hfsexplorer-2026[.]4[.]9-setup[.]exe

resource
unpack001/lib/swing-layout-1.0.4.jar

resource
hfsexplorer-2026.4.9-setup.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/bin/hfsexplorer.exe
unpack001/lib/llio_amd64.dll
unpack001/lib/llio_arm.dll
unpack001/lib/llio_i386.dll

hfsexplorer-2026.4.9-setup.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 e49d5d0770bb17220cf11db2365a2307ad1d82eeab1f3ced1d6c0d0853b8a599
MD5 5a93ed7be443f5d2cc1276e7895f8011
SHA1 55d14278f72c4c94e1c275624bfc799eaab73924
SHA512 0e31d6cbdb6364c3e74347dec05e208e6372022c107d6a59ae01152ec3752b7a3e12393723fe698ad477761632ada4f03101a1703bef9a0268a76809dd43e700
SSDEEP 49152:v2ei7KXIz8VLmx2c7fKKYzUAlHijDxcUXJ3wgTIOaOnaH5Fmbufx9:vrDXIEidAojy83wgSEQ58qn
TLSH
T10995333435148B1FD47C21300C1E6356AA56AD3AE78526F283B5BCAC5CB7985CF6EE38
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/InstallOptions.dll

IMPHASH 85f08eb0cbec010ecbc287fa68321173
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryW GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile GetPrivateProfileIntW SetFilePointer MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW GetPrivateProfileStringW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree WriteFile GlobalAlloc

user32

PtInRect LoadCursorW GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard GetClientRect SetWindowRgn LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW MapWindowPoints

gdi32

SetTextColor CreateCompatibleDC GetObjectW GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderW SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

LICENSE.txt

SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

bin/dumpfsdata.bat

SHA256 ff3cf8d7135640af412d85e1e0aa36476b006a8af13de49ce9e5a1ddcb3839e7
MD5 88da4a496a8deb538e08738a035236dd
SHA1 32679533c55e8cbaf1ec1007bb50906c533caf1d
SHA512 c5338212ca270848d27f2ffdb2f8ea090099271e2003b6cdc5abec165b6ccab52650c5cf6f61ae059d2819ae05507cd9e8adb7400fb28cb1c066bbf790637ffe
TLSH
T129D02BEFC0A6262033D304B1EE0C9A6B6A1BC82D429570F2704080731808B2E53DC0BB
MD5 SHA1 SHA512 TLSH

bin/hfsexplorer

SHA256 bc485190927a0e0c2667e9107cfc9ecd9034f8d99c71592022b5406e5278366e
MD5 a99c885b618e0ae6b48d462e2dc88bc2
SHA1 bf47fa0d26a1229356bbad234d573a79c36d3c42
SHA512 c9e1b84e78a28bf37c7f00fcaae0c2af2d843c7c1889faae4b27d9b2aa7e3f397214616c1e97aaa6088bc5ce31deb17aec2fa111dd4841170ab000f3132e8a3b
TLSH
T1D8012354115485E603AFCF653B0BDCC9A805220B50505D29F56DCB157FF93358482AC3
MD5 SHA1 SHA512 TLSH

linux

bin/hfsexplorer.bat

SHA256 7f4d2996e3e2e8dfc8385edc376b68ff854fe686f72e6091dc51b65040c0a462
MD5 b5195389d9f3eff2aa0170fd047f8251
SHA1 45b2ff5f501c84f06ba9c25598139dafb6ac00cc
SHA512 1e5071beeb54d7422f3f5d313c1efc1fa655952bf839a9ec4376e65e481311edf2afeddeb3ec276df2174bbd85b5db0e2cec43455d6b2efad331a3e98d397169
TLSH
T1D0D02BEEC096373032E304B1DE0D4F5BA22B8429128474E2205080655805F1E53EC4FB
MD5 SHA1 SHA512 TLSH

bin/hfsexplorer.exe

IMPHASH c29f4293c4efa27149597bd7e97000aa
SHA256 d17f6d997993f33c92333f9fbb4d64506dd49ed9c03812ab418dabea6948dabd
MD5 1c431d2ddb93d3efa8c31cea6ea69401
SHA1 4df117c8249a2ce377bc22f8ae1f56d891949202
SHA512 21d0168a5851631682f1fe55027c5056b8cf4f6b818f6ade4e62a562dbee46b625934fe314774f7aedba6667e91241f4bd212b6400c48acba6408c85a43da115
SSDEEP 6144:sYLvkClfRboS8lM/Ndo9SLVckGzBpcCwMCYS9RWUYDOtaEUNJFK/DmG/K67863Tn:sYjkCBV4FaF6S/yD2pUv8bL
TLSH
T187E46C50BF8669B3EC01427449A6D7BD1374BC909A22F73791F0FE1F3673A920D9261A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

