Analysis
- user interaction
yes - max time kernel
586s - max time network
558s - platform
windows10-2004_x64 - resource
win10v2004-20260513-ja - resource tags
- submitted
28/06/2026, 22:22
General
- Target Puyo15_Carnival.exe
- Size 30.2MB
- Sample260628-2aa1csft5w
- SHA256 d66c7247e8fafd525586cb7cab0a3ecb7f34f76f55e1fe27c0bccc39e8b9cc64
Malware Config
Signatures
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 17 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies Internet Explorer settings 1 TTPs 12 IoCs
- Modifies data under HKEY_USERS 1 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Puyo15_Carnival.exe"C:\Users\Admin\AppData\Local\Temp\Puyo15_Carnival.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe -deleter3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe"C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe" {DD19BC0E-827B-48CE-9D16-F7917E8B486C}:{A4A284F2-12C3-4FAD-8BE2-B8E16084164E}4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\SEGA\puyo15\README.TXT2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://segadirect.jp/Catalog/ProductList1.aspx?st=PT&pt=PC2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://segadirect.jp/Catalog/ProductList1.aspx?st=PT&pt=PC3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffb0d74c188,0x7ffb0d74c194,0x7ffb0d74c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,7437378697312632009,2238411300234083619,524288 --field-trial-handle=2892,i,8388686008071857228,14358182608677295941,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,908663852477109092,14722686853523627587,262144 --field-trial-handle=2892,i,8388686008071857228,14358182608677295941,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,11647448423540970877,8423437389223786326,524288 --field-trial-handle=2892,i,8388686008071857228,14358182608677295941,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,2066158211646486755,1502179659446845556,2097152 --field-trial-handle=2892,i,8388686008071857228,14358182608677295941,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,12190817963656854284,13779657248162662758,2097152 --field-trial-handle=2892,i,8388686008071857228,14358182608677295941,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=ja --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,15588853232818844008,13206259256686504187,524288 --field-trial-handle=2892,i,8388686008071857228,14358182608677295941,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=ja --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,3912311472878899263,2432145989970242739,524288 --field-trial-handle=2892,i,8388686008071857228,14358182608677295941,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4868,i,17001073115627808872,13373511466482652436,2097152 --field-trial-handle=2892,i,8388686008071857228,14358182608677295941,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffb0d74c188,0x7ffb0d74c194,0x7ffb0d74c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,10323696668012169194,7250517581620871827,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10426707119135033122,13565281490792639727,262144 