what happened here?

i started up winamp which is a trusted app and it was sandboxed. so i clicked dont isolate again and restarted it.

i checked online to see if maybe it updated and it didnt. then i looked at my defense + logs and found it was sandboxed then like 20 seconds later it was scanned online and found safe

any ideas why this happened?

[attachment deleted by admin]

I think the cloud server responded too late and then CIS sandboxed it.