Merry X-Mas ransomware-affected file
File type: Ransomware encrypted file
Files with the .rmcm1 file extension are original user files encrypted and renamed by the Merry X-Mas ransomware.
They are associated with Emsisoft Decrypter for MRCR, a utility for restoring affected files.
File type category:
Ransomware encrypted file
Date updated: October 14, 2026
The .rmcm1 file extension is associated with Merry X-Mas, a ransomware strain that first appeared in early January 2017. The extension identifies files that the ransomware encrypted and renamed; it does not indicate a separate, usable file format.
Each .rmcm1 file represents an original user file whose contents were encrypted. The ransomware's ransom note is named YOUR_FILES_ARE_DEAD.hta.
Emsisoft Decrypter for MRCR, from Emsisoft, is a Microsoft Windows utility intended to decrypt files affected by this ransomware. Once decrypted, the files can be opened using the applications associated with their original formats.
A .rmcm1 file cannot normally be opened as an original document while it remains encrypted. On Microsoft Windows, use Emsisoft Decrypter for MRCR to attempt decryption, then open the restored file with the application that supports its original format.
There is no meaningful direct conversion from the .rmcm1 file format. First decrypt the file with Emsisoft Decrypter for MRCR; after restoration, the original file can be converted using software that supports its original format.
Software apps that recover RMCM1 files:
Microsoft Windows
Language