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,5709673600507983372,1550308331687134223,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,409471578949169364,13630659926410314534,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=ja --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,10474245137716175566,8929419998798380614,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,409471578949169364,13630659926410314534,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=ja --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,11963186862661529371,11550279693695315903,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,10753183681428706085,10253701268187205719,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,5931507954383920833,11785825478838161690,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,16508606563107779316,14474230959255489266,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,10872316064885075903,10668225373519043194,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=ja --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,5448955117155368297,16455173605666278547,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,17478611778422832336,2766582049336850853,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,11808933498508946980,10201495000340400755,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,16167095393393941360,1105562919362569202,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,5089833537322290685,12487858950967915645,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,11228324165053628867,15467153180904004484,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,9972428928780320764,13631517472437482711,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4880,i,16326696030363553629,12466525441284285102,262144 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,15905091070434740360,6389851123263579206,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,6900386594762074487,809237148450263321,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=ja --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,14300395583800651454,16273488451167433911,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,3868068103068415437,6290027265277298659,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=ja --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1332,i,4558967712389856026,4188848123249322872,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,17446116327541423629,9357696743724049878,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,2453800217491688276,3162993769174494553,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,6360060311009547663,2374977931285641544,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4020,i,2432173652858563816,5957830898425731929,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,11113038195162477834,10022353700291133128,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,15974919074595336612,17844156461842194882,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,15863052781348623292,15130614273755389168,524288 --field-trial-handle=2304,i,6124550621948486267,6774160666504501665,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:85⤵
