decrypter.emsisoft.comEmsisoft: Free Ransomware Decryption Tools

Why Emsisoft Protection Business Security Enterprise Security + EDR MSP Security Anti-Malware Home Mobile Security Remediation Remediation Kit Commandline Scanner Ransomware Decryption Partners Managed Service Providers Third Party Integrations Security Operations Centers Resellers Affiliates Pricing Buy online Buy from local partner Renew license Hit by ransomware? We’re here to fix that. Use our free ransomware decryption tools to unlock your files without paying the ransom Please note that these free tools are provided as-is and without warranty of any kind. The tools may only work with specific ransomware versions, and may not work with versions that were released after a tool was created. Technical support for the tools is available only to customers using a paid Emsisoft product. [May, 17, 2016] - Version: 1.0.0.29 777 decryptor Use this decrypter if your files have been encrypted and renamed to *.777. It may be necessary to select the correct version of the malware in the options tab for the decrypter to work properly. Download 170161 downloads [Sep, 28, 2016] - Version: 1.0.0.51 Al-Namrood decryptor The Al-Namrood ransomware is a fork of the Apocalypse ransomware. The group behind it primarily attacks servers that have remote desktop services enabled. Encrypted files are renamed to .unavailable or .disappeared and for each file a ransom note is created with the name *.Read_Me.Txt. The ransomware asks the victim to contact " [email protected] " or " [email protected] ". To decrypt your files the decrypter requires your ID. The ID can be set within the "Options" tab. By default the decrypter will set the ID to the ID that corresponds to the system the decrypter runs on. However, if that is not the same system the malware infection and encryption took place on, make sure to put in the ID as specified in the ransom note. Download 75006 downloads [May, 6, 2017] - Version: 1.0.0.33 Amnesia decryptor Amnesia is a ransomware written in the Delphi programming language that encrypts your files using the AES-256 encryption algorithm. Encrypted files get renamed to *.amnesia and a ransom note is called "HOW TO RECOVER ENCRYPTED FILES.TXT" and asks you to contact " [email protected] ". It can be found on your Desktop. More technical information Detailed usage guide Download 98350 downloads [May, 30, 2017] - Version: 1.0.0.54 Amnesia2 decryptor Amnesia2 is a ransomware written in the Delphi programming language that encrypts your files using the AES-128 encryption algorithm. Encrypted files get renamed to *.amnesia and a ransom note is called "HOW TO RECOVER ENCRYPTED FILES.TXT" and asks you to contact " [email protected] ". It can be found on your Desktop. More technical information Detailed usage guide Download 96239 downloads [Jun, 12, 2016] - Version: 1.0.0.24 Apocalypse decryptor Use this decrypter if your files have been encrypted and renamed to .encrypted, .FuckYourData, .Encryptedfile or .SecureCrypted with ransom notes named .How_To_Decrypt.txt, .Where_my_files.txt, .How_to_Recover_Data.txt or .Contact_Here_To_Recover_Your_Files.txt created for each encrypted file. The ransom note asks you to contact " [email protected] ", " [email protected] ", " [email protected] " or " [email protected] ". More technical information Detailed usage guide Download 73156 downloads [Jun, 18, 2016] - Version: 1.0.0.34 ApocalypseVM decryptor Use this decrypter if your files have been encrypted and renamed to .encrypted or .locked with ransom notes named .How_To_Decrypt.txt, .README.txt, .How_to_Decrypt_Your_Files.txt or .How_To_Get_Back.txt created for each encrypted file. The ransom note asks you to contact " [email protected] ", " [email protected] " or " [email protected] " and contains a personal ID. To use the decrypter you will require an encrypted file of at least 4096 bytes in size as well as its unencrypted version. To start the decrypter select both the encrypted and unencrypted file and drag and drop