File categories
A set of default file categories is provided. Although not recommended these categories can be customized (by a Super User only) to add or remove file extensions.
File Analytics profiles and categorizes collected data by file type (filename extension). This categorized data is listed in the report, which lists the top 50 file types for the selected volumes/shares.
Note:
The report is an aggregation at the volume level of only the top 50 file extensions. For a complete list of all profiled file types, use the checkbox, available in the report and several other File Analytics reports; or from the Tools menu list, select: File List Export represents all filenames profiled for the Portal. Typically, if multiple volumes/shares are selected in the report scope, the report will list less types than what is listed in the exported output.
Table: File categories
Category | Filename Extensions |
|---|---|
Adobe Acrobat | |
Archives | zip, tar, cab, gz, rar, z |
Audio | aiff, au, mp3, mp4, wav, wma |
Backups | bak, bkp, bkf |
CD/DVD Images | iso, nrg, img |
Desktop Publishing | qxd |
Email Archives | pst |
Hard Drive Images | tib, gho, ghs |
Images | bmp, gif, jpg, jpeg, tif, tiff, png, psd |
Installers | msi, rpm |
Log Files | log |
Lotus Notes | nsf, ns2, ns3, ns4, box, ncf, ntf |
MS Office Documents | doc, docx, docm, dot, dotx, dotm, xls, xlsx, xlsm, xlt, xltx, xltm, xlsb, xlam, ppt, pptx, pptm, potx, potm, ppam, ppsx, ppsm, mdb, accdb, accde, accdt, accdr |
System Files | exe, dll, bin |
Text Files | txt, csv |
Video | mpg, mpeg, avi, mov, m4v |
VMware | vmdk, nvram, vmx, vmxf, vmtm, vmem, vmsn, vmsd, hlog |
Ransomware | emc, #, ##encrypted_by_pablukl0cker##, #locky, 0000, 0wn3dyou, 0x0, 0x004867, 0x009d8a, 1999, 1btc, 1cbu1, 1txt, 2cxpcihgsvxb3, 3301, 3ncry, 3ncrypt3d, 490, 491, 492, 4rwcry4w, 4x82n, 63vc4, 666, 6fkr8d, 707, 725, 726, 73i87A, 7h9r, 7zipper, 8637, 8lock8, 96e2, @decrypt2017, AngleWare, BarRax, CCCRRPPP, CCCRRRPPP, Dexter, EnCiPhErEd, LeChiffre, MERRY, MRCR1, PEGS1, PoAr2w, R16m01d05, RARE1, RMCM1, SecureCrypted, VforVendetta, Whereisyourfiles, _AiraCropEncrypted, __dilmav1, _airacropencrypted) not found., _ryp, a19, a5zfn, a604af9070, a990, a9v9ahu4, aaa, aajf, abc, actum, adk, aes!, aes-ni, aes256, aes_ni, aes_ni_0day, aesir, aga, airacropencrypted!, akaibvn, akira, alcatraz, aleta, allcry, alosia, amba, amnesia, andonio, android, angelamerkel, anon, antihacker2017, anubi, ap19, area, areyoulovemyrans, areyoulovemyransfile, armadilo1, asasin, asdasdasd, atlas, au1crypt, axx, azer, b0ff, b10cked, b5c6, b89b, bagi, bam!, bart, basslock, bbqb, beef, beep, beethoven, belgian_cocoa, better_call_saul, big1, bitkangoroo, bitstak, bleep, bleepyourfiles, blind, blind2, bloc, blocatto, bloccato, block_file12, blocked, blocked2, bloked, bmcode, bonum, braincrypt, breaking