REVSTEALER ProManager module execution (wallet theft/phishing overlay)
Detects the execution of processes named 'ProManager.exe' or 'ProManagerServicedc894.exe', which may be indicative of unauthorized software or potentially malicious activity.
Microsoft Sentinel (KQL)

