20

I am aware of that… in theory. But doesn’t the deep screen sandbox go so far to track child process spawns as well? In that understanding I’d expect the deep screen to follow both processes at least to moment the process is actually showing the first dialogue which is to ask for admin privileges. That’s why my theory would be that the sandbox of the deep screen crashes the self extractor before it can fully spawn the child process (the error message would even suggest that it exactly fails at the moment to try to spawn it). Because the previous deep screening was not able to scan that child process it obviously recognizes it as “unscanned” and does what it was programmed to.