BitLockerWizardElev.exe

  • File Path: C:\Windows\system32\BitLockerWizardElev.exe
  • Description: BitLocker Drive Encryption Wizard

Hashes

Type Hash
MD5 46A96812D5A434C3794F06DB978D0C19
SHA1 59F735DBF95BF182C6DA1AD4CA17ABCC3A6AD2C0
SHA256 103078B84013B55F8CFDB5A89973F1930CF50AEF7D0C22DABAA9AC6BED967D5E
SHA384 A1BC153241D3A307BA18522DD4D8C1CEE947836CB7F7C48A224353E1C617C48C35287EA1AF8FBF9B4809D1A4B3ADF95F
SHA512 D4385F85D892801CBF61DC4B55FF17DB31C6AF7678CC95B9C39D329BCCDC0C9A3576A7C8CE7C3685C513DD50901DCE98D80D7D8621D0DC1BA003D9B5A25B5B17
SSDEEP 3072:1AgMFwnVS570M9kdatGCO+xmBc+hMPhPsx:+g1Vs7nyatGt+SYF

Runtime Data

Usage (stderr):

Bitlocker Wizard Launcher
    	Usage: BitlockerWizard X: <P|R|S|T>
    	    P is mapped to  FVEUI_AFTER_TPM_PPI_NO_REBOOT
    	    R is mapped to  FVEUI_AFTER_TPM_PPI_REBOOT
    	    S is mapped to  FVEUI_MODE_CREATE_NO_REBOOT
    	    T is mapped to  FVEUI_MODE_CREATE_AFTER_REBOOT
    	    U is mapped to  FVEUI_MODE_DUPLICATEKEY
    	    V is mapped to  FVEUI_MODE_RESUME
    	    W is mapped to  FVEUI_AFTER_REPARTITION
    	    X is mapped to  FVEUI_PARAM_AFTER_REPARTITION_TPM_PPI
    	    Y is mapped to  FVEUI_PARAM_SAVE_RECOVERY
    	    Z is mapped to  FVEUI_PARAM_PASSPHRASE
    	    K is mapped to  FVEUI_PARAM_STARTUPKEY
    	    J is mapped to  FVEUI_PARAM_CHANGE_PIN
    	    I is mapped to  FVEUI_PARAM_STARTUP_UNLOCK

Loaded Modules:

Path
C:\Windows\System32\advapi32.dll
C:\Windows\system32\bcd.dll
C:\Windows\System32\bcrypt.dll
C:\Windows\System32\bcryptPrimitives.dll
C:\Windows\system32\BDEHDCFGLIB.dll
C:\Windows\system32\BDEUI.dll
C:\Windows\system32\BitLockerWizardElev.exe
C:\Windows\system32\Cabinet.dll
C:\Windows\System32\cfgmgr32.dll
C:\Windows\System32\combase.dll
C:\Windows\System32\COMDLG32.dll
C:\Windows\system32\credui.dll
C:\Windows\System32\CRYPT32.dll
C:\Windows\System32\cryptsp.dll
C:\Windows\system32\dsreg.dll
C:\Windows\system32\DUI70.dll
C:\Windows\system32\FVEAPI.dll
C:\Windows\system32\FVECERTS.dll
C:\Windows\system32\FVESKYBACKUP.dll
C:\Windows\system32\FVEUI.dll
C:\Windows\system32\FVEWIZ.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\imagehlp.dll
C:\Windows\System32\IMM32.DLL
C:\Windows\System32\kernel.appcore.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\MSASN1.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\system32\msvcp110_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\system32\NETAPI32.dll
C:\Windows\system32\NETUTILS.DLL
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\ole32.dll
C:\Windows\System32\OLEAUT32.dll
C:\Windows\System32\powrprof.dll
C:\Windows\System32\profapi.dll
C:\Windows\system32\ReAgent.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\shcore.dll
C:\Windows\System32\SHELL32.dll
C:\Windows\System32\shlwapi.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\system32\UxTheme.dll
C:\Windows\system32\VSSAPI.DLL
C:\Windows\system32\VssTrace.DLL
C:\Windows\System32\win32u.dll
C:\Windows\System32\windows.storage.dll
C:\Windows\system32\WINHTTP.dll
C:\Windows\system32\WKSCLI.DLL
C:\Windows\System32\WS2_32.dll
C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17763.1397_none_de7645305346d5dc\COMCTL32.dll

Signature

  • Status: Signature verified.
  • Serial: 330000026551AE1BBD005CBFBD000000000265
  • Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: BitLockerWizardElev.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\Windows\system32\baaupdate.exe 86
C:\WINDOWS\system32\baaupdate.exe 85
C:\windows\system32\baaupdate.exe 86
C:\WINDOWS\system32\baaupdate.exe 85
C:\Windows\system32\baaupdate.exe 85
C:\WINDOWS\system32\BdeHdCfg.exe 74
C:\Windows\system32\BdeHdCfg.exe 74
C:\WINDOWS\system32\BdeHdCfg.exe 74
C:\Windows\system32\BdeHdCfg.exe 72
C:\windows\system32\BdeHdCfg.exe 79
C:\Windows\system32\bdeunlock.exe 40
C:\Windows\system32\bdeunlock.exe 44
C:\WINDOWS\system32\bdeunlock.exe 41
C:\WINDOWS\system32\bdeunlock.exe 41
C:\windows\system32\bdeunlock.exe 52
C:\Windows\system32\bdeunlock.exe 44
C:\WINDOWS\system32\BitLockerWizard.exe 86
C:\Windows\system32\BitLockerWizard.exe 88
C:\windows\system32\BitLockerWizard.exe 91
C:\WINDOWS\system32\BitLockerWizard.exe 88
C:\Windows\system32\BitLockerWizard.exe 86
C:\Windows\system32\BitLockerWizard.exe 86
C:\Windows\system32\BitLockerWizardElev.exe 85
C:\WINDOWS\system32\BitLockerWizardElev.exe 86
C:\Windows\system32\BitLockerWizardElev.exe 88
C:\windows\system32\BitLockerWizardElev.exe 90
C:\WINDOWS\system32\BitLockerWizardElev.exe 85
C:\Windows\system32\fvecpl.dll 40
C:\Windows\system32\fvenotify.exe 68
C:\WINDOWS\system32\fvenotify.exe 55
C:\windows\system32\fvenotify.exe 72
C:\WINDOWS\system32\fvenotify.exe 66
C:\Windows\system32\fvenotify.exe 69
C:\WINDOWS\system32\fveprompt.exe 72
C:\Windows\system32\fveprompt.exe 69
C:\Windows\system32\fveprompt.exe 71
C:\WINDOWS\system32\fveprompt.exe 75
C:\windows\system32\fveprompt.exe 72
C:\Windows\system32\fveui.dll 49
C:\WINDOWS\system32\manage-bde.exe 55
C:\Windows\system32\manage-bde.exe 54
C:\Windows\system32\manage-bde.exe 52
C:\WINDOWS\system32\manage-bde.exe 52
C:\windows\system32\manage-bde.exe 58
C:\Windows\system32\repair-bde.exe 79
C:\WINDOWS\system32\repair-bde.exe 79
C:\WINDOWS\system32\repair-bde.exe 80
C:\windows\system32\repair-bde.exe 79
C:\Windows\system32\repair-bde.exe 72

MIT License. Copyright (c) 2020-2021 Strontic.