To understand why these downloads trigger critical infrastructure alerts, it is necessary to examine how they function: