VSSAdmin
Named by 2 kept items in this workspace.
Search every workspace for VSSAdmin. It matches the name as written, so it can find other things that share it.
The items that name it 2
Windows built-in utility used to create or delete shadow copies; commonly abused by attackers and monitored by Huntress detections
Windows utility abused by the ransomware to delete shadow copies (delete shadows /all /quiet)
All technologies in this workspace.