bdeunlock.exe
BitLocker Unlock file version info
Program on Windows 6 known copies with hashes
Is it the real bdeunlock.exe?
C:\Windows\system32\6 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\bdeunlock.exe · signed by Microsoft Windows
a04d1e6c61eeaf81b5f4be4c326e717366f8c45ef7312a16113b677af3f47efd10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\bdeunlock.exe · signed by Microsoft Windows
387911a1ac9d717420b0bd6e4c8055ef2ec75c66c64ffa2447b12d49e95ac4b410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\bdeunlock.exe · signed by Microsoft Windows
dcfdd67bf3244ff86cadaaea50b43cce5479014ea2021c0c2fb40b7c856e560310.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\bdeunlock.exe · signed by Microsoft Windows
7196824cfb26b4981a95b34209b53299c5ba51784b961b921b41174a51ee8aab10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\bdeunlock.exe · signed by Microsoft Windows
939d06cab2527efcdc3ab98fc450452552ac99c45a312095aefcba6a2549d9da6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\bdeunlock.exe · signed by Microsoft Windows
ac611b82d2ccbe59bb4ffef186c58899ebe0bb2d62be2392fbe47708ba6b3f42From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.