msdt.exe

  • File Path: C:\WINDOWS\SysWOW64\msdt.exe
  • Description: Diagnostics Troubleshooting Wizard

Screenshot

msdt.exe

Hashes

Type Hash
MD5 7F5E763F479D20C7FC3B421F3B9346B2
SHA1 9F8BEEF1ADC36E78C9C5C3C88A62CFBA65B0B3F5
SHA256 F2367A8459FCAEFB36D55C1B5F90963CB68AC8489589767010412BEABE3BF03F
SHA384 B2ECDC4B452CB510255BC43A158E7982899DD53D2DABC402F8B23350197497770788CEF7F7EA45DB9A1AA208795F842A
SHA512 373AC670B50195A3128D6BE49E9B7F8F3A248C7C0F2141F67500D25A9DA8C0C77EF9B2B619B6DCEBA0992277530987CF70E9649AE711F969CDB09E0111EF47AD
SSDEEP 6144:2BGkiStyt1EZN00/VxMWSug18fWONNYlXsUhChk74RP+e+7p:2+Jt0xMfh1PONqxhChk0Rz
IMP F821FED57D2DA743AB457520DC9BBEEC
PESHA1 F79AF906ECF74E25C25F071F514BBC9FE2FA07B2
PE256 7122962D22E0ACC7E540C1F9406EDC4B42E190973C4F8387C45EBDE9B8AA7017

Runtime Data

Window Title:

An error occurred

Open Handles:

Path Type
(—) C:\Users\user\AppData\Local\Temp\msdtadmin_2FDE6193-3452-4774-BC18-5665976CB26C_\inuse File
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\msdt.exe.mui File
(R-D) C:\Windows\System32\en-US\oleaccrc.dll.mui File
(R-D) C:\Windows\SystemResources\imageres.dll.mun File
(R-D) C:\Windows\SystemResources\msdt.exe.mun File
(R-D) C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.22000.1_en-us_b335b4dbed333454\comctl32.dll.mui File
(RW-) C:\Windows File
(RW-) C:\Windows\SysWOW64 File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.22000.1_en-us_b335b4dbed333454 File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_e541a94fcce8ed6d File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\Windows\Theme1077709572 Section
\Windows\Theme3461253685 Section

Loaded Modules:

Path
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\wow64.dll
C:\WINDOWS\System32\wow64base.dll
C:\WINDOWS\System32\wow64con.dll
C:\WINDOWS\System32\wow64cpu.dll
C:\WINDOWS\System32\wow64win.dll
C:\WINDOWS\SysWOW64\msdt.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: msdt.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/f2367a8459fcaefb36d55c1b5f90963cb68ac8489589767010412beabe3bf03f/detection

Possible Misuse

The following table contains possible examples of msdt.exe being misused. While msdt.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_possible_applocker_bypass.yml - '\msdt.exe' DRL 1.0
LOLBAS Msdt.yml Name: Msdt.exe  
LOLBAS Msdt.yml - Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml /skip TRUE  
LOLBAS Msdt.yml - Path: C:\Windows\System32\Msdt.exe  
LOLBAS Msdt.yml - Path: C:\Windows\SysWOW64\Msdt.exe  

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


msdt

Invokes a troubleshooting pack at the command line or as part of an automated script, and enables additional options without user input.

Syntax

msdt </id <name> | /path <name> | /cab < name>> <</parameter> [options] … <parameter> [options]>>

Parameters

Parameter Description
/id <packagename> Specifies which diagnostic package to run. For a list of available packages, see Available Troubleshooting packs.
/path <directory|.diagpkg file|.diagcfg file> Specifies the full path to a diagnostic package. If you specify a directory, the directory must contain a diagnostic package. You cannot use the /path parameter in conjunction with the** /id, **/dci, or /cab parameters.
/dci <passkey> Prepopulates the passkey field. This parameter is only used when a support provider has supplied a passkey.
/dt <directory> Displays the troubleshooting history in the specified directory. Diagnostic results are stored in the user’s %LOCALAPPDATA%\Diagnostics or %LOCALAPPDATA%\ElevatedDiagnostics directories.
/af <answerfile> Specifies an answer file in XML format that contains responses to one or more diagnostic interactions.
/modal <ownerHWND> Makes the troubleshooting pack modal to a window designated by the parent Console Window Handle (HWND), in decimal. This parameter is typically used by applications that launch a troubleshooting pack. For more information about obtaining Console Window Handles, see How to Obtain a Console Window Handle (HWND).
/moreoptions <true|false> Enables (true) or suppresses (false) the final troubleshooting screen that asks if the user wants to explore additional options. This parameter is typically used when the troubleshooting pack is launched by a troubleshooter that isn’t part of the operating system.
/param <parameters> Specifies a set of interaction responses at the command line, similar to an answer file. This parameter isn’t typically used within the context of troubleshooting packs created with TSP Designer. For more information about developing custom parameters, see Windows Troubleshooting Platform.
/advanced Expands the advanced link on the Welcome page by default when the troubleshooting pack is started.
/custom Prompts the user to confirm each possible resolution before it is applied.

Return codes

Troubleshooting packs comprise a set of root causes, each of which describes a specific technical problem. After completing the troubleshooting pack tasks, each root cause returns a state of fixed, not fixed, detected (but not fixable), or not found. In addition to specific results reported in the troubleshooter user interface, the troubleshooting engine returns a code in the results describing, in general terms, whether or not the troubleshooter fixed the original problem. The codes are:

Code Description
-1 Interruption: The troubleshooter was closed before the troubleshooting tasks were completed.
0 Fixed: The troubleshooter identified and fixed at least one root cause, and no root causes remain in a not fixed state.
1 Present, but not fixed: The troubleshooter identified one or more root causes that remain in a not fixed state. This code is returned even if another root cause was fixed.
2 Not found: The troubleshooter did not identify any root causes.

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.