in ransomware/artifact.lua [2474:2492]
function Ransomware.SetExtensionData(eventData)
if utils.TableHasKey(globals.extensionMap, eventData.fileExtension) then
eventData.currentExtensionData = globals.extensionMap[eventData.fileExtension]
else
eventData.currentExtensionData = globals.unknownExtensionData
end
if globals.FILE_RENAME == eventData.operation then
if eventData.filePreviousExtension ~= eventData.fileExtension then
if utils.TableHasKey(globals.extensionMap, eventData.filePreviousExtension) then
eventData.previousExtensionData = globals.extensionMap[eventData.filePreviousExtension]
else
eventData.previousExtensionData = globals.unknownExtensionData
end
else
eventData.previousExtensionData = eventData.currentExtensionData
end
end
end