REvil checks the Software\recfg registry key for the presence of the rnd_ext value. This value contains the random extension generated at runtime that is appended to encrypted files. If this registry value does not exist, the malware generates a random string of lowercase letters (a-z) and numbers (0-9) ranging from five to ten characters in length (inclusive) and preceded by a period (e.g. 9781xsd4). This string is assigned to the rnd_ext value within the recfg registry subkey