6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BeachAmbience.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\BeachAmbience.mp3
Size 1.5MB
SHA256 b8c5315331f8cd9356f9d6ddf968212f7c748b1ac4590f237a299393ba36609e
MD5 660edad23278f78998b0298b6e51f144
SHA1 dd9f7113b4c20ab9161a98e75859fdd4b6d47484
SHA512 baed531d4a33b001714f19330dcf1b11aa7fb097eb801fcb340f8f2f39606afb5f0d10ed9592d692b6ddfec803c29980dbfcab2f19bd555b0dc9ce1d4f3a3210
SSDEEP 24576:bBy1kzitdDqFIQ/mch7xGao3LbfgBD9gNUqGB/bTM4TKR3jzZvJ7TEYRlNwSYcRe:ZivVci3ojgNUqw/nM4TKtzTE4qcRe
TLSH
T111653351D389FE03D500E3B9AFE34209E114FF463F503EA25E19CF9691DA06A7B58B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RainAmbience.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\RainAmbience.mp3
Size 868KB
SHA256 d5fb460d03b8a0e74ac075abf1821d3ccef4651f3583a55c207ed5f505bf95ca
MD5 fb50b71d122bc9366e227b2035296ed4
SHA1 b90f1940988077be06784da3959957720138d462
SHA512 63e6a58f31853a453ab561ca47bb8ff30e87f51611c68444de2cdb0646b0a3185b383fac0c6cfc8dee0cf1dfff8a701142cb828a8bf68567c84ab339cd6c1800
SSDEEP 24576:6/hkuCAW1TLOlpOm78mMLbaB5u3rL7CJHAJZMcdt:6YFE77caBmmJHAJZ1
TLSH
T1DC152362BA02CCFD99D6082013F35DD695F5EB5F314A32A299F48F8393B964337291C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab_cave_ambient.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\ab_cave_ambient.mp3
Size 934KB
SHA256 d93725def68b368ebafaadf4710b2a53d5af2fd5d331b58798fbcb29f9b6f6f8
MD5 0218e9a045ac80e705b0031f43918380
SHA1 aa500947c21adc3d4879d5abb7d7796d57cdfa8f
SHA512 57217ee2acc83f9871ceb48fced8a6414e9b77e7b969f9fe921cd7c8a32dfff1837607a9ccc38f291948d6b0e4a12ba61072bff29656f4c9af6e818e218c2a63
SSDEEP 24576:pCTVLhwl2M+hHNR+tGL1piQ0kzU1RwB28la5c:8B9wsbWtGL1pLEo28M5c
TLSH
T100152311EDA6E159EE1653F04E1EDBC2D4DFF4342C2329E8368ED7A4B1E9061F9D1206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambience_waterfall.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\ambience_waterfall.mp3
Size 665KB
SHA256 4ad5805317a25bd1fdbb94ba60017997045c1988fe7ad524516ef0d28b5366b0
MD5 aa1475bb90d34ebc38faa505bc2c5d6b
SHA1 910e01850e0c7a8699073b60a1bcebacd259099b
SHA512 aeae45f323168495c74b5478ad3085a798d55afc6687ff8c17ad88087271a3b04a470f1932d923a9b33ef3aa431400e0853ca512e18f65aa75a4f0e71035cfb0
SSDEEP 12288:f2kVyagFo1buI3i1LZ8x3Gp6ijhVEK3nPfmnJLeDtsXfelsEw5r:ia9Uqx3G4ZwnnmJ6BsXfUsEwB
TLSH
T1F0E42329175EA7B6E780B77B3B87067956430BC0EA07742CD3D877211FE9BB1878A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_city.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\ambient_city.mp3
Size 955KB
SHA256 7a3c2fd920b89dd824478c1da55dbe90a8144c92a7ff40e91986a441f9b2f0b1
MD5 124baff841c82642385089c9a27148bb
SHA1 b429654684b9e49c2a094afe4e3b468ce1c5865b
SHA512 e1a3a63265a8fbe044e3028489e52898fc976d4d06629d0bfa4faf61ef9cd5d4dcf5ec77824aa5cf6e3d0134d21379cc387786a0df101338b9679683c4d2d96c
SSDEEP 24576:dxHOSXn9t3DgiwOfHmFbNZZ1Kv3tCHPme78/Mv33pIb:nHtXfhg/Z1eCHPme78/SnpIb
TLSH
T14B2523E72A4A17BBB2D7AEFF1CE317A6CC5559D4504AB6E005C22E51ACB726F03340C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_construction.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\ambient_construction.mp3
Size 882KB
SHA256 78230eaa24ac157753c414488d2fa2cb68dee6e38db5ea7d9514eadf8a6f7630
MD5 19676b269e7580035c49bacc7241156c
SHA1 4044c9e6b32a8de3ae8a7935e0da3c38a45e7aef
SHA512 b20bbfa69418fb9d20f4f000b7167cd5a69bf07421252c096a8a0957a2bd2db476c2a60efc211264ef8ed52e580ba51b1f8a1ee944fa549499937dcfee322302
