Download Decryption Tools

Choose your professional ransomware recovery tool

Available Tools

Decrypt Core

v3.2 � Active

PH_DEC V5

Phobos Decryptor

Have more questions?

Contact our 24/7 support team or explore helpful resources

Contact Support on Telegram

Instant responses from our support team

Full FAQ Ransomware Families User Guide Download Tool

? System Requirements & Compatibility

Compatible with all Windows desktop and server editions (32-bit & 64-bit)

Windows 7 SP1 / 8 / 8.1 / 10 / 11 | Server 2008 R2 - 2025

Minimum Requirements:

  • Windows 7 SP1 / 10 / 11 (32-bit or 64-bit)
  • Windows Server 2008 R2 - 2025 (64-bit)
  • Intel Core i3 / AMD Ryzen 3 or equivalent
  • 4 GB RAM
  • 500 MB free disk space
  • 1280x720 display resolution
  • Internet connection (for API access)

Recommended:

  • Windows 10 / 11 (All editions, 64-bit)
  • Windows Server 2016 or newer (64-bit)
  • Intel Core i5 / AMD Ryzen 5 or better
  • 8 GB RAM or more
  • 1 GB free disk space
  • 1920x1080 display resolution
  • 5 Mbps+ broadband connection

Windows Server Compatibility

? Fully Supported:

  • ? Windows Server 2025 (64-bit)
  • ? Windows Server 2022 (64-bit)
  • ? Windows Server 2019 (64-bit)
  • ? Windows Server 2016 (64-bit)

Supported with Limitations:

  • ? Windows Server 2012 R2 (64-bit, requires .NET 4.8+)
  • ? Windows Server 2012 (64-bit, requires SP1 + KB4103723)
  • ? Windows Server 2008 R2 (64-bit, SP1 required)
  • ? Windows Server 2008 (32-bit & 64-bit, SP2 required)

Required Dependencies

Microsoft Visual C++ Redistributable (x64)

Required for PyQt6 and Python runtime. Download from:

Download VC++ Redistributable

No .NET Framework required - all dependencies are bundled

Tested Configurations

Operating System Build Status
Windows 11 Pro 24H2 (64-bit) 26100 ? Fully Working
Windows 11 Pro 23H2 (64-bit) 22631 ? Fully Working
Windows 11 Home 22H2 (64-bit) 22621 ? Fully Working
Windows 11 Enterprise 22H2 (64-bit) 22621 ? Fully Working
Windows 10 Pro 22H2 (32/64-bit) 19045 ? Fully Working
Windows 10 Home 22H2 (32/64-bit) 19045 ? Fully Working
Windows 10 Pro 21H2 (32/64-bit) 19044 ? Fully Working
Windows 10 Enterprise LTSC 2021 (64-bit) 19044 ? Fully Working
Windows 10 Enterprise LTSB 2016 (64-bit) 14393 Requires Updates
Windows Server 2025 (64-bit) 26100 ? Fully Working
Windows Server 2022 (64-bit) 20348 ? Fully Working
Windows Server 2019 (64-bit) 17763 ? Fully Working
Windows Server 2016 (64-bit) 14393 Requires Updates
Windows Server 2012 R2 (64-bit) 9600 Limited Support
Windows Server 2008 R2 SP1 (64-bit) 7601 Limited Support
Windows 8.1 Pro (32/64-bit) 9600 Limited Support
Windows 7 SP1 (32/64-bit) 7601 Limited Support
Windows Vista / XP 6000 / 2600 ? Not Supported

Pre-Flight Checklist

Ensure these requirements before running the decryption tool:

Windows 7 SP1+ / Server 2008 R2+ (32-bit & 64-bit)
Visual C++ 2015-2022 installed
4 GB RAM available
Active internet connection
Firewall allows *.workers.dev
500 MB free disk space
Administrator rights (for full scans)
Antivirus exclusion configured

Common Issues & Solutions

Error: "Missing VCRUNTIME140.dll"

Solution:

Install Microsoft Visual C++ Redistributable:

Download: https://aka.ms/vs/17/release/vc_redist.x64.exe

This library is required for PyQt6 and Python runtime.

Error: "Application failed to start"

Solution:

  • Right-click ? Run as Administrator
  • Check Windows version: Minimum Build 1809
  • Update Windows to latest version
  • Install Visual C++ Redistributable
Error: "Cannot connect to API"

Solution:

  • Check internet connection
  • Allow HTTPS access to *.workers.dev in firewall
  • Disable VPN/proxy temporarily
  • Check Windows Firewall settings
Windows SmartScreen Warning

Solution:

  1. Click "More info" in the SmartScreen dialog
  2. Click "Run anyway" button
  3. This is normal for new applications without code signing

Build Information

Version

3.2 (Production)

Latest Release

October 12, 2025

Architecture

x86 & x86_64 (32-bit & 64-bit)

Python Version

3.10.0 (bundled)

PyQt Version

6.x (bundled)

File Size

95.8 MB

All dependencies bundled - no installation required

100% Success Rate

PH_DEC V5

Phobos Ransomware Decryptor

Professional decryption tool for Phobos ransomware family. Recover your encrypted files with our advanced decryption technology.

