function Ransomware.SetExtensionData()

in ransomware/artifact.lua [2474:2492]


function Ransomware.SetExtensionData(eventData)
    if utils.TableHasKey(globals.extensionMap, eventData.fileExtension) then
        eventData.currentExtensionData = globals.extensionMap[eventData.fileExtension]
    else
        eventData.currentExtensionData = globals.unknownExtensionData
    end

    if globals.FILE_RENAME == eventData.operation then
        if eventData.filePreviousExtension ~= eventData.fileExtension then
            if utils.TableHasKey(globals.extensionMap, eventData.filePreviousExtension) then
                eventData.previousExtensionData = globals.extensionMap[eventData.filePreviousExtension]
            else
                eventData.previousExtensionData = globals.unknownExtensionData
            end
        else
            eventData.previousExtensionData = eventData.currentExtensionData
        end
    end
end