msdt.exe
- File Path:
C:\Windows\SysWOW64\msdt.exe - Description: Diagnostics Troubleshooting Wizard
Screenshot
Hashes
| Type | Hash |
|---|---|
| MD5 | A9AB42610361BF6432259061737EA309 |
| SHA1 | 25FA6252069395C5F923A22D40FCB0EC6D13A109 |
| SHA256 | 48103C8EE52D4CEFF0FB8974FFB17E6BFAB773B51F9D187A3A581401D6A7663B |
| SHA384 | B8002527584DB7D5D1B03A705593AD4F315BC43270E569F8FAA013DEB3A223A798BE2FAA59A71BBD38DE718659C15E9F |
| SHA512 | FDFA84A297A2492D98BE927E8A797227B2B19AE5EF4326DCA04E19A01D89054AC71330403C6195F056460498315133077FB9559AE054FB14AD36160301A2A2DB |
| SSDEEP | 6144:vBGci6SDxNV7xLAeijxawdtuGjU8TdLO694gI1sicf7LpPtKXl:vW3V7pX8/XzjUILP94g0cD9Ptm |
| IMP | 19CB93A7F4980963BA180BBC8785967E |
| PESHA1 | 64FE45A286695B60511EEE06B432CFE7BB3ACD5A |
| PE256 | 9B3A5113D5886040CDA36EE70893EDDCB818EA2A476CE962DDB7143D46CFBFA4 |
Runtime Data
Window Title:
An error occurred
Open Handles:
| Path | Type |
|---|---|
| (—) C:\Users\user\AppData\Local\Temp\msdtadmin_4FEAE4A6-A1F1-4528-B3F3-316545AC1C61_\inuse | File |
| (R-D) C:\Windows\Fonts\StaticCache.dat | File |
| (R-D) C:\Windows\System32\en-US\msdt.exe.mui | File |
| (R-D) C:\Windows\System32\en-US\oleaccrc.dll.mui | File |
| (R-D) C:\Windows\SystemResources\imageres.dll.mun | File |
| (R-D) C:\Windows\SystemResources\msdt.exe.mun | File |
| (R-D) C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_130e63d987a738df\comctl32.dll.mui | File |
| (RW-) C:\Users\user | File |
| (RW-) C:\Windows | File |
| (RW-) C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_130e63d987a738df | File |
| (RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627 | File |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 | Section |
| \BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 | Section |
| \BaseNamedObjects\NLS_CodePage_437_3_2_0_0 | Section |
| \Sessions\1\Windows\Theme1175649999 | Section |
| \Windows\Theme601709542 | Section |
Loaded Modules:
| Path |
|---|
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\System32\wow64.dll |
| C:\Windows\System32\wow64cpu.dll |
| C:\Windows\System32\wow64win.dll |
| C:\Windows\SysWOW64\msdt.exe |
Signature
- Status: Signature verified.
- Serial:
3300000266BD1580EFA75CD6D3000000000266 - Thumbprint:
A4341B9FD50FB9964283220A36A1EF6F6FAA7840 - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: msdt.exe
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.19041.1 (WinBuild.160101.0800)
- Product Version: 10.0.19041.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 32-bit
File Scan
- VirusTotal Detections: 0/76
- VirusTotal Link: https://www.virustotal.com/gui/file/48103c8ee52d4ceff0fb8974ffb17e6bfab773b51f9d187a3a581401d6a7663b/detection
Possible Misuse
The following table contains possible examples of msdt.exe being misused. While msdt.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | proc_creation_win_possible_applocker_bypass.yml | - '\msdt.exe' |
DRL 1.0 |
| LOLBAS | Msdt.yml | Name: Msdt.exe |
|
| LOLBAS | Msdt.yml | - Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml /skip TRUE |
|
| LOLBAS | Msdt.yml | - Path: C:\Windows\System32\Msdt.exe |
|
| LOLBAS | Msdt.yml | - Path: C:\Windows\SysWOW64\Msdt.exe |
Additional Info*
*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.
msdt
Invokes a troubleshooting pack at the command line or as part of an automated script, and enables additional options without user input.
Syntax
msdt </id <name> | /path <name> | /cab < name>> <</parameter> [options] … <parameter> [options]>>
Parameters
| Parameter | Description |
|---|---|
/id <packagename> |
Specifies which diagnostic package to run. For a list of available packages, see Available Troubleshooting packs. |
/path <directory|.diagpkg file|.diagcfg file> |
Specifies the full path to a diagnostic package. If you specify a directory, the directory must contain a diagnostic package. You cannot use the /path parameter in conjunction with the** /id, **/dci, or /cab parameters. |
/dci <passkey> |
Prepopulates the passkey field. This parameter is only used when a support provider has supplied a passkey. |
/dt <directory> |
Displays the troubleshooting history in the specified directory. Diagnostic results are stored in the user’s %LOCALAPPDATA%\Diagnostics or %LOCALAPPDATA%\ElevatedDiagnostics directories. |
/af <answerfile> |
Specifies an answer file in XML format that contains responses to one or more diagnostic interactions. |
/modal <ownerHWND> |
Makes the troubleshooting pack modal to a window designated by the parent Console Window Handle (HWND), in decimal. This parameter is typically used by applications that launch a troubleshooting pack. For more information about obtaining Console Window Handles, see How to Obtain a Console Window Handle (HWND). |
/moreoptions <true|false> |
Enables (true) or suppresses (false) the final troubleshooting screen that asks if the user wants to explore additional options. This parameter is typically used when the troubleshooting pack is launched by a troubleshooter that isn’t part of the operating system. |
/param <parameters> |
Specifies a set of interaction responses at the command line, similar to an answer file. This parameter isn’t typically used within the context of troubleshooting packs created with TSP Designer. For more information about developing custom parameters, see Windows Troubleshooting Platform. |
| /advanced | Expands the advanced link on the Welcome page by default when the troubleshooting pack is started. |
| /custom | Prompts the user to confirm each possible resolution before it is applied. |
Return codes
Troubleshooting packs comprise a set of root causes, each of which describes a specific technical problem. After completing the troubleshooting pack tasks, each root cause returns a state of fixed, not fixed, detected (but not fixable), or not found. In addition to specific results reported in the troubleshooter user interface, the troubleshooting engine returns a code in the results describing, in general terms, whether or not the troubleshooter fixed the original problem. The codes are:
| Code | Description |
|---|---|
| -1 | Interruption: The troubleshooter was closed before the troubleshooting tasks were completed. |
| 0 | Fixed: The troubleshooter identified and fixed at least one root cause, and no root causes remain in a not fixed state. |
| 1 | Present, but not fixed: The troubleshooter identified one or more root causes that remain in a not fixed state. This code is returned even if another root cause was fixed. |
| 2 | Not found: The troubleshooter did not identify any root causes. |
Additional References
MIT License. Copyright (c) 2020-2021 Strontic.