Overview

overview

10

Static

static

1

PowerToysU...64.exe

windows10-2004-x64

1

PowerToysU...64.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    152s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 06:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PowerToysUserSetup-0.101.2362.0-x64.exe
  • Size 282.6MB
  • Sample260925-gvtb8abb77
  • SHA256 d56fa7130fa68afe553068c15a59a6b24c8dbcc9a0989a43ef0fc5a373230de3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs
    defense_evasionprivilege_escalation
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 31 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Control Panel 9 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:4076
      • C:\Users\Admin\AppData\Local\Temp\PowerToysUserSetup-0.101.2362.0-x64.exe
        "C:\Users\Admin\AppData\Local\Temp\PowerToysUserSetup-0.101.2362.0-x64.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\TEMP\{13EF9462-4256-4DEB-AB8B-6C1BFC6841C2}\.ba\wixstdba.exe
          "C:\Windows\TEMP\{13EF9462-4256-4DEB-AB8B-6C1BFC6841C2}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{939FF884-57D7-4D4F-B623-35F069DACB55} {2DB63BA1-E650-4FB5-927B-D4A7AB06BF85}
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:4044
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Package Cache\439A8989D4069C0616DBFE7F9488ECE1D173FEB234706C45F47E5AA9DB98D155\terminate_powertoys.cmd"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5348
          • C:\Windows\system32\taskkill.exe
            taskkill /IM PowerToys.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2800
      • C:\Users\Admin\AppData\Local\PowerToys\PowerToys.exe
        "C:\Users\Admin\AppData\Local\PowerToys\PowerToys.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:812
        • C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.QuickAccess.exe
          "C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.QuickAccess.exe" --show-event="Local\PowerToysQuickAccess_812_Show" --exit-event="Local\PowerToysQuickAccess_812_Exit" --runner-pipe="\\.\pipe\powertoys_quick_access_runner_b782680d-3277-449c-a7de-e9b1ba518c53" --app-pipe="\\.\pipe\powertoys_quick_access_ui_b782680d-3277-449c-a7de-e9b1ba518c53"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Control Panel
          • Suspicious use of FindShellTrayWindow
          PID:5560
        • C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.ImageResizer.exe
          "C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.ImageResizer.exe" --detect-ai
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Control Panel
          PID:1312
        • C:\Users\Admin\AppData\Local\PowerToys\PowerToys.AlwaysOnTop.exe
          "C:\Users\Admin\AppData\Local\PowerToys\PowerToys.AlwaysOnTop.exe" 812
          3⤵
          • Executes dropped EXE
          • Modifies Control Panel
          PID:2092
        • C:\Users\Admin\AppData\Local\PowerToys\PowerToys.Awake.exe
          PowerToys.Awake.exe --use-pt-config --pid 812
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2872
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe" x-cmdpal://background
          3⤵
            PID:1052
          • C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.Settings.exe
            "C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.Settings.exe" \\.\pipe\powertoys_runner_56f368d1-61b9-4ddd-ae12-1c9a28056349 \\.\pipe\powertoys_settings_56f368d1-61b9-4ddd-ae12-1c9a28056349 812 system true true false false true Dashboard
            3⤵
            • Executes dropped EXE
            • Modifies Control Panel
            • Suspicious use of SetWindowsHookEx
            PID:5284
          • C:\Users\Admin\AppData\Local\PowerToys\PowerToys.ColorPickerUI.exe
            "C:\Users\Admin\AppData\Local\PowerToys\PowerToys.ColorPickerUI.exe" 812
            3⤵
            • Executes dropped EXE
            PID:3080
          • C:\Users\Admin\AppData\Local\PowerToys\PowerToys.FancyZones.exe
            "C:\Users\Admin\AppData\Local\PowerToys\PowerToys.FancyZones.exe" 812
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5872
            • C:\Users\Admin\AppData\Local\PowerToys\PowerToys.FancyZonesEditor.exe
              "C:\Users\Admin\AppData\Local\PowerToys\PowerToys.FancyZonesEditor.exe"
              4⤵
              • Executes dropped EXE
              • Modifies Control Panel
              PID:3228
          • C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.ShortcutGuide.exe
            "C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.ShortcutGuide.exe" 812
