SMOKE#SCREEN Loader: Hidden-Window .NET Loader from Temp/Downloads (AdobeReader_Update/Random-Named)

Duo Tech@duotech

•updated Aug 5, 2026•2•0•5

Detects execution of a hidden-window .NET loader process launched from Temp/Downloads/AppData Local Temp directories, matching known SMOKE#SCREEN loader binary names or randomly generated 8-character executable names, excluding legitimate Program Files/System32 paths.