The downloaded file executed a virtual machine, hiding the ransomware execution from standard security solutions. The activity was detected by the EDR as an anomaly due to the launch of a non-standard virtual machine with suspicious network behavior.