CloseHandle CreateProcessW CreateSemaphoreW DeleteCriticalSection EnterCriticalSection FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemTimeAsFileTime GetTickCount GetVersion InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar QueryPerformanceCounter ReleaseSemaphore SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte lstrlenW

msvcrt

__getmainargs __initenv __lconv_init __p__acmdln __p__fmode __set_app_type __setusermatherr _amsg_exit _cexit _initterm _iob _onexit _write abort calloc exit fflush fprintf fputc fputs free fwprintf fwrite malloc memcpy memset realloc signal sprintf strcmp strlen strncmp strncpy vfprintf wcscat wcscmp wcslen wcsncpy

shell32

CommandLineToArgvW ShellExecuteExW ShellExecuteW

user32

MessageBoxW

Name

.text

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

159KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bin/hfsexplorer_vista.vbs

SHA256 2599bc161954294e41e00b714ee0d3e199cb559c13b8962e46a1e5c90e3fd023
MD5 853975571ca02610167c2de5e9fb64a1
SHA1 666091ec1825b27a819b3bfaa3e5dde5d831851b
SHA512 727a44028ee82c5cadf7f751101014467dfec2feb2ca666a39522a46b43ade3e1d17eadb453f017fd215b816861bce09788d455111bb08b612a08cd32cc0b32f
TLSH
T182F09E924BC5C90917BF41C1E5E7CC91536957785B70AC566CCE984493032AC16375E0
MD5 SHA1 SHA512 TLSH

bin/hfsx

SHA256 c0b521472a84b6b6dd29ea45682e7b3780bb0d45497c1675044cd37e02d63c68
MD5 39dfcb755ae6082b86269b7ae4cee7f8
SHA1 09bb097fbc306f7f70fec03ff14c09570eb1505f
SHA512 ee4a1f84e1cb9cc55e57f627025f7c5723fc7e63e0ad94e640d9e44ea70252528917adb19f4df3e661abe2b0d6138b119bb2462539252c6b327033b004236b8f
TLSH
T1A5D02B20605481E5167BCEB3BA09CC68F809722F5614693DF09AC5152FE8795E1E16C7
MD5 SHA1 SHA512 TLSH

linux

bin/hfsx.bat

SHA256 be10629635db60280364014451615d5b3979d121eed72bb68b9dae86e0cc72da
MD5 7e4405f833126fa95118f3b5d1e88cc8
SHA1 04b141e0d7a1ea108067aeb7f567dafffac18627
SHA512 893e239f0f04dae6dc2586283c826a7359ecdea252ef90fd64a9efb0a03daded25ef1e34e6f67a7f5dd45ecf47fa59f26a0873522f93df03c808245d291fd02e
TLSH
T1F3B012DCC078427473F74172E31C8E17801A9169C4C41035F40156220049F4037D41E9
MD5 SHA1 SHA512 TLSH

bin/resview

SHA256 d13145b3ecefe4588bd5398742cf0c046cb0bced435b7ac5d61e20f3371c7e0b
MD5 f92e74bbf6309724621d05b72e6238bf
SHA1 39a5af7f3c3215d5365add27d479589dd292c6a5
SHA512 11572a7468b397cf7bdfce26549f00edf3c977d3cb7ecb968c4d41ec9d667034c0363df21831859635110733d289a5313357b21a715b948714a8f1f5ed34ca40
TLSH
T133E0E710601441F5157BCE73B904CC647C49311F4124783DF059C0042FF4B55E0D15C7
MD5 SHA1 SHA512 TLSH

linux

bin/resview.bat

SHA256 7c39efd14c3674cf60f897bc8e8925a4edc7e6d89bc0a4f80a59a34f06f21072
MD5 0d6c68e932252f56b123d74312e72efb
SHA1 ec34ae49ce13bb38e42b762b0d8584468c8444ce
SHA512 c6b4d3270270307b753f770cee5fa19cf21176f60ad90f1091bd98957998f0fdda1a6c78d4d294f33c611688d8a94e93f483fe8cdad3c5c3055d2e5b6699136a
TLSH
T17ED0A75BC0F62B7033F30495DD1D5A69A59B987E92E5B4F2704080A61484F1E87EC4BB
MD5 SHA1 SHA512 TLSH

