JFMBackdoor Screen Capture: gdiplus.dll Screenshot Saved to ProgramData\Windows Multimedia

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the creation or modification of files within the 'C:\ProgramData\Windows Multimedia' directory, a path associated with JFMBackdoor's screen capture output. The rule specifically monitors for this activity when initiated by 'fltMC.exe', which is known to be used by this malware for DLL side-loading.