bdechangepin.exe

  • File Path: C:\Windows\system32\bdechangepin.exe
  • Description: BitLocker Drive Encryption: PIN Change Tool

Screenshot

bdechangepin.exe

Hashes

Type Hash
MD5 F58E82580EC2E892BDC9BDFCA1EE9FB7
SHA1 7DC8F2E61CBB44A9BFD8FBAE4F936483FA7B1E33
SHA256 B6D905244DE5F8B472F2C1528FF87674E6C397A2D4522CF340F7B8E538261DC6
SHA384 B9215092E18BE8E1888DC0CE5E9385ABE5039EE5919979933D5C0D420969957334EB0C2EF73B81FA8B2879DD67ECCEA7
SHA512 7B4B4ED1B1E61563715F1E5896DD7BA4168F15B82A369F8621079315306D9C80569B18628FF80E2ABD3202592DCA8CB8E19A4DD7D91ED813A14578EFE9BC1ADF
SSDEEP 6144:HVHv9HVxHEVHHHQVb1kHVqHVqHQQ9T8TXT5ThT2HVfAXTWT6TITQTMVyW176eIs/:xvH+S+
IMP BA4B1FE51A18B04D0B300A89C7D36C5E
PESHA1 AFACFF7A64CDBDBA90AE0F137E88C4F9A0CCFD4D
PE256 8445C0706EB2DE24D069526196BD1E1766C6DEFEA2B6D1220F8D0D0C071A3084

Runtime Data

Window Title:

BitLocker Drive Encryption

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\bdechangepin.exe.mui File
(R-D) C:\Windows\System32\en-US\duser.dll.mui File
(R-D) C:\Windows\System32\en-US\KernelBase.dll.mui File
(R-D) C:\Windows\SystemResources\imageres.dll.mun File
(R-D) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_cb612d02732b0fd9\comctl32.dll.mui File
(RW-) C:\Users\user\Documents File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_cb612d02732b0fd9 File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_ca04af081b815d21 File
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\1\Windows\Theme1703657751 Section
\Windows\Theme1455388728 Section

Loaded Modules:

Path
C:\Windows\system32\bdechangepin.exe
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\ole32.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\SHELL32.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: bdechangepin.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/b6d905244de5f8b472f2c1528ff87674e6c397a2d4522cf340f7b8e538261dc6/detection/

File Similarity (ssdeep match)

File Score
C:\WINDOWS\system32\bdechangepin.exe 85
C:\WINDOWS\system32\bdechangepin.exe 74
C:\Windows\system32\bdechangepin.exe 90
C:\Windows\system32\bdechangepin.exe 74
C:\Windows\system32\bdechangepin.exe 91

MIT License. Copyright (c) 2020-2021 Strontic.