DeadLock Ransomware EXPOSED: .dlock Files and a Session Chat

You open Documents the way you did yesterday. The vacation photo should still be vacation.jpg. The invoice should still be invoice-2026.pdf. The tax sheet should still be taxes.xlsx. Instead every familiar name has two extra stamps tacked on. 1.jpg is now 1.jpg.F8C6A8.dlock. A small text file called READ ME.F8C6A8.txt is sitting in the same folder, as if it has always belonged there.

That is the trap, not a glitch. DeadLock ransomware locks the files first. Then it keeps the old name, writes a short victim ID, and hangs .dlock on the end. Then it drops a note named READ ME.[victim ID].txt and paints a new wallpaper across the desktop. The wallpaper says your infrastructure is DeadLocked. The note talks like a recovery desk. It is a storefront. It tells you the only door left is a Session chat, and it tells you that if you do not walk through that door they will publish what they claim they stole.

This page is for the moment those names appear. It explains the rename, the READ ME with the victim ID, the wallpaper, the Session checkout, the leak threat, and why that messenger is not a recovery team. It is about this strain, the one that leaves .dlock on the end and a READ ME that carries your ID in the filename. F8C6A8 is a sample ID used on this page and in the screenshot. The ID on your disk is the one that matters.

Overview

The first tell is the rename. DeadLock keeps the old name and the old extension, then inserts a short victim ID, then appends .dlock. 1.jpg becomes 1.jpg.F8C6A8.dlock. vacation.jpg becomes vacation.jpg.F8C6A8.dlock. invoice-2026.pdf becomes invoice-2026.pdf.F8C6A8.dlock. taxes.xlsx becomes taxes.xlsx.F8C6A8.dlock. family.mp4 becomes family.mp4.F8C6A8.dlock. You can still read what the file used to be. You cannot open it.

The second tell is the note. After the files are locked, the malware drops READ ME.[victim ID].txt into the same folders. In the sample on this page that file is READ ME.F8C6A8.txt. The victim ID is a unique string assigned to that machine. This page will not invent one for you and will not treat F8C6A8 as if it belongs to every victim. READ ME sounds like a help file. The ID makes the flyer feel personal, like a ticket number at a real counter.

The note claims military-grade encryption. That is attacker copy. It is not a lab result printed here. It tells you to download Session from getsession.org, open a chat, and contact them with the ID printed in the same file. It asks you to send one encrypted file plus a personal key for a 1 MB test decrypt. It says that after you pay they will send a decryptor. It wants Bitcoin or Monero. It does not print a ransom $ amount. It warns you not to rename the locked files, and it says third parties will only raise the price.

The third tell is the wallpaper. The desktop image changes so you cannot miss the flyer even if you never open the text file. The sample wallpaper says your infrastructure is DeadLocked, that all files were stolen and encrypted, and that you should open the Read Me file. Every time you minimize a window, the billboard is there. That is not a new technical step. It is the same storefront painted on the wall after the locksmith left.

That is the whole costume. A locked folder of .dlock names. A READ ME that carries a victim ID. A desktop that now looks like a bill. A Session chat if you follow the note. A leak threat if you stay quiet. There is no public free decryptor known for this strain. There is no reason to install Session today because a ransom note told you to. There is no reason to send them a sample file. There is no reason to invent a $ figure the note left blank on purpose.

The .dlock name is the first warning

Most lockers pick an extension so you notice the change in seconds. DeadLock uses .dlock and keeps the rest of the filename readable. You can still see vacation.jpg inside vacation.jpg.F8C6A8.dlock. You can still see the invoice year. You can still see the word taxes. The familiar words are still in the folder. The files are not familiar anymore.

Do not treat that readable name as a fix. Do not strip .dlock off the end and expect Photos or Excel to open the file. Do not delete the victim ID from the middle and hope the photo comes back. Do not run a bulk “extension fixer” you found in an ad. The name is a label. The lock is in the content. Editing the label can make a later trusted tool have a harder time matching the file to what it was.

READ ME.[victim ID].txt is a sales floor, not a help file

The file tells you the data has been encrypted. Then it adds the second lock. If you do not contact them, they say the data they claim they stole will be published. That sentence is there for people who already have backups. A backup can replace a photo. A backup cannot unsay a leak they claim they will post. The threat is meant to pull you into Session even when the folder is not your only copy.

