595
Once it has encrypted files on the phone , the malware hijacks the device , blocking the user 's access , and attempts to intimidate them into paying a ransom to unlock it .
 ( ransom: paying a ransom,  blocking the user 's access: attack pattern, the malware hijacks the device: attack pattern, encrypted files: attack pattern, the phone: victim) 
Locate the role in the text that participated in the event based on the event type and return it in the event list. 
 Option: Event type: phishing, data breach, ransom, discover vulnerability, patch vulnerability, Arguments type: vulnerable system, capabilities, vulnerability, number of victim, issues addressed, compromised data, damage amount, common vulnerabilities and exposures, victim, patch number, number of data, tool, discoverer, time, purpose, place, payment method, releaser, vulnerable system version, attacker, supported platform, patch, price, vulnerable system owner, trusted entity, attack pattern. 
Text: {0} 
Answer:
 ( ransom: paying a ransom,  blocking the user 's access: attack pattern, the malware hijacks the device: attack pattern, encrypted files: attack pattern, the phone: victim) 