If your PC was hit by WannaCry, WannaCrypt or wCrypt ransomware, there is a chance that you can decrypt your locked files without paying the ransom demand of $300.
A French security researcher at Quarkslab has discovered a solution to get the secret encryption keys used by the WannaCry ransomware for free. This free tool works for all affected Windows OS versions.
However, this decryptor works only if you haven’t restarted the infected computer and you haven’t killed the ransomware process (wnry.exe or wcry.exe). So please don’t restart your system if you want to get your encrypted files back.
WanaKiwi decryptor searches the computer’s memory for prime numbers and pieces together the encryption key used. However, the tool relies on current running memory. So, if you’ve restarted the infected system or you you’ve done too much operations on your PC since the ransomware infiltration, it’s possible the key will not be found.
How To Use It?
Click the download button below and extract the downloaded .zip to a folder on your desktop. Please notice: we recommend you to download this file from another clean PC and then transfer it via USB flash drive in order to avoid risks of overwriting the decryption key in memory.
You can also download WanaKiwi decryption tool from Github repository.
Next, double-click the wanakiwi.exe file to run it.
WanaKiwi decryptor will automatically detect the WannaCrypt malicious processes (wnry.exe or wcry.exe) running on the system.
It might take a couple of minutes for the tool to find the key, and once it’s found the tool will start to search your computer for encrypted files and decrypt them automatically.
After the decryption process completed, you will see a ransom note as a background and all the unlocked files next to their encrypted copies.
Please let us know in the comments below if this decrypter worked for you!