What File extensions does ransomware leave or change?

Ransomware can leave or change various file extensions, depending on the specific type of ransomware and its behavior.

However, some common file extensions that ransomware may leave or change include:

1. .locked
2. .encrypted
3. .crypt
4. .cerber
5. .zepto
6. .odin
7. .thor
8. .arena
9. .nm4
10. .vvv

It's important to note that ransomware can also use random or custom file extensions to make it harder for victims to identify and recover their files. Additionally, some ransomware may not change the file extension at all, but instead encrypt the file contents or add a new file with a ransom note.