HHAZ Ransomware (.Hhaz File) 🔐 Decrypt & Removal Guide

.Hhaz is the new malicious file extension used by Djvu Ransomware. Primary research shows that it encrypts victims’ files by using .hhaz extension. Victims will notice that their encrypted files have additional extensions added to the original file name, for example, if you had an mp4 video file named “myvideo.mp4” it will renamed to “myvideo.mp4.hhaz”. A deeper look into the attack also shows that HHAZ Ransomware drops a ransom note by the name (“_readme.txt“) demanding $980 for the decryption key.

How Dangerous Is Hhaz Ransomware
90% Very Dangerous

0-10% Safe 11-40% Low Risk 41-70% Risky 71-100% Dangerous

What is Hhaz Ransomware

Hhaz Ransomware is the newest member of Stop/Djvu Ransomware family. Just like its predecessors, .Hhaz virus also invades the user’s computer and encrypts their files. It uses a powerful encryption method (Salsa20 encryption) to lock files on compromised computers. Hhaz Ransomware can encrypt all kinds of data files including videos, images, audio, pdf, word files, documents, PPT, excel, and many more.

.Hhaz File Virus can encrypt only the first 150 kilobytes of each file which works perfectly for most media files like audio, videos, and pictures. Most media files are larger than 150 kb nowadays, even pictures taken by smartphones are larger than min 1 MB. Encrypting the first 150 kb make the entire file useless, as most media player or viewers won’t be able to load the file.

How Does It Work?

After encryption, Hhaz Ransomware adds .Hhaz extension in the original name of encrypted data. It targets victim’ important and sensitive files to cause panic in their mind. It aims to use that panic to extort money from the victims. Hhaz Ransomware demands money in exchange for the decryption tool and threatens the victims they won’t be able to restore or access their files again without paying ransom money.

Hhaz Ransomware

.Hhaz File Virus will drop a text file “_readme.txt” in each folder containing locked files asking you for ransom money. According to the ransom note, your files are encrypted but it is still possible to decipher your files with a decryption tool and unie key that you will get when you pay $980 in bitcoins. Well, the unique key is used by Hhaz Ransomware viruses to make sure victims can’t share the decryption tool.

Threat Summary

Name Hhaz Ransomware or .Hhaz File Virus
Type Crypto virus
Category Ransomware
File Extension .Hhaz
Ransom Note _readme.txt
Family Stop Djvu Family
Version 0835
Ransom Amount $980 in the form of bitcoins
Offline ID gG3wF8nDWRqLztkHPAxMzpvNVlmLBMgQKmKiCNt1
Hackers Contact support@freshmail.top, datarestorehelpyou@airmail.cc
Symptoms Your files will be encrypted, you will see a ransom note demanding ransom money.
Distribution Spam Emails, Social Engineering, Software Bundling.
Status Active and dangerous
RSA Public Key Hhaz—–BEGIN PUBLIC KEY—– MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnIetwJnoUeBC6UmAQ5wY CyAydA86/edGAFZMbisWC91WC4602FnbDclBYiLNbAjg8mAN1EnlZkUvBEPIWqJf 8L8b2wjBFevpc+BipWTuWRDt+umrdTI2mxH9+eIi0sxQk6dU1IQ66P4L8eEeVgdG Rm/5dgpaHfMDjgRW79AeTm+0LQuRTvuGaBBHR4J1lcd9oTKy/8yfI3T0CU6rvukG cBu/YScQxwA1uEFtKcMyDqZT0BeuiQkEc1VDnSCuvAgCuaO31I/b4dw01u7lwM9d EBc8sZhycEkMOHJQMLBkrTBc3FAqBOOC6x4vBDriNQ8iPOIUqgwk0eQ5eHvrSDsX GQIDAQAB —–END PUBLIC KEY—–
Removal Download SpyHunter 5 Anti-Malware Now
Data Recovery Download Stellar Windows Data Recovery

Deeper Look Into _readme.txt

“_readme.txt” is a text file used by Hhaz Ransomware to deliver its demand to the victims. The ransom note takes responsibility for the attack, stating that all your files are encrypted and claims that paying the ransom money is the only way you can return your files. It also offers to decrypt your only one encrypted file for free as a guarantee to show the decryption tool works. Well, the decryption key for .Hhaz file virus will cost you $980.

