I did actually use tcpflow to see if there was traffic after the file gets executed, and indeed there is. Unfortunately, it's encrypted so I can't see what's being sent.
I think I quite clearly state that I have no idea (nor intend to presume) whether this is how they're using the information. I'm merely stating it's a possibility.