Orexin EXPOSED: .orexin Files, HOW_TO_RECOVER.txt, and Telegram

You open Documents the way you did yesterday. The first photo should still be 1.jpg. Instead the name has grown a tail. 1.jpg is now 1.jpg-id-5645098835[orexin@atomicmail.io].orexin. A small text file named HOW_TO_RECOVER.txt is sitting in the same folder, as if it has always belonged there. The desktop background has changed too. It shouts ALL YOUR FILES ARE ENCRYPTED.

That is the trap, not a glitch. The lock keeps the old name so you can still read what you lost. The extra ending, the inbox in brackets, and the id string are branding. The text file talks like a recovery desk. The wallpaper talks like a siren. None of that is a help desk. The people who rewrote the bytes already finished the first half of the job. The second half is getting you to write back.

Overview

Orexin ransomware locks the files first. Then it keeps the original filename and hangs a long tail on the end: -id-, a number, the inbox [orexin@atomicmail.io], and the extension .orexin. In the published test sample, 1.jpg becomes 1.jpg-id-5645098835[orexin@atomicmail.io].orexin. That is the only id this page will print. Other locked files in the same folder keep their original names and pick up the same -id-5645098835[orexin@atomicmail.io].orexin tail. You can still read what the file used to be. You cannot open it.

The second tell is the note. After the files are locked, the malware drops HOW_TO_RECOVER.txt into the same folders. HOW TO RECOVER sounds like a procedure. A .txt file opens in Notepad. That combination is meant to be the first English you can still read when the photos will not open. The note is a storefront. It points at orexin@atomicmail.io and at Telegram the Orexin Telegram account. It offers to decrypt one non-valuable file for free. It warns you not to rename the locked copies and not to use third-party tools.

The third tell is the wallpaper. The background shout is ALL YOUR FILES ARE ENCRYPTED. In the published sample the personal ID field on that wallpaper is blank. This page will not invent a personal ID to finish the sentence. A blank ID is still a costume of paperwork. It is not a missing digit you should hunt in a chat.

Windows may now call the type an OREXIN File and offer a useless “choose an app” box. An app cannot talk the bytes back into a JPEG. Double-clicking 1.jpg-id-5645098835[orexin@atomicmail.io].orexin does not open the photo. Spreadsheet software does not open a workbook that picked up the same tail. A video player does not open a clip that picked up the same tail. The listing still has one object per file. The shock lands because the original name is still sitting in front of the lock.

That is the whole costume. A locked folder of .orexin names with the inbox baked into the filename. A HOW_TO_RECOVER.txt file that talks like a recovery brief. A wallpaper that shouts ENCRYPT. A personal ID left blank in the published sample. An inbox. A Telegram door. One free file that is not a gift. A ban on rename and on other tools. There is no public free decryptor known for this strain. There is no printed ransom figure. There is no reason to mail that inbox or open that Telegram today because a text file told you to.

The .orexin tail is the first warning

Most lockers pick a short extra ending so you notice the change in seconds. Orexin uses a long one. The original name stays. Then comes -id-, then a number, then the operators’ inbox in brackets, then .orexin. The published test example is 1.jpg-id-5645098835[orexin@atomicmail.io].orexin. You do not have to decode anything. You can still see 1.jpg inside the new name. You can still see the inbox they want you to use. The familiar words are still in the folder. The files are not familiar anymore.

Do not treat that readable name as a fix. Do not strip .orexin off the end and expect Photos to open the file. Do not clip off -id-5645098835[orexin@atomicmail.io].orexin and save the leftover as 1.jpg. Do not run a bulk “extension fixer” you found in an ad. The name is a label. The lock is in the content. Editing the label can make a later trusted tool have a harder time matching the file to what it was. Leave the locked copies as they are until you have a clean machine and a plan that does not start in a criminal inbox or a criminal chat.

The same readable names also make a later scam easier. Anyone who sees a pile of .orexin files can pretend they already “have your case.” They can quote 1.jpg-id-5645098835[orexin@atomicmail.io].orexin back to you. They can mention HOW_TO_RECOVER.txt so they sound close. They can offer a paid unlock. The extension is branding. The leftover original name is branding. The inbox in the filename is branding. None of that is a hint that the file can be renamed back to normal.