SSDEEP 12288:SQIqsKzFDw5HooSnBhdFkNVG2qGRbqDj/AIJOrWDIAOTkw+W4mBBJyiRzzP6WTnT:SksK12HqBfCC2knLFIvX+WdvTnCg
TLSH
T1EC152349CA14590AE13C1BF43F4F1BD8AE580DD1A0D69FDD25ACEFBA64E56D8DCC2402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_green_jungleish.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\ambient_green_jungleish.mp3
Size 1.6MB
SHA256 d48cfc8546dce9d7e23d0d28cf9008005ec0f4121337e7555b176f6aa8c0f6d5
MD5 c921cafcfe46985dc888a4b71ff8510d
SHA1 7cd85b011fa5ca67fe27c8747fc25ca170be9b07
SHA512 a2ec698f59b03e11212537bc8c177d2bac3ba99c600febfdaa415dab8706035967263e2543152614ca65be9b7ed3b75986386a0a64d0888c29e79ee3e9da751f
SSDEEP 49152:aOh+ac5ndD/V5J4v3L3d6nTcKMKdzO4tctx:Rhdc5dR5J4v3Ynaf4Kf
TLSH
T15A753347CB414017F2CB53B49F53060BCE1A8AE6AB4AB6EE5CDA07E6D273658CFC5904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_red_savannah.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\ambient_red_savannah.mp3
Size 758KB
SHA256 79c23296d2c44f1958d15a1a7a5db87463aebf1bc90070355cb98264e4d57901
MD5 6c1b3a8858c4d7245fa8d087f7ec853f
SHA1 c62d8a30080bad54335e46ca80d83cc003d7daf1
SHA512 c3be7ba0702dfeede42ed548aa12c84e8703a026c637de7ce1fd412c428b2ddeff8646e5d3fb94e9f9ef3f2a94cbc0b8b7dea2d1d945c5d41f24f26ba6046212
SSDEEP 12288:4hHrOaKL+8o4GUnITqfYjacSKnXBsJzRyXBIUqYDXU5i3G6rgeI9la71hYclxFbe:iqaMhAj5BYCBhjJrgXl2XYSPbuH
TLSH
T179F423D1DB20427AF95D25309CB3BEE9C800ABB16543FADD84E51F88E247929F3E1316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ambient_white_dryforest.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\ambient_white_dryforest.mp3
Size 652KB
SHA256 eb90dc799591de5930090b2449702b850bd8644d140777172707b4f7eba8dde1
MD5 ebc99ab860cd70a6e508fb4307dab139
SHA1 ffd3c03f91da68228f2e9ba1b334492addc90aa5
SHA512 63a4cf5b6223aa8944a2584277bf5cf86fbcf344d66ccda20f1cc8c5ccbb5e3e5f918d194fdd9916997798d2ab788dcd745b76fbfc20f9e79d3bd33d28878e7a
SSDEEP 12288:r1z/Tkq0tiEjZygE3B8csNgvAhEq8LTcBptUI4w10RINiyXUvR/R1vQt4Jwa:JzbkqupAMckgvA2q8P6tUI4i3E5/R6O9
TLSH
T145E412E26F950679F54C30B8CFAA76A3DD09C3B11544EBCA65CD8B139097881A3F4BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birds_boss.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\birds_boss.mp3
Size 146KB
SHA256 e57bfbe37f79e791283161780b24817ecf261334add75e0554d9679dcf737c63
MD5 e72d737bda7f80c3aa7e904ee42b54da
SHA1 f6b88e9ac9e0b2d143dbf5973576665baae53214
SHA512 a03d979dd1daf51a1a72078d20142ffbfbe145163aaea7477a85131fac35a1ca8ee620a499d3981d6d701bd574dd92fc61da7ce61c4a3c309ea234e2f59fe426
SSDEEP 3072:FeCHfDhmJ08ah3CxA7icVVOsDaJZemy/teQJAK:MCHfD8J0TPHosDa3em+YKAK
TLSH
T164E30199A7431424F0566A7E772BAF60C201EC6D4C06EAE1C1E4A312B2FF58D77E5368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birds_intro.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\birds_intro.mp3
Size 357KB
SHA256 199a9d5d6d8a39fa0578e6568e356c98cb9761ec1316bddd588c3013a01f2b8f
MD5 c66153a18f314aa9af6c698a6a215417
SHA1 bc8eae465ee784f8966d0788db0de219d6ddbe31
SHA512 3ee614876befe0a2fd93bd1e1620cbacf950034d4b4d5b84f10a8d0e3c205f750fdd8bc0d3ff805192479efca4c5c147d9475f5cfd783145652bc55a3e9cf17c
SSDEEP 6144:l++XuYrpsncEWvQnFaLKH5MPANnMBkUWLF7r6f32sm0GBnHUGfAn8:l+sVwcEWvWaK2YBUz2RflHUl8
TLSH
T19B74224457637EB7F8402A745F226279E7929FAB4A62E0E2DAC467319133201F3D731B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birds_outro.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\birds_outro.mp3
Size 292KB
SHA256 7719b486d88b26345d28c08875206f557af38ec33ef92005154fd3a0fa974f2e
