I had an interview last year with the Windows and Devices Group. On the day of the interview, I was told it would be with people that work on telemetry.

One interviewer told me that keystrokes were being measured by conhost.exe. Not just for internal testing. He clarified that it was done on customer machines. It wasn't clear if they collected individual key presses because we were discussing something you could infer by knowing keystroke timing.

Windows 10 is the most prolific malware in the world.