BitLockerWizard.exe

  • File Path: C:\Windows\system32\BitLockerWizard.exe
  • Description: BitLocker Drive Encryption Wizard

Hashes

Type Hash
MD5 6D30C96F29F64B34BC98E4C81D9B0EE8
SHA1 4A3ADC355F02B9C69BDBE391BFB01469DEE15CF0
SHA256 7758227642702E645AF5E84D1C0E5690E07687C8209072A2C5F79379299EDF74
SHA384 AA4BFE416217EFCD108E2D5610F2308803D35FDBB8D9E9B290DD9AEF3EE7B9CCAFF38C215FCF4F7B940FE2B0BB6ADD37
SHA512 25471B0AC7156D9EE9D12181020039BF551BA3EFE252B656030C12D93B8DB2648A18BDF762740F2A5CD8E43640E4BD4E8742310DEA15823FC76B9E1C126876B8
SSDEEP 3072:h6i+xwnVS570M9kdatGCO+xmBc+hMPhPsx:7bVs7nyatGt+SYF
IMP 1438673C4B1B5696C777658AD76B5D13
PESHA1 88927D9300FD9BC2968A5FB95DD5A9EDB9C14EE8
PE256 A4DC14697B45934883B26BD9B34AA0430EB29FD2FE97170774A05D7FCB1350F4

Runtime Data

Usage (stderr):

Bitlocker Wizard Launcher
    	Usage: BitlockerWizard X: <P|R|S|T>
    	    P is mapped to  FVEUI_AFTER_TPM_PPI_NO_REBOOT
    	    R is mapped to  FVEUI_AFTER_TPM_PPI_REBOOT
    	    S is mapped to  FVEUI_MODE_CREATE_NO_REBOOT
    	    T is mapped to  FVEUI_MODE_CREATE_AFTER_REBOOT
    	    U is mapped to  FVEUI_MODE_DUPLICATEKEY
    	    V is mapped to  FVEUI_MODE_RESUME
    	    W is mapped to  FVEUI_AFTER_REPARTITION
    	    X is mapped to  FVEUI_PARAM_AFTER_REPARTITION_TPM_PPI
    	    Y is mapped to  FVEUI_PARAM_SAVE_RECOVERY
    	    Z is mapped to  FVEUI_PARAM_PASSPHRASE
    	    K is mapped to  FVEUI_PARAM_STARTUPKEY
    	    J is mapped to  FVEUI_PARAM_CHANGE_PIN
    	    I is mapped to  FVEUI_PARAM_STARTUP_UNLOCK

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\bcrypt.dll
C:\Windows\system32\BitLockerWizard.exe
C:\Windows\System32\combase.dll
C:\Windows\system32\FVEWIZ.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\ole32.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002EC6579AD1E670890130000000002EC
  • Thumbprint: F7C2F2C96A328C13CDA8CDB57B715BDEA2CBD1D9
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: BitLockerWizard.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/7758227642702e645af5e84d1c0e5690e07687c8209072a2c5f79379299edf74/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\baaupdate.exe 85
C:\WINDOWS\system32\baaupdate.exe 85
C:\windows\system32\baaupdate.exe 83
C:\WINDOWS\system32\baaupdate.exe 85
C:\Windows\system32\baaupdate.exe 85
C:\WINDOWS\system32\BdeHdCfg.exe 74
C:\Windows\system32\BdeHdCfg.exe 74
C:\WINDOWS\system32\BdeHdCfg.exe 77
C:\Windows\system32\BdeHdCfg.exe 77
C:\windows\system32\BdeHdCfg.exe 79
C:\Windows\system32\bdeunlock.exe 40
C:\Windows\system32\bdeunlock.exe 41
C:\WINDOWS\system32\bdeunlock.exe 43
C:\WINDOWS\system32\bdeunlock.exe 46
C:\windows\system32\bdeunlock.exe 54
C:\Windows\system32\bdeunlock.exe 43
C:\WINDOWS\system32\BitLockerWizard.exe 88
C:\Windows\system32\BitLockerWizard.exe 94
C:\windows\system32\BitLockerWizard.exe 88
C:\WINDOWS\system32\BitLockerWizard.exe 91
C:\Windows\system32\BitLockerWizard.exe 88
C:\Windows\system32\BitLockerWizardElev.exe 86
C:\Windows\system32\BitLockerWizardElev.exe 85
C:\WINDOWS\system32\BitLockerWizardElev.exe 86
C:\Windows\system32\BitLockerWizardElev.exe 88
C:\windows\system32\BitLockerWizardElev.exe 96
C:\WINDOWS\system32\BitLockerWizardElev.exe 85
C:\Windows\system32\fvecpl.dll 41
C:\Windows\system32\fvenotify.exe 72
C:\WINDOWS\system32\fvenotify.exe 57
C:\windows\system32\fvenotify.exe 71
C:\WINDOWS\system32\fvenotify.exe 68
C:\Windows\system32\fvenotify.exe 66
C:\WINDOWS\system32\fveprompt.exe 69
C:\Windows\system32\fveprompt.exe 69
C:\Windows\system32\fveprompt.exe 68
C:\WINDOWS\system32\fveprompt.exe 74
C:\windows\system32\fveprompt.exe 68
C:\Windows\system32\fveui.dll 49
C:\WINDOWS\system32\manage-bde.exe 57
C:\Windows\system32\manage-bde.exe 50
C:\Windows\system32\manage-bde.exe 54
C:\WINDOWS\system32\manage-bde.exe 43
C:\windows\system32\manage-bde.exe 60
C:\Windows\system32\repair-bde.exe 79
C:\WINDOWS\system32\repair-bde.exe 75
C:\WINDOWS\system32\repair-bde.exe 79
C:\windows\system32\repair-bde.exe 82
C:\Windows\system32\repair-bde.exe 75

MIT License. Copyright (c) 2020-2021 Strontic.