appidcertstorecheck.exe
Summary
AppLocker Certificate Store Check - validates certificates referenced by AppLocker policies.
appidcertstorecheck.exe is the 361st most commonly executed Windows program in EchoTrail's dataset, observed 23,881 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- f00ea11118b39d06a3d361e851b6d13b29a3fc0c787ab763e9c351f718cb90bb40.05%
- c95030171f1a69568723966ad6090a8531a2e253372a4facf28a76aad88f609923.52%
- a67bcc238c3d707ed3d78bcb8d47ba05361b3d5c63651bee56860a3d1830ed8d16.66%
- aa10b8ba3c2f360fff0177c67762fe87fe1bb514bb92a4cb2db875fd58877ced10.15%
- 109d7fa51e3ebb2dd1c64251e65cca782bff45d811f73f7dee3708ddad7268334.57%
- 7221e0e74c0db33611cbf17f49ad72122d5a9f05c82d839ef4b04d8c64f444922.88%
- 6cbc308b5d776398983d312a5d8227a80e131a93fa5130daf71c3cac28f9ad711.73%
- 5afdc8ae3aac555a3ddc317d8aa05eab3a7a24ac5641c3a7162aac96f511f6d30.43%
- ee3bbbb57cc37276b683f797d2b2240c833d2b04a73fdc46425c71de400d92a2<0.01%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- svchost.exe99.99%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about appidcertstorecheck.exe
Rocky answers questions about appidcertstorecheck.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.