Several  malware samples use a common function to identify target files by their extension.  malware families can also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.