Its simple. He showed Cruelsister settings. He launched some malware to confirm its working as intended. Then he cleaned sandbox. As he launched the final malware (the one he was trying to show), comodo did not contain it for whatever reason and everything got infected. Bam. Also, Restricted is the 2nd lowest elevation allowed. Unrestricted is the lowest, with literally nothing allowed, but then almost nothing works, so I think Restricted is fine for sandboxing.