[2rsf]

> Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default. They run the executable in an environment where network connectivity is available.

how did the author reach to this conclusion ? is it documented somewhere ?

[antsar]

He includes this screenshot[0], addressing the "send" part. The "run" part seems evident from the network traffic coming from MSFT.

[0] https://miro.medium.com/max/334/0*g_3L3SxR4IYoBAxD