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2e8 0x4941⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd7fb7f11h0dceh42a4hb296hf33927443a3c1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd7fb7f11h0dceh42a4hb296hf33927443a3c --edge-skip-compat-layer-relaunch2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x278,0x7ffb0d74c188,0x7ffb0d74c194,0x7ffb0d74c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,3961703947741499799,3018875217614954570,262144 --field-trial-handle=2256,i,15583389336073194538,52300370742190869,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,11212926490065661171,10869330959074514385,524288 --field-trial-handle=2256,i,15583389336073194538,52300370742190869,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,7837144019815053850,14501996688716453425,524288 --field-trial-handle=2256,i,15583389336073194538,52300370742190869,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,9744299459857611737,14862048927719471759,2097152 --field-trial-handle=2256,i,15583389336073194538,52300370742190869,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:23⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetDateTime1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\SEGA\puyo15\PuyoF.exe"C:\Program Files (x86)\SEGA\puyo15\PuyoF.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\SEGA\puyo15\Lobby.exe"C:\Program Files (x86)\SEGA\puyo15\Lobby.exe" PuyoF_ExecFromLauncher2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\SEGA\puyo15\PuyoF.exe"C:\Program Files (x86)\SEGA\puyo15\PuyoF.exe" S_MULTI14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\9254ba2b377e4fed8c33caec5312dca7 /t 432 /p 28401⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\SEGA\puyo15\PuyoF.exe"C:\Program Files (x86)\SEGA\puyo15\PuyoF.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\SEGA\puyo15\PuyoF.exe"C:\Program Files (x86)\SEGA\puyo15\PuyoF.exe" S_MULTI13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"C:\Program Files (x86)\SEGA\puyo15\Launcher.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\SEGA\puyo15\PuyoF.exe"C:\Program Files (x86)\SEGA\puyo15\PuyoF.exe" S_MULTI12⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\ec8e5d2c25314594835bf0a467481ca3 /t 2008 /p 14761⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DotNetInstaller.exe
ISBEW64.exe
ctor.dll
iGdi.dll
iKernel.dll
iscript.dll
iuser.dll
setup.dll
ISBEW64.tlb
IsP4B87.tmp
Objectps.dll
setup.ini
00_TITLE.wma
01_MENU.wma
02_RULE.wma
03_OPENING.wma
04_MANZAI1.wma
05_MANZAI2.wma
10_TAISEN1.wma
11_TAISEN2.wma
12_TAISEN3.wma
13_TAISEN4.wma
14_PINCH.wma
15_FEVER.wma
18_CLEAR.wma
19_BATANKYU.wma
20_NAME.wma
21_CONTINUE.wma
22_GAMEOVER.wma
0GDTEX.PVR
BG_00.pvp
BG_00.pvz
BG_01.pvp
BG_01.pvz
BG_02.pvp
BG_03.pvp
BG_03.pvz
BG_04.pvp
BG_04.pvz
BG_05.pvp
BG_05.pvz
BG_06.pvp
BG_06.pvz
BG_07.pvz
P00.pse
adinstA2.pvz
adinstA_e.pvz
adinstB.pvz
am_font.pvz
am_hitopuyo.pvz
bonus.pvz
bootbg_all.pvz
cf00.pvz
cf01.pvz
cf02.pvz
cf03.pvz
cf04.pvz
cf05.pvz
cf06.pvz
cf07.pvz
cf08.pvz
cf09.pvz
cf10.pvz
cf11.pvz
cf12.pvz
cf13.pvz
cf14.pvz
cf15.pvz
cf16.pvz
cf17.pvz
cf18.pvz
cm_03.pvz
cm_03_e.pvz
cm_04.pvz
cm_04_e.pvz
cm_05.pvz
cm_05_e.pvz
crowd01.pvz
crowd02.pvz
crowd03.pvz
crowd04.pvz
dic.dat
effect.pvz
fever11.pvp
fever11.pvr
fever12.pvp
fever12.pvr
fever13.pvp
fever13.pvr
fever14.pvp
fever14.pvr
fever15.pvp
fever15.pvr
fever21.pvr
fever22.pvr
fever23.pvr
fever24.pvr
fever25.pvr
fever_count.pvz
font.pvp
font.pvz
fontS.pvr
frame1p.pvp
frame1p.pvz
frame1p_2.pvz
frame2p.pvz
frame2p_2.pvz
frameClassic.pvz
frameClassic_2.pvz
frameToko.pvp
frameToko.pvz
frameToko_2.pvz
futapuyo.pvz
gallery.pvz
hitopuyo.pvz
insideW_0.pvz
insideW_1.pvz
insideW_2.pvz
insideW_3.pvz
insideW_4.pvz
insideW_5.pvz
key00.pvz
logo00.pvp
logo00.pvz
logo3.pvz
main00.pvz
menu_00.pvp
menu_00.pvr
menu_01.pvz
mz000bg.pvz
mz002.pvz
mz101.pvz
mz101bg.pvz
mz102.pvz
mz102bg.pvz
mz103.pvz
mz104.pvz
mz104bg.pvz
mz105.pvz
mz105bg.pvz
mz106.pvz
mz106bg.pvz
mz107.pvz
mz107bg.pvz
mz108.pvz
mz108bg.pvz
mz200.pvz
mz201.pvz
mz202.pvz
mz203.pvz
mz204.pvz
mz205.pvz
mz206.pvz
mz207.pvz
mz208.pvz
mz209.pvz
name00.pvz
name01.pvz
navi.pvz
online_tex.pvz
op0_bg.pvz
op0_bg_e.pvz
op0_text.pvz
op0_text_e.pvz
op1_bg.pvz
op1_bg_e.pvz
op1_text.pvz
op1_text_e.pvz
op2_bg.pvz
op2_bg_e.pvz
op2_text.pvz
op2_text_e.pvz
opc_006.pvz
opc_024.pvz
option00.pvz
pfpc_tournament_bg01.pvz
pfpc_tournament_bg02.pvz
press_any_key.pvz
puyo.pvp
puyo.pvz
rank00.pvz
rank01.pvz
rann9e4e.rra
rating.pvz
replay.pvz
score00.pvz
score01.pvz
sel_00.pvz
sel_01.pvz
sel_02.pvz
sel_03.pvz
sel_04.pvz
sel_05.pvz
sel_06.pvz
sel_07.pvz
sel_08.pvz
sel_09.pvz
sel_10.pvz
sel_11.pvz
sel_12.pvz
sel_13.pvz
sel_14.pvz
sel_15.pvz
sel_16.pvz
sel_16_e.pvz
sel_17.pvz
sel_17_e.pvz
sel_18.pvz
sel_18_e.pvz
sel_xx.pvz
sky.pvp
sky.pvr
stf_font.pvz
stf_logo.pvz
title.pvz
title_menu.pvz
tournament_tex.pvz
Common.dll
Common.dll
CompressionStream.dll
Default.ini
DlgUtil.dll
Launcher.exe
Launcher.ini
Lobby.exe
Lobby.ini
MFC71.dll
Puyo.ico
PuyoF.exe
README.TXT
000RENSA1.WAV
001RENSA2.WAV
002RENSA3.WAV
003RENSA4.WAV
004RENSA5.WAV
005RENSA6.WAV
006RENSA7.WAV
007PUYOIDOU.WAV
008PUYOKAITEN.WAV
009PUYOCHAKUTI.WAV
010PUYOYURE.WAV
011PUYOCHIGIRE.WAV
012OJAMADROP_S.WAV
013OJAMADROP_L.WAV
020SOUSAI.WAV
021FEVERTENTOU.WAV
022ZENKESI.WAV
023FEVER.WAV
024FIELDROT.WAV
025START.WAV
026COUNT9.WAV
027COUNT8.WAV
028COUNT7.WAV
029COUNT6.WAV
030COUNT5.WAV
031COUNT4.WAV
032COUNT3.WAV
033COUNT2.WAV
