Stop Ransomware in its Tracks: Suspicious File Activity