If you or someone you know become a victim of WannaCry ransomeware
and wondering how you can recover your file. Or may be deciding to paying the bad guys. Wait there may be a hope for you and your file may be recovered for free.
WannaCry ransomeware when generate keys for encryption it leaves prime numbers in the memory of its victim. So if the victim is lucky the following tools can help and try to generate the encryption key. It is recommended to run these tool as soon as possible as memory may have be overwritten. If the machine had been restarted there is no hope to recover using the following methods, for now.
WannaKiwi utility allows computers infected by the WannaCry ransomware to recover their files. WannKiwi recover the private-key in memory and save it as 00000000.dky and decrypt all of their files. It does not delete the encrypted files for safety reasons, because if the decryption was unsuccessful the user still has second chance.
Download WannKiwi for free from here
. Usage is simple.
<PID> process ID is optional, WannaKiwi by default search for all instance for WannaCry.
WannaKiwi had been tested and know to be working for 32 bit Windows XP, Windows Server 2003 and Windows 7.
Wannakey is another approach to helping people who fell prey to the mischievousness of few individuals. WannKey work on the same principle described above.
Download WannaKey from here
and run the executable. WannaKey must requires the process id of the WannaCry executable. Its usage is as follows
search_primes.exe PID pathto 0000000.pky