Notice what the note does not give you. It does not give you a $ figure. It does not give you a wallet. It does not give you a support ticket that a real company would honor. It does not give you a refund policy. It gives you a Session door, a victim ID, a 1 MB test, and a tone that says this is already decided. That tone is the product. Read the file as a sales flyer that was dropped after a break-in. Then close it. Keep it on disk. Do not treat it as a set of steps you should follow.

The wallpaper is the same bill, only louder

After the files are locked, the desktop image changes. The new wallpaper repeats the same pitch so you see it even if you never open READ ME.[victim ID].txt. The sample copy says your infrastructure is DeadLocked. It says all files were stolen and encrypted. It tells you to open the Read Me file. It is there when you sit down. It is there when you close a window. It is there when a family member walks past the screen and asks what happened.

This is the hurry-up layer. A text file can be ignored if you are busy trying to open the photo. A desktop cannot. People waste the first hour on the wallpaper. They screenshot it. They search every word on it. They change the image back and hope the files follow. The files do not follow. Keep a copy if you need evidence. Changing the picture back is fine for your nerves. It is not a repair. The lock lives in every .dlock file, not in the image behind your icons.

Session is the checkout aisle

Plenty of lockers print a Gmail address or a Telegram handle. This note sends you to Session. It tells you to download the app from getsession.org and then contact them through that messenger. Session is a real project. That sentence is not an invitation to finish their checkout. Installing Session because a ransom note told you to is how a flyer becomes a live conversation.

The Session ID is printed in the note on your disk. This page will not paste one as if it belongs to every victim. Do not hunt forums for “the” DeadLock Session ID. Do not accept a Session ID from a stranger who claims they already have your case. Anyone who already knows you have .dlock files and a READ ME.[victim ID].txt note can greet you like a case manager.

The leak line is a second lock

DeadLock is sold as double extortion. First they lock the files you can see. Then they claim they already copied data off the machine, and they say that copy will be published if you do not contact them. You cannot audit that claim from the desktop. You are asked to take their word for it inside a chat they own.

On 10 August 2026, the Microsoft Security Blog described DeadLock as a Rust-based, financially motivated operation that uses Session plus blockchain-backed infrastructure on Polygon for parts of its config and recovery shop. Microsoft said the operators use double extortion, that the strain was first observed in July 2025, and that more than one group has deployed it, including affiliates of the Lynx and INC ecosystems.

The same Microsoft page said the operators had published more than 80 claimed victims on their leak blog by July 2026, with more than half of those claims in Europe. The sectors Microsoft named include IT, mining, transportation and logistics, manufacturing, hospitality, and consumer goods. Microsoft names that leak blog as deadlock.liveblog365.com. This page will not invent a Tor address next to that hostname. The leak blog is pressure. It is not a status report you can verify by chatting with the people who wrote the note.

Treat the threat as real enough to take care of accounts, and fake enough that you should not pay to test it. Change passwords from a clean device. Watch bank and email alerts. Tell the people whose files lived on that PC. Opening Session and sending a sample file is not useful work. It is the checkout.

This is not the old pop-up domain

MalwareTips already has a much older write-up for Ywt.adjudicatingdeadlocking.com pop-ups. That page is about a browser pop-up domain. It did not append .dlock to documents. It did not drop READ ME.[victim ID].txt. It did not paint a “Your infrastructure DeadLocked” wallpaper. It did not send anyone to Session.

If your only symptom is a site you never asked for jumping into the browser, you are in that older story. If documents, photos, and shares now end in .dlock, and a READ ME with a victim ID is sitting in those folders, you are not in the pop-up story. The old page wanted an ad click. This ransomware wants a payment and a conversation. Treat them as different files with a shared scrap of branding.

How The Scam Works

The shop is simple once you stop reading it as a rescue. Lock the files. Brand the names with a victim ID and .dlock. Drop a READ ME that sounds like help. Paint the desktop. Point the scared person at Session. Offer a 1 MB test so the first conversation feels fair. Keep the $ amount off the page so the chat can set it later, in private, after you have already stepped inside. Then wave a leak blog if you hesitate.

