#NEWLINE# def create_prefetch_obj( search_string , content_string , condition ) : #NEWLINE# #INDENT# from cybox.common.properties import String #NEWLINE# from cybox.objects.win_volume_object import WinVolume #NEWLINE# from cybox.objects.win_prefetch_object import WinPrefetch , AccessedFileList #NEWLINE# prefected_attrmap = { #NEWLINE# #INDENT# 'PrefetchItem/ApplicationFileName' : 'application_file_name' , #NEWLINE# 'PrefetchItem/LastRun' : 'last_run' , #NEWLINE# 'PrefetchItem/PrefetchHash' : 'prefetch_hash' , #NEWLINE# 'PrefetchItem/TimesExecuted' : 'times_executed' , #NEWLINE# #UNINDENT# } #NEWLINE# volume_attrmap = { #NEWLINE# #INDENT# 'PrefetchItem/VolumeList/VolumeItem/DevicePath' : 'device_path' , #NEWLINE# 'PrefetchItem/VolumeList/VolumeItem/CreationTime' : 'creation_time' , #NEWLINE# 'PrefetchItem/VolumeList/VolumeItem/SerialNumber' : 'serial_number' , #NEWLINE# #UNINDENT# } #NEWLINE# prefetch = WinPrefetch ( ) #NEWLINE# if ( search_string in prefected_attrmap ) : #NEWLINE# #INDENT# set_field ( prefetch , prefected_attrmap [ search_string ] , content_string , condition ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( search_string in volume_attrmap ) : #NEWLINE# #INDENT# LOG . info ( 'Cannot translate WinVolume object. See https://github.com/CybOXProject/python-cybox/issues/269' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( search_string == 'PrefetchItem/AccessedFileList/AccessedFile' ) : #NEWLINE# #INDENT# s = String ( xml . sanitize ( search_string ) ) #NEWLINE# s . condition = condition #NEWLINE# prefetch . accessed_file_list = AccessedFileList ( s ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# return None #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# return Object ( prefetch )