vssadmin delete shadows /all /quiet
to suppress volume restores. C2 beaconing observed to 194.26.29.42:443.
# Immediate Endpoint Containment: netsh advfirewall set allprofiles state on netsh advfirewall firewall add rule name="Block-C2" dir=out action=block remoteip=194.26.29.42 taskkill /F /IM "svchost_updater.exe"