After installing ZLMU / ZL Origin, I observed suspicious host behavior on a personal Windows system, including a reported web protection disablement event, perceived performance degradation, and a later antivirus quarantine hit involving a Discord-related artifact.
The investigation confirmed the presence of user-level scheduled-task persistence under a custom SoftLanding task tree, with internal TaskCache records, task XML definitions, and filesystem timestamps all supporting a staged persistence timeline. A secondary Discord-related artifact (core.asar) was quarantined from a separate ProgramData\willi\Discord\... path, while the active user Discord process was observed under the expected AppData\Local\Discord\... path.
The evidence supports a suspicious persistence incident with partial remediation already in progress, but it does not conclusively prove that all observed symptoms were caused by a single active malware process at the exact time of final testing. This case study focuses on artifact-based reconstruction, not overclaiming a live compromise.
This investigation was performed on a personal Windows endpoint after the installation of a suspicious third-party gaming-related application (ZLMU / ZL Origin).
- Identify whether suspicious persistence mechanisms were established
- Reconstruct a timeline of artifacts
- Correlate task XML, registry TaskCache, filesystem timestamps, antivirus detections, and Prefetch findings
- Document the case as a defensive DFIR / Windows persistence investigation for portfolio purposes
- Full reverse engineering of ZLMU binaries
- Kernel- or memory-level malware analysis
- Attribution to a specific malware family with high confidence
- A definitive claim that all user-observed slowness was malware-caused
The following indicators triggered the investigation:
- Perceived performance degradation
- Perceived network-related slowness
- A reported web protection disablement event around 05:53 AM
- A reported account access attempt
- Discovery of suspicious scheduled tasks under a custom SoftLanding task path
- Antivirus quarantine of a suspicious Discord-related
core.asarartifact
The investigation focused on host artifacts rather than live malware detonation. Evidence was collected from the following sources:
- Task XML exports
- Registry TaskCache
- Task files stored on disk
- Antivirus quarantine / detection details
- Prefetch execution artifacts
- Process-path validation for active Discord
- Manual path comparison between active and suspicious Discord trees
The investigation followed this logic:
- Validate that suspicious tasks actually existed
- Map task names → internal TaskCache GUIDs
- Confirm internal task
Path,Actions,Triggers, andDynamicInfo - Correlate filesystem timestamps of the task definitions
- Compare Discord-related paths and AV detections
- Review Prefetch artifacts for execution correlation
- Separate findings into Confirmed / Likely / Unknown
The investigation confirmed the existence of a custom scheduled-task tree under:
\SoftLanding\S-1-5-21-1472141973-736933594-3381716112-1001\
SoftLandingCreativeManagementTaskSoftLandingDeferralTask-{5741d124-700c-4965-ad0f-61f55251af88}SoftLandingTriggerTask-128000000001615609-render-{a54facd6-7ff1-4f88-a661-569227d49b52}
- Execution context: interactive user token
- Run level: least privilege
- Action type: COM handler
- Triggering included a WNF state change trigger
- Repetition behavior existed, including a 15-minute recurrence
- Restart / availability logic was present
This establishes user-level persistence via Scheduled Tasks + COM handler, rather than a simple visible cmd.exe or powershell.exe task action.
The suspicious task names were successfully mapped to internal TaskCache GUIDs.
-
SoftLandingCreativeManagementTask→{772B0572-BE2B-49A4-BE41-9C3D3F22F664} -
SoftLandingDeferralTask-{5741d124-700c-4965-ad0f-61f55251af88}→{2CD9F4E8-FE01-48AD-8311-128676E2288B} -
SoftLandingTriggerTask-128000000001615609-render-{a54facd6-7ff1-4f88-a661-569227d49b52}→{E43094EA-EE5E-4C49-87DF-F1D85ECBBA27}
For each internal task object, the following were recovered:
PathActionsTriggersDynamicInfo
The internal task action data confirmed COM-handler–based execution, aligning with the XML / GUI observation that these tasks were using custom handlers instead of visible Exec actions.
The physical task files in:
C:\Windows\System32\Tasks\SoftLanding\...
showed a strong staged timeline.
