bdeunlock.exe

  • File Path: C:\WINDOWS\system32\bdeunlock.exe
  • Description: BitLocker Unlock

Hashes

Type Hash
MD5 EDF00F2F7E123623C07A144A1CE5CEF4
SHA1 66D90FDD77CA097510D41A9F2C0F086CB124A6E8
SHA256 A04D1E6C61EEAF81B5F4BE4C326E717366F8C45EF7312A16113B677AF3F47EFD
SHA384 269561ADD9F582E92E350C04C9FB66AA4F7447582CD6A663323D9C40D10BC17840AE29CE57113A323281E15EFBB290AB
SHA512 C201AA31BF56EE1D3932074E564270B636DA402611D5A49B137064066BA3AFBE60442F0B056964AEDEB321D0D0D6C38599821418E834D26FE783C4366E9D0BD6
SSDEEP 6144:BIdERKQt4N/bAAOuI23yxfVLj3K52onVs7nyatGt+SYFSW2C:BIdERjt4NDAAJN3Gftz21H+S+5
IMP E0F899378314471531CB54B05533B862
PESHA1 37D0E8B3E65CA482124E2B74A31B19B4120F59E1
PE256 749687775C4D51323D5330D8734083981880377B9B5B1806B29CE00268BCB49D

Runtime Data

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\bdeunlock.exe.mui File
(R-D) C:\Windows\System32\en-US\dui70.dll.mui File
(R-D) C:\Windows\System32\en-US\oleaccrc.dll.mui File
(R-D) C:\Windows\System32\en-US\Windows.UI.Immersive.dll.mui File
(R-D) C:\Windows\SystemResources\Windows.UI.Immersive.dll.mun File
(RW-) C:\Windows\System32 File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467 File
(RWD) C:\Windows\Fonts\segoeui.ttf File
(RWD) C:\Windows\Fonts\segoeuisl.ttf File
(RWD) C:\Windows\Fonts\seguisym.ttf File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\SessionImmersiveColorPreference Section
\Sessions\2\BaseNamedObjects\windows_shell_global_counters Section

Loaded Modules:

Path
C:\WINDOWS\System32\ADVAPI32.dll
C:\WINDOWS\system32\bdeunlock.exe
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\sechost.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: BDEUNLOCK.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/a04d1e6c61eeaf81b5f4be4c326e717366f8c45ef7312a16113b677af3f47efd/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\baaupdate.exe 47
C:\WINDOWS\system32\baaupdate.exe 44
C:\windows\system32\baaupdate.exe 44
C:\WINDOWS\system32\baaupdate.exe 44
C:\Windows\system32\baaupdate.exe 44
C:\WINDOWS\system32\BdeHdCfg.exe 44
C:\Windows\system32\BdeHdCfg.exe 46
C:\WINDOWS\system32\BdeHdCfg.exe 47
C:\Windows\system32\BdeHdCfg.exe 44
C:\windows\system32\BdeHdCfg.exe 44
C:\Windows\system32\bdeunlock.exe 41
C:\Windows\system32\bdeunlock.exe 44
C:\WINDOWS\system32\bdeunlock.exe 43
C:\windows\system32\bdeunlock.exe 41
C:\Windows\system32\bdeunlock.exe 44
C:\WINDOWS\system32\BitLockerWizard.exe 46
C:\Windows\system32\BitLockerWizard.exe 46
C:\windows\system32\BitLockerWizard.exe 43
C:\WINDOWS\system32\BitLockerWizard.exe 46
C:\Windows\system32\BitLockerWizard.exe 46
C:\Windows\system32\BitLockerWizard.exe 43
C:\Windows\system32\BitLockerWizardElev.exe 41
C:\Windows\system32\BitLockerWizardElev.exe 44
C:\WINDOWS\system32\BitLockerWizardElev.exe 44
C:\Windows\system32\BitLockerWizardElev.exe 41
C:\windows\system32\BitLockerWizardElev.exe 43
C:\WINDOWS\system32\BitLockerWizardElev.exe 47
C:\Windows\system32\fvecpl.dll 38
C:\Windows\system32\fvenotify.exe 46
C:\WINDOWS\system32\fvenotify.exe 41
C:\windows\system32\fvenotify.exe 49
C:\WINDOWS\system32\fvenotify.exe 49
C:\Windows\system32\fvenotify.exe 47
C:\WINDOWS\system32\fveprompt.exe 44
C:\Windows\system32\fveprompt.exe 44
C:\Windows\system32\fveprompt.exe 43
C:\WINDOWS\system32\fveprompt.exe 47
C:\windows\system32\fveprompt.exe 49
C:\Windows\system32\fveui.dll 41
C:\WINDOWS\system32\manage-bde.exe 44
C:\Windows\system32\manage-bde.exe 38
C:\Windows\system32\manage-bde.exe 43
C:\WINDOWS\system32\manage-bde.exe 40
C:\windows\system32\manage-bde.exe 41
C:\Windows\system32\repair-bde.exe 47
C:\WINDOWS\system32\repair-bde.exe 47
C:\WINDOWS\system32\repair-bde.exe 44
C:\windows\system32\repair-bde.exe 43
C:\Windows\system32\repair-bde.exe 40

MIT License. Copyright (c) 2020-2021 Strontic.