I'm a little lost in this article. How can you "look in" when you have nothing on the sandbox to monitor? You have to go inside the sandbox somehow to see registry changes or new processes.

Also, all the ransom-ware I have analyzed doesn't download the decryption key from the C2 servers. It uploads the decryption key to the C2 server so that if the user pays, they can get it back....