bin/unhfs

SHA256 194e61bd67e50a4f304ef459560dae02afbe2d0b417535db3da2724229191f90
MD5 8c2772190033dfcf86673ac02a7c696f
SHA1 929614bfe92b9a48fb773f2d02fcf5cf7293f05f
SHA512 3f45b0e7894792dc1e961c073caa896a4822131e6805ec5c77b3ac7cea5ea795d0acf741595c2eaa1d88eeedca895130113383aaf12f1100b1d1a07b32c3fbfc
TLSH
T183D0EB20A05082E9167BCFB3BA04CC68BC48322F0218383CF09AC0052FF8755E0E12C7
MD5 SHA1 SHA512 TLSH

linux

bin/unhfs.bat

SHA256 01d258088ffaece6ca0290522715433d179892342cf983884cecca42cbfad222
MD5 fbe9c94a2aa1ab29228025737de90070
SHA1 cb47bc6a5222ef65c0f700e9e42ada35fa8dde6e
SHA512 8cea6266e689db59505cc17edb4525f50883e9da1767c42947354d96193818b9bf567e5c8e195c4867be37873473be052b325e4a7d324d270f3b9cec8f6c6cd8
TLSH
T1C0D0A75BC0E6276433D38585DD0D5A59A59B883E535574F2304080A71444B1E97EC4BB
MD5 SHA1 SHA512 TLSH

doc/html/img/HFSExplorer_logo.png

SHA256 71987ac06d087f48236529c3e2b40945e562612b127e0312415ef3afdb88b773
MD5 3c9d2b107535b8ff7c92cd06b1572430
SHA1 9bb3d34cd897316efef0aeebebb481c93759bea5
SHA512 897b157b6c80ee49aee9dcc96e95a84b94380f4ce8af9bb810c2cba01c22213539e7f4cb6582d0288f8f2cd39cf5557dfe10e73c364357149f2f4768d8258e8c
TLSH
T182414C97A348F342AA1E8CA81EDAC0464DFF1170D245411C245E82F357AF6C874B9A0C
MD5 SHA1 SHA512 TLSH

doc/html/index.html

SHA256 8097ba5bcaa346399d19decc586e0f7b1c6ac46555cac442349a003d48e4f15c
MD5 14b744bc094de8dd63493db427e0e882
SHA1 5b0237eae52549c765836f8acfcb4feab74403a7
SHA512 3698606b1082be5deeb4f795966151ddb02d7244d39db8a89d52c4920516e84c3b159adbba873068052cbf5185ff88f162ccb9e7ee8c59e6124735f90b2930bb
TLSH
T18501DC9EA08A934B439257A43AEB6FA08883428F9B544C5DF460646AD498346D67E2D4
MD5 SHA1 SHA512 TLSH

doc/html/troubleshooting.html

SHA256 247416d246a111df9b8443de70e0f67c6612498288d512d8638aa2beda55208f
MD5 cb373497fa13fe08c1f138a6df99da92
SHA1 c1f38552e32ae5db2dab12edad1d38e8cc5773eb
SHA512 384aa208bb805c9be1656ae1abde1eff9173ddda82609e721b406dd56dbefff13f564a0125c2f587ad49648871e5153ceb9a4a5131dc5e58c3865ed83b2303cf
TLSH
T13531651ED6D27336438637C1A09B2793E763520A61D640C8E4BD8335E6943BAC17B0F5
MD5 SHA1 SHA512 TLSH

doc/html/usage.html

SHA256 0118f14d03845662fa5a44e41472d40664cf00ce225dd6c07624634c688c4ed6
MD5 cbb8a39c8f69a079b558e8f0c00d49d6
SHA1 4553f743f6d645541f523e51fcc3dc250dfa7d60
SHA512 b33bab3343e5575a2b85507ab6617943d4c86e8532b778ab32e60bd9704728e9dde8bb5ad938972083cdc7e757bed02ea4939762cb00e44c5ecc17a713f452b7
SSDEEP 96:1zZF4cAPHEmyNDcxowMjFU2jYtsPq6fFgzF3yIH/8LJ86yITNtFg7OSjUQLFruFa:vu+NgxQtjYtE/fFEF3yIf8N86dTNtFrQ
TLSH
T149A1654DA68733361352A2917B5E12A2E331901E13A9761C789FC128F18AA1753FF7F6
MD5 SHA1 SHA512 SSDEEP TLSH