bad, breaking_bad, breeding123, brickr, bript, brt92, btc, btc-help-you, btcbtcbtc, btcware, bugware, bunny, bush, c0rp0r@c@0xr@, canihelpyou, cawwcca, cbu1, ccc, ceber3, cerber, cerber2, cerber3, cerber6, cerbersyslocked0009881, cesar, cezar, cfk, chak, chartogy, chifrator@qq_com, chip, christmas, cifgksaffsfyghd, ck, clinton, cloud, cobra, code, coded, coin, comrade, conficker, conflicker, corrupted, country82000, coverton, cr020801, crab, cradle, crh8, crime, crinf, cripted, criptiko, criptokod, cripttt, crjocker, crjoker, crptd, crptrgr, crptxxx, crrrt, cry, cry128, cry36, cry9, cryeye, crying, cryp1, crypt, crypt1, crypt12, crypt38, crypte, crypted, crypted000007, crypted_file, cryptedopps, crypto, cryptoboss, cryptobyte, cryptojoker, cryptolocker, crypton, cryptoshiel, cryptoshield, cryptotorlocker2015!, cryptowall, cryptowin, crypttt, cryptwalker, cryptz, crypz, crysis, cspider, ctb2, ctbl, ctbl2, cyberdrill, cybersoldiersst, cyclone, cyron, czvxce, czvxe, d2550a49bf52dfc23f2c013c5, d4nk, dCrypt, da_vinci_code, dale, damage, damoclis, darkcry, darkness, dcry, decrypt2017, decryptional, deria, derp, deuscrypt, dg, dharma, diablo6, dian, die, disposed2017, dle, dlenggrl, dolphin, domino, doomed, doxes, ds335, duhust, dviide, dwbiwty, dxjay, dxxd, dyatel@qq_com, e4m, ebay, ecc, eclr, edgel, eky, empty, enc, encedrsa, encencenc, enciphered, encoderpass, encr, encrptd, encrypt, encrypted, encryptedaes, encryptedped, encryptedrsa, encryptedyourfiles, encryptile, enigma, enjey, epic, error, eternity, evil, evillock, executioner, exotic, exploit, explorer, exte, exx, ezz, facebook, failedaccess, fairytail, fake, fantom, fartplz, fat32, fbuvkngy, fil0locked, file0locked, filegofprencrp, fileiscryptedhard, filesfucked, filock, firecrypt, fix, flat, flux, flyper, fmoon, freefoam, frivolity, frtrss, fuck, fuck_you, fuck_you_av_we_are_not_globe_fake, fucked, fucku, fuckyourdata, fun, gangbang, ganklocked, gdcb, gefickt, gembok, getrekt, ghost, gigahertz, globe, gocr, godra, gommemode, good, gorilla, gotham, gotya, gr3g, granny, grt, grux, gruzin@qq_com, gryphon, gsupport3, h3ll, h_f_d_locked, ha3, hacked, hakunamatata, hannah, happ, happenencedfiles, happy, happydayzz, harzhuangzi, hasp, haters, hb15, hcked, heisenberg, hello, helpdecrypt@ukr_net, helpmeencedfiles, herbst, heroesofthestorm, hncrypt, hnumkhotep, hnyear, howcanihelpusir, hrm, htrs, hush, i''want money, iaufkakfhsaraf, id-3044989498_x3m, ifuckedyou, igotyou, ihsdj, illnest, imsorry, incanto, infected, infinite, info, insane, ipcrestore, ipygh, isis, iwant, iwanthelpuuu, jaff, jeepers, jey, jezroz, justbtcwillhelpyou, k0stya, katipuneros, kee, keepcalm, kencf, kernel_complete, kernel_pid, kernel_time, keybtc@inbox, keybtc@inbox_com, keyh0les, keyholes, keyz, kgpvwnr, kilit, kill, killedxxx, kimchenyn, kimcilware, kirked, kk, kkk, kok, korea, korrektor, kostya, kr3, kra, krab, kraken, kratos, krypted, kryptonite, kuntzware, kyra, l0cked, lalabitch,, lambda_l0cked, lamo, lckd, lcked, legion, lego, leon, lesli, letmetrydecfiles, lfk, lightning, lime, lock75, lock93, lockd, locked, locked-by-mafia, locked3, locked_by_pablukl0cker, locked_file, lockify, locklock, lockme, lockout, locky, lokitus, lol!, loli, loptr, lordofshadow, losers, lost, loveransisgood, lovewindows, loveyou, loveyouisreal, ltml, lukitus, lukitus-tiedostopäätettä, madebyadam, magic, magic_software_syndicate, maktub, malki, maniac, matrix, maxicrypt, maya, maysomware, medal, mention9823, micro, mikoyan, mind, mole, mole00, mole01, mole02, mole03, mole04, moments2900, mordor, mp3, mtc, mtk118, mychemicalromance4ever, myransext2017, nalog@qq_com, napoleon, neitrino, nemesis, netn6, news, nm4, no_more_ransom, noblis, nochance, node0, noob, nopasaran, noproblemwedecfiles, noproblemwedecfiles, notfoundrans, nsmf, nuclear, nuclear55, nuke55, numberdot, ocean, odcodc, odin, ogonia, ogre, ohno!, okokokokok, oled, omg!, one-we_can-help_you, oni, onion, only-we_can-help_you, onyon, oops, oor, oplata@qq_com, ordinal, oshit, osiris, otherinformation, otr, owned, oxr, p5tkjw, pa-siem, pablukcrypt, pabluklocker, padcrypt, panda, pay, paybtcs, paycyka, payday, payfordecrypt, payforunlock, paym, paymds, paymrss, paymrts, payms, paymst, paymts, payransom, payrms, pays, paytounlock, pdcr, pec, pedo, perl, petya, phantom, phobos, pirate, pizda@qq_com, pizdec, pizdosik, pky, planetary, plauge17, plin, pnr, pohu, porno, pornoransom, poshkoder, potato, powerfulldecrypt, powned, pr0tect, privat66, prosperous666, pscrypt, pubg, purge, pwned, pzdc, qwerty, qwqd, r3k7m9, r3store, r4a, r4bb0l0ck, r5a, raas, radamant, raid10, ramen, ranranranran, ranrans, ransed, ransom, ransommine, rapid, rastakhiz, razarac, razy, razy1337, rdm, rdmk, rdwf, readme_txt, reagan, realfs0ciety@sigaint.org.fs0ciety, reco, rekt, relock@qq_com, remind, resurrection, revenge , revolution, reyptson, rip, rmd, rnsmwr, rnsmwre, rokku, rose, rrk, rsnslocked, rsplited, rtyrtyrty, ruby, rumblegoodboy, ryp, s1crypt, sage, saherblueeagleransomware, salsa222, same, samsung, sanction, satan, scarab, scl, scorpio, securecrypte, senrus17, serp, serpent, server, sevendays, sexy, sgood, shadow, shark, shifr, shinigami, shino, shit, shutdown57, sifreli, silent, sinta, skjdthghh, skunk, skvtb, slvpawned, snake, son, spectre, spider, spora, sport, srpx, sshxkej, stn, stop, stroman, styx, supercrypt, supported2017, suppose666, suprise, surprise, sux, svn, symbiom_ransomware_locked, sysdown, szesnl, szf, tastylock, technicy, tesla, test, tgif, thetrumplockerf, thetrumplockerp, theva, theworldisyours, thor, toxcrypt, trans, triple_m, trmt, troyancoder@qq_com, true, trump, trun, ttt, tzu, udz2j8mv, uiwix, unavailable, unlis, usr0, vForVendetta, vbransom, vcrypt1, vdul, velikasrbija, velso, vendetta, venusf, venusp, viiper, viki, vindows, visioncrypt, vpgvlkb, vrmrkz, vscrypt, vvv, vxlock, wallet, wamarlocked, wana decrypt0r trojan-syria editi0n, warn_wallet, wcry, wcryt, wdie, weapologize, weareyourfriends, weencedufiles, wflx, whatthefuck, whycry, wincry, windows, windows10, wlu, wmfxdqz, wncry, wncrypt, wncryt, wndie, wnry, wooly, wowreadfordecryp, wowwhereismyfiles, write, write_us_on_email, wrny, wsmile, wtdi, wuciwug, www, wxdrjbgsda, wyvern, x0lzs3c, x1881, x3m, x3mpro, xbtl, xcrypt, xdata, xfile, xhspythxn, xiaoba1, xiaoba10, xiaoba11, xiaoba12, xiaoba13, xiaoba14, xiaoba15, xiaoba16, xiaoba17, xiaoba18, xiaoba19, xiaoba2, xiaoba20, xiaoba21, xiaoba22, xiaoba23, xiaoba24, xiaoba25, xiaoba26, xiaoba27, xiaoba28, xiaoba29, xiaoba3, xiaoba30, xiaoba31, xiaoba32, xiaoba33, xiaoba34, xiaoba4, xiaoba5, xiaoba6, xiaoba7, xiaoba8, xiaoba9, xmdxtazx, xncrypt, xolzsec, xorist, xort, xrnt, xrtn, xtbl, xxx, xyz, xzzx, yakes, ykcol, yl, youransom, yourransom, ytbl, yyto, z3r0, z81928819, zablokowane, zayka, zbt, zc3791, zcrypt, zendr4, zepto, zilla, zimbra, zino, zorro, zuzya, zxz, zycrypt, zyklon, zzz, zzzz, zzzzz, xdata |