If you’ve been affected, or know someone affected, by the WannaCry ransomware that spread across the world this month, and you happen to run Windows XP still, there’s a freely available decryption tool to help retrieve your files. The tool, called WannaKey, will only work on Windows XP computers that have been infected by WannaCry and has some files encrypted, but has not been rebooted since.
That’s a critical requirement, as it turns out that the decryption key for WannaCry on Windows XP is still held in the system memory. Rebooting resets everything, and the decryption key vanishes. While there is a slim chance that WannaKey can work on other Windows versions, the encryption API used may differ vastly from that under Windows XP.