Samas/SamSam ransomware-affected file
File type: Ransomware encrypted file
Files with the .whereisyourfiles file extension are files encrypted by a variant of Samas/SamSam ransomware and renamed with this suffix.
File type category:
Ransomware encrypted file
Date updated: October 22, 2026
The .whereisyourfiles file extension was used by some later variants of Samas/SamSam ransomware, which first appeared in late December 2016. The ransomware targets files on Windows systems and makes their original contents inaccessible by encrypting them.
The ransomware also drops a ransom note named WHERE-YOUR-FILES.html in affected folders. These files are not a separate document format; the suffix identifies files affected by the ransomware.
A .whereisyourfiles file cannot be opened normally because its contents are encrypted. A decryptor that supports the specific Samas/SamSam variant is required to restore access.
Renaming the suffix does not decrypt the file.
There is no meaningful way to convert a .whereisyourfiles file while it remains encrypted. Decrypt the file first; after recovery, it can be opened or converted according to its original file type.
Language