lib/apache-ant-1.7.0-bzip2.jar

SHA256 df648f4390d949f4e5a59531d1daba995e7ec7d7979035c322a9111a7a85c7ee
MD5 3ae8aa7e594fc5aa293a0984ad90e32e
SHA1 34d2f20ea974a513bd98fe0264464fa849b05b1d
SHA512 b925fa8ed61d64f99b62752b2c13431e0f1fe5199483b366961e04e07c6ba02672a1ef26aa31e5d37323937dbfad799afa1d97ba4abc1b9182a7c56cbe593a29
SSDEEP 768:iS+ZlLUo42Xpgye4R27IJGarebjkERLQFRQe6:OTLxPgN4R10a+3RLQFR36
TLSH
T120C2C02F88D50D4FF72B50B885CB872CA2F94C850BC7527A97D594779C13AA80E67E83
MD5 SHA1 SHA512 SSDEEP TLSH

lib/csframework.jar

SHA256 d7f351bcec81e90ba094368584eb3d11148392bd8cd19322a43ae0103938bf28
MD5 ca343e720ca8c4a9142d776a9250dd13
SHA1 bb55d502594bbcf64a4cae570cf70616c04c6da6
SHA512 3a77bf5877a674adc8bfc0b88b26b9e6a560c0a4cccc7df20d4aa642f99353cc78e443b1589986ae132a1d17bcb6ad1fecd2404fed6c1af12ed29ee95f6d4277
SSDEEP 1536:/fGMoC16WLNUVXGXAYoemxQr53mWYGkSz1Q7Buw6XIb8ZkXpIeVpcQHO01HTwIou:no2JwK3vi8Zk/5HP5TwIoNaMeX
TLSH
T1FC83AE32A961A1F4F272C5B3539B0EAF38197478748F9031A668FF5174B0A8D7712B1E
MD5 SHA1 SHA512 SSDEEP TLSH

lib/filedrop.jar

SHA256 e1f6a068d7d12de5853dc78344264748abe4362914f46c186aca7545ac1d9260
MD5 c3667717152fcd8b44d0337ae95bfc70
SHA1 17fefbbf6cc96e07d073214e8d4bb836fd287fe4
SHA512 4e67282a82cc2384ad1aa5f6e028051ca337203e5b017b469dfab22e375e046746ef50e03050e2558138edc57d700fe41be6dfaabdd331b3c86ad82394de1ed6
SSDEEP 384:nX0x33J0PGlbbP8AmaV/+r+7syaKsmam+p6V+19CMqRkLpUuzD6y:X0LHmaVGsdLanz1gMquLpUuH6y
TLSH
T105B2B075AF566DA6F14B55B8B1E3C905361C4301D400B9EA27904A4CAC9CE5C2FCBBFE
MD5 SHA1 SHA512 SSDEEP TLSH

lib/hfsx.jar

SHA256 8d9bbc6a38ac520a50997a8593ad3b099d076464da832d70eea97ce9750ed9a9
MD5 28a83bed4073302bbbb65e85dc41ce19
SHA1 3a1642cd5d4f22578b1b3a1821e92b2cc2377200
SHA512 d271a545de0441740438648cb722a33b21426dd9a43066d983d03edc070e92b5a481efedb01c2f0d3675f36af92543c5958ee232b9a74fd32bb104a611aa9926
SSDEEP 24576:EdK5WxdODhff6iO1dUVW+oAaaPamuyU7bvDEE0gOtb:x5WxiffZyd20kC7nEE0gOtb
TLSH
T14955E035C9EC1530D57382F2819A1E5379B91098F48B34F1B5BCFF86B6729882782B5B
MD5 SHA1 SHA512 SSDEEP TLSH

lib/hfsx_dmglib.jar

SHA256 e115485c227dadf2f9a24df089ad0e3d0f42aefd7cc3bca859469e8c147efb82
MD5 875dbe710a93ec0901359f2361e726aa
SHA1 5e7dfdc1a6192362af19d2824f8b2e995240a304
SHA512 bb5d97d30c6f8b2f3487f9da8b9af0160781bbaa3c06e9c39b4de0f542eba1f40d211e6b24639eb08c37a5c593d68c19c4b9337d97baa4cfc140b24688b1cd72
SSDEEP 3072:9gYpVGzOxPVS7oscBunoIXNMyPsE4wdnrg0myk:9gwIOZViob2tO7mhe
TLSH
T1A4F3D130BCE4E831F226C7B3965B5D313B3956A4709B2461B6D8DFC7B4E4885AB0770A
MD5 SHA1 SHA512 SSDEEP TLSH

