Topic
CrowdStrike sent an alert reporting about an instruction that involves the K2 smartforms Runtime Application Pool:
c:\windows\system32\inetsrv\w3wp.exe -ap "{AppPool}" -v "v4.0" -l "webengine4.dll" -a \\.\pipe\iisipm15226876-e9af-4ccb-b328-4de5343b53f3 -h "C:\inetpub\temp\apppools\{AppPool}\{AppPool}.config" -w "" -m 0 -t 20 -ta 0
Instructions
This is expected as this command line indicates that the Application Pool is running. You can confirm this from the Task Manager:
- Go to the Details tab.
- Right-click any column header and click on Select columns.
- Check the box next to the Command line option then click OK.
- Look for the w3wp.exe process running under your Application Pool account.