On Windows 10 it is probably a background scheduled task (image courtesy of another AppGuard user). As you can see, the parent is svchost.exe:
View attachment 189604
If you give it enough time, it will eventually run on your real system. For whatever reason(s), it could be - as you suspect - being triggered to run in Shadow Mode. Shadow Mode sufficiently changes the image to the extent that it has been known that some software would deactivate when Shadowed. So there is a technical explanation, but for the precise answer you would have to ask Tony as only he knows his soft well enough.