SoftLandingCreativeManagementTask- CreationTime:
2026-02-25 10:43:58 PM - LastWriteTime:
2026-02-25 10:43:58 PM
- CreationTime:
-
SoftLandingDeferralTask-{5741d124-700c-4965-ad0f-61f55251af88}- CreationTime:
2026-03-05 05:52:42 PM - LastWriteTime:
2026-03-05 05:52:42 PM
- CreationTime:
-
SoftLandingTriggerTask-128000000001615609-render-{a54facd6-7ff1-4f88-a661-569227d49b52}- CreationTime:
2026-03-05 05:52:42 PM - LastWriteTime:
2026-03-05 05:52:42 PM
- CreationTime:
This strongly suggests:
- Phase 1: initial foothold / primary persistence on 2026-02-25
- Phase 2: additional helper / recurrence tasks added on 2026-03-05
This staged artifact creation supports the hypothesis that the observed issue may have evolved over time, rather than causing maximum impact immediately after installation.
The Microsoft-Windows-TaskScheduler/Operational log was checked and found to be:
IsEnabled = False
Historical Task Scheduler execution events were not available retroactively. This prevented full recovery of task execution history from that channel and forced the investigation to rely on:
- Task XML
- TaskCache
- Filesystem timestamps
- Antivirus artifacts
- Prefetch data
This is an important limitation, not a failure of the investigation.
A suspicious core.asar artifact was detected and quarantined by antivirus.
- File:
core.asar - Detection label:
TR/Malware - SHA256:
979A0CB31C2FC8D78BE7B2125C7D5738EC3015AB8CEC899DA11C3D2B8FBB08EA
C:\ProgramData\willi\Discord\app-1.0.9042\modules\discord_desktop_core-1\discord_desktop_core\core.asar
This artifact was treated as a secondary suspicious finding discovered during the investigation rather than automatically assumed to be the sole root cause of the incident.
The active Discord process observed during investigation resolved to the expected user path:
C:\Users\William Barquero\AppData\Local\Discord\app-...\Discord.exe
However, the quarantined core.asar came from a different tree:
C:\ProgramData\willi\Discord\...
This supports at least one of the following:
- a parallel Discord-like installation
- a staging or disguised Electron-style application tree
- a pre-existing alternate Discord tree that was later modified
The root folder C:\ProgramData\willi\Discord had a creation date from March 27, 2024, which predates the current incident. Therefore, the evidence does not support claiming that the entire folder tree was created by the recent ZLMU installation.
A more defensible conclusion is that pre-existing content may have been modified or leveraged during the incident.
Relevant Prefetch entries were identified, including:
- Multiple
DISCORD.EXE-*.pf WSC_AGENT_ENROLL_UPDATE.EXE-AB4715E6.pfDISCORDHOOKHELPER64.EXE-C3CBD281.pfPOWERSHELL.EXE-CA1AE517.pfCMD.EXE-*
-
WSC_AGENT_ENROLL_UPDATE.EXE-AB4715E6.pf- LastWriteTime:
2026-03-06 05:52:48 AM
- LastWriteTime:
-
DISCORDHOOKHELPER64.EXE-C3CBD281.pf- LastWriteTime:
2026-03-06 03:00:41 AM
- LastWriteTime:
WSC_AGENT_ENROLL_UPDATE.EXE is notable because its Prefetch timestamp is very close to the observed web protection disablement window (~05:53 AM).
However, the investigation does not claim direct causality based on time correlation alone.
Multiple different DISCORD.EXE-*.pf entries suggest that Discord.exe was executed from more than one path over time, which is consistent with the existence of both:
- a normal user Discord installation
- a separate Discord-like tree under
ProgramData
Manual string extraction attempts against selected Prefetch files produced largely unreadable / truncated output and did not yield clean path attribution.
This was assessed as a parsing / decoding limitation rather than evidence that the Prefetch files were “encrypted by malware.”
This is a useful defensive lesson:
- Not all binary artifacts can be interpreted reliably with ad hoc string extraction
- Some artifacts require a dedicated parser
Initial scheduled-task persistence appears on disk:
SoftLandingCreativeManagementTask
Initial XML trigger boundary exists for the main task.
Additional recurring behavior is present in XML for the main task.
Two additional tasks appear on disk:
SoftLandingDeferralTask-{5741d124-700c-4965-ad0f-61f55251af88}SoftLandingTriggerTask-128000000001615609-render-{a54facd6-7ff1-4f88-a661-569227d49b52}
DISCORDHOOKHELPER64.EXE Prefetch artifact indicates execution.
WSC_AGENT_ENROLL_UPDATE.EXE Prefetch artifact indicates execution.
Web protection disablement was observed around this timeframe.
