Shadow Copies creation using operating systems utilities, possible credential access
Read the full analysis on IntelFusions