Something strange

A. THE BUG/ISSUE (Varies from issue to issue)
Can you reproduce the problem & if so how reliably?:
If you can, exact steps to reproduce. If not, exactly what you did & what happened:
1: Started a browser, in Secure shopping or “alone”. No problem when browser in Container.

One or two sentences explaining what actually happened:
Not shure, what is this… Host process for windows services downloads about 3 megabytes from I have captured some traffic with Wireshark (the 3 MB.pcapng).
One or two sentences explaining what you expected to happen:
Not expected to happen this.
If a software compatibility problem have you tried the advice to make programs work with CIS?:
Any software except CIS/OS involved? If so - name, & exact version:
NetLimiter, Wireshark Portable 2.4.2.
Any other information, eg your guess at the cause, how you tried to fix it etc:
MITM attack?

Exact CIS version & configuration: CIS, Internet Security.

Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
HIPS: Safe mode, Auto-Containment: Enabled, VirusScope:Enabled, Website Filtering:Enabled, Antivirus:Stateful, Firewall:Safe mode.
Have you made any other changes to the default config? (egs here.):

Have you updated (without uninstall) from CIS 5, 6 or 7?:
if so, have you tried a clean reinstall - if not please do?:
Have you imported a config from a previous version of CIS:
if so, have you tried a standard config - if not please do:
OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
Windows 8.1, 32bit, Administrator, no v.machine.
Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
a=Secure Shopping 1.1.421657.99, COMODO Internet Security Essentials 1.2.424651.94

It downloads a certificate revocation list.

It is necessary to download CRL every time I go to
It did not happen to another security software.