logos is correct.

“…but I’m pretty sure that CIS def+ sends an alert when Avast auto-sandbox does (an alert about the auto-sandbox alert, not its content). It’s a process, period.”

When I implemented Avast AutoSandbox tool test, I got 1/2 a dozen alerts from Comodo saying that Avastsvc.exe wanted to change some files and registry keys, as matter of fact the alerts came out before Avast itself telling me that the tool must be run in the sandbox ( I have it set to ask ).