/**
 * @file modules/generated/module_vt_generated.h
 * @brief Definition of module_vt written in array. Generated by json_to_array.py
 * @copyright (c) 2021 Avast Software, licensed under the MIT license
 */
 #pragma once

 #include "yaramod/types/modules/module_content.h"

 namespace yaramod {

 namespace modules {

 class Gmodule_vt : public ModuleContent
 {
 public:
    static constexpr std::size_t module_content_size = 109967;
    static constexpr const char* module_content_parts[] = {
"{\"kind\": \"struct\", \"name\": \"vt\", \"attributes\": [{\"kind\": \"struct\", \"name\": \"FileType\", \"attributes\": [{\"name\": \"ACE\", \"kind\": \"value\", \"documentation\": \"compressed ace\", \"type\": \"i\"}, {\"name\": \"ANDROID\", \"kind\": \"value\", \"documentation\": \"executable mobile android apk\", \"type\": \"i\"}, {\"name\": \"APPLE\", \"kind\": \"value\", \"documentation\": \"apple apple-gen\", \"type\": \"i\"}, {\"name\": \"APPLE_PLIST\", \"kind\": \"value\", \"documentation\": \"apple appleplist\", \"type\": \"i\"}, {\"name\": \"APPLEDOUBLE\", \"kind\": \"value\", \"documentation\": \"apple appledouble\", \"type\": \"i\"}, {\"name\": \"APPLESINGLE\", \"kind\": \"value\", \"documentation\": \"apple applesingle\", \"type\": \"i\"}, {\"name\": \"ARC\", \"kind\": \"value\", \"documentation\": \"compressed arc\", \"type\": \"i\"}, {\"name\": \"ARJ\", \"kind\": \"value\", \"documentation\": \"compressed arj\", \"type\": \"i\"}, {\"name\": \"ASD\", \"kind\": \"value\", \"documentation\": \"compressed asd\", \"type\": \"i\"}, {\"name\": \"ASF\", \"kind\": \"value\", \"documentation\": \"multimedia video asf\", \"type\": \"i\"}, {\"name\": \"AVI\", \"kind\": \"value\", \"document",
"ation\": \"multimedia video avi\", \"type\": \"i\"}, {\"name\": \"AWK\", \"kind\": \"value\", \"documentation\": \"source awk\", \"type\": \"i\"}, {\"name\": \"BMP\", \"kind\": \"value\", \"documentation\": \"multimedia image bmp\", \"type\": \"i\"}, {\"name\": \"BZIP\", \"kind\": \"value\", \"documentation\": \"compressed bzip\", \"type\": \"i\"}, {\"name\": \"C\", \"kind\": \"value\", \"documentation\": \"source c\", \"type\": \"i\"}, {\"name\": \"CAB\", \"kind\": \"value\", \"documentation\": \"compressed cab\", \"type\": \"i\"}, {\"name\": \"CAP\", \"kind\": \"value\", \"documentation\": \"internet cap pcap\", \"type\": \"i\"}, {\"name\": \"CHM\", \"kind\": \"value\", \"documentation\": \"help chm\", \"type\": \"i\"}, {\"name\": \"COFF\", \"kind\": \"value\", \"documentation\": \"executable coff\", \"type\": \"i\"}, {\"name\": \"COOKIE\", \"kind\": \"value\", \"documentation\": \"internet iecookie\", \"type\": \"i\"}, {\"name\": \"CPP\", \"kind\": \"value\", \"documentation\": \"source cpp\", \"type\": \"i\"}, {\"name\": \"CRX\", \"kind\": \"value\", \"documentation\": \"crx chrome extension browser\", \"type\": \"i\"}, {\"name\": \"DEB\", \"kind\": \"value\", \"documentation\": \"executable lin",
