msdt.exe

  • File Path: C:\WINDOWS\system32\msdt.exe
  • Description: Diagnostics Troubleshooting Wizard

Screenshot

msdt.exe

Hashes

Type Hash
MD5 34CA527E0DE6FA60DDBF633F1CFF7DC3
SHA1 5A5507E05A81A2FCC6C2BB5D59955B30E7B8F2A9
SHA256 AE98210A080C9F124AC7224B719773B11F70E48404AE394E3F7311A06532EB81
SHA384 44B48FC06B5169DA01CC2278911DC9BC4CC0E352534FCECFCC90168C4CED64DAAC8F4586D08156B873220F51D58FAFDA
SHA512 C1F9165A65AEDB83B85E9DB4CD1FC67F18B665CFF8853382115D85B55500A4AF293B5C254A65301B371BE6E524D1D61E2E8415D265AD36AC8AE561DDDF8F8D86
SSDEEP 12288:A+iyIQnEvTDjPP0EDgR1osWxo53W96MHFdEXbCNQWZ:t5+XjXPDgR6xo496MHFd0CN
IMP 0755363D7DC0FF5C83A7878C35DEB642
PESHA1 DA4E28198CB835C3492EBD6E672E12560BF5BD57
PE256 C49E4989AC67AEA3716617D0D55BB49BA236A21030F72086604606CC5617E220

Runtime Data

Window Title:

An error occurred

Open Handles:

Path Type
(—) C:\Users\user\AppData\Local\Temp\msdtadmin_BC8B9996-1070-4A57-B36A-97DAA9F24906_\inuse File
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\msdt.exe.mui File
(R-D) C:\Windows\System32\en-US\oleaccrc.dll.mui File
(R-D) C:\Windows\SystemResources\imageres.dll.mun File
(R-D) C:\Windows\SystemResources\msdt.exe.mun File
(R-D) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.22000.1_en-us_6b887e04d8b70b4e\comctl32.dll.mui File
(RW-) C:\Windows\System32 File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.22000.1_en-us_6b887e04d8b70b4e File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467 File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\Windows\Theme1077709572 Section
\Windows\Theme3461253685 Section

Loaded Modules:

Path
C:\WINDOWS\System32\ADVAPI32.dll
C:\WINDOWS\system32\ATL.DLL
C:\WINDOWS\system32\Cabinet.dll
C:\WINDOWS\System32\combase.dll
C:\WINDOWS\System32\COMDLG32.dll
C:\WINDOWS\System32\CRYPT32.dll
C:\WINDOWS\system32\DUI70.dll
C:\WINDOWS\system32\DUser.dll
C:\WINDOWS\System32\GDI32.dll
C:\WINDOWS\System32\gdi32full.dll
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\system32\msdt.exe
C:\WINDOWS\System32\msvcp_win.dll
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\ole32.dll
C:\WINDOWS\System32\OLEAUT32.dll
C:\WINDOWS\System32\RPCRT4.dll
C:\WINDOWS\System32\sechost.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\System32\shcore.dll
C:\WINDOWS\System32\SHELL32.dll
C:\WINDOWS\System32\SHLWAPI.dll
C:\WINDOWS\System32\ucrtbase.dll
C:\WINDOWS\System32\USER32.dll
C:\WINDOWS\system32\UxTheme.dll
C:\WINDOWS\system32\wer.dll
C:\WINDOWS\System32\win32u.dll
C:\WINDOWS\system32\WINHTTP.dll
C:\WINDOWS\System32\WINTRUST.dll
C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467\COMCTL32.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: msdt.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/ae98210a080c9f124ac7224b719773b11f70e48404ae394e3f7311a06532eb81/detection

Possible Misuse

The following table contains possible examples of msdt.exe being misused. While msdt.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_possible_applocker_bypass.yml - '\msdt.exe' DRL 1.0
LOLBAS Msdt.yml Name: Msdt.exe  
LOLBAS Msdt.yml - Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml /skip TRUE  
LOLBAS Msdt.yml - Path: C:\Windows\System32\Msdt.exe  
LOLBAS Msdt.yml - Path: C:\Windows\SysWOW64\Msdt.exe  

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


msdt

Invokes a troubleshooting pack at the command line or as part of an automated script, and enables additional options without user input.

Syntax

msdt </id <name> | /path <name> | /cab < name>> <</parameter> [options] … <parameter> [options]>>

Parameters

Parameter Description
/id <packagename> Specifies which diagnostic package to run. For a list of available packages, see Available Troubleshooting packs.
/path <directory|.diagpkg file|.diagcfg file> Specifies the full path to a diagnostic package. If you specify a directory, the directory must contain a diagnostic package. You cannot use the /path parameter in conjunction with the** /id, **/dci, or /cab parameters.
/dci <passkey> Prepopulates the passkey field. This parameter is only used when a support provider has supplied a passkey.
/dt <directory> Displays the troubleshooting history in the specified directory. Diagnostic results are stored in the user’s %LOCALAPPDATA%\Diagnostics or %LOCALAPPDATA%\ElevatedDiagnostics directories.
/af <answerfile> Specifies an answer file in XML format that contains responses to one or more diagnostic interactions.
/modal <ownerHWND> Makes the troubleshooting pack modal to a window designated by the parent Console Window Handle (HWND), in decimal. This parameter is typically used by applications that launch a troubleshooting pack. For more information about obtaining Console Window Handles, see How to Obtain a Console Window Handle (HWND).
/moreoptions <true|false> Enables (true) or suppresses (false) the final troubleshooting screen that asks if the user wants to explore additional options. This parameter is typically used when the troubleshooting pack is launched by a troubleshooter that isn’t part of the operating system.
/param <parameters> Specifies a set of interaction responses at the command line, similar to an answer file. This parameter isn’t typically used within the context of troubleshooting packs created with TSP Designer. For more information about developing custom parameters, see Windows Troubleshooting Platform.
/advanced Expands the advanced link on the Welcome page by default when the troubleshooting pack is started.
/custom Prompts the user to confirm each possible resolution before it is applied.

Return codes

Troubleshooting packs comprise a set of root causes, each of which describes a specific technical problem. After completing the troubleshooting pack tasks, each root cause returns a state of fixed, not fixed, detected (but not fixable), or not found. In addition to specific results reported in the troubleshooter user interface, the troubleshooting engine returns a code in the results describing, in general terms, whether or not the troubleshooter fixed the original problem. The codes are:

Code Description
-1 Interruption: The troubleshooter was closed before the troubleshooting tasks were completed.
0 Fixed: The troubleshooter identified and fixed at least one root cause, and no root causes remain in a not fixed state.
1 Present, but not fixed: The troubleshooter identified one or more root causes that remain in a not fixed state. This code is returned even if another root cause was fixed.
2 Not found: The troubleshooter did not identify any root causes.

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.