$ElasticInstallPath\Endpoint\cache\RansomwareDumps

Search for Posts that contain the STIX object entered