VShadow is a command-line tool that can be used to create and manage volume shadow copies.
vshadow.exe -nw -exec=c:\windows\system32\calc.exe C:
Executes calc.exe from vshadow.exe.
Performs execution of specified executable file.
C:\Program Files (x86)\Windows Kits\10\bin\10.0.XXXXX.0\x64\vshadow.exe
IOC: vshadow.exe usage with -exec parameter
Ayberk Halaç