            3⤵
            • Executes dropped EXE
            • Modifies Control Panel
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5032
            • C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.ShortcutGuide.IndexYmlGenerator.exe
              "C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.ShortcutGuide.IndexYmlGenerator.exe"
              4⤵
              • Executes dropped EXE
              PID:5264
          • C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.Settings.exe
            "C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.Settings.exe" \\.\pipe\powertoys_runner_1ac912f8-9942-4bd8-8b16-66e191112df4 \\.\pipe\powertoys_settings_1ac912f8-9942-4bd8-8b16-66e191112df4 812 system true true true false false
            3⤵
            • Executes dropped EXE
            • Modifies Control Panel
            PID:5160
          • C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.ShortcutGuide.exe
            "C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.ShortcutGuide.exe" 812 telemetry
            3⤵
            • Executes dropped EXE
            PID:5780
          • C:\Users\Admin\AppData\Local\PowerToys\PowerToys.MouseWithoutBorders.exe
            PowerToys.MouseWithoutBorders.exe
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4908
        • C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.Peek.UI.exe
          "C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.Peek.UI.exe" 812
          2⤵
          • Executes dropped EXE
          • Modifies Control Panel
          PID:5012
      • C:\Users\Admin\AppData\Local\Package Cache\{28CDFE7F-68F0-403E-B53D-7A6E1E9AAA17}\PowerToysUserSetup-0.101.2362.0-x64.exe
        "C:\Users\Admin\AppData\Local\Package Cache\{28CDFE7F-68F0-403E-B53D-7A6E1E9AAA17}\PowerToysUserSetup-0.101.2362.0-x64.exe" /burn.runonce
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4688
        • C:\Users\Admin\AppData\Local\Package Cache\{28CDFE7F-68F0-403E-B53D-7A6E1E9AAA17}\PowerToysUserSetup-0.101.2362.0-x64.exe
          "C:\Users\Admin\AppData\Local\Package Cache\{28CDFE7F-68F0-403E-B53D-7A6E1E9AAA17}\PowerToysUserSetup-0.101.2362.0-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\powertoys-bootstrapper-msi-0.101.2362.0_20260925071217.log"
          2⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:940
          • C:\Windows\TEMP\{7542B086-2160-4670-946F-B38CC344232B}\.ba\wixstdba.exe
            "C:\Windows\TEMP\{7542B086-2160-4670-946F-B38CC344232B}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{A4420A7F-BBE4-4243-B3CF-FE127937FD75} {8BD8666D-520A-4E5A-BD55-0BB95E96FFC1}
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:4800
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Package Cache\439A8989D4069C0616DBFE7F9488ECE1D173FEB234706C45F47E5AA9DB98D155\terminate_powertoys.cmd"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4112
            • C:\Windows\system32\taskkill.exe
              taskkill /IM PowerToys.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3588
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding 222120E7E84031C05EDB4E0FC4A253E5
          2⤵
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Users\Admin\AppData\Local\PowerToys\PowerToys.exe
            "C:\Users\Admin\AppData\Local\PowerToys\\PowerToys.exe" --dont-elevate
            3⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:6080
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:5960
        • C:\Users\Admin\AppData\Local\PowerToys\PowerToys.exe
          C:\Users\Admin\AppData\Local\PowerToys\PowerToys.exe
          1⤵
          • Executes dropped EXE
          PID:696
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4672
          • C:\Program Files\WindowsApps\Microsoft.CommandPalette_0.12.12365.0_x64__8wekyb3d8bbwe\Microsoft.CmdPal.UI.exe
            "C:\Program Files\WindowsApps\Microsoft.CommandPalette_0.12.12365.0_x64__8wekyb3d8bbwe\Microsoft.CmdPal.UI.exe" x-cmdpal://background/
            2⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:8
        • C:\Windows\SysWOW64\DllHost.exe
          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
          1⤵
          • System Location Discovery: System Language Discovery
          PID:3244
        • C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\Microsoft.CmdPal.Ext.PowerToys.exe
          "C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\\Microsoft.CmdPal.Ext.PowerToys.exe" -RegisterProcessAsComServer -Embedding
          1⤵
          • Executes dropped EXE
          PID:4592

