bcdedit
Named by 3 kept items in this workspace.
Search every workspace for bcdedit. It matches the name as written, so it can find other things that share it.
The items that name it 3
Windows boot configuration utility abused to disable recovery (recoveryenabled no, bootstatuspolicy ignoreallfailures)
Windows command-line tool used to enable kernel debugging and configure network debug settings (bcdedit /debug on, bcdedit /dbgsettings)
Used by the threat actor to disable Windows recovery (recoveryenabled no) as part of ransomware deployment.
All technologies in this workspace.