Cache.dll connectback urls: 209.200.83.43/ajax/links.php 209.200.83.43/ajax/api.php 209.200.83.43/ajax/index.php 209.200.83.43/ajax/error.php 209.200.83.43/ajax/profile.php 209.200.83.43/ajax/online.php 209.200.83.43/ajax/loader.php 209.200.83.43/ajax/search.php Observed user-agent string on the wire, but it’s dynamically generated based on the Windows system settings (retrieved using standard win32 api “ObtainUserAgentString”): “User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)” Communications with the CozyDuke C2 include key/value pairs passed as URL parameters