I have a cold forensic image of a computer that got infected with Ransomware. From what I can find with Google, this was probably TeslaCrypt/AlphaCrypt. Encrypted files have extension .CCC and folders have the _how_recover_???.txt and .html files....
What is .CCC Extension?
If your files become unreadable and end up with a .ccc extension, your computer is infected by a new variant of TeslaCrypt ransomware. This ransomware has ability to encrypt the important files in the infected machines. Any files that are encrypted with the newer variant of TeslaCrypt will have the .exx, .xyz, .zzz, .aaa, .abc, .ccc or .vvv extension appended to the end of the filename.