HOW_TO_RECOVER.txt is a sales floor, not a help file

The note is named to be opened. HOW TO RECOVER. Plenty of real software drops a text file. This one uses that habit against you. It is meant to be the first thing you double-click when the folder already looks wrong. A .txt file does not look like an installer. It does not look like a second payload. It looks like instructions. Instructions are easier to obey than a threat.

The body of the note is a script. Your files are locked. Do not rename them. Do not use third-party tools. Contact us here. We will unlock one non-valuable file so you can see that we are real. Each line has a job. The lock line is there so you feel outmatched. The rename line is there so you do not try a local edit. The tool line is there so you do not try anything they do not control. The contact line is checkout. The free-file line is the demo counter. Keep the file on disk. Then close it. Do not treat it as a set of steps you should follow.

The filename is evidence. Copy the name you actually have. Do not tidy it. Do not shorten it to “the recover file.” Do not type a guessed string into Telegram so a stranger can “look you up.” Do not mail a copy of the note to orexin@atomicmail.io to “open a ticket.” The note is how you prove this was this strain. It is not a password, and it is not a claim ticket you redeem in a chat.

ALL YOUR FILES ARE ENCRYPTED is wallpaper theater

The wallpaper shout does the same job a fake breaking-news banner does on a scare page. It names the disaster in capital letters so the rest of the flyer feels like the only adult in the room. You are supposed to stop thinking and start obeying. ALL YOUR FILES ARE ENCRYPTED is not a diagnosis you needed. You already saw 1.jpg-id-5645098835[orexin@atomicmail.io].orexin in the folder. The background is there so you cannot look away.

The shout is also a brand. Later search ads will quote it. Later “helpers” will paste it so they sound close to your machine. Anyone can copy a headline. Copying ALL YOUR FILES ARE ENCRYPTED does not mean they can reverse .orexin. It means they read the same wallpaper you did, or they read a screenshot of it.

If the wallpaper is sitting on more than one profile on the same PC, that is normal for this family. Lockers change the background so you cannot miss the pitch. Finding the shout on the lock screen and on the desktop is not two incidents. It is one incident with a loud flyer. Photograph it from a phone if you need evidence. Then leave it. You do not need to “fix the wallpaper” before you isolate the machine. You do not need to ask Telegram what the shout means.

The personal ID on the wallpaper is blank on purpose

The published sample leaves the personal ID field empty. That gap is the hook. A filled ID would look like a case number. An empty ID looks like a form you failed to complete. People try to complete forms. They hunt forums. They ask a stranger for “the real ID.” They type random strings. They wait for a later email that claims to hold the missing line.

This page will not invent a personal ID to put in that blank. If your copy of the wallpaper is empty there, it is empty. Photograph it as evidence. Do not tidy it. Do not fill it in so it looks more professional. Do not accept a long digit string from a comment, a Telegram channel, or a “helper” who already knows the extension. Anyone can read .orexin off a screenshot. Handing you digits does not prove they can open 1.jpg-id-5645098835[orexin@atomicmail.io].orexin.

A blank ID also gives copycats a job. They will sell the missing string. They will say the published sample was incomplete and they have the operator’s real ticket. They will ask you to open Telegram first, then paste what they send. That is still the same shop, or a second shop standing in the same doorway. The original flyer left the field empty. Do not finish it for them.

orexin@atomicmail.io is checkout, not a help desk

The inbox is printed in two places you cannot miss. It sits inside every locked filename, in brackets, as [orexin@atomicmail.io]. It also sits in the note as the address you are supposed to write. That repetition is not a courtesy. It is a checkout aisle painted onto the files themselves. Even if you never open HOW_TO_RECOVER.txt, the listing already tells you where they want the mail to go.

Do not mail that inbox. Do not send a sample file to prove you are a real victim. Do not argue about a price that has not been printed. Do not ask them to “confirm” the blank personal ID. An inbox is how a locked photo becomes a negotiation. Negotiation is how a demand appears. The filename already told you the door. Walking through it is the product.

