Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2023 12:51
Behavioral task
behavioral1
Sample
some_malicious_file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
some_malicious_file.exe
Resource
win10v2004-20230220-en
General
-
Target
some_malicious_file.exe
-
Size
164KB
-
MD5
890a58f200dfff23165df9e1b088e58f
-
SHA1
74e3d82f7ee81109e150dc41112cf95b3a4b5307
-
SHA256
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93
-
SHA512
2ee3636833cd9b02f5e311401817b15514845d4c12c1416d7e345845f8084775bf8c5f8f32822066b75a6b627a93138a0b27deb99c8bbb1f8d640132a2d8de0d
-
SSDEEP
3072:Hp5SexkWi1Lbi4eTMlwDCnu/q2GB96W/y:JvGWwbnWJ/yB9
Malware Config
Extracted
C:\Recovery\89avni-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7A70AA78BCC0895E
http://decryptor.top/7A70AA78BCC0895E
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
some_malicious_file.exedescription ioc process File renamed C:\Users\Admin\Pictures\BlockCompress.tiff => \??\c:\users\admin\pictures\BlockCompress.tiff.89avni some_malicious_file.exe File renamed C:\Users\Admin\Pictures\CheckpointExit.crw => \??\c:\users\admin\pictures\CheckpointExit.crw.89avni some_malicious_file.exe File renamed C:\Users\Admin\Pictures\ConvertToSubmit.crw => \??\c:\users\admin\pictures\ConvertToSubmit.crw.89avni some_malicious_file.exe File renamed C:\Users\Admin\Pictures\ProtectUpdate.crw => \??\c:\users\admin\pictures\ProtectUpdate.crw.89avni some_malicious_file.exe File renamed C:\Users\Admin\Pictures\ResetEnable.png => \??\c:\users\admin\pictures\ResetEnable.png.89avni some_malicious_file.exe File renamed C:\Users\Admin\Pictures\UnlockClear.tiff => \??\c:\users\admin\pictures\UnlockClear.tiff.89avni some_malicious_file.exe File opened for modification \??\c:\users\admin\pictures\BlockCompress.tiff some_malicious_file.exe File opened for modification \??\c:\users\admin\pictures\UnlockClear.tiff some_malicious_file.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
some_malicious_file.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation some_malicious_file.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
some_malicious_file.exedescription ioc process File opened (read-only) \??\N: some_malicious_file.exe File opened (read-only) \??\R: some_malicious_file.exe File opened (read-only) \??\V: some_malicious_file.exe File opened (read-only) \??\Y: some_malicious_file.exe File opened (read-only) \??\B: some_malicious_file.exe File opened (read-only) \??\H: some_malicious_file.exe File opened (read-only) \??\S: some_malicious_file.exe File opened (read-only) \??\T: some_malicious_file.exe File opened (read-only) \??\W: some_malicious_file.exe File opened (read-only) \??\X: some_malicious_file.exe File opened (read-only) \??\Z: some_malicious_file.exe File opened (read-only) \??\G: some_malicious_file.exe File opened (read-only) \??\O: some_malicious_file.exe File opened (read-only) \??\L: some_malicious_file.exe File opened (read-only) \??\M: some_malicious_file.exe File opened (read-only) \??\Q: some_malicious_file.exe File opened (read-only) \??\A: some_malicious_file.exe File opened (read-only) \??\I: some_malicious_file.exe File opened (read-only) \??\J: some_malicious_file.exe File opened (read-only) \??\K: some_malicious_file.exe File opened (read-only) \??\P: some_malicious_file.exe File opened (read-only) \??\U: some_malicious_file.exe File opened (read-only) \??\D: some_malicious_file.exe File opened (read-only) \??\E: some_malicious_file.exe File opened (read-only) \??\F: some_malicious_file.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
some_malicious_file.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\t12zvxxqhc8ug.bmp" some_malicious_file.exe -
Drops file in Program Files directory 31 IoCs
Processes:
some_malicious_file.exedescription ioc process File created \??\c:\program files (x86)\89avni-readme.txt some_malicious_file.exe File opened for modification \??\c:\program files\HideSplit.cr2 some_malicious_file.exe File opened for modification \??\c:\program files\SendReceive.html some_malicious_file.exe File opened for modification \??\c:\program files\StepSubmit.dwfx some_malicious_file.exe File opened for modification \??\c:\program files\UnblockExpand.jpeg some_malicious_file.exe File opened for modification \??\c:\program files\JoinConvert.ods some_malicious_file.exe File opened for modification \??\c:\program files\LockMove.7z some_malicious_file.exe File opened for modification \??\c:\program files\OutSet.vdw some_malicious_file.exe File opened for modification \??\c:\program files\PushRevoke.ppsm some_malicious_file.exe File opened for modification \??\c:\program files\SearchStep.M2V some_malicious_file.exe File opened for modification \??\c:\program files\CompleteRegister.vssm some_malicious_file.exe File opened for modification \??