My application ran away and called home from Redmond
It's not just executables.  I once caught Microsoft Defender sending copies of sensitives files like places.sqlite out of my Firefox profile directory to Redmond.  Needless to say, I disabled that feature permanently via local policy.