Ransomware

File name and extension

CryptXXX V1, V2, V3*

{original file name}.crypt, cryp1, crypz, or 5 hexadecimal characters

CryptXXX V4, V5

{MD5 Hash}.5 hexadecimal characters

TeslaCrypt V1**

{original file name}.ECC

TeslaCrypt V2**

{original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZ

TeslaCrypt V3

{original file name}.XXX or TTT or MP3 or MICRO

TeslaCrypt V4

File name and extension are unchanged

SNSLocker

{Original file name}.RSNSLocked

AutoLocky

{Original file name}.locky

BadBlock

{Original file name}

777

{Original file name}.777

XORIST

{Original file name}.xorist or random extension

XORBAT

{Original file name}.crypted

CERBER V1

{10 random characters}.cerber

Stampado

{Original file name}.locked

Nemucod

{Original file name}.crypted

Chimera

{Original file name}.crypt

LECHIFFRE

{Original file name}.LeChiffre

MirCop

Lock.{Original file name}