\c:\program files\RestoreFind.png some_malicious_file.exe File opened for modification \??\c:\program files\SyncMount.tif some_malicious_file.exe File opened for modification \??\c:\program files\GetCompress.emz some_malicious_file.exe File opened for modification \??\c:\program files\ReadDisable.ods some_malicious_file.exe File opened for modification \??\c:\program files\ResetDebug.mpp some_malicious_file.exe File opened for modification \??\c:\program files\ResumeClear.au some_malicious_file.exe File created \??\c:\program files\89avni-readme.txt some_malicious_file.exe File created \??\c:\program files\d60dff40.lock some_malicious_file.exe File opened for modification \??\c:\program files\CopyUpdate.vst some_malicious_file.exe File opened for modification \??\c:\program files\ExitLimit.tiff some_malicious_file.exe File opened for modification \??\c:\program files\SendPublish.ADT some_malicious_file.exe File opened for modification \??\c:\program files\DebugLimit.cr2 some_malicious_file.exe File opened for modification \??\c:\program files\FindPublish.odt some_malicious_file.exe File opened for modification \??\c:\program files\ProtectPing.contact some_malicious_file.exe File opened for modification \??\c:\program files\UninstallRegister.rm some_malicious_file.exe File opened for modification \??\c:\program files\ExpandStep.i64 some_malicious_file.exe File created \??\c:\program files (x86)\d60dff40.lock some_malicious_file.exe File opened for modification \??\c:\program files\RestoreExit.tmp some_malicious_file.exe File opened for modification \??\c:\program files\SearchExport.pptm some_malicious_file.exe File opened for modification \??\c:\program files\UnlockResume.mp4v some_malicious_file.exe -
Drops file in Windows directory 64 IoCs
Processes:
some_malicious_file.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ndis-minwin_31bf3856ad364e35_10.0.19041.1151_none_ce259344dd35ac79_ndistrace.mof_39e216d3 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.19041.1_en-us_25d6f2766f7cf9c2_storsvc.dll.mui_2fc7b1d3 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.906_none_25e4da38255df869_sspicli.dll_bcec1809 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1023_uk-ua_00edb9ea93827738_comctl32.dll.mui_0da4e682 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_lv-lv_ab9bc1d129a747ed_bootmgfw.efi.mui_a6e78cfa some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_zh-tw_88c9261aa201eecd_msimsg.dll.mui_72e8994f some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..ndactivitymoderator_31bf3856ad364e35_10.0.19041.1_none_959a3e1eebb4b6e0_bamsettingsclient.dll_db7ec840 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.19041.746_none_c33b9b0d5e48a5d2.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_pl-pl_6c22b0c49894068b_memtest.efi.mui_71e15c22 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_hu-hu_0f39d18194c80f6e.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f_sppmig.dll_22b5b188 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_sk-sk_4980bfc1af538369.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_en-us_950d46109b6707a2_wmiutils.dll.mui_42583eaf some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d2d_31bf3856ad364e35_10.0.19041.546_none_85962dc4bac043a9_d2d1.dll_ef77984b some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_ru-ru_6e67960b0e7433f2_msimsg.dll.mui_72e8994f some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-f..uetype-malgungothic_31bf3856ad364e35_10.0.19041.1_none_bb40ebfb65874170_malgun.ttf_166813d8 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.19041.1_none_3500efd1cdfd0fad_vgafixr.fon_de339586 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shacct_31bf3856ad364e35_10.0.19041.1_none_7bf3412dc0d2d29d.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.19041.1266_none_e0eefe63c72d43e8_apps.inf_0b7d7d89 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-n..orkconnectionbroker_31bf3856ad364e35_10.0.19041.1_none_1cf5080798a0163f.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-oleacc_31bf3856ad364e35_10.0.19041.746_none_52d2b2ecb593c243_oleacc.dll_2f3fa5bf some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671_winload.efi_75834aa0 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_10.0.19041.1266_none_153dc4c3b9f13a6f_driver.stl_8a4e6441 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_lt-lt_ef598ca8aecfa1ed_bootmgr.exe.mui_c434701f some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.19041.1_none_9064b8c1b47576c0_iscsidsc.dll_20ed5065 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.19041.1_en-us_313221c95b98e24b_rtm.dll.mui_55e4e990 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a_setupapi.mof_8d9de59f some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-pshed_31bf3856ad364e35_10.0.19041.1_none_1c389b2600d2d78a_pshed.dll_f6ac239e some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.19041.1_none_3947da6a963cb0d8_vgasyst.fon_aefdfa30 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.19041.1_none_ca60666860ba12d7_cga80866.fon_2e78de72 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.1_ru-ru_463415464f22eb1e.