Tagged ransomware lifecycle