Antivirus quarantines:
core.asar- detection label:
TR/Malware
- Suspicious scheduled-task persistence existed under the
SoftLandingtree - Internal TaskCache records matched the suspicious tasks
- The persistence mechanism used COM handlers
- Task artifacts were created in two stages (Feb 25 and Mar 5)
- A Discord-related
core.asarartifact was quarantined from a separateProgramData\willi\Discord\...path - Prefetch confirms execution of several relevant binaries around the period of interest
- The main task established the initial persistence foothold, and the later tasks expanded recurrence or orchestration
- The
ProgramData\willi\Discordtree was relevant to the incident, at least as a modified or leveraged application structure - The March 5 task creation represents a second-stage event that may explain why stronger symptoms were noticed later
- Whether all observed performance issues were directly caused by the same suspicious artifact chain
- Whether
WSC_AGENT_ENROLL_UPDATE.EXEwas itself malicious or simply adjacent in time - Whether the quarantined
core.asarwas the primary payload - Whether active malicious execution was still occurring during the final phase of investigation
- Whether all original CLSID relationships remained unchanged throughout the full incident lifecycle
This investigation had several important limitations:
- Task Scheduler Operational history was disabled, eliminating one of the best sources of execution history
- Some suspicious executables identified in Prefetch were no longer present on disk
- A dedicated Prefetch parser was not successfully deployed during the investigation, limiting full path attribution
- The antivirus may have already performed partial remediation before all artifacts were analyzed
- The system state may therefore represent a post-incident or partially remediated condition, not a pristine “during compromise” state
These limitations are explicitly documented to avoid overstating conclusions.
This investigation confirmed a suspicious Windows persistence case involving:
- custom
SoftLandingscheduled tasks - COM-handler–based execution
- staged task creation over time
- a quarantined Discord-related secondary artifact
- relevant execution artifacts in Prefetch
The evidence strongly supports the presence of suspicious persistence and related host artifacts, but it does not support an exaggerated claim that every observed symptom was conclusively caused by one active malware process at the exact time of final testing.
The most defensible conclusion is:
A suspicious persistence incident occurred on the endpoint following ZLMU-related installation activity, and by the time of deeper investigation, the system appeared to be in a partially remediated or partially broken state.
That conclusion is technically stronger than overclaiming a fully proven live compromise.
- Not all suspicious behavior proves active compromise at the time of observation
- Scheduled-task persistence can use COM handlers and hide direct execution paths from casual inspection
- Correlating XML + TaskCache + filesystem timestamps + AV findings + Prefetch can reconstruct an incident even when operational logs are missing
- Good incident documentation separates:
- confirmed facts
- supported hypotheses
- unknowns
- Strong defensive analysis is about precision, not dramatic conclusions
This case study demonstrates practical experience in:
- Windows artifact-based investigation
- Scheduled-task persistence analysis
- Task XML review
- Registry TaskCache correlation
- Filesystem timeline reconstruction
- Prefetch-based execution artifact review
- Evidence-driven reasoning with confidence levels
- Writing a balanced DFIR-style incident report
case-study-zlmu-softlanding/
├── README.md
├── evidence/
│ ├── task-xml/
│ ├── taskcache/
│ ├── prefetch/
│ ├── av-detections/
│ └── screenshots/
├── images/
│ ├── task-scheduler-softlanding.png
│ ├── taskcache-query-results.png
│ ├── prefetch-output.png
│ └── discord-path-comparison.png
└── appendix/
└── raw-notes.md
- Task Scheduler view showing the
SoftLandingtree - XML / task details view showing custom handler / triggers
- TaskCache command output with
Idvalues - File timestamps for the physical task files
- Discord path comparison (
AppDatavsProgramData\willi\Discord) - Antivirus quarantine details for
core.asar - Prefetch output table showing relevant entries and timestamps
SoftLandingCreativeManagementTaskSoftLandingDeferralTask-{5741d124-700c-4965-ad0f-61f55251af88}SoftLandingTriggerTask-128000000001615609-render-{a54facd6-7ff1-4f88-a661-569227d49b52}
{772B0572-BE2B-49A4-BE41-9C3D3F22F664}{2CD9F4E8-FE01-48AD-8311-128676E2288B}{E43094EA-EE5E-4C49-87DF-F1D85ECBBA27}
core.asar- SHA256:
979A0CB31C2FC8D78BE7B2125C7D5738EC3015AB8CEC899DA11C3D2B8FBB08EA
- Active process path:
AppData\Local\Discord\... - Quarantined artifact path:
ProgramData\willi\Discord\...
WSC_AGENT_ENROLL_UPDATE.EXE-AB4715E6.pfDISCORDHOOKHELPER64.EXE-C3CBD281.pf- multiple
DISCORD.EXE-*.pf
This case study was intentionally written to preserve evidence discipline and avoid overstating conclusions. The goal was not to “prove malware at all costs,” but to demonstrate a structured, defensible investigative process grounded in Windows host artifacts.