probably i would have ran it outside as the crack just silently “crashed” (while successfully dropped the malware as admin in the right spot, ready to be ran as admin at the next boot via the task scheduler) and i would have thought “maybe it doesn’t run in a sandbox/vm”.

But yes, in a hindsight, if i ran in sandboxie then i might have noticed that it had dropped suspiciously named files in common:startup with that nice file transfer GUI (unless if the malware detected sandboxie and did not run the malicious routines)

Introducing: fish

And then you just need to remember the first letters of the previously typed command