From GTIG/Mandiant's triage table: look for any executable, especially upgrade-now.exe, under AOMEI's html\ or Tmphtml\ directories (that folder only holds rendering assets). Check for scheduled tasks \RadminComponentRuntime or \NitroRuntime, processes launched with --runtimechk or --nitrod, and files under %LOCALAPPDATA%\Radmin\ (BlkScrDl.dll, csvc\RuntimeComponent.dll, config.zip, metadata.dat). Signed FamItrfc.exe is genuine Famatech software being abused to load an unsigned DLL, so don't clear it on signature alone. Also watch for Eztwain4.dll beside Nitro-named executables in %LOCALAPPDATA%\Nitro Pro\ launched by hidden-window PowerShell, and for unsigned children of Backupper.exe or ABNotify.exe. Query sketch (KQL): DeviceProcessEvents | where InitiatingProcessFileName in~ ('Backupper.exe','ABNotify.exe') or ProcessCommandLine has_any ('--runtimechk','--nitrod'). Sweep the whole April–July 2026 range; hashes and YARA rules are in the GTIG post.