Long description

This figure shows two screen shots side by side.

The screenshot on the left is labelled ‘(a)’. It shows a Windows desktop with a black background. There is the following text on the desktop: ‘Ooops, your important files are encrypted. If you see this text but don’t see the “Wanna Encropt0r” window, then your antivirus removed the decrypt software or you deleted it from your computer. If you need your files you have to run the decrypt software. Please find an application file named “@WannaDecryptor@.exe” in any folder or restore from the antivirus quarantine. Run and follow the instructions!’ All the text is in red except for the phrases “Wanna Encropt0r” and “@WannaDecryptor@.exe” which are in blue.

The screenshot on the right is labelled ‘(b)’. It shows the Wana Decryptor 2.0 interface. Not all the details are described.

The background colour of the page is maroon. There is a scrollable window with a white background that occupies approximately two thirds of the page with its top right corner near the top right of the page. At the top of the page, in the maroon area there is the heading ‘Ooops, your files have been encrypted!’ To the left of this there is a padlock icon. There is text in the scrollable box and the scroll bar indicates that only two thirds of this text is currently visible. The text is split into three sections each with a heading.

The first section is headed ‘What Happened to My Computer?’ Below that the text reads ‘ Your important files are encrypted. Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service.’

The second section is headed ‘Can I Recover my Files?’ Below that the text reads ‘Sure. We guarantee that you can recover all your files safely and easily. But you have not so enough time. You can decrypt some of your files for free. Try now by clicking <Decrypt>. But if you want to decrypt all your files, you need to pay. You only have 3 days to submit the payment. After that the price will be doubled. Also, if you don’t pay in 7 days, you won’t be able to recover your files forever. We will have free events for users who are so poor that they couldn’t pay in 6 months.’

The third section is headed ‘How Do I Pay?’ Below that the text reads ‘Payment is accepted in Bitcoin only. For more information, click <About bitcoin>. Please check the current price of Bitcoin and buy some bitcoins. For more information, click <How to buy bitcoins>. And send the correct amount to the address specified in this window.’

To the left of the scrollable window there are two text boxes, one above the other. The top box is headed ‘Payment will be raised on’. Below that there is a date and a countdown timer showing the time remaining. It is showing ‘03:23:59:47’. The lower box is headed ‘Your files will be lost on’. Below that there is a date and a countdown timer showing the time remaining. It is showing ‘06:23:59:47’.

Below the scrollable window there is a text box with the words ‘Send $300 worth of bitcoin to this address:’. The address has been obscured. Below this are what appear to be two buttons. The button on the right has the label ‘Check Payment’ and the button on the right has the label ‘Decrypt’.