A ransomware simulation measures the behavior that triggers real infection, downloading and opening the file, and teaches at that exact moment.