I spent several hours yesterday investigating with sysinternals process monitor (
https://learn.microsoft.com/en-us/sysinternals/downloads/procmon#screenshots)
I ran 2 tests, one for 10 mins and one for 30, I then filtered the results to only show the activities of the aceshigh11.exe, the 10 min test gave me around 391,000 results, the 30 min gave around 980,000 which I exported to csv.
I then sorted by the duration of each activity, there were only 2 events that took more than a fraction of a second, for the 10 min test, that activity took 601 seconds (10 mins almost exactly) and for the 30 min test, the same activity took 1838 seconds (30 and a tiny bit mins)
I stress again, the next longest activity was 0.0042045 of a sec, while opening/reading terrset00.res (a 150mb file), every other activity on the 30 min test was less than a 1000'th of a sec.
The activity in question is the aceshigh11.exe attempting to access the path C:\Windows\System32\drivers\etc which is a protected folder where your hosts file (and a few others live)
Why it's attempting to do this, I can't tell, I can only guess it might want to set some HT server ip
s in the host file, perhaps leftover old code from the early days of AH?
The exact entry is this :
Time of day 1:31:12.1592613 PM
Process name aceshigh11.exe
PID 5464
Operation NotifyChangeDirectory
Path C:\Windows\System32\drivers\etc
Result CANCELLED
Detail Filter: FILE_NOTIFY_CHANGE_FILE_NAME, FILE_NOTIFY_CHANGE_DIR_NAME, FILE_NOTIFY_CHANGE_ATTRIBUTES, FILE_NOTIFY_CHANGE_SIZE, FILE_NOTIFY_CHANGE_LAST_WRITE, FILE_NOTIFY_CHANGE_SECURITY
Process start 1/08/2024 1:30:37 PM
Duration 601.3205644 (seconds)
And for the 30 mins test, same thing
Time of day 2:34:09.7747351 PM
Process Name aceshigh11.exe
PID 2684
Operation NotifyChangeDirectory C:\Windows\System32\drivers\etc
Result CANCELLED
Detail Filter: FILE_NOTIFY_CHANGE_FILE_NAME, FILE_NOTIFY_CHANGE_DIR_NAME, FILE_NOTIFY_CHANGE_ATTRIBUTES, FILE_NOTIFY_CHANGE_SIZE, FILE_NOTIFY_CHANGE_LAST_WRITE, FILE_NOTIFY_CHANGE_SECURITY
Process start 1/08/2024 2:34:08 PM
Duration 1838.9060439 (30.633 mins)
Around the cancelled entry, aces seems to be doing some queries on network configuration of the machine it's running on, the highlighted entries are the ones that seem to go for 10 mins and then fail/are cancelled.
https://imgur.com/R0vLInOhttps://imgur.com/Q1qoibxApologies, please download the images to see them better...
I'm not suggesting anything suspicious or unusual is happening, but the huge difference in duration of these processes, and the timing lining up really well makes me wonder.
RE my previous guess about skins, I can write that off, there is a lot of skin checking done, but it all happens in milliseconds
HT, I hope this is helpful, I can provide the spreadsheets and the exported process monitor logs if needed.
Steely