MD5 e9234e661ff22c4420697387c9def44f
SHA1 9ea5508d6b89d09b8a6a89ac8ba5264283a0c5cd
SHA512 7b6f6f12ba8c05e825543e1f01374f4fd4ce03a65f7cecb65d1eff1ddd89286ea05d0f468f20d5593d28190a8236c5fb54c29badc04f75b7693526a121e4afcd
SSDEEP 6144:deD82tmmf9Rs2mRugmu89JxfB/yP8IPDMhDkiOI3xlsVMtjn4gM:4D8u2Ruhu8HL/IPAhAidLCuM
TLSH
T1BB5423842D8D29C0F8E2F6364D2B38A3E5070E585481C555735BB320B2D75BABBF9E78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birthday_ambience.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\birthday_ambience.mp3
Size 693KB
SHA256 a672d6c0f3abfab6427721b550c700380854e89b88e21c97644322af4dd3622f
MD5 561234feed51b118619e032561971ae9
SHA1 802527c1206dec18a51510411bc11ef672593021
SHA512 f826dd3035814f0c2744be9b38d00b19614f0bb5c13a17cf487d870e00cd8e8eadded4579d9f70f5e09cd8034ddcedd6a2a3b18f338119cc019af0915b074d91
SSDEEP 12288:IUB9vUYlLDfffaDKtxR00+V4PLzyD566QekWuyeHSpvPCU0mDjY7:IUB98YlLDf//0GC6pWuy4eX1v6
TLSH
T1F5E42332EA983A35F1CD52B59D62B342B21A17FAB3473850B9456B4013EF43B33BB915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

funky_theme.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\funky_theme.mp3
Size 1.7MB
SHA256 6c52b0d9438cc379fe16818604c818c60e2f3ea3727754c92a9ebfef1533514c
MD5 8685fe14227131550e7067fc7ed25179
SHA1 756400eb47a1a6dc05bfb5f1b4a8b6969d1f8e23
SHA512 09097a5e9835e370dcacb660d3946193dcf4bd3b9cdd4613309ec46d41341c240ab990c15414dba0e5dce5c8cecf94bf03cb7493c7dd93b282a64d926abc3cbe
SSDEEP 49152:N/GFZI8BmuVw/pgj4iFPNDGJSRhF0RP84e8Hl/q:xUFMuVLFPNSJSRhuG8Hl/q
TLSH
T16E85230FCB106226F7085BB4CE5733A8DF596BA00A4771D85A147B6970B31C8FBE4B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game_complete.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\game_complete.mp3
Size 283KB
SHA256 966a98b93f7c6bb23b77f64501efb03b6edafce184bae7764d538dffd695c2d5
MD5 716b8fae5dbf608787d96b55e8882e3b
SHA1 b9268e5f587a2de6e4eead56bd1208ef222f4915
SHA512 dbae1ca4176349ecf7edb9e4f420177121aaab021f48e0985c38f7e3d2aa98e576e2cbbe74441f707507285ba3018bfc31f4bd21e97f277d6db13619ebc64c9e
SSDEEP 6144:OTmrAU6wP/V9Vdu42atxnTjc8Gf17msuFykBYkfgju0ISUdcuEfLK:O+AsNu42aTTI8E17Fu0FkL0IVEm
TLSH
T15F5423D8E680D38BF83B14394C8539854B7A9F507B29BF9AA4F13E4D8DB4490730756E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_0.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\level_0.mp3
Size 59KB
SHA256 f2e54c5011b25f5f78443b1c474876a2661a2848ce505a1ccf1f9dff05cbf293
MD5 04db30d08d0f7781cbc4753de80fa751
SHA1 89c6aca5383aa25127a64030527fbe82417dca3e
SHA512 0d8c446107991e161522f448f0d1bb68223cd8bb3f21ca44a853001c1916ba727f2e299ac84546b2763ce9686334182b3e637156c99bb36fe73658564fa448c9
SSDEEP 1536:a+tj3+QIfkd+fCK450HEmOq+e4wyS3HpgnqHx:ak3Akd+fl450H9x+83HpECx
TLSH
T13A4302798B0606EED164B131B63E0F064AFE7365BA46F1CA52C74F2E6D3442C26178F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_1.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\level_1.mp3
Size 116KB
SHA256 f4db91c1308dfb4637557e22788d8f9e4fe30374824ea48dc895a710d9fa2b3a
MD5 35771beda6baf3cab1ea24ba2efb19cd
SHA1 50187fda73231a5863244e9df7f292fbe92d8f72
SHA512 539d613a00652453e4f74f5996005d87fe02796d02cd8dcb7c8fd6e5060818d19d8e4625400785c490668b45cd70571ccb1f03183555be457d7187f7d2a6a20c
SSDEEP 3072:47UiPzs88m51NtkjnOj7tVQz8TbNG66GTIhv:47sQkSj74z8TR2MIZ
TLSH
T137C3126587107ADEF0181C33E12C6E42A598BB6E775532D924E0CBB3BF2C6463F21AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_1_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\level_1_2.mp3