1. The lock keeps the old name so you recognize the loss

DeadLock encrypts the files it wants as leverage, then writes a short victim ID and appends .dlock. That is why 1.jpg is still readable as 1.jpg.F8C6A8.dlock. The operators want you to inventory the damage in seconds. They want you to see the vacation photo, the invoice, the tax sheet, and the family video in one glance. A coded filename can confuse you. A readable filename makes you feel the theft.

If only one folder looks wrong, do not assume the rest of the disk is safe. Ransomware walks trees. It hits Documents, Desktop, Pictures, Downloads, and any drive letter it can reach, including a USB stick you forgot was plugged in. Unplug extra disks. Do not plug in the backup drive “just to check.” Checking is how the backup gets the same .dlock ending.

2. The READ ME turns a break-in into a ticket number

The READ ME tells you the data is encrypted. It calls the lock military-grade. That claim is theirs. It is not a verification printed here. It tells you the way back is contact. It tells you the way to contact them is Session from getsession.org, then the ID already sitting in the filename. Then it offers a 1 MB test so the next click feels like due diligence instead of a payment.

The victim ID is not a gift. It is a handle. It lets them keep your chat separate from the next victim. It lets a later fake helper say “send me your READ ME” and look prepared. Copy the filename for your own records if you need to describe the incident. Do not paste that ID into a stranger’s form. Do not read the ID out on a phone call that started with “we can decrypt .dlock files.”

3. The wallpaper hurries you toward the note

After the rename, the desktop changes. The wallpaper does not add a new demand. It repeats the one you already have. Your infrastructure is DeadLocked. The files were stolen and encrypted. Open the Read Me file. That last line is the whole job of the picture. It turns a closed text file into a billboard you cannot put in a drawer.

4. Session is the storefront

The note does not send you to a shop with a padlock icon and a return policy. It sends you to Session. That line is an identifier. It tells you which campaign you are looking at. It is not a support queue. Microsoft’s August 2026 write-up is blunt about why that messenger is useful to this crew. Session plus a blockchain-backed config store on Polygon makes parts of the recovery shop harder to take offline. Resilience for them is not a service for you.

Do not install Session “just to see.” Do not attach a file “just to ask a question.” Every message is a signal that a person is sitting in front of the locked machine and is willing to talk. That is the moment the price, the pressure, and the follow-up scams begin. If you already use Session for other reasons, that is your business. Do not use it today to open the ID printed in READ ME.[victim ID].txt.

5. The 1 MB test is not a contract

The note offers a free test. Send one encrypted file and a personal key, and they will decrypt up to 1 MB to prove they can give the rest back. That offer sounds reasonable. It is one of the oldest lines in this business. Unlocking a junk PDF does not unlock the payroll folder. It does not prove the leak copies will be deleted. It does not prove the decryptor they later sell will finish the job.

The test also gives them more of your data. A “worthless” file can still hold a client name, an address, or an internal path. The personal key they ask for is another handle. You do not owe them a sample. You do not need their proof. If a trusted decryptor ever appears, it will come from a project like No More Ransom, not from a Session thread that just locked your share. Of course they can open a file they locked. The 1 MB demo is how the payment conversation starts. Do not send the sample.

6. Bitcoin or Monero with no printed $ figure

The note says you must pay. It names Bitcoin or Monero. It never writes a USD price. It never writes a coin amount. The blank is the point. A missing number lets them invent the bill after they see who you are. A home user with family photos is one conversation. A shop with customer mail is another. The chat is where they can name a $ figure that matches whatever they think you will pay.

Treat any later number, in Session or in a follow-up mail, as a demand. It is not a quote from a vendor with a refund policy. If you start buying Bitcoin or Monero “just in case,” you have already begun their checkout. Do not fund a wallet because the note sounded organized.

7. The leak blog is pressure

After the lock, the note spends its best sentences on the data it says it already stole. Microsoft’s August 2026 reporting put a public shape on that threat. The operators’ leak blog, named there as deadlock.liveblog365.com, had more than 80 claimed victims, more than half of them in Europe. IT shops, mines, transport and logistics firms, factories, hotels, and consumer-goods companies were in the mix Microsoft listed.

