Aye as it was a process that tended to indicate a malware definition file being accessed, especially as there was no physical location for the file