Decrypt WannaCry Files for free

If you or someone you know become a victim of WannaCry ransomeware and wondering how you can recover your file. Or may be deciding to paying the bad guys. Wait there may be a hope for you and your file may be recovered for free. WannaCry ransomeware when generate keys for encryption it leaves prime numbers in the memory of its victim. So if the victim is lucky the following tools can help and try to generate the encryption key. It is recommended to run these tool as soon as possible as memory may have be overwritten. If the machine had been restarted there is no hope to recover using the following methods, for now.

wanakiwi

WannaKiwi utility allows computers infected by the WannaCry ransomware to recover their files. WannKiwi recover the private-key in memory and save it as 00000000.dky and decrypt all of their files. It does not delete the encrypted files for safety reasons, because if the decryption was unsuccessful the user still has second chance.

Download WannKiwi for free from here. Usage is simple.

wanakiwi.exe <PID>

<PID> process ID is optional, WannaKiwi by default search for all instance for WannaCry.

WannaKiwi had been tested and know to be working for 32 bit Windows XP, Windows Server 2003 and Windows 7.

Wannakey

Wannakey is another approach to helping people who fell prey to the mischievousness of few individuals. WannKey work on the same principle described above. Download WannaKey from here and run the executable. WannaKey must requires the process id of the WannaCry executable. Its usage is as follows

search_primes.exe PID pathto0000000.pky