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              Windows Command Shell

              1
              T1059.003

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Privilege Escalation

              Access Token Manipulation

              1
              T1134

              Parent PID Spoofing

              1
              T1134.004

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Defense Evasion

              Access Token Manipulation

              1
              T1134

              Parent PID Spoofing

              1
              T1134.004

              Modify Registry

              1
              T1112

              Credential Access

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              3
              T1012

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e5a1cf2.rbs
              • Path C:\Config.Msi\e5a1cf2.rbs
              • Size 635KB
              • SHA256 1f8518c9b55dc03106138864510b7bd894fb4d9ceac16f242b4d31a986871412
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              settings.json
              • Path C:\Users\Admin\AppData\Local\Microsoft\PowerToys\FancyZones\settings.json
              • Size 1KB
              • SHA256 30185972998bd485916159a78a08cd1f9710d8c38d1e276753c453eb83bf4d79
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.json
              • Path C:\Users\Admin\AppData\Local\Microsoft\PowerToys\MouseWithoutBorders\settings.json
              • Size 1KB
              • SHA256 5ad3d5a2eafa5afcfb6c5ef577e36e879239e264ff8e4de6713888bf36452310
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TerminatePowerToys
              • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\TerminatePowerToys
              • Size 469B
              • SHA256 c5bded10d9ce53431e12f6806693a67122805f0a2235b373f868799374a353e3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              WebView2
              • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\WebView2
              • Size 1.7MB
              • SHA256 98370211f329f59b97308915790eeae4580a29a88c4285ee43a9f190a16e832e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PowerToysUserSetup-0.101.2362.0-x64.exe
              • Path C:\Users\Admin\AppData\Local\Package Cache\{28CDFE7F-68F0-403E-B53D-7A6E1E9AAA17}\PowerToysUserSetup-0.101.2362.0-x64.exe
              • Size 1.2MB
              • SHA256 69dee0511059a8f2e98973e5bf39b3dadaf950cd4f19b0bae03cbf9772a61e09
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              state.rsm
              • Path C:\Users\Admin\AppData\Local\Package Cache\{28CDFE7F-68F0-403E-B53D-7A6E1E9AAA17}\state.rsm
              • Size 1KB
              • SHA256 22c4d59d152da8e299cec1282b534181f7cd7ead7ff27da60ecaf56bb8017156
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.json
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.CommandPalette_8wekyb3d8bbwe\LocalState\settings.json
              • Size 6KB
              • SHA256 235886d4cf933de124cd228840535bad21a356b42920acb26dd2d7b4dd585022
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              settings.json
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.CommandPalette_8wekyb3d8bbwe\LocalState\settings.json
              • Size 6KB
              • SHA256 b23f1dbcaa8ac48b978550207c8752824ef96eafd9d55e4bfc03a151abd61c43
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Accessibility.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\Accessibility.dll
              • Size 20KB
              • SHA256 7ce3bd7a5d0ec61be7d5d139e51831c4a20ae32cb7635baac739846fd0fc07b4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              monaco_languages.json
              • Path C:\Users\Admin\AppData\Local\PowerToys\Assets\Monaco\monaco_languages.json
              • Size 9KB
              • SHA256 1730676bcdc41b2ae5ceae4d3df506a1edc56962621f44b6f246cb43a5751f6f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ControlzEx.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\ControlzEx.dll
              • Size 452KB
              • SHA256 4b6eb1c39327362228ca20a65456c53a6531d72c7fcc0c9705d0d239289d6714
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CoreMessagingXP.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\CoreMessagingXP.dll
              • Size 1017KB
              • SHA256 00a4f20a39a24542024bc091b939f6f3852f6aa24e30286a3fc183531e165606
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              D3DCompiler_47_cor3.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\D3DCompiler_47_cor3.dll
              • Size 4.5MB
              • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DirectML.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\DirectML.dll
              • Size 17.8MB
              • SHA256 7ae717a1304253c71f0793e5d8a172ad779934e7465b0648b64013da832fd8ae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DirectWriteForwarder.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\DirectWriteForwarder.dll
              • Size 493KB
              • SHA256 2526dcb41392b1756fd8fdb517fdca1c852b774b957e6e6c66715f616e5fc027
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PowerToys.ColorPickerUI.runtimeconfig.json
