JFMBackdoor Timestomping via fltMC.exe Loaded from Temp Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects the JFMBackdoor utility masquerading as fltMC.exe by executing from a non-standard location (typically %TEMP%) and performing timestomping operations via SetFileTime. This technique is used to manipulate MACE timestamps as an anti-forensic measure.