msdt.exe

  • File Path: C:\Windows\system32\msdt.exe
  • Description: Diagnostics Troubleshooting Wizard

Screenshot

msdt.exe

Hashes

Type Hash
MD5 992C3F0CC8180F2F51156671E027AE75
SHA1 942EC8C2CCFCACD75A1CD86CBE8873AEE5115E29
SHA256 6859D1B5D1BEAA2985B298F3FCEE67F0AAC747687A9DEC2B4376585E99E9756F
SHA384 9883706170D4AE0B7588859790F2743B1744BB601D31EE6055953777251D96F5FBC2BDA47B2F76F500783D955AA915D1
SHA512 1F1B8D39E29274CFC87A9EF1510ADB9C530086A421C121523376731C8933C6E234E9146310D3767CE888A8DCE7A5713221F4D25E5B7B6398D06AE2BE2B99EADF
SSDEEP 6144:DyDdIBWtP3soBExEjFsH/72/KRRYmKwsJ0ONA3lZf+/BrfMpBXqL/+7jGpys3Z/L:DmoLoexFz2CRlxbfgfOti4svB
IMP 3A1E8B78C984CDC6E669D871794AD160
PESHA1 6251DFF361951BFCBF348841AADD86C2D5663665
PE256 624E67C8898E4D692DAF39272F68B60E0C233D997B08A1096285002A0DE2DF20

Runtime Data

Window Title:

An error occurred

Open Handles:

Path Type
(—) C:\Users\user\AppData\Local\Temp\msdtadmin_F25172B4-11C9-468B-BDF5-74913D94B483_\inuse File
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\msdt.exe.mui File
(R-D) C:\Windows\System32\en-US\oleaccrc.dll.mui File
(R-D) C:\Windows\SystemResources\imageres.dll.mun File
(R-D) C:\Windows\SystemResources\msdt.exe.mun File
(R-D) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_cb612d02732b0fd9\comctl32.dll.mui File
(RW-) C:\Users\user File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_cb612d02732b0fd9 File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_ca04af081b815d21 File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\1\Windows\Theme1175649999 Section
\Windows\Theme601709542 Section

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\combase.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\system32\msdt.exe
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\OLEAUT32.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\SHELL32.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\win32u.dll
C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_ca04af081b815d21\COMCTL32.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: msdt.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/76
  • VirusTotal Link: https://www.virustotal.com/gui/file/6859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f/detection

Possible Misuse

The following table contains possible examples of msdt.exe being misused. While msdt.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_possible_applocker_bypass.yml - '\msdt.exe' DRL 1.0
LOLBAS Msdt.yml Name: Msdt.exe  
LOLBAS Msdt.yml - Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml /skip TRUE  
LOLBAS Msdt.yml - Path: C:\Windows\System32\Msdt.exe  
LOLBAS Msdt.yml - Path: C:\Windows\SysWOW64\Msdt.exe  

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


msdt

Invokes a troubleshooting pack at the command line or as part of an automated script, and enables additional options without user input.

Syntax

msdt </id <name> | /path <name> | /cab < name>> <</parameter> [options] … <parameter> [options]>>

Parameters

Parameter Description
/id <packagename> Specifies which diagnostic package to run. For a list of available packages, see Available Troubleshooting packs.
/path <directory|.diagpkg file|.diagcfg file> Specifies the full path to a diagnostic package. If you specify a directory, the directory must contain a diagnostic package. You cannot use the /path parameter in conjunction with the** /id, **/dci, or /cab parameters.
/dci <passkey> Prepopulates the passkey field. This parameter is only used when a support provider has supplied a passkey.
/dt <directory> Displays the troubleshooting history in the specified directory. Diagnostic results are stored in the user’s %LOCALAPPDATA%\Diagnostics or %LOCALAPPDATA%\ElevatedDiagnostics directories.
/af <answerfile> Specifies an answer file in XML format that contains responses to one or more diagnostic interactions.
/modal <ownerHWND> Makes the troubleshooting pack modal to a window designated by the parent Console Window Handle (HWND), in decimal. This parameter is typically used by applications that launch a troubleshooting pack. For more information about obtaining Console Window Handles, see How to Obtain a Console Window Handle (HWND).
/moreoptions <true|false> Enables (true) or suppresses (false) the final troubleshooting screen that asks if the user wants to explore additional options. This parameter is typically used when the troubleshooting pack is launched by a troubleshooter that isn’t part of the operating system.
/param <parameters> Specifies a set of interaction responses at the command line, similar to an answer file. This parameter isn’t typically used within the context of troubleshooting packs created with TSP Designer. For more information about developing custom parameters, see Windows Troubleshooting Platform.
/advanced Expands the advanced link on the Welcome page by default when the troubleshooting pack is started.
/custom Prompts the user to confirm each possible resolution before it is applied.

Return codes

Troubleshooting packs comprise a set of root causes, each of which describes a specific technical problem. After completing the troubleshooting pack tasks, each root cause returns a state of fixed, not fixed, detected (but not fixable), or not found. In addition to specific results reported in the troubleshooter user interface, the troubleshooting engine returns a code in the results describing, in general terms, whether or not the troubleshooter fixed the original problem. The codes are:

Code Description
-1 Interruption: The troubleshooter was closed before the troubleshooting tasks were completed.
0 Fixed: The troubleshooter identified and fixed at least one root cause, and no root causes remain in a not fixed state.
1 Present, but not fixed: The troubleshooter identified one or more root causes that remain in a not fixed state. This code is returned even if another root cause was fixed.
2 Not found: The troubleshooter did not identify any root causes.

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.