Cool! Have you run this against a corpus of known ransomware samples to see how well it performs?