.Hhaz File Virus also provides a huge discount offer. According to the ransom note, victims who contact the email address mentioned on the ransom within the first 72 hours will get a flat 50% discount and will only have to pay $490 for the decryption tool. However, you can’t trust the hackers. The best option for you to protect your system and your precious data is to remove .Hhaz Virus Ransomware as soon as possible from your system.

Ransom Note Show by Hhaz File Virus


Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
Reserve e-mail address to contact us:

Your personal ID:


How .Hhaz Virus Ransomware Enter Your PC

Hhaz Ransomware usually intrudes on your computer through spam email attachments containing malicious documents. Once you open such an email on your device, it will download malicious codes into your system. These malicious codes will download and install .Hhaz file virus secretly in your computer and before you know it, all your files are encrypted.

Hhaz Virus can get into your machine through bundled freeware programs. It can also get injected into your system through other harmful threats and malware. What’s more, Hhaz Ransomware can also get downloaded to your system when you visit malicious or pron websites or use drive-by download websites. Well, once your system is infected, .Hhaz file virus will make your system miserable.

.Hhaz File Virus is a highly contaminating ransomware, it can spread through external file-sharing drives and even through networks. If one of your devices is infected, all the devices sharing the same network will get infected by .Hhaz file virus. For example, if your PC is infected then all other devices sharing the Internet from the same network will get infected also.

Harmful Effects of Hhaz Virus

  • Encrypts all important files making them completely inaccessible.
  • Hhaz virus forces victims to pay ransom money to access their files.
  • Deletes Volume Shadow copies from the system, making it harder for victims to restore their files.
  • Hhaz Ransomware will install Trojan-PWS (password stealing trojans), like Smokeloader, Vidar Stealer, Redline Stealer, Azorult, etc.
  • Adds certain domains to the HOSTS file disabling victims from accessing security-related websites.
  • Opens a backdoor allowing remote access to hackers, making the system vulnerable to further malware attacks.
  • The compromised computer will become slower and start freezing frequently.

How To Deal With Hhaz Ransomware

Hhaz Ransomware is a serious threat to any Windows computer system. What’s tricky about this notorious ransomware is that it not only compromises victims’ data but also leaves malicious codes deep inside the infected PC. These malicious codes can be exploited by the hackers in future. Even if you pay the money and get your .Hhaz files decrypted, it won’t be over. As soon as hackers come up with new variants of .Hhaz File Virus, your files will be encrypted again.

The only way to ensure your data and your PC are completely safe is to get rid of Hhaz Ransomware completely along with all its malicious codes, auto-executable files, and hidden Trojans. You should also restore all the settings and other changes made by .Hhaz virus in your system. Once the ransomware is gone permanently, you can restore all encrypted .Hhaz files by restoring the backup files or by using powerful data recovery software.

How To Remove Hhaz Ransomware

The only way to truly protect your system and your important data is to get rid of Hhaz Ransomware. Well, as long as this notorious Ransomware virus stays in your computer your data will never be never safe. Hence, you should try and remove Hhaz Ransomware along with all its associated files and hidden codes completely from your PC as soon as possible.

Make sure all the encrypted files are safe because to decrypt data you will need the encrypted files. Once, .Hhaz Virus is gone for good, then you can easily restore all important files by restoring the backup. However, if you don’t have a proper backup of your files then we suggest you use a powerful data recovery tool to restore your files safely.

Some severe threats like Hhaz Ransomware often come back on the infected PC if all its core files and malicious codes are not completely removed. We recommend you scan your PC for threats with SpyHunter 5 Anti-Malware. It can save you lots of time and effort.

SpyHunter 5 Anti-Malware provides a 7-day fully functional Free Trial with Credit card required, NO charge will apply upfront. No charge if you cancel 2 business days before the trial ends. Notification before billing and 30-day money-back guarantee. Read EULA and Privacy Policy, and Discount Terms. See more details.

Follow this step-by-step removal guide to delete .Hhaz File Virus manually from your computer. Bear in mind, that the manual removal guide will assist you in getting rid of Hhaz Ransomware from your computer, however even the smallest mistake while performing these steps can leave your computer in a worse situation.

