Described by Elastic as being associated with win.jupyter, and being used in the context of initial access, persistence, and C&C capabilities.