Note: This article is technically accurate and it can be applied to rudimentary RSA implementations that only use time retrieval functions as seed as demonstrated by CS Students from Virginia University . However, CryptoDefense uses CrytoAPI which uses a robust PRNG based on process ID, thread ID, system clock, system time, system counter, memory status, free disk clusters, etc . I dramatically changed the keys recovery approach as soon as I found out the keys were stored on disk. Why keep this article then? Oh, we wanted the crooks to think we were down the wrong path ;) Do NOT use somebody else's decryption program! The reason why each key is unique and why you can't use somebody else's decryption program is because this ransomware randomly generates the keys for each victim. If there was a unique private key for everyone, there would be no need to panic! But the is a problem... Software alone is technica...