Why winword.exe spawning iexplore.exe event though Internet explorer is retired?

Hari 0 Reputation points
2026-02-11T16:26:27.6833333+00:00

Hi Everyone,

I have recently observed a scenario where winword.exe is spawning iexplore.exe. However, Microsoft officially retired the Internet explorer desktop application in 2022.

During investigation, I found the following command line, which appear legitimate.

"C:\Program Files\Internet Explorer\iexplore.exe" https://go.microsoft.com/fwlink/?linkid=845227

Given that Internet Explorer has been retired:

1.      Should I consider this behavior suspicious or potentially malicious?

2.      If this is a legitimate, why am I still seeing the iexplore.exe process running in the environment?

3.      Should Internet explorer process still be running on windows server system after its retirement?

4.      Is this something worth investigating further from a security perspective?

Any insights or guidance would be appreciated, thanks you!

Microsoft Security | Microsoft Defender | Other
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-02-11T16:26:41.8933333+00:00

    The behavior you are observing, where winword.exe is spawning iexplore.exe, could be a legitimate action if it is related to features within Microsoft Word that require web access. However, since Internet Explorer has been officially retired as of June 15, 2022, the presence of iexplore.exe in your environment raises several considerations:

    1. Suspicious Behavior: Given that Internet Explorer is retired, any spawning of iexplore.exe should be treated with caution. It could potentially indicate a legacy application or a script that is still attempting to use Internet Explorer for web access. It's advisable to investigate further to ensure that this behavior is not malicious.
    2. Legitimacy of the Process: While iexplore.exe may still run in certain environments, especially if legacy applications or configurations are present, its continued operation is not typical in modern setups. Microsoft Edge with IE mode is recommended for accessing legacy sites, and organizations are encouraged to transition away from Internet Explorer.
    3. Running on Windows Server: Even though Internet Explorer has been retired, it may still be present on some Windows Server systems, especially if they have not been updated or if they are running legacy applications that depend on it. However, it is generally advised to disable or remove Internet Explorer where possible.
    4. Security Perspective: Yes, this situation warrants further investigation from a security perspective. The presence of a retired application can pose security risks, especially if it is being exploited or if it interacts with modern web content that may not be secure. It is recommended to review the configurations and consider transitioning to supported solutions like Microsoft Edge.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.