1# Copyright (c) 2017, The MITRE Corporation. All rights reserved.
2# See LICENSE.txt for complete terms.
3
4from mixbox import entities
5from mixbox import fields
6
7import cybox.bindings.win_prefetch_object as win_prefetch_binding
8from cybox.objects.device_object import Device
9from cybox.objects.win_volume_object import WinVolume
10from cybox.common import String, DateTime, Long, ObjectProperties
11
12
13class AccessedFileList(entities.EntityList):
14    _binding = win_prefetch_binding
15    _binding_class = win_prefetch_binding.AccessedFileListType
16    _namespace = "http://cybox.mitre.org/objects#WinPrefetchObject-2"
17
18    accessed_file = fields.TypedField("Accessed_File", String, multiple=True)
19
20
21class AccessedDirectoryList(entities.EntityList):
22    _binding = win_prefetch_binding
23    _binding_class = win_prefetch_binding.AccessedDirectoryListType
24    _namespace = "http://cybox.mitre.org/objects#WinPrefetchObject-2"
25
26    accessed_directory = fields.TypedField("Accessed_Directory", String, multiple=True)
27
28
29class Volume(entities.Entity):
30    _binding = win_prefetch_binding
31    _binding_class = win_prefetch_binding.VolumeType
32    _namespace = "http://cybox.mitre.org/objects#WinPrefetchObject-2"
33
34    volumeitem = fields.TypedField("VolumeItem", WinVolume, multiple=True)
35    deviceitem = fields.TypedField("DeviceItem", Device, multiple=True)
36
37
38class WinPrefetch(ObjectProperties):
39    _binding = win_prefetch_binding
40    _binding_class = win_prefetch_binding.WindowsPrefetchObjectType
41    _namespace = "http://cybox.mitre.org/objects#WinPrefetchObject-2"
42    _XSI_NS = "WinPrefetchObj"
43    _XSI_TYPE = "WindowsPrefetchObjectType"
44
45    application_file_name = fields.TypedField("Application_File_Name", String)
46    prefetch_hash = fields.TypedField("Prefetch_Hash", String)
47    times_executed = fields.TypedField("Times_Executed", Long)
48    first_run = fields.TypedField("First_Run", DateTime)
49    last_run = fields.TypedField("Last_Run", DateTime)
50    volume = fields.TypedField("Volume", WinVolume)
51    accessed_file_list = fields.TypedField("Accessed_File_List", AccessedFileList)
52    accessed_directory_list = fields.TypedField("Accessed_Directory_List", AccessedDirectoryList)
53