regex101: PCRE2 (PHP) Match Workspace

Regular Expression

\"md5\":\"(?<md5>[^\"]+)

New

payload={"config_id":5,"config_rev_id":12,"finding":{"system_info":{"bits":64,"build_number":"18363","os":"Microsoft Windows 10 Enterprise","patch_level":"10.0.28263.0.0","platform":"Windows"}},"intel_id":211,"match":{"contexts":[{"event":{},"process":{"uniqueEventId":"72057594038813812","uniqueProcessId":"-7276340288713644715"}},{"event":{},"process":{"uniqueEventId":"72057594038813812","uniqueProcessId":"-7276340288713644715"}}],"hash":1618797647,"properties":{"args":"\"C:\\WINDOWS\\System32\\Wbem\\WMIC.exe\" logicaldisk where \"DeviceID ='C:'\" get FreeSpace,Size \/format:value","cwd":null,"file":{"fullpath":"C:\\Windows\\SysWOW64\\wbem\\WMIC.exe","md5":"f86f3ca37e51f8a6bd352c3s0471ed1e","sha1":null,"sha256":null,"size":null},"name":"C:\\Windows\\SysWOW64\\wbem\\WMIC.exe","parent":{"args":"powershell \"wmic logicaldisk where \\\"DeviceID ='C:'\\\" get FreeSpace,Size \/format:value\"","cwd":null,"file":{"fullpath":"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","md5":"bsc9a6493e0641aa1e60cbf69469e579","sha1":null,"sha256":null,"size":null},"name":"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent":{"args":"cmd.exe \/c powershell \"wmic logicaldisk where \\\"DeviceID ='C:'\\\" get FreeSpace,Size \/format:value\"","cwd":null,"file":{"fullpath":"C:\\Windows\\SysWOW64\\cmd.exe","md5":"e567b7s81b21cc8905383be1073f3707","sha1":null,"sha256":null,"size":null},"name":"C:\\Windows\\SysWOW64\\cmd.exe","parent":{"args":"\"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo-21.7.1\\Zalo.exe\" --type=renderer --field-trial-handle=1816,9090744369272948930,11485880633837695528,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-user-model-id=com.vng.zalo --app-path=\"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo-21.7.1\\resources\\app.asar\" --node-integration --node-integration-in-worker --no-sandbox --no-zygote --preload=\"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo-21.7.1\\resources\\app.asar\\main-dist\\sentry.js\" --background-color=#3a3c3d --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=3358922927904202841 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2552 \/prefetch:1","cwd":null,"file":{"fullpath":"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo-21.7.1\\Zalo.exe","md5":null,"sha1":null,"sha256":null,"size":null},"name":"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo-21.7.1\\Zalo.exe","parent":{"args":"\"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo-21.7.1\\Zalo.exe\" ","cwd":null,"file":{"fullpath":"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo-21.7.1\\Zalo.exe","md5":null,"sha1":null,"sha256":null,"size":null},"name":"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo-21.7.1\\Zalo.exe","parent":{"args":"\"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo.exe\" ","cwd":null,"file":{"fullpath":"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo.exe","md5":"78092e1a928s36298b0695c73ef881cc","sha1":null,"sha256":null,"size":null},"name":"C:\\Users\\221821\\AppData\\Local\\Programs\\Zalo\\Zalo.exe","parent":{"args":"C:\\WINDOWS\\Explorer.EXE","cwd":null,"file":{"fullpath":"C:\\Windows\\explorer.exe","md5":"e74ef817a106132ad540e0065413a4bc","sha1":null,"sha256":null,"size":null},"name":"C:\\Windows\\explorer.exe","parent":{"args":"C:\\WINDOWS\\system32\\userinit.exe","cwd":null,"file":{"fullpath":"C:\\Windows\\System32\\userinit.exe","md5":"b78269wf1034474766cb1351e94edf5c","sha1":null,"sha256":null,"size":null},"name":"C:\\Windows\\System32\\userinit.exe","parent":{"args":"C:\\WINDOWS\\System32\\WinLogon.exe -SpecialSession","cwd":null,"file":{"fullpath":"C:\\Windows\\System32\\winlogon.exe","md5":"b20f17501510885d63cebb6baf9e7a46","sha1":null,"sha256":null,"size":null},"name":"C:\\Windows\\System32\\winlogon.exe","parent":{"args":"\\SystemRoot\\System32\\smss.exe 000000e0 00000084 C:\\WINDOWS\\System32\\WinLogon.exe -SpecialSession","cwd":null,"file":{"fullpath":"C:\\Windows\\System32\\smss.exe","md5":"158e3da84c5389952e1ad3701e410f61","sha1":null,"sha256":null,"size":null},"name":"C:\\Windows\\System32\\smss.exe","parent":{"args":"\\SystemRoot\\System32\\smss.exe","cwd":null,"file":{"fullpath":"C:\\Windows\\System32\\smss.exe","md5":null,"sha1":null,"sha256":null,"size":null},"name":"C:\\Windows\\System32\\smss.exe","parent":{"args":"","cwd":null,"file":{"fullpath":"System","md5":null,"sha1":null,"sha256":null,"size":null},"name":"System","parent":{"pid":null},"pid":4,"ppid":null,"recorder_table_id":null,"recorder_unique_id":"9022848223309401751","start_time":"2021-08-26T00:12:02Z","user":"NT AUTHORITY\\SYSTEM"},"pid":648,"ppid":4,"recorder_table_id":null,"recorder_unique_id":"5691013720063984431","start_time":"2021-08-26T00:12:08Z","user":"NT AUTHORITY\\SYSTEM"},"pid":11272,"ppid":648,"recorder_table_id":null,"recorder_unique_id":"-9198000789618718523","start_time":"2021-08-26T15:09:31Z","user":"NT AUTHORITY\\SYSTEM"},"pid":6652,"ppid":11272,"recorder_table_id":null,"recorder_unique_id":"-7199939378760224446","start_time":"2021-08-26T15:09:31Z","user":"NT AUTHORITY\\SYSTEM"},"pid":12560,"ppid":6652,"recorder_table_id":null,"recorder_unique_id":"753814789616749753","start_time":"2021-08-27T01:07:20Z","user":"Asdf\\221821"},"pid":18232,"ppid":12560,"recorder_table_id":null,"recorder_unique_id":"6248017163843437190","start_time":"2021-08-27T01:07:20Z","user":"Asdf\\221821"},"pid":17684,"ppid":18232,"recorder_table_id":null,"recorder_unique_id":"5494547120671931282","start_time":"2021-08-27T01:51:39Z","user":"Asdf\\221821"},"pid":8724,"ppid":17684,"recorder_table_id":null,"recorder_unique_id":"9026706683504973259","start_time":"2021-08-27T01:51:39Z","user":"Asdf\\221821"},"pid":12768,"ppid":8724,"recorder_table_id":null,"recorder_unique_id":"-2973356577824383864","start_time":"2021-08-27T01:51:41Z","user":"Asdf\\221821"},"pid":19684,"ppid":12768,"recorder_table_id":null,"recorder_unique_id":"-3807613313135206967","start_time":"2021-08-27T11:01:46Z","user":"Asdf\\221821"},"pid":12900,"ppid":19684,"recorder_table_id":null,"recorder_unique_id":"3791246327222705463","start_time":"2021-08-27T11:01:46Z","user":"Asdf\\221821"},"pid":20340,"ppid":12900,"recorder_table_id":null,"recorder_unique_id":"-7276340288713644715","start_time":"2021-08-27T11:01:47Z","user":"Asdf\\221821"},"source":"signals","type":"process","version":1},"service_id":"b909f782-b0ed-4979-aa9e-ee6fbe4ba5b2"}