I did actually use tcpflow to see if there was traffic after the file gets executed, and indeed there is. Unfortunately, it's encrypted so I can't see what's being sent.