BitLockerWizardElev.exe

  • File Path: C:\WINDOWS\system32\BitLockerWizardElev.exe
  • Description: BitLocker Drive Encryption Wizard

Hashes

Type Hash
MD5 A2F993D2E0F1265E592451D6238BD627
SHA1 6083A18342C8E765BBAE10A8F1CD6AFBC251BE26
SHA256 C5ACB94F0F2A2A6ADBE254051DC2DE9AFF056E608D2B95FA69ACC4721F57F871
SHA384 7A9A3707F387F69D3A1E98DF76D102409BD9A0BED7B5AA0E57E2275A6C7197D12493F726A264C1E59E9D9EFCC87CB5C2
SHA512 52E7FECC49A2ECC2286A6B689252E1EAF57B6CB38468C0E801FAD477192CA5415B0B968364DC45CEB91A70CA0E7450E805BB511F9B13C38CAFF57A404309CA95
SSDEEP 3072:OofjoZwnVS570M9kdatGCO+xmBc+hMPhPsx:LjlVs7nyatGt+SYF
IMP 1438673C4B1B5696C777658AD76B5D13
PESHA1 B07CF3DFD4A931B17A36E14937D793849D407C08
PE256 661B5FBF8C4E19BCC27CB761172882658A9E24BC42373D002F98F9CD0CEDE4F0

Runtime Data

Usage (stderr):

Bitlocker Wizard Launcher
    	Usage: BitlockerWizard X: <P|R|S|T>
    	    P is mapped to  FVEUI_AFTER_TPM_PPI_NO_REBOOT
    	    R is mapped to  FVEUI_AFTER_TPM_PPI_REBOOT
    	    S is mapped to  FVEUI_MODE_CREATE_NO_REBOOT
    	    T is mapped to  FVEUI_MODE_CREATE_AFTER_REBOOT
    	    U is mapped to  FVEUI_MODE_DUPLICATEKEY
    	    V is mapped to  FVEUI_MODE_RESUME
    	    W is mapped to  FVEUI_AFTER_REPARTITION
    	    X is mapped to  FVEUI_PARAM_AFTER_REPARTITION_TPM_PPI
    	    Y is mapped to  FVEUI_PARAM_SAVE_RECOVERY
    	    Z is mapped to  FVEUI_PARAM_PASSPHRASE
    	    K is mapped to  FVEUI_PARAM_STARTUPKEY
    	    J is mapped to  FVEUI_PARAM_CHANGE_PIN
    	    I is mapped to  FVEUI_PARAM_STARTUP_UNLOCK

Loaded Modules:

Path
C:\WINDOWS\system32\BitLockerWizardElev.exe
C:\WINDOWS\system32\FVEWIZ.dll
C:\WINDOWS\System32\GDI32.dll
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\System32\msvcp_win.dll
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\ole32.dll
C:\WINDOWS\System32\ucrtbase.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: BitLockerWizardElev.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/c5acb94f0f2a2a6adbe254051dc2de9aff056e608d2b95fa69acc4721f57f871/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\baaupdate.exe 86
C:\WINDOWS\system32\baaupdate.exe 80
C:\windows\system32\baaupdate.exe 82
C:\WINDOWS\system32\baaupdate.exe 83
C:\Windows\system32\baaupdate.exe 83
C:\WINDOWS\system32\BdeHdCfg.exe 75
C:\Windows\system32\BdeHdCfg.exe 74
C:\WINDOWS\system32\BdeHdCfg.exe 74
C:\Windows\system32\BdeHdCfg.exe 74
C:\windows\system32\BdeHdCfg.exe 77
C:\Windows\system32\bdeunlock.exe 43
C:\Windows\system32\bdeunlock.exe 47
C:\WINDOWS\system32\bdeunlock.exe 41
C:\WINDOWS\system32\bdeunlock.exe 47
C:\windows\system32\bdeunlock.exe 52
C:\Windows\system32\bdeunlock.exe 47
C:\WINDOWS\system32\BitLockerWizard.exe 88
C:\Windows\system32\BitLockerWizard.exe 86
C:\windows\system32\BitLockerWizard.exe 86
C:\WINDOWS\system32\BitLockerWizard.exe 91
C:\Windows\system32\BitLockerWizard.exe 85
C:\Windows\system32\BitLockerWizard.exe 88
C:\Windows\system32\BitLockerWizardElev.exe 85
C:\Windows\system32\BitLockerWizardElev.exe 86
C:\WINDOWS\system32\BitLockerWizardElev.exe 88
C:\Windows\system32\BitLockerWizardElev.exe 85
C:\windows\system32\BitLockerWizardElev.exe 88
C:\Windows\system32\fvecpl.dll 40
C:\Windows\system32\fvenotify.exe 69
C:\WINDOWS\system32\fvenotify.exe 60
C:\windows\system32\fvenotify.exe 77
C:\WINDOWS\system32\fvenotify.exe 68
C:\Windows\system32\fvenotify.exe 66
C:\WINDOWS\system32\fveprompt.exe 69
C:\Windows\system32\fveprompt.exe 71
C:\Windows\system32\fveprompt.exe 68
C:\WINDOWS\system32\fveprompt.exe 71
C:\windows\system32\fveprompt.exe 72
C:\Windows\system32\fveui.dll 52
C:\WINDOWS\system32\manage-bde.exe 55
C:\Windows\system32\manage-bde.exe 54
C:\Windows\system32\manage-bde.exe 52
C:\WINDOWS\system32\manage-bde.exe 46
C:\windows\system32\manage-bde.exe 58
C:\Windows\system32\repair-bde.exe 80
C:\WINDOWS\system32\repair-bde.exe 77
C:\WINDOWS\system32\repair-bde.exe 77
C:\windows\system32\repair-bde.exe 74
C:\Windows\system32\repair-bde.exe 72

MIT License. Copyright (c) 2020-2021 Strontic.