/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/__pycache__/
/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/__pycache__
NameSizeModeActions
config.cpython-311.opt-1.pyc74330644editdlrm
config.cpython-311.pyc74330644editdlrm
engine.cpython-311.opt-1.pyc48010644editdlrm
engine.cpython-311.pyc48010644editdlrm
model.cpython-311.opt-1.pyc590870644editdlrm
model.cpython-311.pyc590870644editdlrm
mrs_upload_queue.cpython-311.opt-1.pyc12150644editdlrm
mrs_upload_queue.cpython-311.pyc12150644editdlrm
__init__.cpython-311.opt-1.pyc1860644editdlrm
__init__.cpython-311.pyc1860644editdlrm
Edit: /opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/__pycache__/model.cpython-311.pyc (59087B)
sjrdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ddlm Z ddl mZddlmZdd lmZmZmZmZmZmZmZdd lmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%dd l&m'Z'dd l(m)Z)dd l*m+Z+m,Z,ddl-m.Z.m/Z/m0Z0ddl1m2Z2m3Z3m4Z4m5Z5ddl6m7Z7ddl8m9Z9m:Z:m;Z;mm?Z?ddl@mAZAddlBmCZCGdde+ZDGdde+ZEe dGddZFGdde+ZGGdd e+ZHGd!d"e+ZIGd#d$e+ZJd%ZKd&ZLd'ZMeKeLfZNGd(d)e+ZOGd*d+e+ZPdS),u  This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program.  If not, see . Copyright © 2019 Cloud Linux Software Inc. This software is also available under ImunifyAV commercial license, see ) annotationsN) dataclass)reduce) attrgetter)Path)time)AnyDictIterableListSetTuplecast) SQL BooleanFieldCase CharFieldCheck Expression FloatFieldForeignKeyField IntegerField ModelSelectPrimaryKeyField TextFieldfn model_to_dict)UserType)Modelinstance) FilenameField ScanPathFieldapply_order_by)execute_iterable_expressionget_abspath_from_user_dirget_results_iterable_expressionsplit_for_chunk)RemoteRevertHitInfo)FAILED_TO_CLEANUPMalwareHitStatusMalwareScanResourceTypeMalwareScanTypeVulnerabilityHitStatus) get_crontab)MalwareDatabaseHitInfo)sqlite_max_variable_numberc~eZdZdZGddZedZedZedZ ede d e j e je je je je je jfg Zedd Zedd Zedd Zedd Zede d ejjejjfg ZedZ edd Z!e" de j e je jfd ddZ#d S) MalwareScanzRepresents a batch of files scanned for malware Usually a single AI-BOLIT execution. See :class:`.MalwareScanType` for possible kinds of scans. c eZdZejZdZdS)MalwareScan.Meta malware_scansN__name__ __module__ __qualname__r!dbdatabasedb_tableJ/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/model.pyMetar5Vs;"r?rAT primary_keyFnullz type in {}rE constraintsrrEdefaultNresource_type in {}c8ttSNintrr>r?r@zMalwareScan.sTVVr?)typespathsc v||j|j|j|j|j|j|j|j d|j |j | |j|k |j|k}|r-| |j |}| |j|j|j|jtj||}|t'|||}|dt+|fS)N scan_typeT clear_limit)selecttotal_resourcespathscanidstarted completederrortotal_malicioustypealias resource_typewherein_group_byorder_byr3desclimitoffsetr$countlistdicts) clssincetorgrhrerQrRquerys r@ ondemand_listzMalwareScan.ondemand_listsd" JJ#    #{++!  U38<<&& ' ' U3;%' ( ( U3;"$ % % "  5KK U 3 344E NN#SXsz3;  Xk)..00 1 1 U5\\ VF^^   "8S%88E{{t{,,d5;;==.A.AAAr?rM)$r8r9r:__doc__rArrZrr[r\rformatr- ON_DEMANDREALTIMEMALWARE_RESPONSE BACKGROUNDRESCANUSERRESCAN_OUTDATEDr_rXr#rYrr]r^r,DBvalueFILEra initiator timestamp classmethodrpr>r?r@r3r3Os ######## Y4 ( ( (Fl&&&G $'''I 9  E##'1'0'8'2'.','7        D&#lq999O =dB / / /D I4 . . .E"lq999OI  E%,,/28/4:       M t$$$I %1D1DEEEI /B  %  &   /B/B/B/B[/B/B/Br?r3c "eZdZdZGddZeZeedddZ e dZ e dZ e dZe dZedd Ze d Ze d Zed Ze ej Zed Ze ded ejjejjfg Z e d Z!e d Z"e d Z#e d Z$e d Z%e&dDdZ'e&dZ(GddZ)e* dEdFdZ+e* dGdZ,e*dHdZ-e*dddZ.e*dIdZ/e*dHdZ0e*dJd Z1e*dKd"Z2e*dLd$Z3e*d%Z4e* dMd&Z5e*dd'd(Z6e*dNd+Z7e*dOd-Z8e*d.Z9d/Z:e*dPdQd1Z;e*dRd4Ze*dSd8Z?e*dSd9Z@e*d:ZAe*d;ZBe*d<ZCeDdTdAZEdBZFdCZGdS)U MalwareHitz*Represents a malicious or suspicious file.c eZdZejZdZdS)MalwareHit.Meta malware_hitsNr7r>r?r@rArs;!r?rAFhitsCASCADErE related_name on_deleterDrHTrIrKrFreturnstrc6tt|jSrM)rrr_selfs r@ signature_idzMalwareHit.signature_idsC###r?cTtt|j}t|SrMrr orig_filerrrs r@orig_file_pathzMalwareHit.orig_file_pathdn-- Ir?c$eZdZedZdS)MalwareHit.OrderByc ttjtjdftjdftjdftjdftjdffdfS)Nrd) rrstatusr+CLEANUP_PENDINGCLEANUP_STARTEDFOUND CLEANUP_DONECLEANUP_REMOVEDr>r?r@rzMalwareHit.OrderBy.status sb%)91=)91=)/3)6:)91=     r?N)r8r9r: staticmethodrr>r?r@OrderByr s-       r?rrN Tuple[int, List[dict[str, Any]]]c , ||tt}|p t}|tj|ktj|kzg}|5d|d}|t d|f|j|zz|#|tj|k|#|tj |k| "|tj | z| rω r||j dk||j  fd| D}|rrg}g}|D]/}|d||d0d|}|t d|d|ttj|}|}| "|tj| z}||||}| t-| t|}||}d |D}||fS) N%CAST(orig_file AS TEXT) LIKE ?filec~g|]9}t|tk"|7|:Sr>)len startswith).0p site_searchs r@ z)MalwareHit._hits_list..MsMq66C ,,,,k1J1J,,,,r?zorig_file NOT LIKE ?z AND ()c6g|]}|Sr>as_dictrrows r@rz)MalwareHit._hits_list..t 333C#++--333r?)rWr3joinrr[appendruserrrZrrarrroperatorand_idrcrbrgrhr$ _hits_num)rlclausesrmrnrgrhsearch by_scan_idrre by_statusidsr user_siteskwargsrwhere_conditionspattern longer_paths sql_chunks sql_paramsrYcombined_sql_string full_clausesmax_count_clausesordered max_countresults ` r@ _hits_listzMalwareHit._hits_lists$zz#{++00== \466   E )k.AR.G H   #&mmmG  # #4wjAA8W$&       # #JOt$; < < <  !  # #K$6*$D E E E   # #J$5$B C C C  +   # #C$5$? @ @ @  # #CM$<$<[$I$I J J J#L    (22D%%&<===%%jjj1111&-ll:&>&># ''2/222J?? hm-=>> ) ? JM--c22 2L**\**0077>>vFF  $Xz7CCGMM"344 337333&  r?cx|r&|r$|tj|ktj|kzz}|||j|kz}|t j|jt|}|t|t|}| SrM) r3r[rrWrCOUNTrrrbr$rscalar)rlrrmrnrreqs r@rzMalwareHit._hits_numxs  R   +u4#r) G   sx4' 'G JJrx'' ( ( - -k : : @ @ I I  xQ77Axxzzr?c||jtj|jz|||SrM)rrnot_inr+CLEANUP malicious)rlrmrnrs r@ malicious_numzMalwareHit.malicious_nums?}} Z  /7 8 83= H       r?)ignore_cleanedc|j}|r'||jtjz}|j|g|Ri|SrM)rrrr+rr)rlrargsrrs r@malicious_listzMalwareHit.malicious_listsR-  C sz(()9)ABB BGs~g7777777r?c Z|tn|}|jtj|kztj|kz}|||j|kz}||jtj|j  d t | |j}d|D}ttjtj}||dS)Nric(i|]}|j|jSr>)rrirs r@ z0MalwareHit.malicious_summary..s888C#*ci888r?)counts last_scan)rrr3r[rrWrrrrr`rrbrdMAXr) rlrmrnrrrrowsrrs r@malicious_summaryzMalwareHit.malicious_summaryszTVVVr M"e+ -"b( *    sx4' 'G JJsz28CF#3#3#9#9'#B#B C C T+   U7^^ Xcj ! ! 984888&&rvk.A'B'BCCJJLL  y999r?cFd|D}d}t|||||S)Ncg|] }|j Sr>rrs r@rz)MalwareHit.set_status..'''3'''r?cd|i}|||d<|jdi||j|S)Nr cleaned_atr>updaterbrrc)rrlrrfields_to_updates r@ expressionz)MalwareHit.set_status..expressionU&  %1; .3:11 01177 3HH Hr?r%)rlrrrrs r@ set_statuszMalwareHit.set_statusF''$''' I I I+ c6:   r? to_deleterjcFd|D}fd}t||S)Ncg|] }|j Sr>rrs r@rz/MalwareHit.delete_instances..s111SV111r?cj|SrM)deleterbrrc)rrls r@rz/MalwareHit.delete_instances..expressions+::<<%%cfjjoo66 6r?r)rlrrs` r@delete_instanceszMalwareHit.delete_instancessA11y111  7 7 7 7 7+:yAAAr? to_updatec|D][}|D]D\}}|D]\}}t||||E\dSrM)itemssetattrsave)rlrdata _instancenew_fields_datafieldr{s r@update_instanceszMalwareHit.update_instancess ! !D.2jjll ! !* ?$3$9$9$;$;55LE5Iue4444     ! ! !r?rc`|jtjg|jz}|SrM)rrcr+rr)rlrs r@ is_infectedzMalwareHit.is_infecteds: JNN$*   m   r?c|jSrM)rrls r@ is_suspiciouszMalwareHit.is_suspiciouss  ~r?c Tfd}tt||||dS)Nc|j}|||j|z}nSr(||jt jz}n)r'||jt jz}|5t|tr|g}||j |z}| |SrM) rrrcrrr+r RESTORABLE isinstancerrrWrb) chunk_of_idsrlrrcleanuprestores r@rz/MalwareHit.malicious_select..expressionsmG'36::l333 G3:,,-=-EFFF G3:>>*:*EFFFdC((" 6D38<<---::<<%%g.. .r?T)exec_expr_with_empty_iterrjr')rlrrrrrrs `` r@malicious_selectzMalwareHit.malicious_selectsS / / / / / / +Cdd      