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-xmllite_31bf3856ad364e35_10.0.19041.1_none_49813668770cd6ad.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_ko-kr_0703274c38013b60_bootmgr.efi.mui_be5d0075 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.19041.1_none_3500efd1cdfd0fad_s8514fix.fon_2d5cdf27 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tm_31bf3856ad364e35_10.0.19041.1_none_030656e323303a3e.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base_31bf3856ad364e35_10.0.19041.1288_none_8d0a87531015fc57_wintypes.dll_96e015b1 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..ndowmanager-effects_31bf3856ad364e35_10.0.19041.546_none_d951a72ad1ee4c8e.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-userpowermanagement_31bf3856ad364e35_10.0.19041.546_none_8b678fb390086be3_powrprof.dll_480be757 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1023_pt-br_d880c157d21b4698.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_hu-hu_1ebc558b5fa34c0d_bootmgfw.efi.mui_a6e78cfa some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_4cf57b53b9d3b259.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_10.0.19041.450_none_107cae8412302d3e.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..ndowmanager-effects_31bf3856ad364e35_10.0.19041.1_none_b1496dae127c8892.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57_svchost.exe_4dd0f0bc some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-xmllite_31bf3856ad364e35_10.0.19041.546_none_71896fe5367e9aa9_xmllite.dll_ce078c31 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.19041.1_none_3500efd1cdfd0fad_h8514fix.fon_9a1c84fa some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ui-xaml-controls_31bf3856ad364e35_10.0.19041.1_none_cbcdaccb7d841431.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-transactionmanagerapi_31bf3856ad364e35_10.0.19041.1_none_171d07e1a7b66413.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_sv-se_8e0ddc60c5dec4a0_comctl32.dll.mui_0da4e682 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-userenv_31bf3856ad364e35_10.0.19041.572_none_6e154087aa2e1290.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_sr-..-rs_043fd09a5a699039_comctl32.dll.mui_0da4e682 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.84_none_ae156ee654cf8c31.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ncrypt-dll_31bf3856ad364e35_10.0.19041.1_none_1e240d67c55a5719.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-shell32_31bf3856ad364e35_10.0.19041.1266_none_eb43a8b5fb8e05e3.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_uk-ua_e877902ae1363f99.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_10.0.19041.1_none_a47da0f08ec32f0a.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tdi-driver_31bf3856ad364e35_10.0.19041.1_none_1cdf560fd553ffa5_tdi.sys_d1537112 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-spp.resources_31bf3856ad364e35_10.0.19041.1_en-us_52b90495d63821ca_sppsvc.exe.mui_40875a72 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rdbss_31bf3856ad364e35_10.0.19041.1237_none_ce9793ac169d9359.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.19041.1_en-us_fe43af9ffedb8283_user32.dll.mui_14652dbb some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft.windows.gdiplus.systemcopy_31bf3856ad364e35_10.0.19041.1288_none_65f6e760df9e0212.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.1_he-il_e3b57816d785f86c.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.19041.546_none_cbaf9205cfe557da.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7_msmpcom.dll_34ead564 some_malicious_file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
some_malicious_file.exepid process 4980 some_malicious_file.exe 4980 some_malicious_file.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
some_malicious_file.exedescription pid process target process PID 4980 wrote to memory of 4940 4980 some_malicious_file.exe cmd.exe PID 4980 wrote to memory of 4940 4980 some_malicious_file.exe cmd.exe PID 4980 wrote to memory of 4940 4980 some_malicious_file.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\some_malicious_file.exe"C:\Users\Admin\AppData\Local\Temp\some_malicious_file.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Recovery\89avni-readme.txtFilesize
6KB
MD5e5e2829f755cd0df64c5c04764d061b0
SHA1b5ae627033beb2b89e035c1ed9affb816473e6e3
SHA256cbe12054a715cc4580c444e02ff9237393224716abf7fd7d88e615100b1dc7ad
SHA5128916231dba1ff3d0f039fc232c0f350b9f9cbd7f5b30e9fee8dc570d98946c51d5a62b7489775e0ec53ddbdabcf0230a3f5064e0228a3045f06ae9681ff390e8