I was under impression that file versioning is disabled since Windows 10, MS prefers OneDrive's file versioning instead. Besides yes, malware generally performs commands like:
Code:
vssadmin delete shadows /for=c: /all /quiet
Learn how CrowdStrike uses improved behavior-based detections to prevent the LockBit ransomware family from tampering with Volume Shadow Copies.
www.crowdstrike.com