r?statusesc2fd}t||S)Ncj|}r|jz}|SrMrrcrrWrbfilesrrlrs r@rz'MalwareHit.get_hits..expressionTm''..G 43:>>(333::<<%%g.. .r?r'rlrrrs` ` r@get_hitszMalwareHit.get_hits4 / / / / / / /z5AAAr? hits_infoSet[MalwareDatabaseHitInfo]cxd|D}d|D}d|Dtttj|tj|}fd|D}|S)Ncg|] }|j Sr>rYrentrys r@rz*MalwareHit.get_db_hits..s333333r?cg|] }|j Sr>app_namer(s r@rz*MalwareHit.get_db_hits..6665666r?c*g|]}|j|jfSr>rYr,r(s r@rz*MalwareHit.get_db_hits..s!JJJuuz5>2JJJr?c4g|]}|j|jfv|Sr>rr,rhit paths_appss r@rz*MalwareHit.get_db_hits.. s3   CM3<#@J#N#NC#N#N#Nr?)rjrrWrbrrcr,)rlr#rRappsrr4s @r@ get_db_hitszMalwareHit.get_db_hitss3333366I666JJ JJJ       U:'++E22 3 3 U:&**400 1 1           r?list[RemoteRevertHitInfo]cdd|D}d|D}d|D}d|Dtttj|tj|tj|tjtj }fd|D}|S)Ncg|] }|j Sr>) app_root_pathr(s r@rz.s<<<$<<r+r(s r@rz.r-r?cg|] }|j Sr>)sig_idr(s r@rz.s:::uel:::r?c6g|]}|j|j|jfSr>)r:r,r=r(s r@rz.s6    %.%, ?   r?c@g|]}|j|j|jfv|Sr>)rr,rr2s r@rz. s<    s|S-=>*LL LLLr?) rjrdb_hitsrbrrcr,r_rr+r)rlr#rRr5 signaturesrr4s @r@get_db_hits_for_remote_revertz(MalwareHit.get_db_hits_for_remote_reverts&=<)<<<66I666:: :::   "   "&    U:'++E22 3 3 U:&**400 1 1 U:?&&z22 3 3 U:$(()9)DEE F F " "          r?c.fd}t||S)Ncj|SrMrrbrrcrrls r@rz*MalwareHit.delete_hits..expression)/::<<%%cm&7&7&>&>?? ?r?rrlrrs` r@ delete_hitszMalwareHit.delete_hits'3 @ @ @ @ @+:u===r?cjt||SrM)r_get_pk_exprrs r@refreshzMalwareHit.refresh.s"Dzz~~dmmoo...r?Iterable[MalwareHit]cLfd}tt||S)Nc}r3tt}|jd|DS)Ncg|] }|j Sr>rrr3s r@rz?MalwareHit.refresh_hits..expression..7s*B*B*Bc36*B*B*Br?)rWr3rrbrrc)rrorlinclude_scan_infos r@rz+MalwareHit.refresh_hits..expression3siJJLLE  G 3 4499+FF;;svzz*B*BT*B*B*BCCDD Dr?r)rlrrTrs` ` r@ refresh_hitszMalwareHit.refresh_hits1sC E E E E E E 3JEEFFFr?r~rOc||j|k|jt jz|jdzS)NF)rWrbrrrcr+CLEANEDis_null)rlr~s r@ cleaned_sincezMalwareHit.cleaned_since;s^zz||!! ^y (z~~.677 9~%%e,, .   r?rc||jtjjkSrM)rWrbrar,rzr{r s r@r@zMalwareHit.db_hitsCs4zz||!!  !8!;!A A   r?cv||jtjkS)z,Return db hits that are in queue for cleanup)r@rbrr+rr s r@db_hits_pending_cleanupz"MalwareHit.db_hits_pending_cleanupI2{{}}"" J*: :   r?cv||jtjkS)z3Return db hits for which the cleanup is in progress)r@rbrr+rr s r@db_hits_under_cleanupz MalwareHit.db_hits_under_cleanupPr]r?cv||jtjkS)z3Return db hits for which the restore is in progressr@rbrr+CLEANUP_RESTORE_STARTEDr s r@db_hits_under_restorationz$MalwareHit.db_hits_under_restorationWs2{{}}"" J*B B   