As mentioned above, we believe the reason the code reaches out to the symbol server is to find the locations of three undocumented Kerberosrelated functions: KdcVerifyEncryptedTimeStamp, KerbHashPasswordEx3 and KerbFreeKey. The sample is primarily looking for these