Princess Locker ransomware-affected file
File type: Ransomware encrypted file
Files with the .1cbu1 file extension have been encrypted and affected by the Princess Locker ransomware.
The extension identifies an encrypted file, not a regular document or media format.
File type category:
Ransomware encrypted file
Date updated: October 9, 2026
Princess Locker was ransomware reported in September 2016. It encrypted users' files, changed their file suffixes to .1cbu1, and demanded a ransom in exchange for decryption.
The affected file contains the user's original data in encrypted form. The suffix is added or changed by the ransomware and does not describe the original file format, so it cannot be interpreted reliably without decrypting the file first.
Princess Locker targeted Windows computers. A decryptor and a key-generation tool were reported as released in November 2016, but the extension itself is not a format supported by ordinary applications.
A .1cbu1 file cannot normally be opened with a document, image, archive, or media application. It must first be decrypted with a decryptor compatible with the affected Princess Locker files.
Decryptor tools and a key-generation tool were released in November 2016. After successful decryption, the original file can be opened with the application associated with its original filename extension.
A .1cbu1 file cannot be meaningfully converted while it is encrypted. The files must first be recovered and decrypted.
Once decryption restores the original data and filename extension, the resulting file may be converted with software that supports its original format.
Language