Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Read the full analysis on IntelFusions