conhost.exe --headless
Named by 2 kept items in this workspace.
Search every workspace for conhost.exe --headless. It matches the name as written, so it can find other things that share it.
The items that name it 2
Used by malware to launch deno.exe wrapping the implant out of sight
Used by the LNK file to invoke DavWWWRoot path and execute new.bat over WebDAV
All technologies in this workspace.