sigcheck.exe
by Microsoft (Sysinternals)
Security Tool
Summary
Sysinternals Sigcheck — file signature and certificate verification utility
sigcheck.exe is the 2420th most commonly executed Windows program in EchoTrail's dataset, observed 183 times across enterprise environments. It typically runs from C:\Windows\Temp and it is most often launched by powershell.exe.
2420th
most commonly executed Windows program
183
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\Temp97.27%
- C:\Users\...2.73%
Top Hashes (SHA256)
- af20ca06c404c57b13b67169da4f18c146f7df6b0a6bb9b599da2a7bd9fe12cd97.27%
- 4fe9a2bd4b160a5352333d00d0b0c10f13685af7acdb48e9e9d0c3877a19eed42.73%
Process Ancestry
Top Grandparents
- explorer.exe94.38%
- powershell.exe5.62%
Top Parents
- powershell.exe97.27%
- cmd.exe2.73%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about sigcheck.exe
Rocky answers questions about sigcheck.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.