PUP.HackAV

By CagedTech in Potentially Unwanted Programs

Published: January 20, 2023

Last updated: October 5, 2026

Threat Scorecard

Popularity Rank:	6,440
Threat Level:	10 % (Normal)
Infected Computers:	5,592

First Seen:	June 26, 2021
Last Seen:	October 5, 2026
OS(es) Affected:	Windows

The detection of PUP.HackAV on your system indicates the presence of a potentially unwanted program (PUP) that may compromise your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it to prevent potential harm.

Table of Contents

What Is PUP.HackAV?

PUP.HackAV is a type of malicious software that is not necessarily malicious in the classical sense but can still cause significant problems for users. Potentially unwanted programs often sneak onto systems through bundled software downloads, deceptive installation prompts, or exploits in software vulnerabilities. They can lead to a range of issues, including unwanted advertisements, data collection without consent, and performance degradation.

How PUP.HackAV Operates

PUPs like PUP.HackAV typically operate by integrating themselves into the system in a way that makes them difficult to detect and remove. They may alter system settings, add themselves to startup programs, or even hijack browser settings to display unwanted content. Their primary goal is often to generate revenue for their creators through advertisements, affiliate marketing, or by selling collected user data. In some cases, PUPs can also act as vectors for more severe malware, making their removal crucial for system security.

Symptoms of Infection

Identifying a PUP.HackAV infection can be challenging, but there are several symptoms you might notice. These include an increase in unwanted pop-ups or advertisements, changes in your browser's homepage or search engine, the appearance of unfamiliar programs or toolbars, and a general slowdown in system performance. If you've observed any of these symptoms, it's a good indication that your system might be infected.

Increased pop-up advertisements
Unexplained changes in browser settings
Appearance of unfamiliar programs or toolbars
Slowdown in system performance

How to Remove PUP.HackAV

Enter Safe Mode with Networking to prevent the malware from interfering with the removal process.
Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of PUP.HackAV.
Uninstall any suspicious programs that were installed around the time the symptoms began. Be cautious and only remove programs you are certain are malicious or unnecessary.
Reset your browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any malicious extensions or settings changes made by the PUP.
Reboot your system and perform another scan with your anti-malware tool to ensure all components of the PUP have been removed.

Conclusion

Removing PUP.HackAV from your system is crucial to restore your computer's security and performance. By following the steps outlined above, you can effectively eliminate this potentially unwanted program and protect your system from future infections. Remember, prevention is key; always be cautious when downloading software, read user agreements carefully, and keep your operating system and security software up to date to minimize the risk of PUP infections.

File System Details

PUP.HackAV may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	ashBase.dll	9e137e9ea95483b8b8bc57ec01f9310a	219
Name: ashBase.dll MD5: 9e137e9ea95483b8b8bc57ec01f9310a Size: 349.17 KB (349176 bytes) Detections: 219 Type: Dynamic link library Path: C:\Program Files\AVAST Software\Avast\ashBase.dll Group: Malware file Last Updated: December 1, 2025
2.	eav_nt32.exe	7f8fadc46d29d377844262b584bf259b	24
Name: eav_nt32.exe MD5: 7f8fadc46d29d377844262b584bf259b Size: 58.62 MB (58629055 bytes) Detections: 24 Type: Executable File Path: c:\users\<username>\documents\downloads\eset\eset nod32 antivirus 13.2.15.0 + activation\eset nod32 antivirus 13.2.15.0 + activation\setup Group: Malware file Last Updated: July 11, 2024
3.	anti virus.exe	6360992b983566d568e76bcc60bfc0b9	2
Name: anti virus.exe MD5: 6360992b983566d568e76bcc60bfc0b9 Size: 2.26 MB (2267547 bytes) Detections: 2 Type: Executable File Path: %SYSTEMDRIVE%\users\<username>\desktop Group: Malware file Last Updated: June 19, 2023