Warning:- Removing Hhaz Ransomware will require you to complete multiple lengthy tasks. We tried to make it as simple as possible for you. Users should know that to delete .Hhaz Virus Ransomware from PC, they will need to restart their system and web browsers multiple times. Hence, it would be wise to bookmark this webpage or open it on a separate device like a mobile, other PC, etc. so that you won’t need to find this site again.”

1. Isolate Infected Device

Once your computer or any other digital is infected with Hhaz ransomware virus, the first step you should take is to isolate your infected device. It is very important to contain the spread of infection in order to protect other devices from this threat.

Hhaz Ransomware is known to travel via network and hence can easily infect any other devices connected to the same network. To isolate the infected device victims must disconnect their PC from any wired or wireless internet network. You might also wanna turn off Bluetooth, and wifi and also remove all external devices like external hard drives, USB drives, etc.

2. Boot Your PC In Safe Mode

  • Press the “Windows Key + R” keys to open the Run box.
  • Enter “MSConfig” in the Run box and then click the OK button.
  • The System Configuration window will appear on your screen, switch to the Boot tab.
  • Select Safe Boot then check the network box.
  • Click on Apply and finally hit the OK button.

.Hhaz File Virus usually executes different tasks and processes in the system background, as long as these processes are running on your system you won’t be able to uninstall the malware installed on your system. Hence, after starting your computer in Safe Mode, you will need to kill all malicious tasks executed by .Hhaz File Virus in your system background.

3. Kill Hhaz Ransomware From Task Manager

  • Press the Winkey + R keys together to open the Run box.
  • Enter “tskmgr” and click the OK button.
  • Select a malicious process related to Hhaz Ransomware.
  • Now right-click on any suspicious process related .Hhaz virus to then click End process.

Kill Hhaz Ransomware

4. Disable .Hhaz File Virus From Start-Up

.Hhaz File Virus usually alters Start-Up settings in the infected computer system, enabling itself to execute its rogue codes during your computer boot process.

If you haven’t already closed the Task Manager window yet, you should see the Start-Up tab. However, if Windows  Task Manager is closed, press Ctrl + Shift + Esc on your keyboard to open it again.

  • Click on the Start-Up Tab.
  • Find and select all malicious processes related to Hhaz Ransomware
  • Right-click on the malicious process and then click on Disable.

Disable .Hhaz File Virus

5. Remove Malicious IP Address From Host File

As we already discussed above, Hhaz Ransomware often creates a backdoor in the compromised system allowing remote access to the hackers. Therefore, it is very important to remove malicious IP addresses from your system or hackers might steal your confidential information and can even slip other harmful viruses into your computer.

  • Open the Run window by pressing the Windows + R buttons simultaneously.
  • Copy and paste this path (C:\Windows\System32\drivers\etc) in the Run box and hit the OK button.
  • Remove all IP addresses you find below Localhost.

Delete malicious IP Address

6. Show Hidden Files And Folders

Research shows .Hhaz Ransomware secretly creates various malicious hidden files and folders in the compromised PC. These hidden files are used to reinstall viruses in case victims try to remove the malware from their PC.

  • Open the Windows Run command again as we did before i.e., press the Windows + R keys together.
  • Now enter “control.exe folders” in the Run box and hit the OK button.
  • File Explorer Option will appear on your system then click on the View tab
  • Scroll down to the Hidden Files And Folders option and select Show Hidden Files, Folders, and drive option.

Show Hidden Files And Folders

7. Remove .Hhaz VirusFrom Registry Editor

  • Press the “Windows+R” buttons to open “Run Box”.
  • Type the “Regedit” command in the Run and Press Ok.
  • Windows Registry Editor Windows will open on your system screen.
  • Find and erase all .Hhaz Virus related files from your Registry Entries files.

Remove Hhaz Virus From Registry Files

Beware, deleting an important registry can completely mess up your computing machine. It can simply make your system unusable. Before you take any further steps and make things even worse for you, just make sure you know what you are doing. If you have any doubts, you should take the help of SpyHunter Malware Scanner tool, it will remove Hhaz Ransomware and along with its malicious files safely and completely.

Hhaz Ransomware often comes back on the infected PC if all its core files and malicious codes are not completely removed. We recommend you scan your PC for threats with SpyHunter 5 Anti-Malware. It can save you lots of time and effort.

