In the last few years I've noticed that a growing number of Windows application installers attempt to make outbound connections on port 80 immediately upon running the installer. My firewall alerts me even before the Unknown Pulisher Run/Cancel prompt appears. I always deny these connections, which never seems to inhibit the installation in any way. Here are some examples host destinations that I've seen: www.download.windowsupdate.com, go.microsoft.com, cds34.iad9.msecn.net, csc3, crl.thawte.com, crl.usertrust.com, crl.comodoca.com.
Of course each installer program is different, but this is a highly consistent behavior. Is there any way to know the nature or purpose of these connections?