D+ alerts for sandboxed apps?

I’ve noticed that with some applications that are automatically sandboxed I’ll sometimes get a D+ alert along with the sandbox alert - the D+ alert being in front. I was wondering what was the point of this? Is the alert for the app trying to do something inside the sandbox or outside? If outside, shouldn’t it have already been protected by the sandbox? And if inside, why would I get this as it shouldn’t matter?

Just looking for a little clarification. Thanks.

Sandboxed apps might trigger alerts for some actions like Hooking.

Allowing such actions will seemingly have the same security considerations described in such alerts.

eg Allowing Anti-Keylogger Tester (AKLT) directX hooks mean the app will be able to capture keyboard inputs while aklt.exe is running.

[attachment deleted by admin]

shouldnt there be no D+ alerts when a sandboxed app is being asked to be placed in the sandbox?

i would have no D+ alerts, then have only have a sandbox popup, then if the user says dont sandbox then start the D+ alerts needed.