autochk.exe
Summary
Autochk (autochk.exe) is the boot-time version of chkdsk that runs only on NTFS disks before Windows fully starts. It checks and repairs file system integrity during the early boot phase.
autochk.exe is the 512th most commonly executed Windows program in EchoTrail's dataset, observed 11,137 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by smss.exe.
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 317762402774ee68a080f6ccc67c8460a746db64484fc37bb3a1f5b8a583f03a31.38%
- 464b487726c75908dae762ebf4fceb6da43d5c5b63dffa7e31414032670b63b711.18%
- 4a2b66e5587be0bdec99c1ec758db67f35d1988b1fcd916355d6473e3bcdd13e9.84%
- 60169baa6e0122de2bd46303611d6b4f9f3128be65deab26f661c58f4182da949.24%
- 7bc847ce6c2d29c334f0d1600bbbde3933ff45f6bee5186f442e6270a3f9ec4e5.32%
- eac4d44d68d22c91395755bf41db110f9b378b37f5056f4e45e2257d36c8903b4.94%
- 644417b839762a3325920a87c3d955ca974a4ec1d6f0082169102674359212554.46%
- 04fc7d9c0c6586ad5d08a3224b2afde2dab8203257a1499948870f5d4b06b6f23.47%
- 25ed9d247d1849b6b9b403c93c3966c180e645726d0edc706c94f56450eb7fd22.71%
- cb1fdd5384b60b7a385a9debbf50d7329066e0823fb0e2421672a16addd626c41.6%
Process Ancestry
Top Parents
- smss.exe100%
Top Children
- cmd.exe5%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does autochk.exe normally do?
Located in C:\Windows\System32. Launched by smss.exe during boot. Runs before the Windows subsystem is fully loaded.
When is autochk.exe suspicious?
Non-Microsoft-signed autochk.exe in System32 (rootkit replacement). Network connections from the autochk phase (should not occur). Autochk replaced by third-party software that persists (e.g., Absolute/Computrace persistence).
How do attackers abuse autochk.exe?
Boot-time rootkit: the Emissary Panda APT deployed an autochk rootkit that replaced the legitimate autochk.exe to achieve early boot persistence. Computrace/Absolute persistence uses a modified autochk to reinstall their agent. Any non-Microsoft autochk.exe is suspicious.
Detection guidance
High-confidence: autochk.exe that is not signed by Microsoft. File hash not matching known Microsoft versions. Medium-confidence: autochk.exe generating network traffic (check for connections to search.namequery.com or 209.53.113.23 for Absolute/Computrace).
False positive notes
Absolute/Computrace endpoint management may legitimately replace autochk.exe in some deployments. In VDI environments, Absolute autochk may persist unexpectedly.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about autochk.exe
Rocky answers questions about autochk.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.