Believe the risk enough to treat it as a possible breach. Tell counsel and your incident lead if this is a company. Do not believe the promise enough to buy a deletion you cannot verify. The CISA StopRansomware Guide is blunt about this kind of squeeze. Paying does not ensure the files come back, does not ensure the systems are clean, and does not ensure the data stays unpublished.

Do not browse the leak blog “just to see if you are listed.” That visit does not unlock vacation.jpg.F8C6A8.dlock. If someone later sends you a link and says your company is already on the operators’ leak blog, treat that message as part of the same sale. Report it. Do not start a bidding war over silence.

8. Third parties sell the same miracle

The READ ME warns you not to rename the locked files and not to use third-party decryptors. It says outsiders will only raise the price. Part of that warning is self-serving. The authors want you talking to them, not to a relative, an insurer, or a real technician. Part of it is still a useful caution in the wrong mouth. Mystery “one-click decrypt” apps from ads can damage files. Bulk rename tools can scramble names that a later trusted project might have used.

After a ransomware incident, search results fill up with companies that say they can decrypt DeadLock or “all .dlock files.” Some of those shops are ordinary overpriced consultants. Plenty are a second scam. They will quote the victim ID so they sound close to the case. They will ask for a sample file, a remote-access session, or a deposit. They may even open one junk file, because anyone who is in contact with the original criminals can borrow the same 1 MB demo. Then the price rises, the chat dies, or the remote tool installs more malware.

9. Payment closes nothing

Paying is not a guarantee. The people who send the note can take the money and disappear. They can send a tool that only unlocks a few files. They can come back later and lock the same machine again. A Session chat makes that outcome easier, not harder. You cannot leave a review on a private messenger.

What To Do If Your Files End in .dlock

Do not install Session today because READ ME.[victim ID].txt told you to. Do not open the Session ID printed in the note. Session is the storefront. Do not send one encrypted file plus a personal key for their 1 MB test. Do not pay a $ figure they name after you arrive. Do not invent a payment the note never printed. The leak blog is pressure, not a reason to start that chat. If you already opened Session before you found this page, stop there. Do not send more files. Do not pay a deposit to “hold the price.”

• STEP 1: Use Rkill to terminate suspicious programs.
• STEP 2: Use Malwarebytes to remove for Ransomware and Unwanted Programs
• STEP 3: Use HitmanPro to remove Trojans and other Malware
• STEP 4: Use AdwCleaner to remove Malicious Browser Extensions and Adware
• STEP 5: Perform a final check with ESET Online Scanner
• STEP 6: Restore the files encrypted by ransomware

STEP 1: Use Rkill to terminate suspicious programs.

In this first step, we will download and run Rkill to terminate suspicious programs that may be running on your computer.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 2: Use Malwarebytes to remove Ransomware and Unwanted Programs

In this second step, we will install Malwarebytes to scan and remove any infections, adware, or potentially unwanted programs that may be present on your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   DOWNLOAD MALWAREBYTES FOR WINDOWS (FREE)
   
   (The link opens in a new page where your download will start)

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.

   

STEP 3: Use HitmanPro to remove Rootkits and other Malware

In this third step, while the computer is in normal back, we will download and run a scan with HitmanPro to remove Trojans, rootkits, and other malicious programs.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   DOWNLOAD HITMANPRO (FREE SCAN)
   (The link opens in a new page where your download will start)

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 4: Use AdwCleaner to remove Malicious Browser Extensions and Adware

In this next step, we will use AdwCleaner to remove malicious browser policies and unwanted browser extensions from your computer.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   DOWNLOAD ADWCLEANER (FREE)
   (The link opens in a new page where your download will start)

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner_x.x.x.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

STEP 5: Perform a final check with ESET Online Scanner

This final step involves installing and running a scan with ESET Online Scanner to check for any additional malicious programs that may be installed on the computer..

ESET Online Scanner is a free second-opinion scanner that performs a deep, full-system check for viruses, trojans, rootkits, and other malware. We use it as the final step because it’s thorough — if anything slipped past the previous scans, ESET will find it. A clean result here means your computer is malware-free.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   

   DOWNLOAD ESET ONLINE SCANNER (FREE)
   (The link opens in a new page where your download will start)

2. Run the Installer

   When the download finishes, open your Downloads folder and double-click “esetonlinescanner.exe“.
   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   On the Terms of use screen, click Accept.
   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.
   

