driverquery.exe

  • File Path: C:\Windows\SysWOW64\driverquery.exe
  • Description: Queries the drivers on a system

Hashes

Type Hash
MD5 35E01178B770031DCDFF984A49F57D90
SHA1 575D01167CE84F32E30C597113434076BAA1901F
SHA256 54BD0E8075F63285C1408516913ABD9913BA058A80A43E345AD42B34F36F6C12
SHA384 B87E37B6A1E173F8AA31933F569CDF5E6749C67E5836EC688ED9E20E92A7C91AF287F2D6ED02702148D1960051AA414F
SHA512 EB0935C6E6CFDC2AF4F3687957C0FCE837BC95765CAB646E237F90A46D3046A063A57C9BD568955E867C6AE900DB1B17EF930F154AF4D62AE96D07F49B2DC654
SSDEEP 1536:USJKP28Q/NA/HleeW38KYYcW+lQgi/uTjBgS/InxDJjLTK:E0NA/UsbYcGgikgnxdjL2
IMP F43657274705381484D63C59A47DACF7
PESHA1 9E074AAF1A4FF0FFC4970D95B52F761643BEE989
PE256 9C25217A56AE02764ACC1AD6DFAEA87B795A73F68782A7F28A5E793A20DAEF68

Runtime Data

Usage (stdout):


DRIVERQUERY [/S system [/U username [/P [password]]]]
              [/FO format] [/NH] [/SI] [/V] 
Description:
    Enables an administrator to display a list of 
    installed device drivers.

Parameter List:
      /S     system           Specifies the remote system to connect to.

      /U     [domain\]user    Specifies the user context 
                              under which the command should execute.

      /P     [password]       Specify the password for the given 
                              user context.

      /FO    format           Specifies the type of output to display.
                              Valid values to be passed with the
                              switch are "TABLE", "LIST", "CSV".

      /NH                     Specifies that the "Column Header" 
                              should not be displayed. Valid for  
                              "TABLE" and "CSV" format only.

      /SI                     Provides information about signed drivers.

      /V                      Displays verbose output. Not valid 
                              for signed drivers.

      /?                      Displays this help message.

Examples:
    DRIVERQUERY
    DRIVERQUERY /FO CSV /SI
    DRIVERQUERY /NH
    DRIVERQUERY /S ipaddress /U user /V 
    DRIVERQUERY /S system /U domain\user /P password /FO LIST

Usage (stderr):

ERROR: Invalid argument/option - '--help'.
Type "DRIVERQUERY /?" for usage.

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\driverquery.exe

Signature

  • Status: Signature verified.
  • Serial: 33000001C422B2F79B793DACB20000000001C4
  • Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: drvqry.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/54bd0e8075f63285c1408516913abd9913ba058a80a43e345ad42b34f36f6c12/detection/

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


driverquery

Enables an administrator to display a list of installed device drivers and their properties. If used without parameters, driverquery runs on the local computer.

Syntax

driverquery [/s <system> [/u [<domain>\]<username> [/p <password>]]] [/fo {table | list | csv}] [/nh] [/v | /si]

Parameters

Parameter Description
/s <system> Specifies the name or IP address of a remote computer. Do not use backslashes. The default is the local computer.
/u [<domain>]<username> Runs the command with the credentials of the user account as specified by user or domain\user. By default, /s uses the credentials of the user who is currently logged on to the computer that is issuing the command. /u can’t be used unless /s is specified.
/p <password> Specifies the password of the user account that is specified in the /u parameter. /p cannot be used unless /u is specified.
/fo table Formats the output as a table. This is the default.
/fo list Formats the output as a list.
/fo csv Formats the output with comma-separated values.
/nh Omits the header row from the displayed driver information. Not valid if the /fo parameter is set to list.
/v Displays verbose output. /v is not valid for signed drivers.
/si Provides information about signed drivers.
/? Displays help at the command prompt.

Examples

To display a list of installed device drivers on the local computer, type:

driverquery

To display the output in a comma-separated values (CSV) format, type:

driverquery /fo csv

To hide the header row in the output, type:

driverquery /nh

To use the driverquery command on a remote server named server1 using your current credentials on the local computer, type:

driverquery /s server1

To use the driverquery command on a remote server named server1 using the credentials for user1 on the domain maindom, type:

driverquery /s server1 /u maindom\user1 /p p@ssw3d

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.