WannaCry

WannaCry is a big deal right now. It's a worldwide ransomware attack that's making headlines and probably going to be remembered as one of the worst types of malware ever. Seriously, it's that bad!

Microsoft's Response to WannaCry

So, here's the scoop: Microsoft even put out an emergency update for Windows XP users to help stop this infamous ransomware from spreading. But despite their efforts, lots of computers still got hit hard by WannaCry.

If You're an XP User

If you happen to be using Windows XP and your computer got infected, listen up! DO NOT REBOOT your machine! This is super important because there's still a chance you can recover your files without shelling out $300 in ransom.

Meet Wannakey

This is where Wannakey comes into play. It’s a small tool created by a smart French security researcher named Adrien Guinet. Wannakey can help you recover the prime numbers from the RSA key used by WannaCry on your computer. Just remember, it only works if you haven’t restarted your computer after getting infected.

No Guarantees

Now, it’s important to keep in mind that this tool isn’t guaranteed to work perfectly. So, let’s hope you’re lucky and that the critical memory hasn’t been moved or deleted!

Steps to Recover Your Files

1. First off, make sure you have the Microsoft Visual C++ Redistributable Package 2013.


2. You’ll also need to find the process identifier for wrcy.exe (the WannaCry process) using Task Manager and locate a file called 00000000.pky.


3. Next, download Wannakey from our servers and run it through your command prompt (CMD) with this command: "search_primes.exe PID path\to\00000000.pky".


4. If all goes well and there’s a valid prime number in your memory, you'll see a priv.key file generated right where you're working!

Crossing Fingers!

Good luck!

If You Succeed...

Were you successful at recovering those RSA private keys? If so, check out WanaFork. It might help you decrypt and get back your files!