Size 118KB
SHA256 876f694ae807295baf2e61d88dad37a8e8058ee67c7da2bce393cc8193446815
MD5 a27690acb719d6aafc436b9e4344058d
SHA1 380df6c2a872b91976d415ef7fb3652fb98fdede
SHA512 331e5f1b8c3fe5e8ea15c1fafc5cdd7b5d1b3a8ec6d2d5ab378bb3a833151711dab17c067f9a39053912a32cee3705b7aaeedfb7b13b5276cc8ad5a7ca2936d8
SSDEEP 3072:THjF5RGnIVCO9Fg0CLlfjEy62meq69z2gh2ax:jjnnLklT62Mk2gh2g
TLSH
T1B4C3028613989D0DE0B30870966DD6B0C3B9BB13FABAB55BD3D68B604876A5B3F150C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\level_2.mp3
Size 119KB
SHA256 afb18b351da719dfdb53b7bc3a5554e707606df3cfcce9e3a19e573302e4b0c9
MD5 2a36d0792447d94efc9b4c3e65b74122
SHA1 3593bb6af36aaa72375a13613a5d2409fa6db421
SHA512 53ac5657981a5ecfcec2c039822b0c94359ee806f0d743c2c64a47bfa579e66e5f52737c795045208fb3014f4483881afef34d863404767ab1372a68d9f7a58e
SSDEEP 3072:26Tegc5TVDv8yFchOzYj+kntaMosO6SlwM6SejJLg6:2Ceg8TVw34Eaknt8hlUSe+6
TLSH
T13BC3128749026C2CD194097315D2FEEE11FBA704322A6F5BEBF8B741347E26465EBB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_3_1.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\level_3_1.mp3
Size 122KB
SHA256 96f0c4cc6fb1d9f71e2fcccfcc1fdf509676f44279a58916eb03dd64aef3335a
MD5 214c5c49fedee6c2755cc355504b0932
SHA1 6c9d035572e8b233df34f1ec665d11b5b864df47
SHA512 bd973c2289c1f726c222f0cc94a8615993b0a8f3ba91e33b1f5f2cff670cb18a7c8604050f07f6a65748bc7cb7d142a8e1d64325bfbfa93813f180bcbb20e3b5
SSDEEP 3072:FDKFubBypAuN4cgEmuMeX5HZllyJoccoL/Mmu5wlw3A53w1OkV:FcOuaW55u9/o5wl/53wge
TLSH
T1C2C31215EB84678CC54F0430FD988D41BE7BAB6C32606ECE7FF1672098B5FA97898254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_3_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\level_3_2.mp3
Size 121KB
SHA256 1540bd5cf5a388a24c3b7a130a338b1f415688b41038de7abc9f10e7962f870a
MD5 f9d5825f8a58479271c934a3e73b0cbd
SHA1 53e451d3f0ce36b090fe7d9a4f925fd42ff5b2bc
SHA512 0223ba939bed6454010d3e145bbfb064bfc3a7029725a40c9f92d0b41a10073410619df702a0b6b085328ed57da19285f0f9a8ebe55ab14c5c271e2fe388bea4
SSDEEP 3072:F2ndcS7jqka8v/YocKIb+A6OXhCIKe/zHKGnFdfstQp/VEU4qj9lEPi2P8:4cAjqkpQocKIPX5/TT90RylO8
TLSH
T1E6C312158F1E662EF0496B3288809F3689757FDB3A30B03633E48B467077A74376D94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_4_1.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\level_4_1.mp3
Size 121KB
SHA256 c5f9d9016859115d99e7e9c873b4fc762d4cea139bc60cad608d9a0f4179813a
MD5 bd5dcfea8407f1a34aad3665506ff069
SHA1 567655424e127a63e3958e8f8e51bc72ec1c19d3
SHA512 d425669f7647aba605d80407a6c2dc86ea9f24c9d1df3a6bee62f381ba5eec4fc01230edabafbcbddf831b0559466c04924d0e6593bf45d8f162e519f7494e22
SSDEEP 3072:pUZ51dUYRTBEFcZbX/IIDUhLgeAoPDcA880AyV7ab:c1deFcdgDLoqDP880Atb
TLSH
T1CFC31228F38E08CEC06988F079DF66A1E9B3FF5D71A439C081F68F229635751791A2D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_4_2.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\level_4_2.mp3
Size 118KB
SHA256 d1c5d822ca6fe469d1f37333d3dcc7f945553a78c64fb02e3a68cd9189fda7f6
MD5 9f13e94612c225d0046ba268cefa3772
SHA1 5fd9f794b94b7631f840a646fe102f954964bef8
SHA512 4e0607ceca1ca7f0fc418935e3bc532eadd5dfcf80ec08663dfd29a932ae92d15816df99be798ff69bf5baacba289663ac0d6cf307408ba9cfda643caa75b9ad
SSDEEP 3072:tOGPk9slqXU0Vvy+nrSRpiirVLfnmHgx0flkV3:tXPkV/k3hnmUukV3
TLSH
T1B0C3025A4F47841EF45C523482706B9AC1AB2F557261377F1AFAAB0B89778B1FB104CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level_complete.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\level_complete.mp3
