[New WTFBin]: WTFBIN Here

[mthrfcknruckus]

• Contributor Name: Michael Weber "mthrfcknruckus" @mjweber915
• Application/Executable: spaceman.exe
• WTF Behavior Description: The file is associated with EaseUS Partition Manager or Hard Drive Tools 2003 by TradeTouch.com. Aside from the odd name of the binary, other WTF behaviors include installing to system32 and creating scheduled tasks. These stand out when triaging in PowerShell using Get-ScheduledTask | Select -Property Author.
• Link to Documentation of Behavior: https://answers.microsoft.com/en-us/windows/forum/all/windows-10-spacemanexe/c60c4d6b-0bca-49e3-8054-68213efbd67a
• Please provide any images for additional evidence. https://github.com/mthrfcknruckus/spaceman.exe/blob/main/2022-10-07%2015_36_49-Administrator_%20Windows%20PowerShell.png

[mttaggart]

The image link appears broken. Could we get another one please, especially one that includes the scheduled tasks?

[mthrfcknruckus]

sorry for the confusion, see below for results of commands schtasks /query /v /fo LIST | findstr /c:"spaceman.exe" | findstr /v /c:"Task To Run" and Get-ScheduledTask | Select -Property Author (spaceman.exe task is highlighted):

[mttaggart]

Added in 4cd8129f950d65bcc752bca156dc54402ddca503