getmac.exe

  • File Path: C:\WINDOWS\SysWOW64\getmac.exe
  • Description: Displays NIC MAC information

Hashes

Type Hash
MD5 92AEE8FBF79BC0F2D7DB82950E64B3A9
SHA1 DEC4E1E6A03A689A5A14F8CEDECB14A83D9E5965
SHA256 A76002E58180CADE8DD1E0D1F443B5CD6411F6E77554F961A3036F2890E7485E
SHA384 820FC34DFDEA33CEAB61FC101220B70257A9512A7353ACB1071F89CD697ADBAF9262D3920E9B81E9AEB581ED638EF561
SHA512 B8E39B013AAF73C713AD3B885CE31CDB15209CD240CF0F18B257924E97D636371357D7AF716FCF6947DD8F6365255D99D597B1F99C42E521886E91A8F952853D
SSDEEP 1536:n4aTmLRdc4ys9HcZwruLU9udD47EfAIAarRJh7:eTc499HcZwKC7EYIAajh
IMP 15D387A6E5BAF0A4EF358010F8152ADB
PESHA1 AFEBD05EB631AD3D436C42BAB33E7AE856967702
PE256 B52FA2C60A9BFD4C2758DC68CE8589C29C5F61A45E88431FEA71487FA2A38AB3

Runtime Data

Usage (stdout):


GETMAC [/S system [/U username [/P [password]]]] [/FO format] [/NH] [/V]

Description:
    This tool enables an administrator to display the MAC address
    for network adapters on a system.

Parameter List: 
    /S     system            Specifies the remote system to connect to.

    /U     [domain\]user     Specifies the user context under 
                             which the command should execute.

    /P     [password]        Specifies the password for the given
                             user context. Prompts for input if omitted.

    /FO    format            Specifies the format in which the output
                             is to be displayed.
                             Valid values: "TABLE", "LIST", "CSV".

    /NH                      Specifies that the "Column Header" should
                             not be displayed in the output.
                             Valid only for TABLE and CSV formats.

    /V                       Specifies that verbose output is displayed.

    /?                       Displays this help message.

Examples: 
    GETMAC /? 
    GETMAC /FO csv 
    GETMAC /S system /NH /V
    GETMAC /S system /U user
    GETMAC /S system /U domain\user /P password /FO list /V
    GETMAC /S system /U domain\user /P password /FO table /NH

Usage (stderr):

ERROR: Invalid argument/option - '--help'.
Type "GETMAC /?" for usage.

Loaded Modules:

Path
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\wow64.dll
C:\WINDOWS\System32\wow64base.dll
C:\WINDOWS\System32\wow64con.dll
C:\WINDOWS\System32\wow64cpu.dll
C:\WINDOWS\System32\wow64win.dll
C:\WINDOWS\SysWOW64\getmac.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: GetMac.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/a76002e58180cade8dd1e0d1f443b5cd6411f6e77554f961a3036f2890e7485e/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

getmac

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Returns the media access control (MAC) address and list of network protocols associated with each address for all network cards in each computer, either locally or across a network. This command is particularly useful either when you want to enter the MAC address into a network analyzer, or when you need to know what protocols are currently in use on each network adapter on a computer.

Syntax

getmac[.exe][/s <computer> [/u <domain\<user> [/p <password>]]][/fo {table | list | csv}][/nh][/v]

Parameters

Parameter Description
/s <computer> Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer.
/u <domain>\<user> Runs the command with the account permissions of the user specified by user or domain\user. The default is the permissions of the current logged on user on the computer issuing the command.
/p <password> Specifies the password of the user account that is specified in the /u parameter.
/fo {table | list | csv} Specifies the format to use for the query output. Valid values are table, list, and csv. The default format for output is table.
/nh Suppresses column header in output. Valid when the /fo parameter is set to table or csv.
/v Specifies that the output display verbose information.
/? Displays help at the command prompt.

Examples

The following examples show how you can use the getmac command:

getmac /fo table /nh /v

getmac /s srvmain

getmac /s srvmain /u maindom\hiropln

getmac /s srvmain /u maindom\hiropln /p p@ssW23

getmac /s srvmain /u maindom\hiropln /p p@ssW23 /fo list /v

getmac /s srvmain /u maindom\hiropln /p p@ssW23 /fo table /nh

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.