1# Copyright (c) 2017, The MITRE Corporation. All rights reserved. 2# See LICENSE.txt for complete terms. 3 4from mixbox import entities 5from mixbox import fields 6 7import cybox.bindings.win_prefetch_object as win_prefetch_binding 8from cybox.objects.device_object import Device 9from cybox.objects.win_volume_object import WinVolume 10from cybox.common import String, DateTime, Long, ObjectProperties 11 12 13class AccessedFileList(entities.EntityList): 14 _binding = win_prefetch_binding 15 _binding_class = win_prefetch_binding.AccessedFileListType 16 _namespace = "http://cybox.mitre.org/objects#WinPrefetchObject-2" 17 18 accessed_file = fields.TypedField("Accessed_File", String, multiple=True) 19 20 21class AccessedDirectoryList(entities.EntityList): 22 _binding = win_prefetch_binding 23 _binding_class = win_prefetch_binding.AccessedDirectoryListType 24 _namespace = "http://cybox.mitre.org/objects#WinPrefetchObject-2" 25 26 accessed_directory = fields.TypedField("Accessed_Directory", String, multiple=True) 27 28 29class Volume(entities.Entity): 30 _binding = win_prefetch_binding 31 _binding_class = win_prefetch_binding.VolumeType 32 _namespace = "http://cybox.mitre.org/objects#WinPrefetchObject-2" 33 34 volumeitem = fields.TypedField("VolumeItem", WinVolume, multiple=True) 35 deviceitem = fields.TypedField("DeviceItem", Device, multiple=True) 36 37 38class WinPrefetch(ObjectProperties): 39 _binding = win_prefetch_binding 40 _binding_class = win_prefetch_binding.WindowsPrefetchObjectType 41 _namespace = "http://cybox.mitre.org/objects#WinPrefetchObject-2" 42 _XSI_NS = "WinPrefetchObj" 43 _XSI_TYPE = "WindowsPrefetchObjectType" 44 45 application_file_name = fields.TypedField("Application_File_Name", String) 46 prefetch_hash = fields.TypedField("Prefetch_Hash", String) 47 times_executed = fields.TypedField("Times_Executed", Long) 48 first_run = fields.TypedField("First_Run", DateTime) 49 last_run = fields.TypedField("Last_Run", DateTime) 50 volume = fields.TypedField("Volume", WinVolume) 51 accessed_file_list = fields.TypedField("Accessed_File_List", AccessedFileList) 52 accessed_directory_list = fields.TypedField("Accessed_Directory_List", AccessedDirectoryList) 53