{
	"id": "5f31c873-6222-4752-8059-b7641693c451",
	"created_at": "2026-04-06T03:36:04.422651Z",
	"updated_at": "2026-04-10T03:35:21.533442Z",
	"deleted_at": null,
	"sha1_hash": "c31cdf199eadd8625ad58572dd1ad45cbeb177ff",
	"title": "Dir",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 69235,
	"plain_text": "Dir\r\nBy Archiveddocs\r\nArchived: 2026-04-06 02:52:15 UTC\r\nApplies To: Windows Vista, Windows Server 2008, Windows Server 2012, Windows 8\r\nDisplays a list of a directory's files and subdirectories. If used without parameters, dir displays the disk's volume\r\nlabel and serial number, followed by a list of directories and files on the disk (including their names and the date\r\nand time each was last modified). For files, dir displays the name extension and the size in bytes. Dir also\r\ndisplays the total number of files and directories listed, their cumulative size, and the free space (in bytes)\r\nremaining on the disk.\r\nFor examples of how to use this command, see Examples.\r\ndir [\u003cDrive\u003e:][\u003cPath\u003e][\u003cFileName\u003e] [...] [/p] [/q] [/w] [/d] [/a[[:]\u003cAttributes\u003e]][/o[[:]\u003cSortOrder\u003e]] [/t[[:]\u003c\r\nParameter Description\r\n[\u003cDrive\u003e:]\r\n[\u003cPath\u003e]\r\nSpecifies the drive and directory for which you want to see a listing.\r\n[\u003cFileName\u003e] Specifies a particular file or group of files for which you want to see a listing.\r\n/p\r\nDisplays one screen of the listing at a time. To see the next screen, press any key on the\r\nkeyboard.\r\n/q Displays file ownership information.\r\n/w\r\nDisplays the listing in wide format, with as many as five file names or directory names on\r\neach line.\r\n/d Displays the listing in the same format as /w, but the files are sorted by column.\r\nhttps://technet.microsoft.com/en-us/library/cc755121.aspx\r\nPage 1 of 6\n\nParameter Description\r\n/a[[:]\r\n\u003cAttributes\u003e]\r\nDisplays only the names of those directories and files with the attributes that you specify.\r\nIf you omit /a, dir displays the names of all files except hidden and system files. If you use\r\n/a without specifying Attributes, dir displays the names of all files, including hidden and\r\nsystem files.\r\nThe following list describes each of the values that you can use for Attributes. Using a\r\ncolon (:) is optional. Use any combination of these values, and do not separate the values\r\nwith spaces.\r\n   d Directories\r\n   h Hidden files\r\n   s System files\r\n   l Reparse points\r\n   r Read-only files\r\n   a Files ready for archiving\r\n   i Not content indexed files\r\n   - Prefix meaning \"not\"\r\n/o[[:]\r\n\u003cSortOrder\u003e]\r\nSorts the output according to SortOrder, which can be any combination of the following\r\nvalues:\r\n   n By name (alphabetical)\r\n   e By extension (alphabetical)\r\n   g Group directories first\r\n   s By size (smallest first)\r\n   d By date/time (oldest first)\r\n   - Prefix to reverse order\r\nhttps://technet.microsoft.com/en-us/library/cc755121.aspx\r\nPage 2 of 6\n\nParameter Description\r\nNote\r\nUsing a colon is optional. Multiple values are processed in the order in which you list\r\nthem. Do not separate multiple values with spaces.\r\nIf SortOrder is not specified, dir /o lists the directories in alphabetic order, followed by the\r\nfiles, which are also sorted in alphabetic order.\r\n/t[[:]\r\n\u003cTimeField\u003e]\r\nSpecifies which time field to display or use for sorting. The following list describes each\r\nof the values you can use for TimeField:\r\nc Creation\r\na Last access\r\nw Last written\r\n/s\r\nLists every occurrence of the specified file name within the specified directory and all\r\nsubdirectories.\r\n/b Displays a bare list of directories and files, with no additional information. /b overrides /w.\r\n/l Displays unsorted directory names and file names in lowercase.\r\n/n Displays a long list format with file names on the far right of the screen.\r\n/x\r\nDisplays the short names generated for non-8dot3 file names. The display is the same as\r\nthe display for /n, but the short name is inserted before the long name.\r\n/c\r\nDisplays the thousand separator in file sizes. This is the default behavior. Use /-c to hide\r\nseparators.\r\nhttps://technet.microsoft.com/en-us/library/cc755121.aspx\r\nPage 3 of 6\n\nParameter Description\r\n/4 Displays years in four-digit format.\r\n/? Displays help at the command prompt.\r\nTo use multiple FileName parameters, separate each file name with a space, comma, or semicolon.\r\nYou can use wildcard characters (* or**?**), to represent one or more characters of a file name and to\r\ndisplay a subset of files or subdirectories.\r\nAsterisk (*): Use the asterisk as a substitute for any string of characters, for example:\r\ndir *.txt lists all files in the current directory with extensions that begin with .txt, such as .txt, .txt1,\r\n.txt_old.\r\ndir read*.txt lists all files in the current directory that begin with \"read\" and with extensions that\r\nbegin with .txt, such as .txt, .txt1, or .txt_old.\r\ndir read*.* lists all files in the current directory that begin with \"read\" with any extension.\r\nThe asterisk wildcard always uses short file name mapping, so you might get unexpected results. For\r\nexample, the following directory contains two files (t.txt2 and t97.txt):\r\nC:\\test\u003edir /x\r\nVolume in drive C has no label.