EchoTrail

PowerToys 0.102.3101

by Microsoft Corporationinstaller signed by Microsoft CorporationValid

Sources: observed in the EchoTrail lab on Windows 11 on November 9, 2026.

The install

Installer
powertoysusersetup-0.102.3101.0-x64.exe
Installer type
burn
Installed through
a type-detected silent switch
Install directory
C:\Users\lab\AppData\Local\PowerToys
Launched
PowerToys.exe
Windows
Windows 11
Date
November 9, 2026
Executables dropped
2001

installer sha256 4b4c49a31e8b7e6a36647ccd3033acb0ad56c306595a9409e59865c3c27d1cf2

The lab used PowerToys for 2 minutes, changed a setting, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to PowerToys's own windows.

PowerToys 0.102.3101: First window
First window. PowerToys Settings Home window is open on top of a Welcome to PowerToys window, showing quick access and a utilities list with toggles.
PowerToys 0.102.3101: Settings
Settings. PowerToys Settings shows the Always On Top page with the module toggle On and activation shortcuts listed.

What it dropped

Executables

  • powertoys.zoomit.exesigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValidran during the lab session
    C:\Users\lab\AppData\Local\PowerToys\PowerToys.ZoomIt.exe
    sha256 f08150c689ccd01d67818ce4862475b0fb57cee873e5de555065000abc25819e
  • microsoft.windows.sdk.net.dll
    C:\Users\lab\AppData\Local\PowerToys\Microsoft.Windows.SDK.NET.dll
    sha256 4964dd17fdffa3a13873e9b76d3ad4f6e4f01f55e187be443791693bae952c45
  • microsoft.windows.sdk.net.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\Microsoft.Windows.SDK.NET.dll
    sha256 4964dd17fdffa3a13873e9b76d3ad4f6e4f01f55e187be443791693bae952c45
  • onnxruntime.dll
    C:\Users\lab\AppData\Local\PowerToys\onnxruntime.dll
    sha256 f64c098b67eee3c769416564c4abc32e605eaa9a1804e41c03e74b4713d04333
  • onnxruntime.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\onnxruntime.dll
    sha256 f64c098b67eee3c769416564c4abc32e605eaa9a1804e41c03e74b4713d04333
  • directml.dll
    C:\Users\lab\AppData\Local\PowerToys\DirectML.dll
    sha256 7ae717a1304253c71f0793e5d8a172ad779934e7465b0648b64013da832fd8ae
  • directml.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\DirectML.dll
    sha256 7ae717a1304253c71f0793e5d8a172ad779934e7465b0648b64013da832fd8ae
  • system.private.corelib.dllsigned by CN=.NET, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\System.Private.CoreLib.dll
    sha256 ed80a1a5dd066c0407ad59686f9af90a4f3e55dbf3e4c973b53cc8c9d0706f82
  • system.private.corelib.dllsigned by CN=.NET, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\System.Private.CoreLib.dll
    sha256 ed80a1a5dd066c0407ad59686f9af90a4f3e55dbf3e4c973b53cc8c9d0706f82
  • presentationframework.dll
    C:\Users\lab\AppData\Local\PowerToys\PresentationFramework.dll
    sha256 fa9aa188f9c92dc95b4e56f303b1875244bf45786733948c79034fe95fb0cd86
  • presentationframework.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\PresentationFramework.dll
    sha256 fa9aa188f9c92dc95b4e56f303b1875244bf45786733948c79034fe95fb0cd86
  • microsoft.ui.xaml.dllsigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\Microsoft.ui.xaml.dll
    sha256 2b22eb6130821f43a26239d441ef3a898bea24b1c1078b5941249431c4b4fbf8
  • microsoft.ui.xaml.dllsigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\Microsoft.ui.xaml.dll
    sha256 2b22eb6130821f43a26239d441ef3a898bea24b1c1078b5941249431c4b4fbf8
  • system.windows.forms.dll
    C:\Users\lab\AppData\Local\PowerToys\System.Windows.Forms.dll
    sha256 a178f2f0de086c30e743ce32b8bfbb150e802e1bab235ff14525b4a6e2227df9
  • system.windows.forms.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\System.Windows.Forms.dll
    sha256 a178f2f0de086c30e743ce32b8bfbb150e802e1bab235ff14525b4a6e2227df9
  • libskiasharp.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\libSkiaSharp.dll
    sha256 9a0d95e8caaa852c70d085af6a40a744242172ad9ea3fd6bc7599875a8a1dbcd
  • presentationcore.dll
    C:\Users\lab\AppData\Local\PowerToys\PresentationCore.dll
    sha256 c2ac0752b0a3018331519b8aec6fa085346bfc59609ea29954821a0ab19ee839
