WildFire ransomware-affected file
File type: Ransomware encrypted file
A file with the .wflx file extension is an encrypted file produced by the WildFire ransomware.
The extension does not identify a normal document format. It marks a user's file after WildFire has encrypted it and renamed it.
File type category:
Ransomware encrypted file
Date updated: October 5, 2026
WildFire is ransomware that was distributed through email messages, including messages with a macro-embedded Word document attached. When run, it encrypts the user's files and demands a ransom in bitcoins for their recovery.
The .wflx suffix is added to files affected by this ransomware. The encrypted data remains associated with the original file, but it cannot normally be read by the application that created it until it has been decrypted.
WildFire appears to have been rebranded as Hades in October 2016. The later ransomware used a semi-random suffix consisting of .~HL followed by the first five characters of the encryption password. For example, file.doc could be renamed to file.doc.~HLX1234. This later naming scheme is separate from the .wflx suffix.
A .wflx file cannot be opened normally with a document, image, or other file application because its contents are encrypted. Renaming the file or removing the suffix does not decrypt it.
Recovery requires a WildFire-compatible decryption utility, if one is available, or restoration from an unaffected backup. Paying the ransom does not guarantee recovery.
A .wflx file cannot be meaningfully converted to another format while it remains encrypted. It must first be decrypted with a compatible WildFire decryption utility or replaced with a clean backup copy; the recovered file can then be opened or exported by its original application.
Language