Sysinternals suite
Named by 2 kept items in this workspace.
Search every workspace for Sysinternals suite. It matches the name as written, so it can find other things that share it.
The items that name it 2
Legitimate admin/forensic tools often abused; multiple rules updated with ARM64 (*64a.exe) variant coverage
All technologies in this workspace.