restic
Named by 2 kept items in this workspace.
Search every workspace for restic. It matches the name as written, so it can find other things that share it.
The items that name it 2
Backup utility cited as previously observed used for data exfiltration
Backup utility observed used for data exfiltration; renamed to winupdate.exe in incidents described
All technologies in this workspace.