034COUNT1.WAV
035COUNT0.WAV
036DECIDE.WAV
037CANCEL.WAV
038PAUSE.WAV
039CURSOR.WAV
040RANNYU_MONO.WAV
040RANNYU_STEREO.WAV
041CREDIT_MONO.WAV
041CREDIT_STEREO.WAV
044TIMECOUNT.WAV
045COUNTEND.WAV
SnapUtil.dll
SplashM15.bmp
Updater.exe
Updater.ptxml
CH00VO00.WAV
CH00VO01.WAV
CH00VO02.WAV
CH00VO03.WAV
CH00VO05.WAV
CH00VO06.WAV
CH00VO07.WAV
CH00VO08.WAV
CH00VO09.WAV
CH00VO10.WAV
CH00VO12.WAV
CH00VO13.WAV
CH00VO14.WAV
CH00VO15.WAV
CH00VO16.WAV
CH00VO17.WAV
CH00VO18.WAV
CH00VO19.WAV
CH00VO20.WAV
CH01VO00.WAV
CH01VO01.WAV
CH01VO02.WAV
CH01VO03.WAV
CH01VO04.WAV
CH01VO05.WAV
CH01VO06.WAV
CH01VO07.WAV
CH01VO08.WAV
CH01VO09.WAV
CH01VO10.WAV
CH01VO12.WAV
CH01VO13.WAV
CH01VO14.WAV
CH01VO15.WAV
CH01VO16.WAV
CH01VO17.WAV
CH01VO18.WAV
CH01VO19.WAV
CH01VO20.WAV
CH02VO00.WAV
CH02VO00_2.WAV
CH02VO01.WAV
CH02VO02.WAV
CH02VO03.WAV
CH02VO04.WAV
CH02VO05.WAV
CH02VO06.WAV
CH02VO07.WAV
CH02VO09.WAV
CH02VO10.WAV
CH02VO11.WAV
CH02VO12.WAV
CH02VO13.WAV
CH02VO14.WAV
CH02VO15.WAV
CH02VO16.WAV
CH02VO17.WAV
CH02VO18.WAV
CH02VO19.WAV
CH02VO20.WAV
CH03VO00.WAV
CH03VO01.WAV
CH03VO02.WAV
CH03VO03.WAV
CH03VO05.WAV
CH03VO06.WAV
CH03VO07.WAV
CH03VO08.WAV
CH03VO09.WAV
CH03VO10.WAV
CH03VO12.WAV
CH03VO13.WAV
CH03VO14.WAV
CH03VO15.WAV
CH03VO16.WAV
CH03VO17.WAV
CH03VO18.WAV
CH03VO19.WAV
CH03VO20.WAV
CH04VO00.WAV
CH04VO01.WAV
CH04VO02.WAV
CH04VO03.WAV
CH04VO04.WAV
CH04VO05.WAV
CH04VO06.WAV
CH04VO07.WAV
CH04VO09.WAV
CH04VO10.WAV
CH04VO11.WAV
CH04VO12.WAV
CH04VO13.WAV
CH04VO14.WAV
CH04VO15.WAV
CH04VO16.WAV
CH04VO17.WAV
CH04VO18.WAV
CH04VO19.WAV
CH04VO20.WAV
CH05VO00.WAV
CH05VO01.WAV
CH05VO02.WAV
CH05VO03.WAV
CH05VO04.WAV
CH05VO05.WAV
CH05VO06.WAV
CH05VO07.WAV
CH05VO09.WAV
CH05VO10.WAV
CH05VO11.WAV
CH05VO12.WAV
CH05VO13.WAV
CH05VO14.WAV
CH05VO15.WAV
CH05VO16.WAV
CH05VO17.WAV
CH05VO18.WAV
CH05VO19.WAV
CH05VO20.WAV
CH06VO00.WAV
CH06VO01.WAV
CH06VO02.WAV
CH06VO03.WAV
CH06VO04.WAV
CH06VO05.WAV
CH06VO06.WAV
CH06VO07.WAV
CH06VO09.WAV
CH06VO10.WAV
CH06VO11.WAV
CH06VO12.WAV
CH06VO13.WAV
CH06VO14.WAV
CH06VO15.WAV
CH06VO16.WAV
CH06VO17.WAV
CH06VO18.WAV
CH06VO19.WAV
CH06VO20.WAV
CH07VO00.WAV
CH07VO01.WAV
CH07VO02.WAV
CH07VO03.WAV
CH07VO04.WAV
CH07VO05.WAV
CH07VO06.WAV
CH07VO07.WAV
CH07VO09.WAV
CH07VO10.WAV
CH07VO12.WAV
CH07VO13.WAV
CH07VO14.WAV
CH07VO15.WAV
CH07VO17.WAV
CH07VO18.WAV
CH07VO19.WAV
CH07VO20.WAV
CH07a718.rra
CH07a738.rra
CH08VO00.WAV
CH08VO01.WAV
CH08VO02.WAV
CH08VO03.WAV
CH08VO05.WAV
CH08VO06.WAV
CH08VO07.WAV
CH08VO08.WAV
CH08VO09.WAV
CH08VO10.WAV
CH08VO12.WAV
CH08VO13.WAV
CH08VO14.WAV
CH08VO15.WAV
CH08VO16.WAV
CH08VO17.WAV
CH08VO18.WAV
CH08VO19.WAV
CH08VO20.WAV
CH09VO00.WAV
CH09VO01.WAV
CH09VO02.WAV
CH09VO03.WAV
CH09VO05.WAV
CH09VO06.WAV
CH09VO07.WAV
CH09VO08.WAV
CH09VO09.WAV
CH09VO10.WAV
CH09VO12.WAV
CH09VO13.WAV
CH09VO14.WAV
CH09VO15.WAV
CH09VO16.WAV
CH09VO17.WAV
CH09VO18.WAV
CH09VO19.WAV
CH09VO20.WAV
CH10VO00.WAV
CH10VO01.WAV
CH10VO02.WAV
CH10VO03.WAV
CH10VO04.WAV
CH10VO05.WAV
CH10VO06.WAV
CH10VO09.WAV
CH10VO10.WAV
CH10VO11.WAV