SpyHunter 5 Anti-Malware provides a 7-day fully functional Free Trial with Credit card required, NO charge will apply upfront. No charge if you cancel 2 business days before the trial ends. Notification before billing and 30-day money-back guarantee. Read EULA and Privacy Policy, and Discount Terms. See more details.

8. Delete Malicious Files Created By Hhaz Ransomware

If you remember, we discussed and found hidden files and folders. However, we did not delete them in the previous step, and it is very important to completely delete all rogue files to make sure that the virus does not re-install after removal so that the virus cannot return to the PC.

  • Again press the Windows + R keys simultaneously to open Windows Run box.
  • Enter the paths one by one in Run Box and click the OK button.
  • Finally, permanently delete all malicious files carefully.
  1. %AppData%
  2. %LocalAppData%
  3. %ProgramData%
  4. %WinDir%
  5. %Temp%

9. Restore Your Computer

Windows Computer provides a System Restore feature to its users. This feature helps to fix minor mistakes or issues. But to use this feature, users have to create a system restore point. If you have created a system restore point before Hhaz Ransomware attack on your system, then you can restore your computer to deal with Hhaz ransomware. System Restore will restore your system exactly as it was when you created the system restore point. Restoring your computer will take your system back to the state it was in before the virus infection and may make your system as if it was never infected.

  • Open the Windows Search box and enter (cmd.exe).
  • Command Prompt will window appears on your computer screen, select “Run as administrator“.
  • Type (rstrui.exe) in the command prompt and press Enter.
  • Now “Windows Restore Points and Settings” window will appear on your system, choose one of the previously created system restore points.
  • Finally, select “Next” and click on the “Finish” button.

System Restore

Users must know that System Restore may not be able to completely erase all traces of .Hhaz file virus from infected PCs. Severe malware like Hhaz Ransomware makes some deep-level modifications in the infected computer. These modifications and leftovers are there to make sure the virus can reactivate and reinstall itself in co case victims try to remove it. In order to remove all traces of  Hhaz Ransomware along with malicious codes created by this virus completely PC you should make use of SpyHunter 5 Anti-malware Tool.

Remove Hhaz Ransomware with SpyHunter

SpyHunter 5 Anti-Malware is an amazingly effective and equally easy solution to removing all kinds of critical malware including Hhaz Ransomware from the Windows system. It comes with a pack of several effective and advanced features that will help the users to remove .Hhaz virus completely in just a few easy steps.

It is a very safe, quick, and powerful utility. The most amazing thing about this significant utility is that it provides complete protection to your system from all kinds of PC threats and viruses. It quickly scans your entire system and removes .Hhaz File Virus along with other suspicious infections in a very safe as well as hassle-free way.

With the SpyHunter 5 Anti-Malware, you can schedule the scan times. It also provides essential technical assistance directly from the security experts if needed. It is compatible with all versions of Windows OS computers such as Windows XP, Vista, 7, 8, 8.1, and 10.

SpyHunter 5 Anti-Malware provides a very easy-to-understand graphical user interface that enables the users to navigate this tool quite easily without any kind of essential technical skills. Therefore, it is recommended the victims download the SpyHunter 5 Anti-Malware and get rid of Hhaz Ransomware completely.

Steps To Download And Install SpyHunter

  • To download SpyHunter Anti-Malware tool in your system click on below download button. This download button will open the download page for you in a new tab and the software download will start automatically. Follow the download and installation instructions for the software on the download page or you can return to this page and continue the installation process from here.

Hhaz Ransomware often comes back on the infected PC if all its core files and malicious codes are not completely removed. We recommend you scan your PC for threats with SpyHunter 5 Anti-Malware. It can save you lots of time and effort.

SpyHunter 5 Anti-Malware provides a 7-day fully functional Free Trial with Credit card required, NO charge will apply upfront. No charge if you cancel 2 business days before the trial ends. Notification before billing and 30-day money-back guarantee. Read EULA and Privacy Policy, and Discount Terms. See more details.

  • When the download is complete, locate SpyHunter in your system. If you haven’t selected a specific download location before downloading, the software should be in the Downloads folder. Double-click on “SpyHunter-Installer.exe” to start the installation process.


  • If the confirmation window appears on your system screen, click on YES to continue the installation.

Confirmation Window

  • SpyHunter provides language support for various languages to its users to make it easier for them to use this software. Select your desired language and click on the “OK” button.