lib/iharder-base64.jar

SHA256 7d2f04c3818c3b18f80b8b550c64bcd35aa8e9cf386713be7a2d334f728b0f26
MD5 bf9ddd552c339e77b260c262887bf4fa
SHA1 5dc053c08cc01a7a2045c5f18da7a8d46983ad5c
SHA512 16b04a29a6de51abc45a1d80c3bea1a6dd58246e6247a6082ed0bf26e623647db5a67509a10600b3ef7c1db4ff9297568fe28c577e5c771f6c7e4c292799a950
SSDEEP 192:1oVfnYUb/X9AufZrM5OoteR0UV/pchsXbrdL8Ek/KyBEROmc:mfnYUTdhkOGUrchsLr9k/KyJ
TLSH
T1DA22BEFCFF18314AD3214C3D31F0CDC5FA215E4968406B6B5AB0143C6C6728679CAAEA
MD5 SHA1 SHA512 SSDEEP TLSH

lib/llio_amd64.dll

IMPHASH 6ca412c30c636547d3db56cf2420d5e3
SHA256 c46a914f7a5284a7569d186dbaf02ef1fe33a8a07beb512d17ebe6659098b439
MD5 7a928661a926d8b69e1431abab625765
SHA1 f5516abd38b023359f0101ef5e1dc472a09ab2c5
SHA512 476fc981a0db85b4304f3235a1665fd513202ae754845388b46dea5bd87aeedf8f671bc5280ae4fb1908b09a824be3f1066cf629d2ad29f82f5b4a0b36edd556
SSDEEP 1536:oVYU97xdyya0AxB0plWqipTTJD5ybl5Wi:oX9rgmlzipTTux5Wi
TLSH
T16353396AA3A100B9D4A3D6B8C9E35F55F272F416077943CF4768CA5A5F333E09A3A311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

11968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

lib/llio_arm.dll

IMPHASH b23da8219f13b40185fa4abff7dff64d
SHA256 7f04a754f8a124858aa2ef623363eebfce03a9229c7d1093f933802224b61088
MD5 94c1f3bd44725c1851d493e403da7eb4
SHA1 5d335ccb3c91ce9bb43071d3d8417e8cb406e6bd
SHA512 19cc684f7b4a136bf0c122e1039b5038c433a843922de5a38047d665de21c077454ee0135728cf6bf663223343fd81211d3363689046157520c034097364ca46
SSDEEP 1536:jikWLeaVDbpqzgARRyyfngmUidvz5FHnsWWcd7MUtHmvSU9sDbC3/+NK1K:jgeEDDy43id79oUznDbC3/+NK1K
TLSH
T1C6A3AF017BD5AA61EAFF99789070A60C8B1AFEE0F5F19F01591740BAAC137D48E34F25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

6

Entry point

11561

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

lib/llio_arm64.dll

SHA256 45926be0a224c5b9ace1a2e71acdc4d1537a6a38155753afe98b7f8f3a62351a
MD5 3c1f46e86e77892b301bf2521ed43997
SHA1 401ae45a3968d79a74c8761d057b2c3caaed7782
SHA512 a7e0d40ae8e247c79be86fde0b81fcf327f74d12a6496890d4397604b41c55b340293b5f8f50b86e6754c55bfbedfc1466fa2c446ce561739bb0cd526ddc7a8e
SSDEEP 3072:0/AWWeZ65ROt6ZZUV1TBYpPOI04VTocuSmhOi:WAWzIRtZZUVsrIpS
TLSH
T1CCD36C0379597C03E1D2DB78E9934F50732FFA7484348E1AB116415CEEABBC58EB58A2
MD5 SHA1 SHA512 SSDEEP TLSH

lib/llio_i386.dll

IMPHASH 8f47ae718dedb37210fe727364a6fcd6
SHA256 13b917496b600306e21cb1cecb416c73fe041fd4b1b5a8ed5e117b15ac12197a
MD5 ed244803d0fa06268a110b8f3d2c48a5
SHA1 b3ca7edfc66660a398d5352773536dd022f42cda
SHA512 200f7bc013097b675ec5c7dca50f44b5a3d143e528ee6ddb31bccb00e2a25385a33cd2d6712f9c4154fec1dacffe9240ee05d64685d6cfe472d02cbdbb68a56e
SSDEEP 768:auvBOsli5ClxSDXcTbC7TfP17J32J75/EkR7Wsofd7nOpyyRRwC/wB:Z5riAlKsTe733Q75MkuNyYC/G
TLSH
T163536B507650C472C09764395669D3717A3AB0315AFA80DBBF974B2A9FB03D0BE3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10636

