session id ransomware