Keep the string as an identifier. orexin@atomicmail.io is how you prove this was this strain when you write an incident report. It is not a support queue. Atomic Mail is a real mail brand. That is why the line works. A made-up mail domain would feel like a scam. A real provider feels like a procedure. The procedure is still theirs. A real mail host is not a recovery desk for .orexin files.

Telegram is the other storefront

The note also points at Telegram, at the Orexin Telegram account. A messenger puts you in a room they own, on an account they can delete, with a chat they can screenshot and reuse. Email at least leaves a copy in your Sent folder. A private chat can vanish. Exclusive contact in a messenger is the important part of the pitch even when they also print an inbox. They want the conversation where they set the rules.

Do not open Telegram today because HOW_TO_RECOVER.txt told you to. Do not join the Orexin Telegram account to “see if it looks real.” Looking real is the job of a channel. A logo, a post history, a pin, a sample decrypt screenshot: all of that is storefront design. None of it is a decryptor on your disk. A handle is cheap to copy. A channel is cheap to clone. After a wave of .orexin files, copycats will stand in the same doorway.

Writing the first message does not start a warranty. It starts a negotiation you cannot enforce, on a platform they chose because it is hard to unwind. If you already had Telegram installed for ordinary messages, that does not make this a support channel. Close the note. Stay out of a new conversation that starts from HOW_TO_RECOVER.txt.

One free file is a sample stall, not a gift

The note offers to decrypt one non-valuable file for free. That sentence is meant to sound like proof. Proof is how a scared person becomes a customer. You send a junk file. They send it back unlocked. You feel that the other side can do the job. Then the real files, the ones that matter, get a price that was never printed on the wallpaper or in the text file.

A demo that unlocks one file is not proof they can unlock the rest. Anyone who holds a key can open one junk object they asked you to pick. Anyone can unlock a file they planted. Anyone can send back a clean copy of a photo they already had. The word non-valuable is the tell. They do not want the first exchange to give you the file you actually need. They want the first exchange to train you to keep writing.

Do not send a test file. Do not pick “a small one” because the note said non-valuable. Do not let a relative pick one “just to see.” Seeing is the product. Once you have seen a decrypt, the rest of the script is a checkout. The free file is not mercy. It is a sample counter at the front of the shop.

Do not rename, and do not run other tools, is a leash

The note warns you not to rename the locked files and not to use third-party tools. On its face that sounds like a warning about wrecking the lock. In the flyer it does extra work. It tells you to stay inside their story. It tells you a relative who wants to copy the files off the machine is a threat. It tells you a trusted incident desk is a threat. It tells you waiting for a public tool is a threat.

There is a narrow truth hiding in that line, and it is not theirs. Do not run random decryptors from ads. Do not bulk-rename the pile. Do not feed 1.jpg-id-5645098835[orexin@atomicmail.io].orexin into a website that promises to unlock files in the browser. Those steps can damage files. The note uses that risk as a leash. You can respect the files without obeying the people who locked them. Keep the copies. Do not follow HOW_TO_RECOVER.txt as a playbook.

How The Ransomware Works

The shop is simple once you stop reading it as a rescue. Lock the files. Keep the old name. Hang -id-5645098835[orexin@atomicmail.io].orexin on the end. Drop HOW_TO_RECOVER.txt. Change the wallpaper to ALL YOUR FILES ARE ENCRYPTED. Leave the personal ID blank. Point the scared person at orexin@atomicmail.io and at the Orexin Telegram account. Offer one non-valuable file as a demo. Warn them not to rename and not to use other tools. Then wait.

1. The lock keeps the old name so you recognize the loss

The first move is the rename you can see in Explorer. Orexin leaves the original filename in place and appends the long tail. 1.jpg is still readable inside 1.jpg-id-5645098835[orexin@atomicmail.io].orexin. That is not a courtesy. Recognition is the product. If the files became random blocks with no names, you might delay. If the names are still yours, you feel the loss immediately, and you look for the file that explains it.