them onto the decrypter executable. Download 65724 downloads [Jul, 7, 2022] - Version: 1.0.0.0 AstraLocker decryptor AstraLocker is a ransomware based on the leaked Babuk source code, and encrypts files using a modified HC-128 encryption algorithm, and Curve25519. The extension ".Astra" or ".babyk" is appended to files. Detailed usage guide Download 25091 downloads [Apr, 1, 2019] - Version: 1.0.0.10 Aurora decryptor Aurora is a ransomware family that encrypts files using XTEA and RSA, and may also be known as "Zorro", "Desu", or "AnimusLocker". Known extensions include ".Aurora", ".aurora", ".animus", ".ONI", ".Nano", ".cryptoid", ".peekaboo", ".isolated", ".infected", ".locked", ".veracrypt", ".masked", ".crypton", ".coronolock", ".bukyak", ".serpom", and ".systems32x". Detailed usage guide Download 68192 downloads [Apr, 16, 2016] - Version: 1.0.0.11 AutoLocky decryptor Use this decrypter if your files have been encrypted and renamed to *.locky, but the file base name is still unchanged, and you find a ransom note named info.txt or info.html on your Desktop. Download 186114 downloads [Jun, 11, 2021] - Version: 2.1.0.0 Avaddon decryptor The Avaddon ransomware encrypts victim’s files using AES-256 and RSA-2048, and appends a random extension. Detailed usage guide Download 97960 downloads [Sep, 26, 2019] - Version: 1.0.0.0 Avest decryptor The Avest ransomware encrypts victim’s files and appends the extension ".ckey( ).email( ).pack14" to the filename. More technical information Download 49136 downloads [May, 28, 2016] - Version: 1.0.0.174 BadBlock decryptor Use this decrypter if your files have been encrypted but not renamed. The malware identifies itself as BadBlock both in the red ransomware screen as well as in the ransomnote "Help Decrypt.html" that can be found on the Desktop. More technical information Download 52366 downloads [Mar, 9, 2019] - Version: 1.0.0.6 BigBobRoss decryptor BigBobRoss is a ransomware written in C++ using QT. It uses AES-128 ECB to encrypt files, and adds the extension ".obfuscated", ".encryptedALL", or ".cheetah". The ransom note "Read Me.txt" asks the victim to contact " [email protected] ". More technical information Detailed usage guide Download 58261 downloads [Aug, 6, 2020] - Version: 1.0.0.0 CheckMail7 decryptor CheckMail7 encrypt’s its victim’s files and appends the extension " [email protected] ". Detailed usage guide Download 36110 downloads [Dec, 20, 2019] - Version: 1.0.0.4 ChernoLocker decryptor ChernoLocker is a ransomware programmed in Python, and encrypts files using AES-256, commonly adding the extension "(.CHERNOLOCKER)" or "( [email protected] )". More technical information Detailed usage guide Download 49306 downloads [May, 2, 2017] - Version: 1.0.0.54 Cry128 decryptor Cry128 belongs to the CryptON/Nemesis ransomware family that is mostly used for targetted attacks via RDP. Files are encrypted using a customized version of AES and RSA. We have seen the following extensions being used by Cry128: ".fgb45ft3pqamyji7.onion.to. ", ".id gebdp3k7bolalnd4.onion. ", ".id_ 2irbar3mjvbap6gt.onion.to. " and ".id- _[qg6m5wo7h3id55ym.onion.to].63vc4". More technical information Detailed usage guide Download 87365 downloads [Apr, 6, 2017] - Version: 1.0.0.41 Cry9 decryptor Cry9 is the successor of the CryptON ransomware family that is mostly used for targetted attacks via RDP. Files are encrypted using a customized version of AES, RSA and SHA-512. We have seen the following extensions being used by Cry9: ". -juccy[a]protonmail.ch", ".id- ", ".id- _[ [email protected] ].xj5v2", ".id- _r9oj", ".id- x3m", ".id- [ [email protected] ]_[ [email protected] ].x3m", ". ", ". -sofia lobster[a]protonmail.ch" and ". [wqfhdgpdelcgww4g.onion.to].r2vy6". More technical information Detailed usage guide Download 83573 downloads [Jan, 30, 2016] - Version: 1.0.0.164 CrypBoss decryptor Use this decrypter is your files have been encrypted and renamed to either .crypt or .R16M01D05. In addition the ransom note will ask you to contact a @dr.com...