"ux deb\", \"type\": \"i\"}, {\"name\": \"DIB\", \"kind\": \"value\", \"documentation\": \"multimedia image dib\", \"type\": \"i\"}, {\"name\": \"DIVX\", \"kind\": \"value\", \"documentation\": \"multimedia video divx\", \"type\": \"i\"}, {\"name\": \"DMG\", \"kind\": \"value\", \"documentation\": \"executable mac dmg\", \"type\": \"i\"}, {\"name\": \"DOC\", \"kind\": \"value\", \"documentation\": \"document msoffice text word doc\", \"type\": \"i\"}, {\"name\": \"DOCX\", \"kind\": \"value\", \"documentation\": \"document msoffice text word docx\", \"type\": \"i\"}, {\"name\": \"DOS_COM\", \"kind\": \"value\", \"documentation\": \"executable dos com\", \"type\": \"i\"}, {\"name\": \"DOS_EXE\", \"kind\": \"value\", \"documentation\": \"executable dos mz\", \"type\": \"i\"}, {\"name\": \"DYALOG\", \"kind\": \"value\", \"documentation\": \"source dyalog\", \"type\": \"i\"}, {\"name\": \"DZIP\", \"kind\": \"value\", \"documentation\": \"compressed dzip\", \"type\": \"i\"}, {\"name\": \"EBOOK\", \"kind\": \"value\", \"documentation\": \"document ebook epub\", \"type\": \"i\"}, {\"name\": \"ELF\", \"kind\": \"value\", \"documentation\": \"executable linux elf\", \"type\": \"i\"}, {\"name\": \"EMA",
"IL\", \"kind\": \"value\", \"documentation\": \"internet email\", \"type\": \"i\"}, {\"name\": \"EMF\", \"kind\": \"value\", \"documentation\": \"multimedia image emf\", \"type\": \"i\"}, {\"name\": \"EOT\", \"kind\": \"value\", \"documentation\": \"font opentype eof\", \"type\": \"i\"}, {\"name\": \"FLAC\", \"kind\": \"value\", \"documentation\": \"multimedia audio flac\", \"type\": \"i\"}, {\"name\": \"FLC\", \"kind\": \"value\", \"documentation\": \"multimedia animation flc\", \"type\": \"i\"}, {\"name\": \"FLI\", \"kind\": \"value\", \"documentation\": \"multimedia animation fli\", \"type\": \"i\"}, {\"name\": \"FLV\", \"kind\": \"value\", \"documentation\": \"multimedia video flv \", \"type\": \"i\"}, {\"name\": \"FORTRAN\", \"kind\": \"value\", \"documentation\": \"source fortran\", \"type\": \"i\"}, {\"name\": \"FPX\", \"kind\": \"value\", \"documentation\": \"multimedia image fpx\", \"type\": \"i\"}, {\"name\": \"GIF\", \"kind\": \"value\", \"documentation\": \"multimedia image gif\", \"type\": \"i\"}, {\"name\": \"GIMP\", \"kind\": \"value\", \"documentation\": \"multimedia image gimp\", \"type\": \"i\"}, {\"name\": \"GUL\", \"kind\": \"value\", \"documentation\": \"document samsu",
"ngdoc text gul\", \"type\": \"i\"}, {\"name\": \"GZIP\", \"kind\": \"value\", \"documentation\": \"compressed gzip\", \"type\": \"i\"}, {\"name\": \"HTML\", \"kind\": \"value\", \"documentation\": \"internet html\", \"type\": \"i\"}, {\"name\": \"HWP\", \"kind\": \"value\", \"documentation\": \"document hangul text hwp\", \"type\": \"i\"}, {\"name\": \"ICO\", \"kind\": \"value\", \"documentation\": \"multimedia image ico\", \"type\": \"i\"}, {\"name\": \"IN_DESIGN\", \"kind\": \"value\", \"documentation\": \"multimedia image indesign\", \"type\": \"i\"}, {\"name\": \"IPHONE\", \"kind\": \"value\", \"documentation\": \"executable mobile iphone ios\", \"type\": \"i\"}, {\"name\": \"ISOIMAGE\", \"kind\": \"value\", \"documentation\": \"compressed isoimage\", \"type\": \"i\"}, {\"name\": \"JAR\", \"kind\": \"value\", \"documentation\": \"compressed jar\", \"type\": \"i\"}, {\"name\": \"JAVA\", \"kind\": \"value\", \"documentation\": \"source java\", \"type\": \"i\"}, {\"name\": \"JAVA_BYTECODE\", \"kind\": \"value\", \"documentation\": \"executable java-bytecode class\", \"type\": \"i\"}, {\"name\": \"JAVASCRIPT\", \"kind\": \"value\", \"documentation\": \"source javascript\", \"type\": \"",
