Derailing ransomware 2.0 requires a little trickery