CmdID

CmdID / Files

getmac.exe

Displays NIC MAC information file version info

Program on Windows 12 known copies with hashes Command getmac

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real getmac.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDisplays NIC MAC information

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\getmac.exe · signed by Microsoft Windows

92473977a002c5a70b652dab2bd5e7099940e35f03ae0249935e5667916d149d

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\getmac.exe · signed by Microsoft Windows

a76002e58180cade8dd1e0d1f443b5cd6411f6e77554f961a3036f2890e7485e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\getmac.exe · signed by Microsoft Windows

467ce33b5145c6e71499f32139f14d81b47c38f11dca26b330367add263dba12

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\getmac.exe · signed by Microsoft Windows

af862b278038dc2a84dee82932cfdcffc837a747c7852dc905de72300c6fd937

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\getmac.exe · signed by Microsoft Windows

83a26a068e174e389b9793e93e65b802b6d923cc70ee8afb06b49c885491b462

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\getmac.exe · signed by Microsoft Windows

94256542e235681ba64a20bc50910dd745d52347a89d36be2dd4c1465901c52b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\getmac.exe · signed by Microsoft Windows

31a48b157db2ced030516b0f41604ef7bb51149fba3fafd1926347f92b9ca5e2

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\getmac.exe · signed by Microsoft Windows

35e08ae5ae1d826c5fc8e41cfa5cfd30a0463975059bd4e8ff710a94f7d9f31a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\getmac.exe · signed by Microsoft Windows

3d7af74b6313751663d28a68084cad9c1f5e9f82b01fd5352880cbe86a06aab2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\getmac.exe · signed by Microsoft Windows

a2b86c9c404568baf6cdbd1d5f393c9893f71fd941523dee9e576ff1979ccca0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\getmac.exe · not signed

10a496c92dfdce13697e15c47e2a9ac0c3f04121dfbefdbf7f5067292446e186

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\getmac.exe · not signed

13f2b062be907d963d749f42c82a619351f1b6167f5f7e62f1e89ffa31d39b7c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.