r?c<d|D}d|D}d|D||j||j|}fd|DS)z Return db hits for which the cleanup is in progress specified by the provided set of MalwareDatabaseHitInfo ch|] }|j Sr>r'rhit_infos r@ z6MalwareHit.db_hits_under_cleanup_in..fs???hHM???r?ch|] }|j Sr>r+rfs r@rhz6MalwareHit.db_hits_under_cleanup_in..gsGGGh)GGGr?c*h|]}|j|jfSr>r/rfs r@rhz6MalwareHit.db_hits_under_cleanup_in..hs/   3;X]H- .   r?c4g|]}|j|jfv|Sr>r1)rr3path_app_name_sets r@rz7MalwareHit.db_hits_under_cleanup_in..ps8    s|,0AAA AAAr?)r_rbrrcr,)rl hit_info_setpath_set app_name_setrorls @r@db_hits_under_cleanup_inz#MalwareHit.db_hits_under_cleanup_in^s@?,???GG,GGG   ?K     % % ' ' U3=$$X.. / / U3<##L11 2 2          r?c||jtjtjgSrM)r@rbrrcr+CLEANUP_RESTORE_PENDINGCLEANUP_REMOTE_RESTORE_PENDINGr s r@db_hits_pending_cleanup_restorez*MalwareHit.db_hits_pending_cleanup_restorevsF{{}}"" JNN$<$C     r?cv||jtjkSrMrar s r@db_hits_under_cleanup_restorez(MalwareHit.db_hits_under_cleanup_restores0{{}}"" J*B B   r? hit_list_listList['MalwareHit'] attributeDict[str, List['MalwareHit']]ctdtj|Dt |}dtj|t |DS)Nc3K|]}|VdSrMr>rSs r@ z0MalwareHit.group_by_attribute.." I ISS I I I I I Ir?keyc4i|]\}}|t|Sr>rjr attr_valuers r@rz1MalwareHit.group_by_attribute..4    D T    r?sorted itertoolschain from_iterablergroupbyryrwhit_lists r@group_by_attributezMalwareHit.group_by_attribute I IIO99-HH I I I9%%     $-$5y))%%%    r?c@id|jd|jd|jd|jjd|jd|jjd|jd|jd |jd |j d |j d |j d |j did|j d|jd|j|j|j|jt$jjkret+t,t,jt,jt,jt,j|jkt,j|jkt,j|jkt,j |j kt,j|jkt,j|jkt,j|jkt,j|jkt,jdt,jdt,jd ngdS)Nrusernamercreatedscan_idrTrar_hashsizerrr extra_datadb_namer,db_hostF)db_portsnippet table_fields)!rrrrZr[ scanid_idr_rarrrrrrr,rrrr,rzr{rjMalwareHistoryrW table_name table_field table_row_infrbrYrrrXrkrs r@rzMalwareHit.as_dicts-- $'-  -  DN-  t{* - t~ - ) -  T/-  DI-  DI-  DI-  -  dk-  $/-  "-  t|-  !- " t|#- $||.%)@)C)III+"))&1&2&4 U&/4=@&.$,>&.$,>&.$,>&+t~=&48JJ&.$+=&3ty@&199%@@&2::5AA&4<r?r@rrs44""""""""   B _%f F I5 ! ! !E 9% D 5)))I 9% D  %777I 9$   D 9$   D %%%IY/5 6 6 6F&&&JI  E%,,/28/4:       Myd###HiT"""GiT"""GiT"""GiT"""G $$$X$X"   X!X!X!X![X!tDH   [    [ 278888[8 :::[:&   [ BBB[B!!![!   [ [9>   [ .)-BBBB[B   [ [0>>[> ///GGGG[G   [    [    [    [    [   [ .  [   [     \  . . . `NNNNNr?rT)frozenceZdZUdZded<ded<ded<ded<ded<d ed <ded <ded <d ed <ded<edZedZdS)MalwareHitAlternatezA Used as a replacement for MalwareHit for file hits only rrZrNoner,rrrOrrr_r~boolrc |||d|d|d|d|d|ddd|ddd|ddd  S) Nrrrrrrmatchesr~ suspicious) rZrr,rrrrr_r~rr>)rlrZfilenamers r@createzMalwareHitAlternate.createsssw-ffffa+6l1ok2v,q/,77    r?cNttj|jSrM)rosfsdecoderrs r@rz"MalwareHitAlternate.orig_file_pathsBK//000r?N) r8r9r:rq__annotations__rrrrr>r?r@rrsKKKNNNNNNJJJ III III III IIINNNOOO   [  11X111r?rcJeZdZdZGddZdZeZeZ ede dgZ e dd Z ed Zefd Zefd Ze dddZeddZedZxZS)MalwareIgnorePathz+A path that must be excluded from all scansc$eZdZejZdZdZdS)MalwareIgnorePath.Metamalware_ignore_path)))rYraTNr8r9r:r!r;r<r=indexesr>r?r@rArs;(6r?rANFzresource_type in ('file','db')rFc8ttSrMrNr>r?r@rPzMalwareIgnorePath.s#dff++r?rHct||j}||_dSrM)rjrWrerYrkCACHE)rlrs r@ _update_cachezMalwareIgnorePath._update_cache s>SZZ\\**3844::<<== r?c Rd|_tt|jdi|S)Nr>)rsuperrr)rlrrs r@rzMalwareIgnorePath.creates. 3u&,,3==f===r?c`d|_tt|SrM)rrrr)rlrs r@rzMalwareIgnorePath.deletes' &,,33555r?ra str | Nonec \||j} || |j|k} || |j|k} |-| |j|} || |j|k} || |} || |} |t||| } |t|} | |j t| dz|jt| kz|jtt|kz} | d} | d| DfS)N/TrUc,g|]}t|Sr>rrs r@rz:MalwareIgnorePath.paths_count_and_list..?s - - -C]3   - - -r?)rWrerYrb added_datecontainsrarhrgr$r&rrr/ri) rlrgrhrrarrmrnrer user_homers r@paths_count_and_listz&MalwareIgnorePath.paths_count_and_lists JJLL ! !#( + +  %/00A >",--A  ))&1122A  $)]:;;A    A  A  xa00A  1$77I$$S^^c%9::8s9~~-/8s;t#4#45557A GGG--  - -1 - - -  r?r List[str]c:|j|i|\}}d|DS)Ncg|] }|d Sr'r>rs r@rz/MalwareIgnorePath.path_list..Es111F 111r?)r)rlrr_ path_lists r@rzMalwareIgnorePath.path_listBs1/s/@@@ 911y1111r?cK|j|t|}|jrK|jD]C}tjdd{Vt|d}||ks ||jvrdSDdS)zChecks whether path stored in MalwareIgnorePath cache or if it's belongs to path from cache or if it matches patters from cache :param str check_path: path to check :return: bool: is ignored according MalwareIgnorePath NrrYTF)rrrasynciosleepparents)rl check_pathrYr ignored_paths r@is_path_ignoredz!MalwareIgnorePath.is_path_ignoredGs 9       J 9 Y  mA&&&&&&&&&#AfI L((ldl.J.J44/Kur?)NNNNNNNN)rar)rr)r8r9r:rqrArrrrrYrrarrrrrrrrr __classcell__)rs@r@rrs5577777777 E   B 9;;DI 'G!H!H IM52E2EFFFJ[>>>>[>6666[6$(  & & & & [& P222[2[r?rc eZdZdZGddZedZedZede d e j j e jj fge jj ZedZedZedZedZedZedd ZedZedZedZedZedZedZedZedZe dd Z ed Z!eddZ"eddZ#d S)rz:Records every event related to :class:`MalwareHit` recordsc eZdZejZdZdS)MalwareHistory.Metamalware_historyNr7r>r?r@rAr^s;$r?rAFrDTrK)rErGrIc8ttSrMrNr>r?r@rPzMalwareHistory.sS[[r?rHNc|j|k|j|kz}|r/||j|td|fzz}|r||j|kz}|||| } |t|t| } t| } | d| fS)Nz(INSTR(path, ?))TrU)ctimeeventrr