If only one folder looks wrong, do not assume the rest of the disk is safe. Ransomware walks trees. It hits Documents, Desktop, Pictures, Downloads, and any drive letter it can reach, including a USB stick you forgot was plugged in. Unplug extra disks. Do not plug in the backup drive “just to check.” Checking is how the backup gets the same .orexin ending.

Double-clicking a renamed file does not bring the photo back. The thumbnail may already look broken. Excel may ask for a workbook that is still sitting in the same folder, only the bytes inside are no longer a workbook. That broken open is the first proof. The second proof is the extra ending. Together they are enough. You do not need Telegram to confirm what you are looking at. You do not need to mail orexin@atomicmail.io to confirm it either.

2. The id string and the inbox in the filename are branding

The published tail is not a random jumble. It is a billboard. -id-5645098835 looks like a ticket. [orexin@atomicmail.io] looks like a return address. .orexin looks like a file type. Put them after the original name and every listing becomes an ad for the same shop. You do not have to open the note to learn where they want the mail. The files already say it.

This page will not invent another id to put next to 5645098835. That number is the published test example. If your own files show a different digit string in the same slot, copy the name you actually have. Do not tidy it. Do not type a guessed id into Telegram so a stranger can “look you up.” Do not treat 5645098835 as a password. It is a label in a filename. It is not a key.

The inbox in brackets does extra work. It trains you to see orexin@atomicmail.io as part of the file, the way a real program might stamp an author. Stamp is not ownership. Stamp is advertising. Quoting the inbox back to you later does not make a helper legitimate. The inbox is public. It is sitting in the folder. Quoting it proves nothing except that they can read a listing.

3. HOW_TO_RECOVER.txt turns a break-in into a ticket

Once the folder looks wrong, the note has to look like the answer. HOW_TO_RECOVER.txt is built for that moment. It is a .txt file, so Windows opens it in Notepad. On many machines a text file sorts near the top, especially with a name in capitals. You open it because it looks like the only thing that still speaks English.

A help file is allowed to tell you what not to do. A help file is allowed to name a support channel. A help file is allowed to offer a test. The note borrows that voice. It is not support. It is the operators introducing themselves as the only vendor left, using the folder they just broke as the waiting room.

Notice what the note does not give you. It does not give you a company, a refund policy, or a way to prove the other side will ever send a key. It does not give you a printed ransom figure. It does not fill the personal ID on the wallpaper. It gives you a tone that says this is already decided. That tone is the product. Read the file as a sales flyer. Then close it. Keep it on disk.

4. The wallpaper shout is the second flyer

Changing the desktop is not a technical requirement for the lock. The files are already unreadable with the old background still in place. The shout is theater. ALL YOUR FILES ARE ENCRYPTED sits behind every window you open, so even a browser search happens in front of their headline. That is the intended mood. Fear of the background is a reason to comply in private.

Do not perform for it. Do not send a screenshot of the wallpaper to the Orexin Telegram account to prove the lock. They already chose the extension. They already chose the note name. They already chose the shout. A photo of the background sitting behind 1.jpg-id-5645098835[orexin@atomicmail.io].orexin does not make you a verified customer. It makes you a person still following the flyer.

If you need a record, photograph the screen with a phone from a machine that is not the infected one, or from the phone itself. Then isolate the PC. Changing the wallpaper back is not recovery. It only hides the flyer. The locked files stay locked either way.

5. The blank personal ID is a form they never filled

The published wallpaper leaves the personal ID empty. Two empty feelings sit next to each other: a shout that says everything is gone, and a field that says you do not even have a ticket. That pair is not sloppy paperwork. It is a costume of paperwork. Unique ID sounds like a claim ticket. Claim tickets make people wait in line. The line they want is a mail thread or a Telegram thread.

Do not invent a personal ID. Do not hash your computer name and send the hash. Do not type the filename HOW_TO_RECOVER.txt into a chat as if that were the ID. Do not use 5645098835 as a serial you redeem. Those strings identify the strain, or they identify the published sample. They do not identify you to a rescue team, because there is no rescue team on the other side of that wallpaper.

