Probably Windows constantly pings the MS server and they record those tuples.