When reviewing the results of a Deep Analysis for a suspicious file, is it possible that any "parallel" processes (processes not initiated or accessed by the suspicious file) could be included in the results as false-positives? We have an executable file that was alerted on and then marked as No Threat by the Automated Investigation. When we perform and review a Deep Analysis, we see communication via a skype process (which should in no way be part of this file's legitimate activity). Submitted the file to 3rd party sandbox analysis and the file reports as mostly benign. We're awaiting response from an Experts on Demand application, but in the meantime would like to seek a better understanding of the deep analysis / false positive potential. (Just for added drama; the file is a non-Orion Solarwinds RMM file, so our curiosity is peaked)
