This query identifies use of wmic.exe to delete shadow copy snapshots prior to encryption.
Already have an account? Log in