CH10VO12.WAV
CH10VO13.WAV
CH10VO14.WAV
CH10VO15.WAV
CH10VO16.WAV
CH10VO17.WAV
CH10VO18.WAV
CH10VO19.WAV
CH10VO20.WAV
CH10a8af.rra
CH11VO00.WAV
CH11VO01.WAV
CH11VO02.WAV
CH11VO03.WAV
CH11VO04.WAV
CH11VO05.WAV
CH11VO06.WAV
CH11VO07.WAV
CH11VO08.WAV
CH11VO09.WAV
CH11VO10.WAV
CH11VO12.WAV
CH11VO13.WAV
CH11VO14.WAV
CH11VO15.WAV
CH11VO16.WAV
CH11VO17.WAV
CH11VO18.WAV
CH11VO19.WAV
CH11VO20.WAV
CH12VO00.WAV
CH12VO01.WAV
CH12VO02.WAV
CH12VO03.WAV
CH12VO04.WAV
CH12VO05.WAV
CH12VO06.WAV
CH12VO07.WAV
CH12VO08.WAV
CH12VO09.WAV
CH12VO10.WAV
CH12VO12.WAV
CH12VO13.WAV
CH12VO14.WAV
CH12VO15.WAV
CH12VO16.WAV
CH12VO17.WAV
CH12VO18.WAV
CH12VO19.WAV
CH12VO20.WAV
CH12VO20C.WAV
CH12VO20P.WAV
CH13VO00.WAV
CH13VO01.WAV
CH13VO02.WAV
CH13VO03.WAV
CH13VO05.WAV
CH13VO06.WAV
CH13VO07.WAV
CH13VO08.WAV
CH13VO09.WAV
CH13VO10.WAV
CH13VO12.WAV
CH13VO13.WAV
CH13VO14.WAV
CH13VO15.WAV
CH13VO16.WAV
CH13VO17.WAV
CH13VO18.WAV
CH13VO19.WAV
CH13VO20.WAV
CH14VO00.WAV
CH14VO01.WAV
CH14VO02.WAV
CH14VO03.WAV
CH14VO04.WAV
CH14VO05.WAV
CH14VO06.WAV
CH14VO07.WAV
CH14VO08.WAV
CH14VO09.WAV
CH14VO10.WAV
CH14VO12.WAV
CH14VO13.WAV
CH14VO14.WAV
CH14VO15.WAV
CH14VO16.WAV
CH14VO17.WAV
CH14VO18.WAV
CH14VO19.WAV
CH14VO20.WAV
CH15VO00.WAV
CH15VO01.WAV
CH15VO02.WAV
CH15VO03.WAV
CH15VO05.WAV
CH15VO06.WAV
CH15VO07.WAV
CH15VO08.WAV
CH15VO09.WAV
CH15VO10.WAV
CH15VO11.WAV
CH15VO12.WAV
CH15VO13.WAV
CH15VO14.WAV
CH15VO15.WAV
CH15VO16.WAV
CH15VO17.WAV
CH15VO18.WAV
CH15VO19.WAV
CH15VO20.WAV
INST0000.WMA
INST0110.WMA
INST0120.WMA
INST0210.WMA
INST0220.WMA
INST0310.WMA
INST0410.WMA
INST0420.WMA
INST0430.WMA
INST0440.WMA
INST0510.WMA
INST0520.WMA
INST0530.WMA
INST0540.WMA
MZ000000.WMA
MZ000010.WMA
MZ000020.WMA
MZ001000.WMA
MZ001010.WMA
MZ001020.WMA
MZ001030.WMA
MZ001040.WMA
MZ001050.WMA
MZ001060.WMA
MZ001070.WMA
MZ001080.WMA
MZ001090.WMA
MZ001100.WMA
MZ001110.WMA
MZ002000.WMA
MZ002010.WMA
MZ002020.WMA
MZ002030.WMA
MZ002040.WMA
MZ002050.WMA
MZ002060.WMA
MZ002070.WMA
MZ002080.WMA
MZ002090.WMA
MZ003000.WMA
MZ003010.WMA
MZ003020.WMA
MZ003030.WMA
MZ003040.WMA
MZ004000.WMA
MZ004010.WMA
MZ004020.WMA
MZ004030.WMA
application.xml
hglCore.dll
hglNj.dll
hlSwapper.exe
msvcp71.dll
msvcr71.dll
snapcl.dll
ソフトの購入.url
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
アンインストール.url
blocklist
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
data_1
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
Secure Preferences
sync_diagnostic.log
aa1359f4-2d33-4073-add3-9e226ef927a1.tmp
aae664df-e4cb-4f58-9a77-6dc2795aa81e.tmp
OperationConfig
OperationConfig~RFe5afc72.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
c4e7b3bf-a0e9-4d05-bdcc-64ddcc2aad64.tmp
BG_02.pvz
BG_07.pvp
TRIAL_BG.PVZ
adinstA.pvz
cm_02_e.pvz
frameClassic.pvp
mz100b.pvz
License.rtf
017OJAMAOKURARE_S.WAV
018OJAMAOKURARE_M.WAV
019OJAMAOKURARE_L.WAV
043OJAMARAKURAI2.WAV
CH00VO11.WAV
d8833079-6934-4471-a898-ad529a79b6be.tmp
data1.cab
data1.hdr
engine32.cab
_Setup.dll
layout.bin
content_new.js