Size 69KB
SHA256 da50606f54269411f16050dae2483ea3c633263f93948372383ff692626d8e5c
MD5 6ee709ad712efd87c4adbdd196047bcf
SHA1 c1f8620d03783a6cd1e1a7e439d20c65ce006faa
SHA512 2653acc7df82694a23aba88bb2767070a75687cbec3be58f5183413e39e6b91a5aa51385a5645e0143ff44260ef1349cad28563512cc8e780a4818e0c2307f4d
SSDEEP 1536:3kTz39GJ+13BvxxwwqmLiHdHjA6EMoMoHJkFD:Uy+1xvxxwwpiaZMopc
TLSH
T1BB630251E615EAB6CBEF977B2CCAA98CA81BEC30380C4B1E4171FB6C347118575DB908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

title_theme.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\music\title_theme.mp3
Size 1.6MB
SHA256 1b04a4d195b7923c621ab4e9703759d54476c0df07bf21502d43c9b4554bd72e
MD5 b350c900c925be202e1f619fc3e9141e
SHA1 6dcdcdb926c72464ae5054055f12fe00b14b1feb
SHA512 c3ea5496d26698f2de8dacef11ead06fddfcbd3d5825042340524a05180ae9b4209e131c76e3fa3aeacc4b38a305cc7b0ab81e7ac8a4531ecac82c40b859d27f
SSDEEP 49152:58veBt4d+1q7Nn0WYG1E+QFbq5//btoPAKKN0G2pjKV:58WB6A8pRYQA25//b5KKCGsQ
TLSH
T13C75233483810D5E819519705F26DEA297FC8FEE3B06B10229F59F8698FB7423B58DD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accordion_break.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\accordion_break.wav
Size 122KB
SHA256 d5217c9b69c36e69659a37ed7625bff291e30c21b7f16c6f5a82fd27908e91d1
MD5 5dfaf665ac21709c3754b6817c53cc06
SHA1 4782a0a59c93fe970b6af9790ed97485e7a58209
SHA512 54ab597d601a9575d28513ca58cdc79069fff97b2e1ad77a8c846ccf5b7b7f6de8c2168f472da9ec55560507e049a3ed9a7b105d1ded51fff8df5b7b181bb923
SSDEEP 3072:D8MmtfmCCYN6J13ktQCwlKzmosSXHk3Id5uccKe/L4:4MuCIIO6VQTXbtcKkL4
TLSH
T179C3DF62F5D30B0456B75621AFA469941ECDF85CBC7469BB9907CE80F283260B7227FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accordion_empty_pull.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\accordion_empty_pull.wav
Size 105KB
SHA256 640393fdd29346c65c20cae8aaaecdc9b2c7a5116b4024304b5de14dd288ff68
MD5 d55f84d183064cbcb9521c647fe03e39
SHA1 5a90a8529a2727a8241bf53c28ce7db882be8294
SHA512 23adca375c2b75094f5332e45c932c1aeb6e014cd60fc8011c363f77ae5b00f7fc88ab1a4999a2fb718af098d3d59dfda07fb08e10d9c9fcb0ea72d0c2270708
SSDEEP 3072:7bc8Epr/yq0BrL/rqGcLqOJne0B5Jpa9LH:7bc8AzGX/OtNJnFB529
TLSH
T1A4B3AD96F1A30758607752759E8489416DCEFD2C7C625ABFA90FCD46B343320BA683BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accordion_empty_push.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\accordion_empty_push.wav
Size 124KB
SHA256 9dcf6356dd30b16806bb6d982cd463c061e8095d5d4184d182f4f36527f19f60
MD5 07924b955b04cc14d6c4da3437ec43f4
SHA1 399841a2a0098fedc3085acc6ff273c06d8c8880
SHA512 ae64d85e2260a8a3e033d08386e09311e1c15589152ecea1fa3cac39290f350b6093a625a455e8c46a053c943ddc2a9575d224a1c726e785d83bdb91763bd50a
SSDEEP 3072:fPrQEupmT9B0caPu1V0QscyMx1Uhtq7C9e44rF36XlVbzlFqh1Vus:fPtVkcD1qjL4rZ6XbbxFqfVus
TLSH
T151C3DF22F0A30B48643796756D9019054DCAFD1D7DA66A7F698FCC94F323730AA613BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alarm_egg_stolen_01.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\alarm_egg_stolen_01.mp3
Size 20KB
SHA256 b75e663c8e91d34741f3d4090008b13dc4728bd8d16db6e34adb19f933d83455
MD5 551bc631bd68110b4010dc3b5a1b9269
SHA1 6636e2497e4596a6e0b762e00e67d4798ef4a8a9
SHA512 c056aa615167790efdc8f3a0494e36f8254135d1b0ea7330e6b99783ef34398b536edb7ada17ececcf91cc2a22cea95fd86ac7b6081cebd96fd2fc32f82299bd
SSDEEP 384:O7u9D+zknlizwpHOJbFGFaewaRW6lo4n4ZhF+bxpoLBy5v/1nQOALr:aoa4VOJbI8qW6e4n43F+dSdy/Kr
TLSH
