WinRansomProtect is a lightweight anti-ransomware tool for Windows. Most antivirus tools rely on signatures — they can only catch what they've already seen. WinRansomProtect watches behavior instead. When a process starts encrypting files in bulk or deleting shadow copies, it gets killed and the files get quarantined. 32 rules cover the main attack paths: ransomware extensions, malicious scripts, process injection, lateral movement. Everything stays local — no cloud, no telemetry, no accounts.