              • Path C:\Users\Admin\AppData\Local\PowerToys\PowerToys.ColorPickerUI.runtimeconfig.json
              • Size 867B
              • SHA256 1401ad3714099edb8aedded755dd6f5f780c5b7682c18e227ec76e8d1e6fa3bf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              PowerToys.exe
              • Path C:\Users\Admin\AppData\Local\PowerToys\PowerToys.exe
              • Size 1.6MB
              • SHA256 da493bef86de32d960de6d9653cc122332e1af97ab5b026ed816cfdd258d5792
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Dia2Lib.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\RunPlugins\History\Dia2Lib.dll
              • Size 57KB
              • SHA256 6c4cac68010fe032218efe5e9fcf46eef9f77bfaa5f3bd33f03c5ff77d5a8fac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TraceReloggerLib.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\RunPlugins\History\TraceReloggerLib.dll
              • Size 22KB
              • SHA256 6830c0f1d3f3c17719181e73dd5cfa8ccbb3f3c575329d2120576545103467b5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PowerDisplay.Models.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\RunPlugins\Indexer\PowerDisplay.Models.dll
              • Size 68KB
              • SHA256 ef7b42b766a00e9adfeb28023c6f3275c88983d6a8348af400cf42955325dd34
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PowerToys.ManagedTelemetry.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\RunPlugins\Indexer\PowerToys.ManagedTelemetry.dll
              • Size 21KB
              • SHA256 a6b3decf60df51361676a7e4bf8d33aa0608288f1b8ec49bc2051f06ba48f540
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PowerToys.MouseJump.Common.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\RunPlugins\Indexer\PowerToys.MouseJump.Common.dll
              • Size 93KB
              • SHA256 57ebae0fa43325b1e021ce091b03986b6ec8b82aa4f20346b5c8d44572746e7c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PowerToys.MouseJump.Models.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\RunPlugins\Indexer\PowerToys.MouseJump.Models.dll
              • Size 44KB
              • SHA256 da7b4edebbfb403c952bb22386d68742250d7c6fe49a16f611fcdfab02275c1d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PowerToys.Interop.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\RunPlugins\OneNote\PowerToys.Interop.dll
              • Size 489KB
              • SHA256 df733810c9184ca7698e6d25ddfe7643f0fbc7e6a3bad1ffb42ec206a3f2638c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PowerToys.ZoomItSettingsInterop.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\RunPlugins\OneNote\PowerToys.ZoomItSettingsInterop.dll
              • Size 277KB
              • SHA256 aa3400b150baca293e51fa00a7e308f9869e17b42ea35bc87645c6f1851aabef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              backup_restore_settings.json
              • Path C:\Users\Admin\AppData\Local\PowerToys\RunPlugins\OneNote\backup_restore_settings.json
              • Size 1KB
              • SHA256 ef6a09cabecefa3dd84f93fca104f58c04e3dad412917ef31a92381b1094adcb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Logo.scale-200.png
              • Path C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\Assets\Settings\Logo.scale-200.png
              • Size 1KB
              • SHA256 e11d4826f4421058b8a1c123a9e611960b38c1b6d52de653f36f0a2f2bfc19f7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              SplashScreen.png
              • Path C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\Assets\Settings\SplashScreen.png
              • Size 1KB
              • SHA256 931baaa8bb40e537a2b41f5be7b01072a87adb40c331234e8a5340183eaf8a3a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              PowerToys.ImageResizer.runtimeconfig.json
              • Path C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\PowerToys.ImageResizer.runtimeconfig.json
              • Size 934B
              • SHA256 d23470ba802838316aaa2d918813f1dee40db784ba19d1b4f05dc21f619145af
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              hardlinks.txt
              • Path C:\Users\Admin\AppData\Local\PowerToys\WinUI3Apps\hardlinks.txt
              • Size 13KB
              • SHA256 ae3f70b43d95f41fe35913806bdf2bcdf296246d23c80087ecc41e03656541b1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              clretwrc.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\clretwrc.dll
              • Size 310KB
              • SHA256 e9f9ccaa20a91570e6e505fd85197b86e8e6582b67864a8630c1a82afb9866a7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              clrgc.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\clrgc.dll
              • Size 657KB
              • SHA256 83a829823c333bfbcf0bd82bc015a61af10ce136d8eb7933b28d97c9193c578b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              clrgcexp.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\clrgcexp.dll
              • Size 694KB
              • SHA256 d006be1e64e796161c8f3abb462c23753d86103a82282013b1c5309c76613f1f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              clrjit.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\clrjit.dll