T15592E1AE860142DDF54576F1A5663106D1FEECA2389F210CEAC54ADC997FC201B15ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alarm_egg_stolen_02.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\alarm_egg_stolen_02.mp3
Size 23KB
SHA256 fda38ca5fde3d5cbfc3e2d9946d98988750800bc970ac204b3690510c5f66924
MD5 6174a020209e861befc80ff5d9dff0d7
SHA1 5d9fc6453531b609a8af7b3faaa859a0d97c4cbf
SHA512 e5b67bffe128f3b8db17560a2815135e5d2f87e490df2f421643bbb4dee9224dc1867ffef4f2f3061bdba89668eff5e7bd968e8a3e99f6a2326bbc97a9967342
SSDEEP 384:zr89OJdJGTOo6fJp5J0aB+BGscPq0xsmE888dnS19LTmqRN8vJ3/ScSF2p3eezgQ:zr89OJGqokJp5JTtPq0Gu9dnS7fqdZpR
TLSH
T191B2D0E0CAF71194C06D73F97AA3582C251AFAD94FA8CCFC62E80235337D8874916B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alarm_egg_stolen_03.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\alarm_egg_stolen_03.mp3
Size 15KB
SHA256 4402d03b3d77652e4bddb92fab3ff62c3d40d88d212d9da9fe8da20dd041506c
MD5 ed9338910448aba841af378b4fc4711f
SHA1 8afb25aac43546d82de1dccaf9a402af45ca735d
SHA512 fc25147699953bb89179e1e9e8a1e420999cada7e65b37af38ad83a3e26a46010113844e1f642eb10df2962fe5a1ea58abd72e1f952f01e1a27206bea240b44a
SSDEEP 384:yNSpBjWp98sVgaPcxROdZsG0gXNDWkdyBJGsLarh6:yNaggBTDBJLarh6
TLSH
T1C062D16648980394E02F4DF485010FC95876D7ADDD19AA7E30C4D5907F9F3D3AC6CE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ball_bounce.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\ball_bounce.wav
Size 28KB
SHA256 11a20f27efdebdc4261004ca6abaa4d6b57b1654f747939fff316739cd9eda83
MD5 5f50a097907cba5e7d8d792465096be6
SHA1 7638e271c30383cf3d2c3c2b9a26e173d72ffefd
SHA512 3413ee82eb9efc0cc0ecf46d10141a98da3b14325eaa9da02ebf8c0712e8aada57a82ffef28b70d7c74e22a7bf594a87fe1fc79f42e3389ad216a210a4571cae
SSDEEP 768:h2uR+KErRsUGbpPrl3XZK0/rfIcUdjNt6jpSS5F:h2spErRsUG9xZK0TINdJA5F
TLSH
T1EED29D52F813591AE67F997BCBA3DA300A663F16BD09510F3240B6816DEF344B35EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_inflate_01.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\balloon_inflate_01.mp3
Size 13KB
SHA256 5765d814f21a63b09d464ac2b0debc14bb13620b676a9b9daef3e8119413e8d5
MD5 d5327288e048105178b68e5859a98090
SHA1 3251e0b2b8146cecfc79e6020db8e53e9db9fd9e
SHA512 139d5adb786657778929b99f7b22333052802c89fdbb4710426134bc0d481064f0d8a45db76718546f06950b29c90b164a2b0fad52ea52da2320a5827b06bb74
SSDEEP 192:/rNlk5gg981/rQUGTINDXP8nNk07os7pVGZzwAmvBb4ewyIthbEcwJKevareGWL1:jNS5d98jND/1xstVGGAmZUewyj/iY5
TLSH
T1CE52D0A4292D399DF6AC47F6522D8F0DE4890EC4C88D9B762422E52000376B7C3E96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_inflate_02.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\balloon_inflate_02.mp3
Size 35KB
SHA256 a586ec1653a052fed10b90d963a0d5ffbbadee565500db378116b3b12441f790
MD5 0e39e1c00cb70e37e2034cbc3f9e51b7
SHA1 ecbc3db66ccd8dbc62d4509b9906cceec5ffd6fa
SHA512 3868b0230b976658cb17cb2591d1c8c7cc225ad07dc63ec94865471ea6f40ddb899a51923b17c1ae15844206543c8e79f563ed55391e48b0e2d4dc93306258e7
SSDEEP 768:bUro/aNSrJIaByav4Cvk8TdNAODAl5c+K+fV4DM7cDCniVLpP0B:Y6rJIaBy1CFy5c+K+d44sciBpP0B
TLSH
T127F2F1D2602410CFDC802F7FFD6A2A478AA7FE9004167EDCEC7785B6A46B5A647A0510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_magic_pop.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\balloon_magic_pop.mp3
Size 24KB
SHA256 4b229be78b89a5fb0f2385ee00aacc8d17b7579b6749cb81fad6ed2f8e69282c
MD5 2de9e72cc867b15c97ce4a7a5de3d757
SHA1 24b545d0b34cd90ea3e95108b7f49ddd479dbeeb
