examples:

• description: "Execute EaseUS spaceman.exe and observe the unusual behavior" command: "EaseUS spaceman.exe"

EaseUS spaceman.exe

EaseUS and bizarre Scheduled Tasks.

The file is associated with EaseUS Partition Manager or Hard Drive Tools 2003 by TradeTouch.com. Aside from the odd name of the binary, other WTF behaviors include installing to system32 and creating scheduled tasks. These stand out when triaging in PowerShell using Get-ScheduledTask | Select -Property Author

Contributed by Michael Weber "mthrfcknruckus" (@mjweber915)