Node.js execution followed by network activity

sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
 (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
 process.parent.name : ("wscript.exe", "powershell.exe") and
 (process.name : "node.exe" or process.pe.original_file_name == "node.exe" or process.code_signature.subject_name == "OpenJS Foundation") and
 not process.args : ("install", "--prefer-offline", "run-driver") and not process.parent.name : "node.exe" and
 not process.executable :
            ("?:\\Program Files\\*.exe",
             "?:\\Program Files (x86)\\*.exe",
             "?:\\Windows\\Prey\\versions\\*\\bin\\node.exe") and
 not (process.code_signature.subject_name in ("Western Union Holdings Inc.", "Autodesk, Inc.", "Tobii AB") and process.code_signature.trusted == true) and
 not process.hash.sha256 in ("767c9498a55e9a093c75761c69996360b73b19a0d43b68f92a8eaccc6079f666", "80eafa18b85001b1773471414150c96ad52e0dd6985a4c25d7d5083fb04ae4fd")]
[dns where event.action == "lookup_requested" and
 not dns.question.name in ("nodejs.org", "localhost", "fonts.googleapis.com", "www.google-analytics.com", "api2.cursor.sh", "registry.npmjs.org", "api.anthropic.com", "versions-prod.lmstudio.ai") and
 not (process.executable : "D:\\Azure-BuildAgent*\\node.exe" and dns.question.name : "proxy4zscaler.*.ch")]