SHA512 4da44e3669302d7f03bb19f4b23b898176de0e6cd0b80858684bd2ab10ea0acde2d9e59837f14357712f36cb82af8291e8750cfe00878778f9e5519b99e8361e
SSDEEP 768:b1bfbQjF1i//V12BAZQ4YtnxZBesgbbNgyYUixYtqNL:xkA3mBp5Resgbe5jYtqx
TLSH
T18DB2D1BED91CC56DCCD96AF080FF584426852FE473A0F6E0A6997483A83B5F2D0984D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon_pop.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\balloon_pop.wav
Size 21KB
SHA256 20bc621567696c8892c1b4b4a49b282b14422a1f0f657d4c686029e38938a6e0
MD5 3b7f554efc3e5cc2a6f06251f28acded
SHA1 b94316836ea529536eec9d63bae2095a3a6b12ff
SHA512 61383b08ca9c6c499c0df522180f000c20f46668cb30d8167909b41ff1d0819b621cd48d14fc663687ac30c86a497a6d0f23444956a505d80be84e27a6129152
SSDEEP 384:msAEpHxf5yk2XPIrrbPh0kWXfWNu6MQ6rg58lNR56OD8B+tLoIeKM40RWRH/pdTb:TRokCQbJ0kU2u6/mxQ4KIeKeEv6k
TLSH
T164A2E13890A71D9CDFDF1A3CEF7FB41394429489E8123D2A830D4DA2B54A7447DEA522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bellows_01.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\bellows_01.mp3
Size 6KB
SHA256 4b17dc5f02605080b2c34b6ef4fda74b796048335dc64b25b60c5293fcea6a66
MD5 0b1b7c02c92a566db92d3151c7396be2
SHA1 f7121ef3aeb2a57da83d5eff77f4b9de2976014f
SHA512 171ae2bf3580875bca0adf695f2714395dffeebefc855387db0131a27882fc4d53bbfc7a69ca6e74749715ee2456f0027506654e549dd3be9a6f7b75d1b21176
SSDEEP 96:37B4wlQVg9AqKrSkWDNvgyASZXH01xvd6SJ3RFpCvi/UMCdQnTlx+5qSn6nm+wgH:3Gq2jTePAShU1/6OLCMe+x+J+lAi1
TLSH
T177D16E3C95470059F12B6A373CFCADA1EFB348A9598CEE9C33A0513604776097F95894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bellows_02.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\bellows_02.mp3
Size 7KB
SHA256 c2e42f41cb39d4944b818eb5987353e61d269b16bfee8bee77c9d8d88366ae1c
MD5 f3a6f801239ff7c51e84034907f87cac
SHA1 66da333049942aebd913fab42e68e2ae664497af
SHA512 3761f17d21ee52c2c216d9fd871994f9bd2f846f7a04f9d9ab7dd8c25d11215b943da16d22df9329d20a44a01afe35e22b8de89a85928d872f80b920f075e02d
SSDEEP 192:pHLtWQVMfGXt36H9Lx72zOaDkTAjvhe8NfC:hLzVMfG936HO1TheEfC
TLSH
T1EDE1BF2A494C2BACC8B13735E0B313566899FE0E82646ADF12FF74305BF22526C1BC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bellows_03.mp3

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\bellows_03.mp3
Size 6KB
SHA256 34cb950d71922b17d312daaf394a0832fe72aac8b0acf5ec0c4dd841d0f26c55
MD5 31a1fcc31791448bbbc95b138dcd4b4b
SHA1 e180afa92733e231c082c2a79a8d0224fa6bd05a
SHA512 1b83588e695c150c9d892e9dcc788cb21a356300977dbc99094c21143113513b350626dd58c97e3fdbd3b38ada3ab0331f5583342947133e01e307c99fe4e2db
SSDEEP 192:Np8X7dAo/RVj8biV7LbiLR3frNMc8+ohyDWG:Np7cV5tiL1zn8+ohy5
TLSH
T1AAE18DAA4E8E561FF94453BAFF69CBC9C3D2CE50A380569E5A4B3324653F041C30A84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigbrother_awakens.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\bigbrother_awakens.wav
Size 128KB
SHA256 cf4fd7f867688053aaa6f1974b66b0fa5b9c939f8ae6c71f9347eceeb121a75b
MD5 0d84a97a00d3ce03e1ad16b6ac62ee1c
SHA1 45ce5189f7090725ec530099cb4df213de883ea3
SHA512 bacffe97808154297cdad0283e7ec320162d40b92513996e89523616bb3d12b131eb67bfee23e7b6cef3b7d44770eb6582172ceecd9847593853f7b2cecbb2bb
SSDEEP 3072:pkaC7vcFySHCzg4Uy2++opMTj5ys1SHyMVzM8TW:qazPCzLj1pMf5yssHykw8T
TLSH
T13DD3E593F5438A10C82B0F394D32AF65067BBC29BF5B921B30497E196E733D25B216D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigbrother_fly.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\bigbrother_fly.wav
Size 74KB
SHA256 66d86a11b1d8c0babe769aeca16152a5326302d335a3b09c8248cf3d9dd07996