If a later copy of the wallpaper on your disk actually contains a string in that field, keep the photo. Do not send the string. Do not post it. An identifier on a ransom wallpaper is evidence for a responder and for a report. It is not a password you redeem in Telegram. The sample described here is blank. Treat a filled line, if you have one, as more evidence, not as a door.

6. The inbox is one door they want you to walk through

The recovery steps in the note start with contact. orexin@atomicmail.io is the mail door. It is free to write, the note wants you to believe. Writing feels cheaper than paying. Writing feels reversible. Writing is how they get you into a thread, where a demand can appear for the first time. The flyer never had to print a ransom amount. The first message does the work of one.

Do not mail that inbox. Do not send a test file through it. Do not ask what they want. A price is how the rest of the script starts. Once you are in the thread, the blank personal ID has something to attach to. Silence is not rude here. Silence is how you stay out of their queue.

If someone later says they will “talk to Orexin for you” by mailing orexin@atomicmail.io on your behalf, that is a broker pitch. Brokers need you in the same funnel. You do not owe them a seat. Report the incident through official desks. Let counsel decide if contact is ever required for a specific legal reason. That decision is not yours to make from the Documents folder at midnight.

7. Telegram is the other door

The second contact path is Telegram, at the Orexin Telegram account. A real messenger is why the line works. A made-up chat brand would feel like a scam. A real app with a real t.me page feels like a procedure. The procedure is still theirs. Telegram is where ordinary people chat in private. This flyer wants that privacy for the operators, not for you.

Do not open Telegram. Do not install it for this incident if you do not already use it. Do not send a test file through it. Do not ask what they want. Do not paste a folder listing into a new chat to prove you are a victim. A messenger thread is how a locked photo becomes a negotiation on a clock they invent in the window.

A handle is cheap to copy. After a wave of .orexin files, a second account will appear with a similar name. It will quote HOW_TO_RECOVER.txt. It will quote the wallpaper shout. It will offer the same one-file demo. The original operators and the copycats want the same first step from you: open the chat. Do not take that step.

8. One non-valuable file is the demo counter

The free-file offer is the closer that does not look like a closer. You are not asked to pay yet. You are asked to pick something that does not matter. Picking feels cheap. Picking feels reversible. Picking is how they get a sample from your disk into their hands, and how they get a decrypt screenshot into yours.

That screenshot is advertising. It will be reused. It will be sent to the next person who opens HOW_TO_RECOVER.txt. It does not prove they can rebuild every file that now ends in .orexin. It proves they can run a demo. A demo is what a stall uses when the price is still unprinted.

Do not pick a file. Do not send a thumbnail. Do not send a crop. Do not send metadata. The note already has the filename pattern. The operators already chose 1.jpg-id-5645098835[orexin@atomicmail.io].orexin as the shape of the lock. They do not need a second copy from you to know what they did.

9. The rename ban and the tool ban fence the shop

The note warns against rename and against third-party recovery tools. Read that again as a sales line. If other tools are forbidden, their chat is the only shop. If rename is forbidden, the small local experiment you might have tried at 2 a.m. becomes too scary to try. The warning is not a lab result. It is a fence around the storefront.

Random “.orexin decryptor” ads are a real second scam, and you should not run those either. That does not make the criminals your IT department. A trusted restore path, when you have one, is not “a third-party tool” they get to veto. An offline copy they never touched is not theirs to poison with a sentence. The note wants you to treat every option except orexin@atomicmail.io and the Orexin Telegram account as sabotage. That is how a monopoly talks, not how a recovery team talks.

Leave 1.jpg-id-5645098835[orexin@atomicmail.io].orexin named as it is. Leave HOW_TO_RECOVER.txt where it is. Leave the wallpaper for the photograph, then isolate the machine. The bans printed in that note are part of the pitch. They are not a recovery procedure.

10. A second shop offers the same miracle

After a ransomware incident, search results fill up with companies that say they can decrypt Orexin or “all .orexin files.” Some of those shops are ordinary overpriced consultants. Plenty are a second scam. They will quote the note pattern back to you. They will mention HOW_TO_RECOVER.txt so they sound close to the case. They will mention the wallpaper shout. They will mention the blank personal ID as if they already called the original crew. They will ask for a sample file, a remote-access session, or a deposit.

