Zero-byte desktop.ini created in C:\ProgramData (implant crash artifact)

Ethan Andrews@eandrews

•updated Aug 17, 2026•10•1•6

Detects the creation of a zero-byte desktop.ini file within the C:\ProgramData directory. This pattern is indicative of a specific malware implant crash artifact, where the process attempts to create a configuration file using an OPEN_ALWAYS handle before experiencing a null pointer dereference.