The encryption process produces WNCRYT files. The WNCRYT files are temporary, eventually replaced by WNCRY files. WNCRYT decryption tools exist but do not work reliably. Restore files by system restor...
The encryption process produces WNCRYT files. The WNCRYT files are temporary, eventually replaced by WNCRY files. WNCRYT decryption tools exist but do not work reliably. Restore files by system restore or from backup.
The updated ransomware now appends .WNCRYT file extension using AES-128 algorithm. The malware asks for Bitcoin transfer to decrypt files. Initially spread via email spam, this ransomware was not very profitable. So developers upgraded the program.
The file extensions used are: .wnry, .wcry, .wncry, and .wncryt. The malware encrypts files larger than 209,715,200 bytes. It may also use the .WNCRYT extension temporarily. The encrypted files use AES-128 cryptography to lock files.
The malware shows a ransom demand after encrypting. It uses files named taskdl.exe and taskse.exe. The msg folder contains ransom demands in multiple languages.
Ransomware Decryptor