The second scam has a friendly website and a case manager. It may even open one junk file, because anyone who is in contact with the original criminals can borrow the same demo the note already offered. Then the chat dies, or the remote tool installs more malware. Quoting orexin@atomicmail.io in their sales copy does not make them the people who designed the lock. Quoting the Orexin Telegram account does not make them a decryptor.

A real public decryptor, when one exists, shows up on an official project page that already existed before your incident. It does not need a deposit. It does not need Telegram. It does not need a mail to that inbox. If the pitch is “we can decrypt, pay us first,” you are still in the market the ransomware created. The No More Ransom project puts the rule in plain language. Paying is not guaranteed to bring the files back, and you should not pay.

11. Payment and writing first close nothing

Paying a stranger for a private key is not a guarantee. The people who send the note can take the money and disappear. They can send a tool that only unlocks the one non-valuable file they already offered. They can come back later and lock the same machine again. A Telegram thread and a mail thread make that outcome easier, not harder. You cannot leave a review on a criminal handle.

Opening Telegram is the free version of the same dead end. Mailing orexin@atomicmail.io is the other free version. There is no public free decryptor known for this strain. There is no printed personal ID in the published sample. There is no printed ransom figure. Starting a chat does not rebuild a JPEG. It only keeps you in their story while the rest of the disk still needs a real plan.

If this is a company machine, tell counsel and your incident lead. If this is a home PC, tell the people whose files lived on it. Change passwords from a clean device. Watch bank and email alerts. Opening Telegram again is not useful work. Mailing that inbox again is not useful work. Both are the checkout, even when the checkout never printed a number.

What To Do If Your Files End in .orexin

Do not open Telegram today because HOW_TO_RECOVER.txt told you to. Do not join the Orexin Telegram account. Do not mail orexin@atomicmail.io. Do not send a “non-valuable” file to prove they can decrypt. Do not type a personal ID, a password, or the digits 5645098835 into Telegram, into that inbox, or into a form a stranger sends back. Do not invent a personal ID to finish the wallpaper. Those doors are the storefront. If you already sent a message before you found this page, stop there. Do not send a test file. Do not pay a deposit to “hold a price” they never printed.

• STEP 1: Use Rkill to terminate suspicious programs.
• STEP 2: Use Malwarebytes to remove for Ransomware and Unwanted Programs
• STEP 3: Use HitmanPro to remove Trojans and other Malware
• STEP 4: Use AdwCleaner to remove Malicious Browser Extensions and Adware
• STEP 5: Perform a final check with ESET Online Scanner
• STEP 6: Restore the files encrypted by ransomware

STEP 1: Use Rkill to terminate suspicious programs.

In this first step, we will download and run Rkill to terminate suspicious programs that may be running on your computer.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 2: Use Malwarebytes to remove Ransomware and Unwanted Programs

In this second step, we will install Malwarebytes to scan and remove any infections, adware, or potentially unwanted programs that may be present on your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   DOWNLOAD MALWAREBYTES FOR WINDOWS (FREE)
   
   (The link opens in a new page where your download will start)

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.

   

STEP 3: Use HitmanPro to remove Rootkits and other Malware

In this third step, while the computer is in normal back, we will download and run a scan with HitmanPro to remove Trojans, rootkits, and other malicious programs.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   DOWNLOAD HITMANPRO (FREE SCAN)
   (The link opens in a new page where your download will start)

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 4: Use AdwCleaner to remove Malicious Browser Extensions and Adware

In this next step, we will use AdwCleaner to remove malicious browser policies and unwanted browser extensions from your computer.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   DOWNLOAD ADWCLEANER (FREE)
   (The link opens in a new page where your download will start)

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner_x.x.x.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

STEP 5: Perform a final check with ESET Online Scanner

This final step involves installing and running a scan with ESET Online Scanner to check for any additional malicious programs that may be installed on the computer..