More files

Analysis Report

General information

Family Name:	PUP.HackAV
Packers:	UPX
Signature status:	No Signature

Known Samples

MD5: 9125484f1d7cbaa006e2f0f86d8b6cbc

SHA1: 2d27dd82c62d365dc1f6155153cd187fde10f870

SHA256: C6281260839A9A193DFCA38578CD3EC52F7693F3C8B6262F97C1E16EC74238A3

File Size: 303.12 KB, 303123 bytes

MD5: 222566267e4199ca360a7485d00b4580

SHA1: fa2c43270da44ad0cc4dd999c889ce4c7d607981

SHA256: A302336A4C2E8F9BA289B484BAB45A56A1E951E18F050E976440DC40A09F6909

File Size: 1.14 MB, 1144832 bytes

MD5: 0a0cd7ff77d9f0612489959f53855338

SHA1: 6f8f0557b42284eadfc58b499b4d6dad22d6f99f

SHA256: 0B636B605B8623DBF01F2CD819E03B4BDE36287670D2DB7E14B4F1900D4548BB

File Size: 57.34 KB, 57344 bytes

MD5: 13aeb91ea973dfde9f51f7642d3ecded

SHA1: cc0a0d7ff59eb6e7a266f60411c9c053d7feb70f

SHA256: 0C55B7D19B8978B4E26C20B030CEC039D61F37A15181970A44BEC7532DB4D481

File Size: 535.91 KB, 535909 bytes

MD5: e6b6022edb02aa3cf50372a13ebc1654

SHA1: 1dea2acfe0ee6806e99c84962f4e1392687a15b3

SHA256: 642867A0F2D1871A665F3E8D2A8A85E4D262C38EC388EDD97E722A56CD93181A

File Size: 3.48 MB, 3477658 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have debug information
File doesn't have exports table
File doesn't have relocations information
File doesn't have security information
File has been packed
File has exports table
File has TLS information
File is 32-bit executable
File is 64-bit executable

File is either console or GUI application
File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
File is Native application (NOT .NET application)
File is not packed
IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name	Value
Comments	Generador 6.0 This installation was built with Inno Setup: http://www.innosetup.com ulisessoft.info
Company Name	nsane productions
Compiled Script	AutoIt v3 Script : 3, 3, 0, 0
File Description	KRTitle Overlay Filter Makes your NOD32 trial last forever. NodLogin www.ulisessoft.info
File Version	NOD32 FiX v2.1 10.6.0.0 6.0.0.0 3, 3, 0, 0 1.00
Internal Name	KRTitle.ax
Legal Copyright	Created By Zhong Kai Ran nsane productions UlisesSoft
Original Filename	KRTitle.ax
Product Name	KRTitle Overlay Filter
Product Version	3.3.11.3 1.00

File Traits

Autoit
big overlay
dll
HighEntropy
Inno
InnoSetup Installer
Installer Manifest
Installer Version
packed
WriteProcessMemory

Block Information

Total Blocks:	2,151
Potentially Malicious Blocks:	0
Whitelisted Blocks:	2,151
Unknown Blocks:	0

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 0 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 1 0 0 0 1 0 0 0 1 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 1 0 0 0 0 0 1 0 0 0 0 0 0 2 2 2 3 0 0 0 0 0 0 1 0 0 0 1 1 1 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 2 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File	Attributes
c:\users\user\appdata\local\temp\a.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\a.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\aut627c.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\aut62fa.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\aut631b.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\aut634a.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\aut635b.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\b.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\b.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\logo.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data

c:\users\user\appdata\local\temp\logo.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mod004.us	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\mod004.us	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\x.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\x.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\~df34466c318c9bf8bf.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

Key::Value	Data	API Name
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n �v��(�1`1�1HO@V�_�zk`{b��P��m�Ù��$წ��=�SB1_T�Vw�`�V��%��AE��D��&��$��L	RegNtPreCreateKey

Windows API Usage

Category	API
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAddAtomEx ntdll.dll!NtAllocateLocallyUniqueId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClose ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtDeviceIoControlFile Show More ntdll.dll!NtDuplicateToken ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtLockFile ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcess ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenThreadToken ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryDefaultLocale ntdll.dll!NtQueryDirectoryFileEx ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryObject ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryTimerResolution ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtReadRequestData ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationObject ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnlockFile ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWriteFile ntdll.dll!NtYieldExecution UNKNOWN
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
User Data Access	GetUserObjectInformation
Encryption Used	BCryptOpenAlgorithmProvider CryptAcquireContext
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess ShellExecute
Service Control	OpenSCManager

Shell Command Execution


							C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\6f8f0557b42284eadfc58b499b4d6dad22d6f99f_0000057344.,LiQMAxHB


							runas c:\users\user\downloads\1dea2acfe0ee6806e99c84962f4e1392687a15b3_0003477658

PUP.HackAV

Threat Scorecard

EnigmaSoft Threat Scorecard

What Is PUP.HackAV?

How PUP.HackAV Operates

Symptoms of Infection

How to Remove PUP.HackAV

Conclusion

File System Details

Analysis Report

General information

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

File Icons

File Icons

Windows PE Version Information

Windows PE Version Information

File Traits

Block Information

Block Information

Visual Map

Files Modified

Files Modified

Registry Modifications

Registry Modifications

Windows API Usage

Windows API Usage

Shell Command Execution

Shell Command Execution

Submit Comment

Related Posts

Trending

Most Viewed