Smoke Loader not only installs its original sample but also replaces it with a fresh version, which is downloaded from the C&amp;C – path: http://&lt;CnC address&gt;/system32.exe. This trick makes detection more difficult – updated samples are repacked by a different crypter, may also have their set of C&amp;Cs changed