20 New processes The malicious svchost constantly queries ieframe.dll, as well as IWebBrowser2 Interface using CLSID dc30c1661-cdaf-11D0-8A3E-00c04fc9e26e, both key components to interact with Internet Explorer