Comment by chinathrow
3 years ago
> Windows Defender anti-virus checking the binary and contacting MS' server for binary signing/black list
Are you sure this happens every time you start an executable? I assumed the definition list gets updated in fixed intervals instead of whenever you launch a program.
i would assume that the information "when does user start program" is valuable and the list is finite, so there is some incentive to go for something in between.