explorer crashes windows online forensics

Explorer crashes windows online forensics windows 10#

The first version was the attackers who had hacked the laptop remotely or gained physical access to it.

The investigator considered two possibilities. The organization’s security systems did not detect any suspicious activity at that time (all the IDS/IPS, SEIM/ERP, AV, WAF and other systems kept shut). Significant sums have been transferred to unrecognized accounts in foreign banks. The company that owned the laptop discovered unauthorized payments in one of its bank accounts, while all transactions appeared to be performed on behalf of legitimate users (the financial director and chief accountant). The computer belonged to the treasurer, whose duties included transacting and documenting with remote banking recipients. A major antivirus was running, and unrestricted Internet access was allowed. Domain security policies were enforced with a corporate password policy, BitLocker volume encryption, built-in firewall and UAC control. The laptop could be used during business trips, work at home, and off premises via a corporate VPN.īy default, the local user was not granted administrative privileges. This same laptop was used as the employee’s main computer.

Explorer crashes windows online forensics windows 10#

The laptop in question runs Windows 10 and was a member of the corporate domain at the time of the incident. Or maybe the employee faked it and stole the money while pointing fingers to “evil hackers”? We’ll sure find out. “Where’s the money?” Or, rather, “Where did the money go?” The user of a company-owned Windows 10 laptop fell victim of a cyberfraud attack.