home

bootsect.exe

Boot Sector Manipulation Tool

Microsoft Corporation

This is installed with multiple programs including Windows Embedded Standard 7 SP1 and License Assessment Tool for Windows Embedded Standard 7. The file has been seen being downloaded from doc-0s-5s-docsviewer.googleusercontent.com and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft® Windows® Operating System

Description:
Boot Sector Manipulation Tool

Version:
6.1.7600.16385 (win7_rtm.090713-1255)

MD5:
dba3e8620db43046b9ee78add41865f4

SHA-1:
563f7ad1a7fa99adc8c7687dc04207bfc2b479eb

SHA-256:
52cd10fde714fcd0a04b25660a2ca69bd6a79b297d0ec088d202a7054ad33a09

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/19/2024 1:21:36 PM UTC  (today)

File size:
100.9 KB (103,312 bytes)

Product version:
6.1.7600.16385

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
bootsect.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Windows\System32\bootsect.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
61062781000000000008

File PE Metadata
OS version:
6.1

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
9.0

CTPH (ssdeep):
1536:fYbtrIOZ5XZX+SQleQKdsN+jiRBlY/k6ftJDRUqrHUm:CI85x5ueQKdsN+jiRI/k6V7Uqom

Entry address:
0x68E0

Entry point:
E8, 3C, 09, 00, 00, E9, C3, FD, FF, FF, CC, CC, CC, CC, CC, CC, FF, 25, 70, 11, 00, 01, CC, CC, CC, CC, CC, CC, FF, 25, 6C, 11, 00, 01, CC, CC, CC, CC, CC, CC, FF, 25, 68, 11, 00, 01, CC, CC, CC, CC, CC, 3B, 0D, 20, 44, 01, 01, 75, 03, C2, 00, 00, E9, 94, 09, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 53, 8B, 44, 24, 14, 0B, C0, 75, 18, 8B, 4C, 24, 10, 8B, 44, 24, 0C, 33, D2, F7, F1, 8B, 44, 24, 08, F7, F1, 8B, C2, 33, D2, EB, 50, 8B, C8, 8B, 5C, 24, 10, 8B, 54, 24, 0C, 8B, 44, 24, 08, D1...
 
[+]

Entropy:
5.7467

Code size:
53 KB (54,272 bytes)

The file bootsect.exe has been discovered within the following programs.

License Assessment Tool for Windows Embedded Standard 7  by Microsoft Corporation
www.microsoft.com
6% remove it
Windows Embedded Standard 7 SP1  by Microsoft Corporation
www.microsoft.com/Embedded
9% remove it
 
Powered by Should I Remove It?

The file bootsect.exe has been seen being distributed by the following 26 URLs.

https://doc-0s-5s-docsviewer.googleusercontent.com/viewer/securedownload/pe9muvmsd628ril82v55ha8vtieei9m8/plvq6r9uth79b17ap36kpann7cdhqn1a/1399119300000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?a=dl&filename=bootsect7600x86.zip&sec=AHSqidax6jf0m-warmLOQSJS7-Lcwe7YNCfTG_ErgjihgYhIInX1msejgrp2HkAS_LSWPnOacn1R&rel=zip;z1;bootsect.exe

http://originaldll.com/.../20574.exe

https://dl.dropbox.com/u/27657024/blog/.../bootsect.exe

http://188.138.70.226/.../bootsect.exe

https://onedrive.live.com/download.aspx?cid=934A6AECAFEDBB5F&authKey=!AN6xUo2m2nJk95I&resid=934A6AECAFEDBB5F!845&ithint=.exe

http://188.138.70.227/.../bootsect.exe

https://onedrive.live.com/download.aspx?cid=934A6AECAFEDBB5F&authKey=!AN6xUo2m2nJk95I&resid=934A6AECAFEDBB5F!845&canary=GM8PKzTNkwmwVSbjWQ 5NY11INmLpDJwYSMSRyBw0ew=0&ithint=.exe

https://doc-04-7g-docsviewer.googleusercontent.com/viewer/securedownload/dsn1aovipa7l846lsfcf94nedj8q2p4u/lqsjl93msa0fa2tfddl4tnm5f6g82m90/1407402900000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?a=dl&filename=bootsect7600x86.zip&sec=AHSqidbeAH_VntzF7Cnb7LeGFexoM1GMlIOuU8msQP9u01edDGP_766f5Hgw7Uu21Fwkee9aUEOs&rel=zip;z1;bootsect.exe