4. Start a Full Scan

   Click Full Scan — this checks your entire computer, not just the common hiding spots.

   

   Select Enable for Detection of Potentially Unwanted Applications — this lets ESET catch adware and bundled junk programs, not just viruses. Then click Start scan.

   

5. Wait for the Scan to Finish

   ESET will now check every file on your computer. Because it’s a full scan, this can take a while — often an hour or more, depending on how much data you have. Leave it running in the background and check on it from time to time.

   

6. Review the Results

   When the scan completes, the Found and resolved detections screen appears. Any threats found were automatically cleaned and quarantined — there’s nothing extra you need to do. Click View detailed results if you want to see exactly what was removed.
   

   If ESET found nothing — congratulations, your computer has passed the final check and is malware-free.

STEP 6: Restore the files encrypted by ransomware

Unfortunately, in most cases, it’s not possible to recover the files encrypted by this ransomware virus because the private key which is needed to unlock the encrypted files is only available through the attackers. However, below we’ve listed three options you can use to try and recover your files.

Option 1: Search a decryption tool for this ransomware

The cybersecurity community is constantly working to create ransomware decryption tools, so you can try to search these sites for updates:

• https://id-ransomware.malwarehunterteam.com/
• https://decrypter.emsisoft.com/
• https://noransom.kaspersky.com/
• https://www.avast.com/ransomware-decryption-tools

Option 2: Use EaseUS Data Recovery Wizard Free to recover the encrypted files

EaseUS Data Recovery Wizard Free can restore files and repair corrupted files with simple clicks. Its powerful scanning algorithms can identify and retrieve huge file type library, including all of the popular video files, audio files, photos, and document formats.
While the free version only allows you to recover 2 GB of data, this can be helpful to see if the recovery is possible and restore back the most important files from your computer.

1. Download EaseUS Data Recovery Wizard Free.

   You can download EaseUS Data Recovery Wizard Free by clicking the link below.

   

   EASEUS DATA RECOVERY WIZARD FREE DOWNLOAD LINK
   (The above link will open a new page from where you can download EaseUS Data Recovery Wizard)

2. Double-click on the EaseUS Data Recovery Wizard Free setup file.

   When EaseUS Data Recovery Wizard Free has finished downloading, double-click on the setup file to install EaseUS Data Recovery Wizard on your computer. In most cases, downloaded files are saved to the Downloads folder.

   

   You may be presented with a User Account Control pop-up asking if you want to allow EaseUS to make changes to your device. If this happens, you should click “Yes” to continue with the EaseUS Data Recovery Wizard Free installation.

3. Follow the on-screen prompts to install EaseUS Data Recovery Wizard.

   When the EaseUS Data Recovery Wizard installation begins, click on the “Install Now” as seen in the image below.
   

   When your EaseUS Data Recovery Wizard installation completes, click the “Start Now” button to start the program.
   

4. Select a location to start recovering the encrypted files.

   Choose the drive or folder where you are the encrypted files that you want to recover and click “Scan“.
   

5. Wait for the EaseUS Data Recovery Wizard scan to complete.

   EaseUS Data Recovery Wizard will now scan your computer files that can be restored. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
   

6. Find the files you want to recover.

   When the EaseUS Data Recovery Wizard scan is finished scanning it will show a screen that displays the files that can be recovered. This tool can recover a lot of data, use the “Filter” button to quickly filter specific file types and find the files that you want to recover.
   

   Click the “Preview” button or double-click on a file for a full preview.
   

7. Select your files and click “Recover”.

   Finally, select the the files you want to recover and click “Recover“.
   
   Choose a safe location to save all the files.
   
   The free version only allow you to recover 2 GB of data, however, this will allow you to recover the most important files and see if EaseUS Data Recovery Wizard can correctly recover them.
   

Option 3: Try to restore your files with ShadowExplorer

This ransomware will attempt to delete all shadow copies when you first start any executable on your computer after becoming infected. Thankfully, the infection is not always able to remove the shadow copies, so you should continue to try restoring your files using this method.

