I run my Firefox sandboxed (in Sandboxie) with execution of most applications prohibited. When I download a .docx document, Firefox starts the Microsoft Word Viewer for it. But at the same time, Sandboxie prohibits SuRun from running.
Why is SuRun trying to run at this time? Firefox nor the Word Viewer runs under an elevated account.
Edit: This behaviour disappears when unchecking
Settings > Execution Hooks > "Set a Hook into all processes that directly execute applications"
But this does not answer the question.
Sorry for the delay.
If you enable SuRun's execution hooks, SuRun tries to detect every process creation and if it detects one, it passes the Parameters of the process to be started via Pipe to the SuRun service.
This is, why SandBoxie runs SuRun before it runs WordView.
SuRun intercepts the call, asks its own service if WordView ist one of the programs to run elevated and then terminates.