Tonight, I found several unfamiliar .exe files on a hard drive connected to my personal computer. Their names matched system directories or existing folders, and each was displayed as 1432 KB. Recently, executable files of the same displayed size have also appeared on removable drives connected to school computers.
The investigation confirmed multiple copies of the same malicious program, with evidence of persistence, automatic startup, and copying to connected storage media. Public analysis reports also identified features associated with taking screenshots.
This incident deserves serious attention. Classroom computers and USB drives are used and exchanged frequently, allowing an infection to spread through everyday routines. Information displayed on an infected device may also concern the privacy of many people beyond its user. I am writing this report to draw attention to the incident and organize the evidence already found, so that others investigating it can avoid retracing the same steps. I do not want to create alarm where the evidence is incomplete. Thank you to everyone willing to read, check, and help.
1. Files with different names are copies of the same program
The sample is exactly 1,466,368 bytes, or 1432 KiB. Copies in the root directories of different volumes borrowed the names of existing folders. The program's internal product description is “Windows 资源管理器后台服务” (“Windows Explorer Background Service”). These names can make it look like a system component or an ordinary file.
When file extensions are hidden, a user may see “资料.exe” simply as “资料” (“Documents”) and open an executable believing it to be a folder. One straightforward check is the file's Type field: a genuine folder should be identified as a folder. Do not double-click something that looks like a folder but is listed as an Application.
2. The program persists on the computer; deleting drive copies is insufficient
One observed sequence was as follows: a USB drive was connected to a computer; without any human action, one of its .exe files executed; approximately five seconds later, a persistent copy appeared in the Startup folder.
Public sandbox analysis recorded corresponding behavior: copying itself to the Startup folder, modifying the registry, and executing from the new location. Full Joe Sandbox report
Deleting only the files on a USB drive may leave the source of propagation on the computer. If the persistent program and startup configuration remain, copies may be recreated, and the program may launch again after a restart or sign-in. Cleanup therefore needs to cover the computer's persistent copies, startup entries, and connected storage media together.
3. The risk of spread within a school is substantial
Teachers frequently use USB drives to transfer lesson materials between offices, classrooms, and personal computers. A single drive may connect to many computers, and a shared computer may receive drives from many teachers. This creates opportunities for an infection to spread across both devices and users.
If a shared computer hosts a persistent source of propagation, it may keep writing malicious copies to connected USB drives. A user who later mistakenly opens one of those programs on another computer may turn that device into a new source. Microsoft also identifies USB drives, external hard drives, and shared storage as routes by which malware can spread. Microsoft: How malware can infect your PC
An ordinary transfer of lesson materials may carry suspicious files into the next classroom. One uncleaned shared computer may contaminate drives that several teachers have already cleaned. If everyone treats only their own drive while the shared source remains in use, infections may recur and the investigation may continue to expand.
Similar observations at school should be investigated together. However, I have not obtained a broad collection of school samples, and identical file sizes alone cannot establish that all affected devices contain the same program. The available evidence also does not establish that a clean computer will necessarily become infected merely by inserting a USB drive without running any program on it. The propagation risk needs serious attention; the actual extent of infection still requires sample comparison and device inspection.
4. The potential privacy risks are substantial
An ANY.RUN report identified a screenshot-related feature: “There is functionality for taking screenshot (YARA)”. Full report
If the program actually takes screenshots, documents, chats, and verification codes displayed on screen could be recorded without copying the original files. In a school, that could include student lists, grades, parents' contact details, unpublished examination questions, and internal documents. The potential consequences extend beyond the computer's user.
The evidence is not conclusive, however. A YARA match is a clue about possible functionality, not proof that screenshots were taken or uploaded; a generic runtime library can also trigger a match. I have not obtained any screenshots, storage locations, recipients, or upload records. This finding cannot establish that information has already been stolen, much less that a large-scale leak has occurred.
5. Origin and purpose
There is plenty of room for imagination here.
The sample contains Simplified Chinese resources, the product description “Windows 资源管理器后台服务” (“Windows Explorer Background Service”), and a version comment stating “本程序使用易语言编写” (“This program was written in E-language”). These details support the conclusion that it came from a Chinese-language development environment, but they do not establish the author's nationality, identity, or organizational affiliation. The E-language website mentioned in the comment is a development-tool website, not a confirmed malware command-and-control address.
Public records show that this exact sample was first submitted to VirusTotal on June 5, 2024. MalwareBazaar, citing Kaspersky data, lists April 19, 2024 as the first-seen date. The sample itself carries a compilation timestamp of November 11, 2020, but compilation timestamps can be altered and cannot be treated as reliable creation dates. VirusTotal history, MalwareBazaar intelligence record
These records show that the sample has been known to security vendors for some time. They do not identify where or when it was first distributed. I have not established the author, the original distribution address, a credible revenue mechanism, or the ultimate intention. The evidence explains its persistence and propagation, but cannot identify advertising, information theft, or a prank as the author's purpose.
6. Recommended response
If you encounter similar files, stop opening suspicious programs, stop using the affected USB drives on other computers, and record the discovery time, filenames, sizes, and security alerts. Do not run the sample to “verify” it, or circulate it as an attachment.
The school should coordinate checks of relevant computers and USB drives, clean persistent copies, startup entries, and copies on storage media together, and check whether they reappear. Formatting a USB drive alone does not remove a propagation source on a computer. Confirm file identities and back up legitimate material before deleting anything. Update security software, scan according to official guidance, and use an offline scan when necessary. Do not add exclusions or disable protection. Microsoft: Antivirus and antimalware software FAQ
The fact that computers and lesson materials still work normally does not make this incident safe to ignore.
Reference details for investigators and administrators
- File size: 1,466,368 bytes (1432 KiB). Matching sizes alone do not confirm identity.
- SHA-256:
2e6346ce1adf15bffca31a0c96274f615e3e0bbf53235e4b4c85555bc012b9d9 - MD5:
101b0eb2e4e9a66491ed3f9411683452 - Filename clues:
Windows 资源管理后台线程.exe(“Windows Explorer Background Thread”),System Volume Information.exe, and .exe files named after real folders. Names can change. - Startup clues: the user's Startup folder and the
systemandsysteminvalues underHKCU\Software\Microsoft\Windows\CurrentVersion\Run. Check the target files and hashes; do not delete entries solely because their names match.
Sources: records from my own device investigation, the ANY.RUN report, and existing public sandbox and threat-intelligence records. I did not run the sample myself as an experiment during this investigation.