Emsisoft Decrypter for MegaLocker will help to decrypt files encrypted by the MegaLocker ransomware.

The MegaLocker ransomware encrypts a victim's files utilizing AES-128 ECB and adds the extension ".nampohyu" to files. The ransom note "!DECRYPT_INSTRUCTION.TXT" instructs the victim to go to a Tor website to contact the criminals.

To use Emsisoft Decrypter for MegaLocker, you will need one of the ransom notes left by the malware.

Below you will find an example of a ransom note:



You will need to remove the malware from your system first; otherwise, it will repeatedly lock your system or encrypt files. By default, Emsisoft Decrypter for MegaLocker will pre-populate the locations to decrypt with the currently connected drives and network drives. Additional locations can be added via the Add button.

Decrypters typically offer various options depending on the particular malware family. The available options are located in the Options tab and can be enabled or disabled there. After you have added all the locations you want to decrypt to the list, click the “Decrypt” button to start the decryption process. The screen will switch to a status view, informing you about the current process and decryption status of your files.

Emsisoft Decrypter for MegaLocker will inform you that the decryption process is complete. If you require a report for your records, you can save it by clicking the Save log button. You also have the option to copy it straight to your clipboard for use in emails, forum posts, etc., if needed.