In late April 2026, the Windows 10 workstation SG-WKS4 (SG-WKS4.ad.silvergroup.io), used by AD\byoussef in the Silver Group domain, was compromised by a multi-stage FormBook / XLoader infostealer. The infection began with a procurement-themed phishing link opened in the user's New Outlook client and ended with FormBook beaconing out from a hollowed browser process to a large set of decoy domains.
Your objective is to trace the attacker's full activity on the host, from the first browser-driven download all the way to FormBook's command-and-control behavior, reconstructing every stage purely from on-disk forensic artifacts and from manual analysis of the recovered scripts and binaries.
Q1 The intrusion began when the user opened a link in their New Outlook client, which forwarded the request to the default browser. Which process spawned the browser that initiated the malicious download, and at what UTC timestamp did the browser start?
The first job in any intrusion timeline is to establish patient zero, the moment a user action first reached attacker infrastructure. The reporting user mentioned clicking a link inside email, so we anchor on the browser launch and pivot backwards to whatever spawned it.
How to approach it. In Event Log Explorer, filter the Sysmon to Event ID 1 (ProcessCreate) and look for the browser starting. When we find the msedge.exe creation record, the field that answers the question is the parent: instead of explorer.exe, the ParentImage is olk.exe, running from the WindowsApps path Microsoft.OutlookForWindows_1.2026.421.500_x64__8wekyb3d8bbwe. That is the modern New Outlook build, which ships as a packaged WindowsApps application rather than the classic outlook.exe, and the behavioral detail that makes this make sense is that New Outlook does not render external web links itself, it hands them to the system default browser.
We confirm the hand-off a second way so we are not relying on a single …