FindLinks64.exe

  • File Path: C:\SysinternalsSuite\FindLinks64.exe
  • Description: Locate file hard links

Hashes

Type Hash
MD5 9352AFA6100B005F4130515A73D920FB
SHA1 E87C525616D1942B2D6F0243A5F38DF0A7D2628A
SHA256 B1BC5A3660C922506BE7F8DB3CE6E229D530BCA8E58EE37FA762B9A9D806854B
SHA384 E0B37F7B1B87CEB36BD69A658A24ED8BA412761C4C657D44175DD56A0FAE121DADFB5A6316BBDA346919770B6C51AE4A
SHA512 DE9B6CB2581880EC88041E91CF2171C2E6FCB53DD5BFDF470CB39B13A1AF154BE512FC3AADA069A80D81EC9FE5EA7DF6B290965CAD0AD740173D0C38D15FDB45
SSDEEP 3072:uODxNyDZ/wKk0hIYFFaWMCZbinMoacWwFKphXc5UF/iK5RxBdKvxW9:fDeDpk0CIFaxC5+VdFS3MpY
IMP B1039D126DFB3A118DAE5EADF55AA799
PESHA1 422F55553E6E2227867B60DD59551185C63780A3
PE256 4B520CFE6ADE90BF2EBF2C87F5586281F42DBC239BA03ED43A28305BCCC33FD1

Runtime Data

Usage (stdout):


Findlinks v1.1 - Locate file hard links
Copyright (C) 2011-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

usage: C:\SysinternalsSuite\FindLinks64.exe [-accepteula] [-nobanner] <file>
-accepteula  Suppress the display of the license dialog and accept the EULA.
-nobanner    Do not display the startup banner and copyright message.

Loaded Modules:

Path
C:\SysinternalsSuite\FindLinks64.exe
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 33000001519E8D8F4071A30E41000000000151
  • Thumbprint: 62009AAABDAE749FD47D19150958329BF6FF4B34
  • Issuer: CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: findlinks.exe
  • Product Name: Sysinternals FindLinks
  • Company Name: Sysinternals - www.sysinternals.com
  • File Version: 1.1
  • Product Version: 1.1
  • Language: English (United States)
  • Legal Copyright: Copyright (C) 2011-2016 Mark Russinovich
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/68
  • VirusTotal Link: https://www.virustotal.com/gui/file/b1bc5a3660c922506be7f8db3ce6e229d530bca8e58ee37fa762b9a9d806854b/detection/

Possible Misuse

The following table contains possible examples of FindLinks64.exe being misused. While FindLinks64.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_false_sysinternalsuite.yml - '\FindLinks64.exe' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.