false assumption: ransomware will use Crypto API

It is a false assumption that ransomware will use the Windows Crypto API. Ransomware may implement their own cryptography routines instead of using the provided APIs as they may be monitored for abuse.

---