file_userrWrbrgrhrkr$rrjri) rlrmrnrgrhrrrerro list_results r@ get_historyzMalwareHistory.get_historys9%#)r/:    **622& 22 G  - s}, ,G ""7++11%88??GGMMOO  "8^UCCE5kk {{t{,,k99r?c |jd|ddp tj|ddp tj|ddpt jjd| dS)Nr}causera)r}rrar>) insertpoprROOTr-MANUALr,r|r{execute)rlrs r@ save_eventzMalwareHistory.save_events  jjd33Dx}**Wd++E/E **_d;;2&+1      ')))))r?r List[dict]cntj5tdt |jjt|jjz}t||D])}| | * ddddS#1swxYwYdS)Nr) chunk_size) r!r;atomicmaxr1_metar<rcolumnsr( insert_manyr)rlrr hits_chunks r@ save_eventszMalwareHistory.save_eventss [   ! ! 6 6*39+=>>sy())*J .dzJJJ 6 6  ++335555 6  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6sA=B**B.1B.rRrjrmrOc>||jtj|j||jtkz|j|kz |j SrM) rWrYrrrbrcrr*rrdtuples)rlrRrms r@get_failed_cleanup_events_countz.MalwareHistory.get_failed_cleanup_events_counts{ JJsx , , U U##9 1139%' Xch   VXX r?)NNN)rr)rRrjrmrO)$r8r9r:rqrAr"rYrr,rrrr,rzr{r|rarrr} file_ownerrrrrrrrrrrrrrrrrr>r?r@rr[sLDD%%%%%%%% =e $ $ $Dyd###HI  E%,,/28/4:    (,2   M I5 ! ! !E I5 ! ! !E u%%%I&&&J u%%%I Le-@-@ A A AEiT"""GiT"""GiT"""G%%%J)&&&K Ld+++MiT"""G9$'''LHL:::[:&[666[6    [    r?rcHeZdZdZGddZeZeedddZ e dZ e dZ e dZe dZe d Ze d Zed Ze ej Zed Zed Zed$dZed%dZedddZedZe d&dZedZ e!d'dZ"ed(d!Z#ed)d"Z$d#Z%dS)*VulnerabilityHitzRepresents a vulnerable file.c eZdZejZdZdS)VulnerabilityHit.Metavulnerability_hitsNr7r>r?r@rAr;'r?rAFvulnerabilitiesrrrDTrcTtt|j}t|SrMrrs r@rzVulnerabilityHit.orig_file_pathrr? signaturerrrc,|dS)Nz VULN-ESUS-)r)rlrs r@matchzVulnerabilityHit.matchs##L111r?rjctjd|x}r-|ddSgS)NzVULN-ESUS-([\d,]+)r,)rergroupssplit)rlrrs r@get_vulnerability_idsz&VulnerabilityHit.get_vulnerability_idssBI3Y?? ?5 0<<>>!$**3// / r?Nrc2fd}t||S)Ncj|}r|jz}|SrMrrs r@rz-VulnerabilityHit.get_hits..expressionrr?rr s` ` r@r!zVulnerabilityHit.get_hitsr"r?c.fd}t||S)Ncj|SrMrErFs r@rz0VulnerabilityHit.delete_hits..expressionrGr?rrHs` r@rIzVulnerabilityHit.delete_hitsrJr?rc  d||tt} |p t}d|} tj|ktj|kz}||t d| f|j| zzz}|||j|kz}|||j|kz}| ||j | zz}|}| ||j | z}| | ||}|t|||}|t!j|j t |}d|D}||fS)Nz%{}%rc6g|]}|Sr>rrs r@rz/VulnerabilityHit._hits_list..