(ScriptBlockText:Get\-WmiObject* OR ScriptBlockText:gwmi* OR ScriptBlockText:Get\-CimInstance* OR ScriptBlockText:gcim*) ScriptBlockText:Win32_ShadowCopy* (ScriptBlockText:.Delete\(\)* OR ScriptBlockText:Remove\-WmiObject* OR ScriptBlockText:rwmi* OR ScriptBlockText:Remove\-CimInstance* OR ScriptBlockText:rcim*)