http://85.25.103.180/.../bootsect.exe

http://85.25.103.133/.../bootsect.exe

https://doc-10-0g-docsviewer.googleusercontent.com/viewer/securedownload/v31phba3jfid8bd8nj4go8oohcrvfk12/bah627rbi62qquqblcfhjo0807b4go17/1414125900000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?sec=AHSqidaHoEuMbNqToQgLYn3brl6SCM9_k85fOGbQxwk9FszVnGg-fVSNesg75KjSiGOzZIHktGcU&a=dl&filename=bootsect7600x86.zip&rel=zip;z1;bootsect.exe&nonce=fh2cfu5jg3ai0&user=AGZ5hq_1FhjsJ1dNu44d7S8ID7Es&hash=pvddm4dll1n332villroju2f5qlp8odg

https://docs.google.com/viewer/noncesigner?nonce=fh2cfu5jg3ai0&continue=https://doc-10-0g-docsviewer.googleusercontent.com/viewer/securedownload/v31phba3jfid8bd8nj4go8oohcrvfk12/bah627rbi62qquqblcfhjo0807b4go17/1414125900000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?sec=AHSqidaHoEuMbNqToQgLYn3brl6SCM9_k85fOGbQxwk9FszVnGg-fVSNesg75KjSiGOzZIHktGcU&a=dl&filename=bootsect7600x86.zip&rel=zip;z1;bootsect.exe&hash=jrm432imvq35pnho19hd9vm1hhqdhgtv

https://doc-10-0g-docsviewer.googleusercontent.com/viewer/securedownload/v31phba3jfid8bd8nj4go8oohcrvfk12/bah627rbi62qquqblcfhjo0807b4go17/1414125900000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?a=dl&filename=bootsect7600x86.zip&sec=AHSqidaHoEuMbNqToQgLYn3brl6SCM9_k85fOGbQxwk9FszVnGg-fVSNesg75KjSiGOzZIHktGcU&rel=zip;z1;bootsect.exe

https://doc-04-7g-docsviewer.googleusercontent.com/viewer/securedownload/dsn1aovipa7l846lsfcf94nedj8q2p4u/am79p5nm0uqhp0277obfeiq37d2csb9g/1410925500000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?a=dl&filename=bootsect7600x86.zip&sec=AHSqidasRhFVAK-4gpY5KISRmdmTFcITxtOcs7KT5gYCbW7sINgUIxQ3E1fry5jVpJh7W8pOfFwl&rel=zip;z1;bootsect.exe

https://doc-0o-7c-docsviewer.googleusercontent.com/viewer/securedownload/3ug4tfg0uv009detps2qgfv1v87hdtn1/n6qigu7oglm6hb3rqskei2ppfimvkgb4/1414188900000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?a=dl&filename=bootsect7600x86.zip&sec=AHSqidYAN69m6FAR_OeOPZVnog58Nmenx-2eBG5yD4C9YXrc85PyALzW9V-9REQTlgfTpq1_KehR&rel=zip;z1;bootsect.exe

https://doc-04-7g-docsviewer.googleusercontent.com/viewer/securedownload/dsn1aovipa7l846lsfcf94nedj8q2p4u/2d6a6hft4f8h8e6t2ogvj2dck2o8s3tn/1401545700000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?sec=AHSqidYyW_ByuLnu7fixgivLHqF_wOvZO1c8qyd-VzEYnAKouroNq6Pn7OKoRg9wQbNj4rZiX7Wj&a=dl&filename=bootsect7600x86.zip&rel=zip;z1;bootsect.exe&nonce=88bqg23ligd8k&user=AGZ5hq8BgbJY1gwaOYx83cPOdNw6&hash=i4a6ghr7a19m02ts203nsro77q8h49h0

https://docs.google.com/viewer/noncesigner?nonce=88bqg23ligd8k&continue=https://doc-04-7g-docsviewer.googleusercontent.com/viewer/securedownload/dsn1aovipa7l846lsfcf94nedj8q2p4u/2d6a6hft4f8h8e6t2ogvj2dck2o8s3tn/1401545700000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?sec=AHSqidYyW_ByuLnu7fixgivLHqF_wOvZO1c8qyd-VzEYnAKouroNq6Pn7OKoRg9wQbNj4rZiX7Wj&a=dl&filename=bootsect7600x86.zip&rel=zip;z1;bootsect.exe&hash=rnkiq4ubpjc20m7ufte395iraq01l1ml

https://doc-04-7g-docsviewer.googleusercontent.com/viewer/securedownload/dsn1aovipa7l846lsfcf94nedj8q2p4u/2d6a6hft4f8h8e6t2ogvj2dck2o8s3tn/1401545700000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?a=dl&filename=bootsect7600x86.zip&sec=AHSqidYyW_ByuLnu7fixgivLHqF_wOvZO1c8qyd-VzEYnAKouroNq6Pn7OKoRg9wQbNj4rZiX7Wj&rel=zip;z1;bootsect.exe