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError SetFilePointer ReadFile CloseHandle DeviceIoControl GetFileInformationByHandle CreateFileW MultiByteToWideChar WriteFile HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetCommandLineA GetVersionExA OutputDebugStringA HeapDestroy HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc HeapReAlloc GetProcAddress GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCurrentThreadId GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP RtlUnwind InitializeCriticalSection Sleep LoadLibraryExA GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle VirtualProtect GetSystemInfo VirtualQuery CreateFileA

lib/llio_ia64.dll

SHA256 89c365d18c0b4f42c0b6993fe9a9c6dfe1d02766a7603d5c92d40a530de4dda6
MD5 bee7a3a52d35613515c3a888f7bb9d08
SHA1 c9e0af9d30ad3d3d5af393c519153623254c3556
SHA512 6fde75c799d4cd46f2aa833aabc1ff40f9fd4cb37907741b5176418fa6c7ccd5070ddca3ed9ac80648e479bddbc1f9283e2f81a72202ad4befb5c32462523649
SSDEEP 3072:M9GrFkFO6dhuobZ2D5tesDLRarOxguk7KB6x877lN4B6gEpN0ii:DraFO6Tuo9YjeqxgVmi87774yf
TLSH
T1A9E3E7467F42E9ABC90A033182E34B6D73F1D3A557B3CB2A563057357E8B3892725A70
MD5 SHA1 SHA512 SSDEEP TLSH

lib/swing-layout-1.0.4.jar

SHA256 143e5551c32934263260412c1d5f4e327fe186b8a5512c0db16ef2e3ed022cad
MD5 983f446152a79d2985a31ae6ad9fd97a
SHA1 6887e101a8c508c851ad137f8cbe09fd1565ac6e
SHA512 d37279fe55152e5bb9f4340e9044cd77884d3ac28a0eedf816e61a24883012d2c3df60262a28b7c346d52f848fe97985cc886d91d0788fd10d022fb3844cb59d
SSDEEP 3072:Hv4HzAOEKAAriHwKJ17bchceqv98Cg1twADgJTlrN/ZVXCvxo:P4T4cbuGU9r
TLSH
T187B3E81BD6005603F787B878CB73AB906FA8BC7485DAE3124AB3F4534AF369D9550AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned JAR

Checks for missing JAR codesign signature.

res/icon.png

SHA256 6325185b92a2dda062d88966fb703f02bd800cf406f7a0881759d8b3fa7824b3
MD5 63209edcafa4f1157a4061845cbe750b
SHA1 c44b611249a6e2e2319cebbf4421c42b0e0b7f69
SHA512 dc0bfd34f2a67716cb4423ea12a337038aede3a976f85b3da988db14094bfc5130763733c4d0ff1cb2a58225f9a27d461798c6d82b986a136d4f7595288d8a51
SSDEEP 96:aZ/I09Da01l+gmkyTt6Hk8nT0Yzc9ajAN0/O1M6p4HY75:aS0tKg9E05T0N9ajqMO1MxHI
TLSH
T1C6B19E1FCAB0E08E0BCD78511DDE0A16A69C222CCC439A6461A2E0DF10C9D4B7F6A8A1
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

hfsexplorer-2026.4.9-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

LICENSE.txt

bin/dumpfsdata.bat

bin/hfsexplorer

bin/hfsexplorer.bat

bin/hfsexplorer.exe

advapi32

kernel32

msvcrt

shell32

user32

generic

bin/hfsexplorer_vista.vbs

bin/hfsx

bin/hfsx.bat

bin/resview

bin/resview.bat

bin/unhfs

bin/unhfs.bat

doc/html/img/HFSExplorer_logo.png

doc/html/index.html

doc/html/troubleshooting.html

doc/html/usage.html

lib/apache-ant-1.7.0-bzip2.jar

lib/csframework.jar

lib/filedrop.jar

lib/hfsx.jar

lib/hfsx_dmglib.jar

lib/iharder-base64.jar

lib/llio_amd64.dll

kernel32

generic

lib/llio_arm.dll

kernel32

generic

lib/llio_arm64.dll

lib/llio_i386.dll

kernel32

generic

lib/llio_ia64.dll

lib/swing-layout-1.0.4.jar

res/icon.png