d450e194-d6d6-49be-a0c1-2683d6f8d1a3.tmp
setup.exe
setup.ibt
setup.ini
setup.inx
FontData.ini
_ISUser.dll
_IsRes.dll
isrt.dll
PuyoF.ini
memory/816-5423-0x000002CBAA0E0000-0x000002CBAA0E1000-memory.dmp
memory/816-5417-0x000002CBAA0E0000-0x000002CBAA0E1000-memory.dmp
memory/816-5418-0x000002CBAA0E0000-0x000002CBAA0E1000-memory.dmp
memory/816-5413-0x000002CBAA0E0000-0x000002CBAA0E1000-memory.dmp
memory/816-5419-0x000002CBAA0E0000-0x000002CBAA0E1000-memory.dmp
memory/816-5420-0x000002CBAA0E0000-0x000002CBAA0E1000-memory.dmp
memory/816-5421-0x000002CBAA0E0000-0x000002CBAA0E1000-memory.dmp
memory/816-5422-0x000002CBAA0E0000-0x000002CBAA0E1000-memory.dmp
memory/816-5411-0x000002CBAA0E0000-0x000002CBAA0E1000-memory.dmp
memory/816-5412-0x000002CBAA0E0000-0x000002CBAA0E1000-memory.dmp
memory/884-5594-0x0000023C1E290000-0x0000023C1E291000-memory.dmp
memory/884-5596-0x0000023C1E290000-0x0000023C1E291000-memory.dmp
memory/884-5597-0x0000023C1E290000-0x0000023C1E291000-memory.dmp
memory/884-5598-0x0000023C1E290000-0x0000023C1E291000-memory.dmp
memory/884-5593-0x0000023C1E290000-0x0000023C1E291000-memory.dmp
memory/884-5595-0x0000023C1E290000-0x0000023C1E291000-memory.dmp
memory/884-5590-0x0000023C1E290000-0x0000023C1E291000-memory.dmp
memory/884-5591-0x0000023C1E290000-0x0000023C1E291000-memory.dmp
memory/884-5589-0x0000023C1E290000-0x0000023C1E291000-memory.dmp
memory/1476-5866-0x00000000025C0000-0x000000000262D000-memory.dmp
memory/1476-5862-0x0000000000B90000-0x0000000000B9D000-memory.dmp
memory/1476-5863-0x0000000000BA0000-0x0000000000BC5000-memory.dmp
memory/2840-5502-0x00000000001F0000-0x00000000001FD000-memory.dmp
memory/2840-5506-0x00000000025E0000-0x000000000264D000-memory.dmp
memory/2840-5505-0x0000000000E70000-0x0000000000E94000-memory.dmp
memory/2840-5503-0x0000000000AB0000-0x0000000000AD5000-memory.dmp
memory/3560-5632-0x0000000000BD0000-0x0000000000BF4000-memory.dmp
memory/3560-5630-0x0000000000B80000-0x0000000000BA5000-memory.dmp
memory/3560-5633-0x0000000000C60000-0x0000000000CCD000-memory.dmp
memory/3640-5448-0x0000000000660000-0x00000000006CD000-memory.dmp
memory/3804-2281-0x0000000005DE0000-0x0000000005E4A000-memory.dmp
memory/3804-2272-0x0000000005D70000-0x0000000005DB4000-memory.dmp
memory/3804-2132-0x0000000005040000-0x0000000005073000-memory.dmp
memory/3804-2138-0x00000000050A0000-0x00000000050C7000-memory.dmp
memory/3804-2289-0x00000000064E0000-0x000000000650F000-memory.dmp
memory/3804-2265-0x0000000005D50000-0x0000000005D61000-memory.dmp
memory/3804-2207-0x00000000051D0000-0x00000000052A0000-memory.dmp
memory/3804-2085-0x0000000004EC0000-0x0000000004F13000-memory.dmp
memory/4508-5604-0x0000000000BF0000-0x0000000000C5D000-memory.dmp
memory/5408-5382-0x0000000000A90000-0x0000000000A9D000-memory.dmp
memory/5408-5383-0x0000000000AA0000-0x0000000000AC5000-memory.dmp
memory/5408-5385-0x0000000000AD0000-0x0000000000AF4000-memory.dmp
memory/5408-5386-0x0000000000E00000-0x0000000000E6D000-memory.dmp