autochk.exe
Sources: 300M+ executions observed in the wild.
Summary
Autochk (autochk.exe) is the boot-time version of chkdsk that runs only on NTFS disks before Windows fully starts. It checks and repairs file system integrity during the early boot phase.
autochk.exe is the 512th most commonly executed Windows program in EchoTrail's dataset, observed 11,137 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by smss.exe.
Get this in your tools
The same record for autochk.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/autochk.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 317762402774ee68a080f6ccc67c8460a746db64484fc37bb3a1f5b8a583f03a31.38%
- 464b487726c75908dae762ebf4fceb6da43d5c5b63dffa7e31414032670b63b711.18%
- 4a2b66e5587be0bdec99c1ec758db67f35d1988b1fcd916355d6473e3bcdd13e9.84%
- 60169baa6e0122de2bd46303611d6b4f9f3128be65deab26f661c58f4182da949.24%
- 7bc847ce6c2d29c334f0d1600bbbde3933ff45f6bee5186f442e6270a3f9ec4e5.32%
- eac4d44d68d22c91395755bf41db110f9b378b37f5056f4e45e2257d36c8903b4.94%
- 644417b839762a3325920a87c3d955ca974a4ec1d6f0082169102674359212554.46%
- 04fc7d9c0c6586ad5d08a3224b2afde2dab8203257a1499948870f5d4b06b6f23.47%
- 25ed9d247d1849b6b9b403c93c3966c180e645726d0edc706c94f56450eb7fd22.71%
- cb1fdd5384b60b7a385a9debbf50d7329066e0823fb0e2421672a16addd626c41.6%
Process Ancestry
Top Parents
- smss.exe100%
Top Children
- cmd.exe5%
Security Analysis
What does autochk.exe normally do?
Located in C:\Windows\System32. Launched by smss.exe during boot. Runs before the Windows subsystem is fully loaded.
When is autochk.exe suspicious?
Non-Microsoft-signed autochk.exe in System32 (rootkit replacement). Network connections from the autochk phase (should not occur). Autochk replaced by third-party software that persists (e.g., Absolute/Computrace persistence).
How do attackers abuse autochk.exe?
Boot-time rootkit: the Emissary Panda APT deployed an autochk rootkit that replaced the legitimate autochk.exe to achieve early boot persistence. Computrace/Absolute persistence uses a modified autochk to reinstall their agent. Any non-Microsoft autochk.exe is suspicious.
Detection guidance
High-confidence: autochk.exe that is not signed by Microsoft. File hash not matching known Microsoft versions. Medium-confidence: autochk.exe generating network traffic (check for connections to search.namequery.com or 209.53.113.23 for Absolute/Computrace).
False positive notes
Absolute/Computrace endpoint management may legitimately replace autochk.exe in some deployments. In VDI environments, Absolute autochk may persist unexpectedly.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about autochk.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for autochk.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.