<rr?)rWr3rrrrr[rrrZrrrcrbrgrhr$rrr)rlrmrnrgrhrrrrerrrrrrrrrrs r@rzVulnerabilityHit._hits_list szz#{++00== \466--''#+u4  2 %    C07*7"$ $L   CH, ,L  ! CJ*4 4L  CJ)3 3L( ? CFJJsOO +L**\**0077>>vFF  $XsG<rSs r@r}z6VulnerabilityHit.group_by_attribute..Ir~r?rc4i|]\}}|t|Sr>rrs r@rz7VulnerabilityHit.group_by_attribute..Lrr?rrs r@rz#VulnerabilityHit.group_by_attributeDrr?r list[int]ct}|D]2}|tt|dz}3t|S)Nr_)setrrrj)rlrvuln_idsr3s r@get_vulnerabilities_idsz(VulnerabilityHit.get_vulnerabilities_idsTsU55  C  66s6{CC HHH~~r?cFd|D}d}t|||||S)Ncg|] }|j Sr>rrs r@rz/VulnerabilityHit.set_status.._rr?cd|i}|||d<|jdi||j|S)Nr patched_atr>r)rrlrrrs r@rz/VulnerabilityHit.set_status..expressionarr?r)rlrrrrs r@rzVulnerabilityHit.set_status]rr?c |j|j|j|jj|j|jj|j|j|j|j |j d S)N) rr file_pathrrrTr_rrrr) rrrrZr[rr_rrrrrs r@rzVulnerabilityHit.as_dictnsN' {*~)IIIk/   r?)rrrr)rrrrj) rNNNNNNNNN)rwrryrrr)rrjrrrM)&r8r9r:rqrArrrr3rZrrrr"rr_rrrr~r. VULNERABLErrrrrrrr!rIrrjrrrrrr>r?r@rrs''((((((((   B _ & F I5 ! ! !E 9% D 5)))I 9% D 9$   D 9$   D %%%IY5@ A A AF&&&J X222[2[ )-BBBB[B>>[>    1!1!1![1!f//[/    \  [   [      r?rcDeZdZdZGddZedZdS)ImunifyPatchSubscriptionz(Stores Imunify Patch user subscriptions.c eZdZejZdZdS)ImunifyPatchSubscription.Metaimunify_patch_subscriptionsN)r8r9r:r!r;r<rr>r?r@rAr$s;2 r?rATrBN)r8r9r:rqrAruser_idr>r?r@r"r"~sP2233333333iD)))GGGr?r"pending processing exhaustedceZdZGddZeZeddZedZ eddZ e dZ edde Zed Zed Ze d Zd S) MRSUploadItemc$eZdZejZdZdZdS)MRSUploadItem.Metamrs_upload_queue)))r upload_reasonT))rr/ enqueued_atF))rlast_attempt_atFNrr>r?r@rAr-s!;% r?rA@F) max_lengthrErD )r3rErIrrTN)r8r9r:rArrrrrrr/rr0PENDINGrrattempts last_errorr1r>r?r@r+r+s           B 9 / / /D u%%%II%888M*%(((K Y"5' B B BF|A&&&H%%%J jd+++OOOr?r+creZdZGddZeddZedZedZd S) MRSQueueCounterc eZdZejZdZdS)MRSQueueCounter.Metamrs_queue_countersNr7r>r?r@rAr<rr?rAr2T)r3rCrrrDN) r8r9r:rArnamerr{last_metrics_report_timer>r?r@r:r:ss(((((((( 9 5 5 5D L # # #E+|666r?r:)Qrq __future__rrrrrr dataclassesr functoolsrrpathlibrrtypingr r r r r rrpeeweerrrrrrrrrrrrrplayhouse.shortcutsr defence360agent.contracts.configrdefence360agent.modelr r!$defence360agent.model.simplificationr"r#r$defence360agent.utilsr%r&r'r(imav.api.cleanup_revertr)imav.malwarelib.configr*r+r,r-r.imav.malwarelib.scan.crontabr/imav.malwarelib.scan.mds.reportr0#imav.malwarelib.utils.sqlite_limitsr1r3rrrrrr"r6 PROCESSING EXHAUSTEDWORKING_STATUSESr+r:r>r?r@rSs*#""""" !!!!!!>>>>>>>>>>>>>>>>>>.-----55555511111111  877777544444BBBBBBJJJJJJrBrBrBrBrB%rBrBrBjJNJNJNJNJNJNJNJNZ $"1"1"1"1"1"1"1"1JaaaaaaaaHj j j j j Uj j j Zs s s s s us s s l*****u***    Z(,,,,,E,,,*77777e77777r?