even if has a certificate in the file, unknown files run to sandbox.
COMODO Help Document
The shield icons at the upper left of each alert are color coded according to the risk level presented by the activity or request.
However, it cannot be stressed enough that you should still read the information in order to reach an informed decision on allowing or blocking the activity.
Yellow Icons - Low Severity - In most cases, you can safely approve these requests. The ‘Remember my answer’ option is automatically pre-selected for safe requests
Orange Icons - Medium Severity - Carefully read the information in the alert description area before making a decision.
These alerts could be the result of a harmless process or activity by a trusted program or an indication of an attack by malware. If you know the application to be safe, then it is usually okay to allow the request. If you do not recognize the application performing the activity or connection request then you should block it.
Red Icons - High Severity - These alerts indicate highly suspicious behavior that is consistent with the activity of a Trojan horse, virus or other malware program. Carefully read the information provided when deciding whether to allow it to proceed.