Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
Read the full analysis on IntelFusions