Merry X-Mas ransomware affected file
File type: Ransomware encrypted file
Files with the PEGS1 file extension were encrypted and renamed by the Merry X-Mas ransomware.
A PEGS1 file is a ransomware-encrypted version of an original user file, not a normal document format.
File type category:
Ransomware encrypted file
Date updated: October 14, 2026
The PEGS1 file extension was used by the Merry X-Mas ransomware, which first appeared in early January 2017.
A PEGS1 file contains data from an original user file that the ransomware encrypted and renamed. The ransom note created by this ransomware is named YOUR_FILES_ARE_DEAD.hta.
Emsisoft Decrypter for MRCR is a Microsoft Windows program intended to decrypt files affected by the relevant ransomware. PEGS1 is a ransomware artifact rather than an independently maintained file format.
A PEGS1 file cannot normally be opened in its encrypted form. On Microsoft Windows, use Emsisoft Decrypter for MRCR to try to decrypt it and recover the original file.
After successful decryption, open the recovered file with a program that supports its original format.
A PEGS1 file cannot be meaningfully converted while it remains encrypted. It must first be decrypted with Emsisoft Decrypter for MRCR or another tool that supports the affected ransomware variant.
Once decrypted, the recovered file can be converted or exported using software that supports its original format.
Software apps that recover PEGS1 files:
Microsoft Windows
Language
