When does Content Analysis System (CAS) send a file to the sandbox?