  • presentationcore.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\PresentationCore.dll
    sha256 c2ac0752b0a3018331519b8aec6fa085346bfc59609ea29954821a0ab19ee839
  • system.private.xml.dll
    C:\Users\lab\AppData\Local\PowerToys\System.Private.Xml.dll
    sha256 d570b8cb9507f2fcac88f80a2fe7597d3e2331a84f337820a7d794632a67ed5d
  • system.private.xml.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\System.Private.Xml.dll
    sha256 d570b8cb9507f2fcac88f80a2fe7597d3e2331a84f337820a7d794632a67ed5d
  • microsoft.winui.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\Microsoft.WinUI.dll
    sha256 8d2b7ef71fce2d6d716735868b0a47adc61b02bfa5b8b4bd5008325a79df54ee
  • microsoft.ui.xaml.controls.dllsigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\Microsoft.UI.Xaml.Controls.dll
    sha256 44479ef18ea26abd9f01315e150de1adde9900f448a4e391fa25bbdd1bfbd5ab
  • microsoft.ui.xaml.controls.dllsigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\Microsoft.UI.Xaml.Controls.dll
    sha256 44479ef18ea26abd9f01315e150de1adde9900f448a4e391fa25bbdd1bfbd5ab
  • microsoft.ui.xaml.dll
    C:\Users\lab\AppData\Local\PowerToys\KeyboardManagerEditor\Microsoft.UI.Xaml.dll
    sha256 b975c41251d70384635c81ba1bab34506ea4c4094237081bbf9ff4ca7c96a90e
  • system.windows.forms.design.dll
    C:\Users\lab\AppData\Local\PowerToys\System.Windows.Forms.Design.dll
    sha256 4b96cf16ea44e11627be57f7ebd5580e7553547d83eb5dc61121ff0d84eff4b3
  • system.windows.forms.design.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\System.Windows.Forms.Design.dll
    sha256 4b96cf16ea44e11627be57f7ebd5580e7553547d83eb5dc61121ff0d84eff4b3
  • d3dcompiler_47_cor3.dllsigned by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\D3DCompiler_47_cor3.dll
    sha256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
  • d3dcompiler_47_cor3.dllsigned by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\D3DCompiler_47_cor3.dll
    sha256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
  • coreclr.dllsigned by CN=.NET, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\coreclr.dll
    sha256 c98c3078a4f2495dd7d3ced967c7a6981545194ed163454703580b740f435521
  • coreclr.dllsigned by CN=.NET, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\coreclr.dll
    sha256 c98c3078a4f2495dd7d3ced967c7a6981545194ed163454703580b740f435521
  • openai.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\OpenAI.dll
    sha256 c8b758f3b78d4ed1d55467a618943c1aa300ad74d7a8419bb0196088652a77bb
  • system.linq.expressions.dllsigned by CN=.NET, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\System.Linq.Expressions.dll
    sha256 f5d05f16c2f31ae822bca8db63019067c8d83b09376b0a60c38b9c98fa0e088f
  • system.linq.expressions.dllsigned by CN=.NET, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\System.Linq.Expressions.dll
    sha256 f5d05f16c2f31ae822bca8db63019067c8d83b09376b0a60c38b9c98fa0e088f
  • system.windows.forms.primitives.dll
    C:\Users\lab\AppData\Local\PowerToys\System.Windows.Forms.Primitives.dll
    sha256 1ce7325bd95c3998fb34b158bd99c3b2105ec6627e4e878f2089c8b77e23cc96
  • system.windows.forms.primitives.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\System.Windows.Forms.Primitives.dll
    sha256 1ce7325bd95c3998fb34b158bd99c3b2105ec6627e4e878f2089c8b77e23cc96
  • winuiedit.dllsigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\WinUIEdit.dll
    sha256 5ba6e51732348b377cbe3a5d0f33fe13753170dc75d514d687b8689c8125c588
  • winuiedit.dllsigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\WinUIEdit.dll
    sha256 5ba6e51732348b377cbe3a5d0f33fe13753170dc75d514d687b8689c8125c588
  • dwritecore.dll
    C:\Users\lab\AppData\Local\PowerToys\DWriteCore.dll
    sha256 426674b9c74612bd2a29d0812212faf0641ad93a48521aeb58eb9a50fac8708d
  • dwritecore.dll
    C:\Users\lab\AppData\Local\PowerToys\WinUI3Apps\DWriteCore.dll
    sha256 426674b9c74612bd2a29d0812212faf0641ad93a48521aeb58eb9a50fac8708d
  • microsoft.diagnostics.tracing.traceevent.dll
    C:\Users\lab\AppData\Local\PowerToys\Microsoft.Diagnostics.Tracing.TraceEvent.dll
    sha256 3e9b1cfd4bfd52f310b441476a11e6a1f030f3c749b90c545042b0c2e95892ed