1. Download ShadowExplorer.

   You can download ShadowExplorer from the below link.

   SHADOW EXPLORER DOWNLOAD LINK
   (This link will open a new web page from where you can download “ShadowExplorer”)

2. Install ShadowExplorer.

   Double-click on the ShadowExplorer-x.x-setup file to start the installation process, then follow the on-screen promts to install this program.
   

3. Select snapshot date.

   Open ShadowExplorer and then from the top bar select the drive where the files that you want to save are located, then select from the snapshot available one previous to this infection.

   

4. Export the files that you want to recover.

   Once you have found a copy of the original file or folder, right-click on it and the select “Export”. A window will prompt you where you want to save the file or folder.
   

Keep every .dlock name exactly as it is. Do not bulk-rename 1.jpg.F8C6A8.dlock back to 1.jpg, or vacation.jpg.F8C6A8.dlock back to vacation.jpg, or invoice-2026.pdf.F8C6A8.dlock back to a normal PDF. Stripping the extra ending is not a repair. It can make a later trusted tool worse, not better. The original name is already sitting in front of the victim ID and .dlock.

Keep READ ME.[victim ID].txt with the locked files. Do not “clean up” every copy of the note. Do not invent a new victim ID if you are writing the incident down. Use the ID that is already in the filename on your disk. F8C6A8 is only the sample on this page. Keep a copy of the wallpaper if you still have it. Those two artifacts are how you prove this was DeadLock and not a different locker that only sounds similar. They are evidence. They are not instructions you should carry out.

Do not run a third-party decryptor you found in an ad, a YouTube description, or a Telegram “recovery” channel. The note already warned you those tools can wreck the files and that third parties raise the price. On the first point the criminals and the honest advice agree, for opposite reasons. They want you exclusive. You want the bytes untouched. Leave the locked copies alone until a trusted project publishes a tool for this family. None is public now.

If a later message quotes your victim ID and offers “the real Session,” that is still the same shop. If a later message skips Session and asks for a $ figure over ordinary email, that is still the same shop, or a copycat standing in the same doorway. If someone claims they already saw you on the operators’ leak blog and can take the listing down for a fee, that is still the same market. Do not answer. Do not help them set a price the original note left blank on purpose.

A 1 MB demo in that chat is not a reason to skip the CISA ransomware reporting page or a report at the FBI IC3 desk. The clock is theirs. The files are already locked. Another night of panic will not change the bytes.

The Bottom Line

DeadLock ransomware is a locker with a readable filename and a READ ME that carries a victim ID. It keeps the old name, writes a short ID, and appends .dlock. 1.jpg becomes 1.jpg.F8C6A8.dlock. vacation.jpg becomes vacation.jpg.F8C6A8.dlock. invoice-2026.pdf becomes invoice-2026.pdf.F8C6A8.dlock. taxes.xlsx becomes taxes.xlsx.F8C6A8.dlock. family.mp4 becomes family.mp4.F8C6A8.dlock. The note is READ ME.[victim ID].txt. In the sample that file is READ ME.F8C6A8.txt. The desktop wallpaper repeats the same bill: your infrastructure is DeadLocked, the files were stolen and encrypted, open the Read Me file.

The note does not print a ransom $ amount. It claims military-grade encryption, which is attacker copy, not a result verified here. It tells you to download Session from getsession.org, contact them with the ID printed in the note, send one encrypted file plus a personal key for a 1 MB test, then pay in Bitcoin or Monero for a decryptor. It warns you not to rename files and says third parties raise the price. Microsoft’s 10 August 2026 Security Blog describes a Rust-based, financially motivated shop that uses Session and Polygon-backed infrastructure, double extortion, and more than 80 claimed victims on the operators’ leak blog, deadlock.liveblog365.com, more than half of them in Europe. This is not the old Ywt.adjudicatingdeadlocking.com pop-up. There is no public free decryptor known for this strain.

Do not pay. Do not open that Session chat. Do not send the sample file. Do not rename the pile in bulk. If you take one sentence with you, take this. A folder of names ending in .dlock, plus a READ ME.[victim ID].txt note and a new wallpaper, is ransomware on the first sighting. Treat it that way before anyone in that chat names a $ figure.