              • Size 2.0MB
              • SHA256 e7bf743e7bf9a01c8c2bcdc0d828212fd8dfc285be9d4ec21962becf456df648
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              concrt140.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\concrt140.dll
              • Size 365KB
              • SHA256 54716f0738af891f283d213b5c8d11b25896bb8ee3097d301eae718560cf974e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              coreclr.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\coreclr.dll
              • Size 4.4MB
              • SHA256 c98c3078a4f2495dd7d3ced967c7a6981545194ed163454703580b740f435521
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dcompi.dll
              • Path C:\Users\Admin\AppData\Local\PowerToys\dcompi.dll
              • Size 1.6MB
              • SHA256 1bab52acf1bbc45f1469af675160da8b2ce0bdccdd4adce3ca3032e674ad6ee3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              powertoys-bootstrapper-msi-0.101.2362.0_20260925071217_001_PowerToysUserSetup_0.101.2362.0_x64.msi.log
              • Path C:\Users\Admin\AppData\Local\Temp\powertoys-bootstrapper-msi-0.101.2362.0_20260925071217_001_PowerToysUserSetup_0.101.2362.0_x64.msi.log
              • Size 2KB
              • SHA256 5d6f6265ecf295b8a8e2d962a40dd0f80e66399c7d93c06a83576de58c5d3b57
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              PowerToys (Preview).lnk
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PowerToys (Preview)\PowerToys (Preview).lnk
              • Size 2KB
              • SHA256 8a51d482b72f003255c3ab821fd6313caf20457ff6ee24cea59c0eb2d5338755
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              PowerToys (Preview).lnk~RFe5ab18e.TMP
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PowerToys (Preview)\PowerToys (Preview).lnk~RFe5ab18e.TMP
              • Size 2KB
              • SHA256 1109ffc523f8b4c4227b0753dd8ab124413c49a95ccf767d8b285fde313cc776
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              MSI2C51.tmp
              • Path C:\Windows\Installer\MSI2C51.tmp
              • Size 1020KB
              • SHA256 074411dfd609f51cd4d6b08ad97bc379bdfb78d2b1676550fc053e66b230d50d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI41B2.tmp
              • Path C:\Windows\Installer\MSI41B2.tmp
              • Size 390KB
              • SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI4230.tmp
              • Path C:\Windows\Installer\MSI4230.tmp
              • Size 193KB
              • SHA256 17f5efee889dcb2d8ffca0f6790079810ba1d018dc76f8ddca45efba79a93fd5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BootstrapperApplicationData.xml
              • Path C:\Windows\TEMP\{13EF9462-4256-4DEB-AB8B-6C1BFC6841C2}\.ba\BootstrapperApplicationData.xml
              • Size 7KB
              • SHA256 a58791c487ade3f66c030786ee4ca58e30554e953c0d8428cd4d0e66a756ee4d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SilentFilesInUseBAFunction.dll
              • Path C:\Windows\TEMP\{13EF9462-4256-4DEB-AB8B-6C1BFC6841C2}\.ba\SilentFilesInUseBAFunction.dll
              • Size 181KB
              • SHA256 f5342d0b0869e0ac7345dcc1ac3c06a4dd6524e431cf22e328afbf4fedd641b1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              icon.ico
              • Path C:\Windows\TEMP\{13EF9462-4256-4DEB-AB8B-6C1BFC6841C2}\.ba\icon.ico
              • Size 41KB
              • SHA256 637eecfa2f0baaf87677adfbd7164ff9954429cf920e1bd7abebe08f85984e1d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              license.rtf
              • Path C:\Windows\TEMP\{13EF9462-4256-4DEB-AB8B-6C1BFC6841C2}\.ba\license.rtf
              • Size 1KB
              • SHA256 69a9f5edbc4c510e7415fe9c973068ecf4267c0ff985e3635541138bc6014251
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              logo.png
              • Path C:\Windows\TEMP\{13EF9462-4256-4DEB-AB8B-6C1BFC6841C2}\.ba\logo.png
              • Size 1KB
              • SHA256 d0f67d8dc4405840bbdef2ef78eed38db08739a773112f16d9edc2cec5f2daca
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              thm.wxl
              • Path C:\Windows\TEMP\{13EF9462-4256-4DEB-AB8B-6C1BFC6841C2}\.ba\thm.wxl
              • Size 5KB
              • SHA256 c59d91c5e1b5026c3b5a2da110f824f3896606b8bd984fa8b583604c49004f91
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              thm.xml
              • Path C:\Windows\TEMP\{13EF9462-4256-4DEB-AB8B-6C1BFC6841C2}\.ba\thm.xml
              • Size 8KB
              • SHA256 bbf2feeaeb81f096bb34950bef0db5969d4afbf9e6a686825def10ad0f52213b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wixstdba.exe
              • Path C:\Windows\Temp\{13EF9462-4256-4DEB-AB8B-6C1BFC6841C2}\.ba\wixstdba.exe
              • Size 489KB
              • SHA256 e05dda0c23421cfc7a2a39b91074928605e1e69ad5f0a2a4e230ed5996fe2ff9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/8-2811-0x000001805CFC0000-0x000001805CFD0000-memory.dmp
              Download

              memory/940-2426-0x00007FF6F8C40000-0x00007FF6F8D29000-memory.dmp
              Download