Red Lamassu JFMBackdoor Screen Capture Staging to C:\ProgramData\Windows Multimedia\ROG

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the creation of files in the 'C:\ProgramData\Windows Multimedia\' directory, specifically files named 'ROG', which is indicative of JFMBackdoor staging captured screenshots using GDI+ functions.