getmac.exe

  • File Path: C:\Windows\SysWOW64\getmac.exe
  • Description: Displays NIC MAC information

Hashes

Type Hash
MD5 31874C37626D02373768F72A64E76214
SHA1 CB788C30FFA61E17327D411B55CE6EE7491062D5
SHA256 AF862B278038DC2A84DEE82932CFDCFFC837A747C7852DC905DE72300C6FD937
SHA384 26EF1C4DA9B8CDB8B565E5A8463D8E6F9A0FA6DBE164C13912D132F4661D7E15896024C6FFC3FE1C7902781368AAF7A3
SHA512 C47E0F5E440C6F00054067510610C5483DD7A5060D1FCEC736231EEA88414D42139F86CACEC56A1EA6CC4288A367D28F1CFBC84471D687562465FE494EDE5264
SSDEEP 1536:oL4azlGfoseDXCPwF3kFCtk1FYTlgkt4cIqi2pBKMAlUasSGm1a:o6foseTCPc4C2/YTWs4ctiSKXlUaPGm0
IMP 6CB365C8C4783D7461BD89A2FF705113
PESHA1 A8355DE57784FFA4AB405287C2485550E1AFF198
PE256 810654C1EE19CF7BC71619B16B8C28E724785AF12B88E8BCC4E04B55BA229088

Runtime Data

Usage (stdout):


GETMAC [/S system [/U username [/P [password]]]] [/FO format] [/NH] [/V]

Description:
    This tool enables an administrator to display the MAC address
    for network adapters on a system.

Parameter List: 
    /S     system            Specifies the remote system to connect to.

    /U     [domain\]user     Specifies the user context under 
                             which the command should execute.

    /P     [password]        Specifies the password for the given
                             user context. Prompts for input if omitted.

    /FO    format            Specifies the format in which the output
                             is to be displayed.
                             Valid values: "TABLE", "LIST", "CSV".

    /NH                      Specifies that the "Column Header" should
                             not be displayed in the output.
                             Valid only for TABLE and CSV formats.

    /V                       Specifies that verbose output is displayed.

    /?                       Displays this help message.

Examples: 
    GETMAC /? 
    GETMAC /FO csv 
    GETMAC /S system /NH /V
    GETMAC /S system /U user
    GETMAC /S system /U domain\user /P password /FO list /V
    GETMAC /S system /U domain\user /P password /FO table /NH

Usage (stderr):

ERROR: Invalid argument/option - '--help'.
Type "GETMAC /?" for usage.

Child Processes:

mmc.exe

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\getmac.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: GetMac.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/af862b278038dc2a84dee82932cfdcffc837a747c7852dc905de72300c6fd937/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

getmac

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Returns the media access control (MAC) address and list of network protocols associated with each address for all network cards in each computer, either locally or across a network. This command is particularly useful either when you want to enter the MAC address into a network analyzer, or when you need to know what protocols are currently in use on each network adapter on a computer.

Syntax

getmac[.exe][/s <computer> [/u <domain\<user> [/p <password>]]][/fo {table | list | csv}][/nh][/v]

Parameters

Parameter Description
/s <computer> Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer.
/u <domain>\<user> Runs the command with the account permissions of the user specified by user or domain\user. The default is the permissions of the current logged on user on the computer issuing the command.
/p <password> Specifies the password of the user account that is specified in the /u parameter.
/fo {table | list | csv} Specifies the format to use for the query output. Valid values are table, list, and csv. The default format for output is table.
/nh Suppresses column header in output. Valid when the /fo parameter is set to table or csv.
/v Specifies that the output display verbose information.
/? Displays help at the command prompt.

Examples

The following examples show how you can use the getmac command:

getmac /fo table /nh /v

getmac /s srvmain

getmac /s srvmain /u maindom\hiropln

getmac /s srvmain /u maindom\hiropln /p p@ssW23

getmac /s srvmain /u maindom\hiropln /p p@ssW23 /fo list /v

getmac /s srvmain /u maindom\hiropln /p p@ssW23 /fo table /nh

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.