\r\nVolume Serial Number is B86A-EF32\r\nDirectory of C:\\test\r\n11/30/2004 01:40 PM \u003cDIR\u003e .\r\n11/30/2004 01:40 PM \u003cDIR\u003e ..\r\n11/30/2004 11:05 AM 0 T97B4~1.TXT t.txt2\r\n11/30/2004 01:16 PM 0 t97.txt\r\nYou might expect that typing dir t97* would return the file t97.txt. However, typing dir t97* returns both\r\nfiles, because the asterisk wildcard matches the file t.txt2 to t97.txt by using its short name map\r\nT97B4~1.TXT. Similarly, typing del t97* would delete both files.\r\nQuestion mark (?): Use the question mark as a substitute for a single character in a name. For example,\r\ntyping dir read???.txt lists any files in the current directory with the .txt extension that begin with \"read\"\r\nhttps://technet.microsoft.com/en-us/library/cc755121.aspx\r\nPage 4 of 6\n\nand are followed by up to three characters. This includes Read.txt, Read1.txt, Read12.txt, Read123.txt, and\r\nReadme1.txt, but not Readme12.txt.\r\nSpecifying file display attributes\r\nIf you use /a with more than one value in Attributes, dir displays the names of only those files with all the\r\nspecified attributes. For example, if you use /a with r and -h as attributes (by using either /a:r-h or /ar-h),\r\ndir will only display the names of the read-only files that are not hidden.\r\nSpecifying file name sorting\r\nIf you specify more than one SortOrder value, dir sorts the file names by the first criterion, then by the\r\nsecond criterion, and so on. For example, if you use /o with the e and -s values for SortOrder (by using\r\neither /o:e-s or /oe-s), dir sorts the names of directories and files by extension, with the largest first, and\r\nthen displays the final result. The alphabetic sorting by extension causes file names with no extensions to\r\nappear first, then directory names, and then file names with extensions.\r\nUsing redirection symbols and pipes\r\nWhen you use the redirection symbol (\u003e) to send dir output to a file or a pipe (|) to send dir output to\r\nanother command, use /a:-d and /b to list the file names only. You can use FileName with /b and /s to\r\nspecify that dir is to search the current directory and its subdirectories for all file names that match\r\nFileName. Dir lists only the drive letter, directory name, file name, and file name extension (one path per\r\nline), for each file name it finds. Before you use a pipe to send dir output to another command, you should\r\nset the TEMP environment variable in your Autoexec.nt file.\r\nThe dir command, with different parameters, is available from the Recovery Console.\r\nTo display all directories one after the other, in alphabetical order, in wide format, and pausing after each screen,\r\nmake sure that the root directory is the current directory, and then type:\r\ndir /s/w/o/p\r\nDir lists the root directory, the subdirectories, and the files in the root directory, including extensions. Then, dir\r\nlists the subdirectory names and file names in each subdirectory in the tree.\r\nTo alter the preceding example so that dir displays the file names and extensions, but omits the directory names,\r\ntype:\r\ndir /s/w/o/p/a:-d\r\nTo print a directory listing, type:\r\ndir \u003e prn\r\nhttps://technet.microsoft.com/en-us/library/cc755121.aspx\r\nPage 5 of 6\n\nWhen you specify prn, the directory list is sent to the printer that is attached to the LPT1 port. If your printer is\r\nattached to a different port, you must replace prn with the name of the correct port.\r\nYou can also redirect output of the dir command to a file by replacing prn with a file name. You can also type a\r\npath. For example, to direct dir output to the file dir.doc in the Records directory, type:\r\ndir \u003e \\records\\dir.doc\r\nIf dir.doc does not exist, dir creates it, unless the Records directory does not exist. In that case, the following\r\nmessage appears:\r\nFile creation error\r\nTo display a list of all the file names with the .txt extension in all directories on drive C, type:\r\ndir c:\\*.txt /w/o/s/p\r\nDir displays, in wide format, an alphabetized list of the matching file names in each directory, and it pauses each\r\ntime the screen fills until you press any key to continue.\r\nCommand-Line Syntax Key\r\nSource: https://technet.microsoft.com/en-us/library/cc755121.aspx\r\nhttps://technet.microsoft.com/en-us/library/cc755121.aspx\r\nPage 6 of 6",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://technet.microsoft.com/en-us/library/cc755121.aspx"
	],
	"report_names": [
		"cc755121.aspx"
	],
	"threat_actors": [
		{
			"id": "2864e40a-f233-4618-ac61-b03760a41cbb",
			"created_at": "2023-12-01T02:02:34.272108Z",
			"updated_at": "2026-04-10T02:00:04.97558Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "ETDA:WildCard",
			"tools": [
				"RustDown",
				"SysJoker"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "256a6a2d-e8a2-4497-b399-628a7fad4b3e",
			"created_at": "2023-11-30T02:00:07.299845Z",
			"updated_at": "2026-04-10T02:00:03.484788Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "MISPGALAXY:WildCard",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775446564,
	"ts_updated_at": 1775792121,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/c31cdf199eadd8625ad58572dd1ad45cbeb177ff.pdf",
		"text": "https://archive.orkl.eu/c31cdf199eadd8625ad58572dd1ad45cbeb177ff.txt",
		"img": "https://archive.orkl.eu/c31cdf199eadd8625ad58572dd1ad45cbeb177ff.jpg"
	}
}