[pdkl95]

> more likely

My point is that guessing without actual data isn't evidence. It's easy to speculate and guess at what we think is going on, but it's a bad idea to assume any particular speculation is right in the best situations. It's foolish when the subject of the investigation's core business model is based on sending different things to specifically targeted groups.

> just turn on these features

Perhaps. There are many ways a feature like this could be implemented. See the various obfuscated code contests for extreme examples of how functionality can be hidden in a program. This just means network logs from different clients are also needed, in addition to hashes of binaries.