I'm guessing it's an antivirus/anti-malware operation.