Tagged ransomware infection cycle