FindLinks.exe

  • File Path: C:\SysinternalsSuite\FindLinks.exe
  • Description: Locate file hard links

Hashes

Type Hash
MD5 6B2362B6CE635E97F42DC21B47134CBF
SHA1 60119AB41A9F3B002DCC288C879D1A8FF72E4E85
SHA256 EB74645B56A4EB4306DE0D0456DC764B58590D6C9A0E0F912B10A4F1DB63BA69
SHA384 E673802905513BE4EA786E946AD629D9AB16AF55D2553027C8A9FA505B22C765A77F5184B3C3524B532CD0ECEEC087CF
SHA512 045F144CBAAA6CCCD74C4C86C29DE413F67ED0D9C02535C6C9B5A79FE7F06F0AD6A9207D45D9559C2A0C37601667E04E174ECA23B25B430329FF769360E5E505
SSDEEP 3072:7yMf6iAsDo6avTjwN1Pr42rlSz5Cw7F7Uo8YZUFyxp+qsdFmHi:7yO6iAsDo6K0N1Ps2rQcyGk5s7mHi
IMP 5B89F5E8FD683EBD16A938968D6E7CD4
PESHA1 65739F874217A51B05F1E7473E937941FA68FFC7
PE256 F93D6E87C3EA639E7ED9AB231D96DFF42B0CB5D5AF798946E1A4C3354A9089C3

Runtime Data

Usage (stdout):


Findlinks v1.1 - Locate file hard links
Copyright (C) 2011-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

usage: C:\SysinternalsSuite\FindLinks.exe [-accepteula] [-nobanner] <file>
-accepteula  Suppress the display of the license dialog and accept the EULA.
-nobanner    Do not display the startup banner and copyright message.

Loaded Modules:

Path
C:\SysinternalsSuite\FindLinks.exe
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll

Signature

  • Status: Signature verified.
  • Serial: 33000001519E8D8F4071A30E41000000000151
  • Thumbprint: 62009AAABDAE749FD47D19150958329BF6FF4B34
  • Issuer: CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: findlinks.exe
  • Product Name: Sysinternals FindLinks
  • Company Name: Sysinternals - www.sysinternals.com
  • File Version: 1.1
  • Product Version: 1.1
  • Language: English (United States)
  • Legal Copyright: Copyright (C) 2011-2016 Mark Russinovich
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/71
  • VirusTotal Link: https://www.virustotal.com/gui/file/eb74645b56a4eb4306de0d0456dc764b58590d6c9a0e0f912b10a4f1db63ba69/detection/

Possible Misuse

The following table contains possible examples of FindLinks.exe being misused. While FindLinks.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_false_sysinternalsuite.yml - '\FindLinks.exe' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.