That's not what happens. He runs his own fake ransomware on his own virtual machine while they are remotely viewing it.