ESET Online Scanner is a free second-opinion scanner that performs a deep, full-system check for viruses, trojans, rootkits, and other malware. We use it as the final step because it’s thorough — if anything slipped past the previous scans, ESET will find it. A clean result here means your computer is malware-free.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   

   DOWNLOAD ESET ONLINE SCANNER (FREE)
   (The link opens in a new page where your download will start)

2. Run the Installer

   When the download finishes, open your Downloads folder and double-click “esetonlinescanner.exe“.
   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   On the Terms of use screen, click Accept.
   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.
   

4. Start a Full Scan

   Click Full Scan — this checks your entire computer, not just the common hiding spots.

   

   Select Enable for Detection of Potentially Unwanted Applications — this lets ESET catch adware and bundled junk programs, not just viruses. Then click Start scan.

   

5. Wait for the Scan to Finish

   ESET will now check every file on your computer. Because it’s a full scan, this can take a while — often an hour or more, depending on how much data you have. Leave it running in the background and check on it from time to time.

   

6. Review the Results

   When the scan completes, the Found and resolved detections screen appears. Any threats found were automatically cleaned and quarantined — there’s nothing extra you need to do. Click View detailed results if you want to see exactly what was removed.
   

   If ESET found nothing — congratulations, your computer has passed the final check and is malware-free.

STEP 6: Restore the files encrypted by ransomware

Unfortunately, in most cases, it’s not possible to recover the files encrypted by this ransomware virus because the private key which is needed to unlock the encrypted files is only available through the attackers. However, below we’ve listed three options you can use to try and recover your files.

Option 1: Search a decryption tool for this ransomware

The cybersecurity community is constantly working to create ransomware decryption tools, so you can try to search these sites for updates:

• https://id-ransomware.malwarehunterteam.com/
• https://decrypter.emsisoft.com/
• https://noransom.kaspersky.com/
• https://www.avast.com/ransomware-decryption-tools

Option 2: Use EaseUS Data Recovery Wizard Free to recover the encrypted files

EaseUS Data Recovery Wizard Free can restore files and repair corrupted files with simple clicks. Its powerful scanning algorithms can identify and retrieve huge file type library, including all of the popular video files, audio files, photos, and document formats.
While the free version only allows you to recover 2 GB of data, this can be helpful to see if the recovery is possible and restore back the most important files from your computer.

1. Download EaseUS Data Recovery Wizard Free.

   You can download EaseUS Data Recovery Wizard Free by clicking the link below.

   

   EASEUS DATA RECOVERY WIZARD FREE DOWNLOAD LINK
   (The above link will open a new page from where you can download EaseUS Data Recovery Wizard)

2. Double-click on the EaseUS Data Recovery Wizard Free setup file.

   When EaseUS Data Recovery Wizard Free has finished downloading, double-click on the setup file to install EaseUS Data Recovery Wizard on your computer. In most cases, downloaded files are saved to the Downloads folder.

   

   You may be presented with a User Account Control pop-up asking if you want to allow EaseUS to make changes to your device. If this happens, you should click “Yes” to continue with the EaseUS Data Recovery Wizard Free installation.

3. Follow the on-screen prompts to install EaseUS Data Recovery Wizard.

   When the EaseUS Data Recovery Wizard installation begins, click on the “Install Now” as seen in the image below.
   

   When your EaseUS Data Recovery Wizard installation completes, click the “Start Now” button to start the program.
   

4. Select a location to start recovering the encrypted files.

   Choose the drive or folder where you are the encrypted files that you want to recover and click “Scan“.
   

5. Wait for the EaseUS Data Recovery Wizard scan to complete.

   EaseUS Data Recovery Wizard will now scan your computer files that can be restored. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
   

6. Find the files you want to recover.

   When the EaseUS Data Recovery Wizard scan is finished scanning it will show a screen that displays the files that can be recovered. This tool can recover a lot of data, use the “Filter” button to quickly filter specific file types and find the files that you want to recover.
   

   Click the “Preview” button or double-click on a file for a full preview.
   

7. Select your files and click “Recover”.

   Finally, select the the files you want to recover and click “Recover“.
   
   Choose a safe location to save all the files.
   
   The free version only allow you to recover 2 GB of data, however, this will allow you to recover the most important files and see if EaseUS Data Recovery Wizard can correctly recover them.
   

