Cloudflared
Named by 2 kept items in this workspace.
Search every workspace for Cloudflared. It matches the name as written, so it can find other things that share it.
The items that name it 2
Alternative reverse tunnel mechanism found commented out in the shipped script, paired with netsh port-proxy to a Linode IP
Used by attackers for persistence after compromising the SonicWall appliance in the Akira example
All technologies in this workspace.