https://doc-10-98-docsviewer.googleusercontent.com/viewer/securedownload/n22c9plare848un57tkg3ub63icei6p3/7ssht0lrjl2d4k49tcrgm9f5qtitb3j9/1389476700000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?sec=AHSqidbRyq9YArzxSm45BTGAFDpUKBiSIZvcQ9BmT4A-pYcZYKyxG25QWP__hK95nX1Ni6oT0fuN&a=dl&filename=bootsect7600x86.zip&rel=zip;z1;bootsect.exe&nonce=12r5pdug13r9e&user=AGZ5hq8QJ-0eeI8MHBRl3JEWvQrT&hash=pfbr71cih6fo3r8j4kmve6hj1uqgamm1

https://docs.google.com/viewer/noncesigner?nonce=12r5pdug13r9e&continue=https://doc-10-98-docsviewer.googleusercontent.com/viewer/securedownload/n22c9plare848un57tkg3ub63icei6p3/7ssht0lrjl2d4k49tcrgm9f5qtitb3j9/1389476700000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?sec=AHSqidbRyq9YArzxSm45BTGAFDpUKBiSIZvcQ9BmT4A-pYcZYKyxG25QWP__hK95nX1Ni6oT0fuN&a=dl&filename=bootsect7600x86.zip&rel=zip;z1;bootsect.exe&hash=qc3h2rckg9bdeif9o8dm8ega3d5kks52

https://doc-10-98-docsviewer.googleusercontent.com/viewer/securedownload/n22c9plare848un57tkg3ub63icei6p3/7ssht0lrjl2d4k49tcrgm9f5qtitb3j9/1389476700000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?a=dl&filename=bootsect7600x86.zip&sec=AHSqidbRyq9YArzxSm45BTGAFDpUKBiSIZvcQ9BmT4A-pYcZYKyxG25QWP__hK95nX1Ni6oT0fuN&rel=zip;z1;bootsect.exe

https://doc-10-0s-docsviewer.googleusercontent.com/viewer/securedownload/tps6ijko102gfg9f540segqtam7bhhus/inldtsmiv7tf2fr75ecbstl97v7u3nk3/1402776900000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?a=dl&filename=bootsect7600x86.zip&sec=AHSqidZA9KkZeR_GWVZ9cefyscuDlIqyY6qswoECnMzTY1K7TPhY5aPs7mYT1Pd9G9-TEmx5yfGN&rel=zip;z1;bootsect.exe

https://doc-10-90-docsviewer.googleusercontent.com/viewer/securedownload/iqqssvuml6ucdljrblgkoh5ju99fk8pu/gaiaehgb4u1dssfjfiq9uiskgkuaob1l/1391879700000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?a=dl&filename=bootsect7600x86.zip&sec=AHSqidbGXTqeWPdN1xpbnZh3GoiSSTA-rCjUB650L2ItloLQbXlu9H0vy3wZPa-_NCw8s1V2oNE6&rel=zip;z1;bootsect.exe

https://doc-0c-2c-docsviewer.googleusercontent.com/viewer/securedownload/esnge90k8uui6955fqr89d3avjpoe678/bpvh8vlg5do3llgn0e9vmdtbvc54tkem/1376031600000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?a=dl&filename=bootsect7600x86.zip&sec=AHSqidbhySWcyQuJW9ae8fX5q7yny7u-bsMy86ugdfAf9wlTySSRHleZNah8ZUtxM0xM4Dbn9jX8&rel=zip;z1;bootsect.exe

https://docs.google.com/viewer/noncesigner?nonce=pn4a02dbtni70&continue=https://doc-0c-2c-docsviewer.googleusercontent.com/viewer/securedownload/esnge90k8uui6955fqr89d3avjpoe678/bpvh8vlg5do3llgn0e9vmdtbvc54tkem/1376031600000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?sec=AHSqidbhySWcyQuJW9ae8fX5q7yny7u-bsMy86ugdfAf9wlTySSRHleZNah8ZUtxM0xM4Dbn9jX8&a=dl&filename=bootsect7600x86.zip&rel=zip;z1;bootsect.exe&hash=f7ik66kb3hv7uathpkajcfhmsngvhc45

https://doc-0c-2c-docsviewer.googleusercontent.com/viewer/securedownload/esnge90k8uui6955fqr89d3avjpoe678/bpvh8vlg5do3llgn0e9vmdtbvc54tkem/1376031600000/c2l0ZXM=/.../YTI5emMySnZjM011WTI5dGZHMWhhVzU4WjNnNk5qSmxaR1kyWTJVeVpUWTBaV1V4WWc=?sec=AHSqidbhySWcyQuJW9ae8fX5q7yny7u-bsMy86ugdfAf9wlTySSRHleZNah8ZUtxM0xM4Dbn9jX8&a=dl&filename=bootsect7600x86.zip&rel=zip;z1;bootsect.exe&nonce=pn4a02dbtni70&user=AGZ5hq8wSMTcUqh-SuQ1rO4k517v&hash=76n48mbjjbmm3ns7d7d38dcm2uuhq2v7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.