CROSSROADCROSSROAD

64-bit Windows downloader written in C, reported by Google Threat Intelligence Group and Mandiant as the first stage of UNC7017's ephemeral supply chain compromise of AOMEI Backupper. Delivered through tampered AOMEI update and promotion configuration files, it checks that it runs from an AOMEI path, aborts its main path when the external IP geolocates to China, resets down_html.ini to legitimate values, downloads and unpacks an archive of trojanized Radmin components into %LOCALAPPDATA%\Radmin\, persists through the RadminComponentRuntime scheduled task and deletes itself. It stages the SHINYROAD backdoor.