[reGEN]

I can't understand sandboxie I haven't looked much into it I'd rather much just use an RDP tbh

Basically, Sandboxie creates its own directory structure and "emulates" them such that they look legit to the running application. Basically, imagine it as a proxy, but for the operating system. If the application writes to disk, Sandboxie will intercept the file path and modify it, e.g. if it writes to C:\Users\%username%\Desktop, it will be written to C:\Some\Sandboxie\Base\Directory\Users\%username%\Desktop (this is an example path, not the actual path). When the application requests the same file, it will do the reverse (read from the Sandboxie directory) to make the application think it's the same. This is the same with registry keys and perhaps services too. I'm not entirely sure how it handles inter-process communication. So, any file or registry keys/values written will actually touch your OS until you decide to delete them.

To achieve this, they employ a kernel-mode driver to ensure that they capture all file/registry/etc. activity, so it may be impossible for the user application to trick Sandboxie into doing something unintended unless there is some exploit such as a sandbox escape. However, Sandboxie also uses a user-mode DLL injected into the application's memory space (probably to capture more API since drivers cannot and may not see all API calls unless they hack up the OS' SSDT which is protected by KPP/Patchguard on 64-bit Windows). Because of this, applications may detect the presence of Sandboxie and modify their behavior as opposed to when executed normally.