Preffered language

Steps to Use SpyHunter

  • SpyHunter will launch itself on your system screen after installation. If this doesn’t happen automatically, launch SpyHunter by double-clicking its shortcut icon on your desktop screen. Scan your system for all kinds of viruses and threats by clicking on the “Start Scan” button.

Scan Hhaz

  • SpyHunter Anti-Malware will scan your entire system and files thoroughly, this may take a while. You can see the list of viruses found in your PC as the scanning process progresses through different drives and folders.

  • After the scanning process is completed, SpyHunter will show you a list of all the harmful and malicious threats found in your system. Select each threat you want to remove and click on the Next button

Remove Hhaz

Restore Encrypted Data

Since .Hhaz File Virus encrypts users’ important data you will need to decrypt all your files after removing this notorious Ransomware virus. If you don’t have any backup available, you should use Stellar Data Recovery Software. It is a potent and effective data recovery tool. Moreover, it is capable of restoring all kinds of lost, corrupted, or even encrypted data. Its advanced features will help you restore all your important files in just a few easy steps.

You might consider Stellar Data Recovery Tool. It is a very powerful and effective data recovery tool. It has been designed to restore all kinds of deleted, lost, corrupted, or even encrypted Data. Steller Data Recovery tool comes with advanced recovery features that enable this tool to bypass complicated encryption barriers and decrypt encrypted data, without compromising the data integrity and quality. Stellar Data Recovery Software has been designed with a user-friendly and very easy-to-use graphical interface. Hence, users will not require technical assistance to navigate or use this software.

  • Click on the below Download button to download Stellar Windows Data Recovery Software on your PC.

Download Data Recovery Software Now

  • Locate the software and double-click on the installer file (stellardatarecovery.exe) of Stellar Data Recovery software.

  • The User Control Pop-up will appear on your system asking permission to install the software, click on Yes to continue the installation process.

  • Stellar Data Recovery Software supports multiple languages to make it easy to understand for users. Choose your preferred language and click on OK. Now wait for the installation process to finish.

Guide To Decrypt .Hhaz Files

Stellar Windows Data Recovery Software usually launches itself automatically after installation. Users can also double-click on the software icon if it doesn’t launch automatically.

  • Choose the desired file type, document, folder, picture, video, etc. that you want to recover or you can simply click on All Data and then hit the Next button.

  • After selecting the data type, you will need to choose the preferred recovery destination. The drive or folder where your encrypted or lost files are located and click the Scan button.

  • Wait for the scan to complete, this might take a while. Once the scanning is completed, you will see the preview of all recoverable data. Select all the files you want to recover and click on the Recover button.

How To Protect Your PC From Malware In the Future

After using the above methods carefully you should not have any problem while removing Hhaz Virus from your PC. However, it is important to know for the users of this kind of attack is very common nowadays. It is very much possible that your system may get infected again with some other malware and hence you need to be very careful. Well, we all know prevention is always better than cure. Hereby, it would be quite sensible for users to follow essential prevention steps to keep their PC safe and healthy for the long run.

Prevention Tips To Avoid Hhaz Ransomware

  • Avoid downloading freeware applications or updates from any unauthorized websites.
  • Users must not click on any misleading and fake advertisements.
  • Try to avoid visiting malicious or pornographic websites.
  • Keep your system and all important programs updated.
  • Download updates from authentic and official websites.
  • Always keep an updated and powerful anti-malware tool on your PC.
  • Scan your PC for hidden threats, malware, and viruses at regular intervals.
  • Do not use any external USB drives in your PC without scanning.
  • Select a custom installation process to install any software on your PC and avoid bundled malware and PUP.
  • Avoid any spam emails from unknown senders as they often carry any malicious attachments.
  • Avoid using any open or public wife network.

Hhaz Ransomware often comes back on the infected PC if all its core files and malicious codes are not completely removed. We recommend you scan your PC for threats with SpyHunter 5 Anti-Malware. It can save you lots of time and effort.

SpyHunter 5 Anti-Malware provides a 7-day fully functional Free Trial with Credit card required, NO charge will apply upfront. No charge if you cancel 2 business days before the trial ends. Notification before billing and 30-day money-back guarantee. Read EULA and Privacy Policy, and Discount Terms. See more details.

About the author


Leave a Comment