During my Windows research/RE work over the years. I have seen telemetry code located in DLL's (never took much notice of it), but they could easily be removed from the system and I presume the programs would continue to execute fine.
I've seen it in kernel code too - the drivers/func names etc are all quite obvious typically with the word "telemetry" in it, functions calls to other locations, but again not took much notice.
|