150+ Extensions All Windows Versions Server Support

Secure Download Access

Enter your access credentials to download PH_DEC V5

Need access? Contact us

100% Success Rate

Guaranteed decryption for all supported Phobos variants

Fast Decryption

High-performance engine for rapid file recovery

Safe & Secure

No data collection, works completely offline

Supported Extensions

PH_DEC V5 supports 150+ Phobos ransomware extensions

.phobos .eight .eking .EKING .help .1500 .actin .actor .Acton .Acuff .acuna .acute .adage .Adair .adams .added .adler .adobe .adult .BORISHORSE .deal .deuce .devil .Devoe .Devon .Devos .Dever .dhlp .DHT .dodoc .Dohee .doras .DQXM .SHTORM .elbow .Elpis .encr .Erxan .Exinh .fast .faust .FARGO .FUSION .gamma .gomer .greed .GUCCI .guides .gtsc .hauri .HSMSS .HUGO .icorp .ICZP .info .jmk .JON .KARLS .karma .kermit .KEYZ .KNOCK .Latar .LDPR .LEILA .LEXX .lilly .LIVE .liver .LOGAN .LX .MAKB .MAKOP .mamba .MANGO .MANUS .MAZZI .mech .METEOR .MILAM .MILLER .MMXXII .MOOA .MOREN .MORSE .NARCO .NEDU .NET .NIGGA .OCEAN .ogdo .ONLOCK .online .OTT .PARKER .pause .PCCUP .phoenix .PINDOS .pip .PIZDEC .PLAUGE .plut .PLUTO .POLSAT .PUTTY .QBX .QBWO .radman .Raldug .rapax .rectot .REKT .relax .ROCKYOU .ROGER .RYUK .SAF .SARAH .SBLOCK .sdk .secret .SERBIA .SHA256 .SHARK .smash .SMITH .SONY .SPICA .spydr .STEEL .step .STORM .STRAFE .STRELA .sup .sux .SXL .system .taiwan .TARGAX .terminator .termit .TEST .TEXON .TINA .toast .tomas .tracker .TRIX .VIPxxx .VIVAL .VIVALDI .VOLKSI .VOS .WALAN .WECAN .webro .wixawm .WRA .xiaopao .YOUWIN .ZEPPELIN .ZEUS .zhuzhu

Don't see your extension? Contact us for support.

About Phobos Ransomware

What is Phobos?

Phobos is a dangerous ransomware family that has been active since 2018. It is known for targeting businesses and individuals worldwide, encrypting valuable files and demanding cryptocurrency payments for decryption keys.

The ransomware is named after the Greek god of fear and operates as a Ransomware-as-a-Service (RaaS), allowing multiple threat actors to deploy it in attacks.

How Does It Spread?

  • Exposed Remote Desktop Protocol (RDP) services
  • Phishing emails with malicious attachments
  • Brute-force attacks on weak passwords
  • Exploiting unpatched vulnerabilities
  • Compromised software downloads

Understanding File Encryption

Original File (Before Attack)
document.pdf

File opens normally, all content is readable and accessible.

Encrypted File (After Attack)
document.pdf.id[ABC123].[email].eking

File cannot open, content is scrambled and unreadable.

What Happens During Encryption?

1. Internal Data Scrambling: Phobos ransomware uses AES-256 encryption to completely scramble the internal binary data of your files. The actual content (text, images, code) becomes unreadable random data.

2. File Renaming: The ransomware appends a unique extension containing: Victim ID, attacker's email, and ransomware variant name.

3. Structure Corruption: The file header and internal structure are modified, making it impossible for any software to recognize or open the file.

How PH_DEC V5 Restores Your Files

1. Decryption Process: Our tool reverses the AES-256 encryption, converting the scrambled binary data back to its original readable form.

2. File Restoration: The malicious extension is removed and the original filename is restored (document.pdf.id[...].eking ? document.pdf).

3. Full Recovery: Your file returns to its exact original state - all content, formatting, and functionality fully restored as if the attack never happened.

encrypted.pdf.eking PH_DEC V5 original.pdf

System Requirements

Windows Desktop

  • Windows 7 (32-bit & 64-bit)
  • Windows 8 / 8.1 (32-bit & 64-bit)
  • Windows 10 (32-bit & 64-bit)
  • Windows 11 (64-bit)

Windows Server

  • Windows Server 2008 R2
  • Windows Server 2012 / 2012 R2
  • Windows Server 2016
  • Windows Server 2019
  • Windows Server 2022
  • Windows Server 2025

Note: Run the decryptor as Administrator for best results. Ensure you have enough disk space to store decrypted files.