Option 3: Try to restore your files with ShadowExplorer

This ransomware will attempt to delete all shadow copies when you first start any executable on your computer after becoming infected. Thankfully, the infection is not always able to remove the shadow copies, so you should continue to try restoring your files using this method.

1. Download ShadowExplorer.

   You can download ShadowExplorer from the below link.

   SHADOW EXPLORER DOWNLOAD LINK
   (This link will open a new web page from where you can download “ShadowExplorer”)

2. Install ShadowExplorer.

   Double-click on the ShadowExplorer-x.x-setup file to start the installation process, then follow the on-screen promts to install this program.
   

3. Select snapshot date.

   Open ShadowExplorer and then from the top bar select the drive where the files that you want to save are located, then select from the snapshot available one previous to this infection.

   

4. Export the files that you want to recover.

   Once you have found a copy of the original file or folder, right-click on it and the select “Export”. A window will prompt you where you want to save the file or folder.
   

Keep every .orexin name exactly as it is. Do not bulk-rename 1.jpg-id-5645098835[orexin@atomicmail.io].orexin back to 1.jpg. Do not clip the -id-5645098835[orexin@atomicmail.io].orexin tail off any other locked file in the same folder. Stripping the extra ending is not a repair. It can make a later trusted tool worse, not better. The original name is already sitting in front of the tail. You do not need to edit it to know what you lost.

Keep HOW_TO_RECOVER.txt with the locked files. Keep a photo of the wallpaper that shouts ALL YOUR FILES ARE ENCRYPTED. Do not “clean up” every copy of the note. Do not fill in the personal ID so the flyer looks complete. The blank is part of how you prove this was this strain and not a different locker that only sounds similar. The note and the wallpaper are evidence. They are not a set of steps you should carry out.

Treat the inbox and the Telegram line as doors, not help desks. Do not mail orexin@atomicmail.io. Do not open the Orexin Telegram account. Do not paste a “universal ID” from a comment. Do not pay anyone to dictate digits into Telegram. Do not run a third-party decryptor you found in an ad, a YouTube description, or a chat “recovery” channel because it promised to talk to the operators. Leave the locked copies alone until a trusted project publishes a tool for this family. None is public now.

If a later message quotes HOW_TO_RECOVER.txt and offers “the real Telegram,” that is still the same shop. If a later message skips Telegram and asks you to mail that inbox with a sample, that is still the same shop, or a copycat standing in the same doorway. If someone claims they can already decrypt Orexin files because they can recite the wallpaper shout and the blank personal ID, they are selling a report, not a key. Do not answer. Do not complete their checkout. Do not help them fix the flyer.

If Windows still offers to pick an app for the .orexin type, decline it. There is no player for that ending. A blank personal ID is not a reason to skip a report. File the incident through the CISA ransomware reporting page or the FBI IC3 desk if those are the right doors for you. The shout on the wallpaper is theirs. The files are already locked. Another night of staring at a blank ID will not change the bytes.

The Bottom Line

Orexin ransomware is a locker with a readable filename, a recover note, and a wallpaper that wants a private reply. It keeps the old name and appends -id-, a number, [orexin@atomicmail.io], and .orexin. In the published test sample, 1.jpg becomes 1.jpg-id-5645098835[orexin@atomicmail.io].orexin. This page will not invent another id. The note is HOW_TO_RECOVER.txt. The wallpaper shout is ALL YOUR FILES ARE ENCRYPTED. The personal ID on that wallpaper is blank in the published sample. The contact marks are orexin@atomicmail.io and Telegram the Orexin Telegram account. The note offers one non-valuable file for free. It warns you not to rename files and not to use third-party tools. There is no public free decryptor known for this strain.

Do not pay. Do not open that Telegram. Do not mail that inbox. Do not send a test file. Do not invent a personal ID. Do not rename the pile in bulk. If you take one sentence with you, take this. A folder of names ending in .orexin, plus HOW_TO_RECOVER.txt and a wallpaper that shouts ALL YOUR FILES ARE ENCRYPTED with a blank personal ID, is ransomware on the first sighting. Treat it that way before anyone in that chat, or in that inbox, names a price.