ransomware 1st response