Why is this happening?
[attachment deleted by admin]
When you sandbox something cmdvirth.exe will be sandboxed as well, it is normal behavior, same with svchost.exe.