rule wannacry_1 : ransom
