bdeunlock.exe
by Microsoft
Operating System
Summary
BitLocker Drive Encryption Unlock - unlocks BitLocker-encrypted drives.
bdeunlock.exe is the 672nd most commonly executed Windows program in EchoTrail's dataset, observed 6,022 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by explorer.exe.
672nd
most commonly executed Windows program
6,022
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- dcfdd67bf3244ff86cadaaea50b43cce5479014ea2021c0c2fb40b7c856e560398.42%
- 7196824cfb26b4981a95b34209b53299c5ba51784b961b921b41174a51ee8aab0.63%
- c1d9fd2a52ccf1cc1e587fc598c2848778107b902d492749e1ec1a7b777bead60.38%
- 7676dce5b58530b9809d2410c845b4e5f11870618040373e326b90c4544485850.25%
- 7ea89be1bba6a7c2b08d70fa8e4cf036cb086ed162bcd22255e2bc0f926b22b20.12%
- 939d06cab2527efcdc3ab98fc450452552ac99c45a312095aefcba6a2549d9da0.08%
- 159feb891d3f1c0adf06fa5162a3528a8919c1a2d2a21785142d2d6b8d17f3590.07%
- f52e19ba4da44ab3ca36ffd388a8af158e15d48351f0dafd9edc5394f78c2fc00.03%
- 387911a1ac9d717420b0bd6e4c8055ef2ec75c66c64ffa2447b12d49e95ac4b40.02%
Process Ancestry
Top Grandparents
- userinit.exe98.48%
- explorer.exe1.52%
Top Parents
- explorer.exe99.82%
- bdeuisrv.exe0.05%
- AXIOMExamine.exe0.02%
- cmd.exe0.02%
- firefox.exe0.02%
- ftk imager.exe0.02%
- TreeSize.exe0.02%
Top Children
- fvenotify.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about bdeunlock.exe
Rocky answers questions about bdeunlock.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.