Suspicious AOMEI ABNotify Child Process From Html Directory
Detects ABNotify.exe, running from the standard AOMEI Backupper installation path, spawning any executable located in the html\ rendering hierarchy. This directory is intended for rendering assets, not executables; a child process launched from here indicates a hijacked upgrade workflow triggered through the AOMEI notification agent with no user interaction.
Sigma
