Ransomware scanner