MD5 7300008a3f5028d5ad8a8dd1131cd927
SHA1 280a662770ded32ba41e1ab3ad71c574d2320e3c
SHA512 166f08876d93147e517a4150732a4a94cbf040a2d52792dd4b31edc1ce6507e448c8fe092d1564a72291c9aa633d22d52d4d63e883d67b216e328ac4676b913a
SSDEEP 1536:ptkcXJKT0NrK/dhjMj6pE/FK+xnpQTMktTp6f0/1goc:n7XJIerY5MYebWPtTI0dc
TLSH
T16B73C012F0415652C9328A358A55D581C7437D0F6D221A8F3A8CFF4EA6F7244ADEBF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigbrother_select.wav

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\data\audio\sfx\bigbrother_select.wav
Size 63KB
SHA256 e7c456bc501302ec10306679b985bd6f977ced83306a367bc7cb888dbb8d4e6b
MD5 cd4d955864b27bb388b54ca5f1bcefd1
SHA1 733bece481272d9d820a33d1855ff02c2329189e
SHA512 12838819af8bd3ad66926a22c30c238790399b1fc1c4aa4c3075ced01a3bc8df5901f4fdab36611c333cd99aaedfff785147290b9b55a5f90010457bda125fc7
SSDEEP 1536:WGyWLJhF0SGmIeD0N6S8nNNm2lLo5YVRuv9m5:P3FImSgNNm2lBz
TLSH
T1B653BE33F183D680D4218A3A9E81976257967E5ABE43669F70017F0E2CB7391CB2787C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\C600AD6\updater.exe
Size 1.7MB
SHA256 d240fd7d636c79775a0b44f1a8ded379ab6289f9e9edeacadf72359cd668e26d
MD5 16e8afd2e4e8b21ea7329d886a5dd0cc
SHA1 bcc519bc3621b34ac9385ff7466942a5a00c9b80
SHA512 d96bdcdf45bade5329a7792bd78ac8b3dc6b206cc124ed769cf527d41da5b4434600ced49f35795b4c2091ac61ab0da9c47593bd86696487d93da5e6cb9952c6
SSDEEP 49152:Uz29kv5555555555555555555555555555555555U:Uz29Q555555555555555555555555553
TLSH
T1FE853A0263E98519F0F75B30A9B257B11A37BC52BC34C74F6A983A1E1D31E40DA26B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decoder.dll

Path C:\Users\Admin\AppData\Roaming\Rovio Entertainment Ltd\Angry Birds 3.3.2\install\decoder.dll
Size 120KB
SHA256 2e3ffa1acb15fb256694b7373e7725d926a322aef076bf1d2725290f5be8bf6a
MD5 87c5bb06d9cddad535194e787dabf848
SHA1 76292101513fc137f5c70dc335f9f924388a252c
SHA512 9837dae4c5abcd39d1bff1781bc053b70d2831d94001c8ffc0a59b086e6824eb4145c6be9538da9dfd0eb8010d6ee9c027c83981144b8e7d35540eed186c1ca7
SSDEEP 3072:AHLohTAI0NkxvLIe9R7Lw1UDm+qnWFGm+T:go+5yxzIebLXS
TLSH
T1D3C39E3133C1C072F11F113E8806E7B99B6F7AA1C9A09A8B7FA40A655F35291DF39356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

MSICDF8.tmp

Path C:\Windows\Installer\MSICDF8.tmp
Size 270KB
SHA256 4337cdfe01a45f6691cf883b57d5663788fda9a368a1eac989cb16e31f049ac0
MD5 50a3d9c4c3b6afda98bd6b0c60363175
SHA1 d69ab1b8c51b0282c3b2a02e179bf27128905835
SHA512 4824cd07d207608798b17210d196b8fd77ab3f75d3331449cea21c77dd3084deef67feeda029ab2e5f81bdbda1fdfbdb2af7fa753cdcf6292a5702454c232edc
SSDEEP 6144:lrR6lMr1Zx214pFEQgNwrvaE8cd4kmQiJSYI43smCvR:lrR62rFBnE5NwbIcuLQiJSYI43bq
TLSH
T115447E1230E4C934D69F5B38AB6C8B75A2F8F5715BA1C803F3D45E1C9BB2A838525F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID636.tmp

Path C:\Windows\Installer\MSID636.tmp
Size 193KB
SHA256 2fa1395f005a32d8147e7a21395c0125c473765302882e8c2509be30b738d634
MD5 02fa966a1c078bc9aee5c6c4f93df743
SHA1 97d91368491a0ba84a38d1668e0c2e7e3f96bd59
SHA512 ba6bc968eb9bab3107ae885714cc2eb3f3a0f8c6e70f7ab7527e6ae93bdc99a054441bfe3e6a3c490193608597898c7d1cdf643437ef887aead3e2c6b6e627cc
SSDEEP 3072:MfG2dK29/1prU/jrCFICa+TEqF16M+bh8vQ5nv5hTmwqp8A6:MfG2wA/19U/jCa09t+AQ5nzEz6
TLSH
T106148D2332E8C037D26F16308556D77155B9B8B25A25D90BBB948E1E9FB1AC3DE31B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4616-0-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Download

memory/4616-26-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Download