They asked it for a detection against exfiltration attempts. Sending a test file out to the Internet sure looks like testing an exfiltration detection.

They claim that it read the DNS records and what was in tmp first. Again, all things that would be very reasonable to do when designing building and testing an exfiltration detection system out of tmp. It did not try and send the contents of the computer to Beijing.

This claim is absolutely overcooked.