Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group
Read the full analysis on IntelFusions