Forwarding you to github.com

GitHub - aguinet/wannakey: Wannacry in-memory key recovery

It does so by searching for them in the wcry.exe process. This is the process that generates the RSA private key. The main issue is that the CryptDestroyKey and CryptReleaseContext does not erase the prime numbers from memory before freeing the associated memory.