RtkNGUI64.exe backdoor exits before desktop.ini read (mutex already held)
Detects the fake, undersized RtkNGUI64.exe exiting without reading C:\ProgramData\desktop.ini. Scoped by file size to the known 12,288-byte backdoor binary -- the legitimate, much larger signed Realtek Audio Console also never reads that file, so without this filter every normal launch of the real app would match.
Microsoft Sentinel (KQL)