"i\"}, {\"name\": \"JNG\", \"kind\": \"value\", \"documentation\": \"multimedia image jng\", \"type\": \"i\"}, {\"name\": \"JPEG\", \"kind\": \"value\", \"documentation\": \"multimedia image jpeg jpg\", \"type\": \"i\"}, {\"name\": \"KGB\", \"kind\": \"value\", \"documentation\": \"compressed kgb\", \"type\": \"i\"}, {\"name\": \"LATEX\", \"kind\": \"value\", \"documentation\": \"document latex\", \"type\": \"i\"}, {\"name\": \"LINUX\", \"kind\": \"value\", \"documentation\": \"linux \", \"type\": \"i\"}, {\"name\": \"LINUX_KERNEL\", \"kind\": \"value\", \"documentation\": \"linux\", \"type\": \"i\"}, {\"name\": \"LNK\", \"kind\": \"value\", \"documentation\": \"windows lnk\", \"type\": \"i\"}, {\"name\": \"MACH_O\", \"kind\": \"value\", \"documentation\": \"executable mac macho\", \"type\": \"i\"}, {\"name\": \"MACINTOSH\", \"kind\": \"value\", \"documentation\": \"apple macintosh mac macintosh-gen\", \"type\": \"i\"}, {\"name\": \"MACINTOSH_HFS\", \"kind\": \"value\", \"documentation\": \"apple macintosh mac machfs\", \"type\": \"i\"}, {\"name\": \"MACINTOSH_LIB\", \"kind\": \"value\", \"documentation\": \"apple mac maclib\", \"type\": \"i\"}, {\"name\": \"MIDI\", \"kind\": \"value\", \"doc",
"umentation\": \"multimedia audio midi\", \"type\": \"i\"}, {\"name\": \"MOV\", \"kind\": \"value\", \"documentation\": \"multimedia video mov\", \"type\": \"i\"}, {\"name\": \"MP3\", \"kind\": \"value\", \"documentation\": \"multimedia audio mp3\", \"type\": \"i\"}, {\"name\": \"MP4\", \"kind\": \"value\", \"documentation\": \"multimedia audio mp4\", \"type\": \"i\"}, {\"name\": \"MPEG\", \"kind\": \"value\", \"documentation\": \"multimedia video mpeg\", \"type\": \"i\"}, {\"name\": \"MSCOMPRESS\", \"kind\": \"value\", \"documentation\": \"compressed mscompress\", \"type\": \"i\"}, {\"name\": \"MSI\", \"kind\": \"value\", \"documentation\": \"installer windows msi\", \"type\": \"i\"}, {\"name\": \"NE_DLL\", \"kind\": \"value\", \"documentation\": \"executable windows win16 ne nedll\", \"type\": \"i\"}, {\"name\": \"NE_EXE\", \"kind\": \"value\", \"documentation\": \"executable windows win16 ne neexe\", \"type\": \"i\"}, {\"name\": \"ODF\", \"kind\": \"value\", \"documentation\": \"document openoffice math odf\", \"type\": \"i\"}, {\"name\": \"ODG\", \"kind\": \"value\", \"documentation\": \"document openoffice draw odg\", \"type\": \"i\"}, {\"name\": \"ODP\", \"kind\": \"value\", ",
"\"documentation\": \"document openoffice presentation odp\", \"type\": \"i\"}, {\"name\": \"ODS\", \"kind\": \"value\", \"documentation\": \"document openoffice spreadsheet ods\", \"type\": \"i\"}, {\"name\": \"ODT\", \"kind\": \"value\", \"documentation\": \"document openoffice text odt\", \"type\": \"i\"}, {\"name\": \"OGG\", \"kind\": \"value\", \"documentation\": \"multimedia video ogg\", \"type\": \"i\"}, {\"name\": \"OUTLOOK\", \"kind\": \"value\", \"documentation\": \"internet email outlook\", \"type\": \"i\"}, {\"name\": \"PALMOS\", \"kind\": \"value\", \"documentation\": \"executable mobile palmos\", \"type\": \"i\"}, {\"name\": \"PASCAL\", \"kind\": \"value\", \"documentation\": \"source pascal\", \"type\": \"i\"}, {\"name\": \"PDF\", \"kind\": \"value\", \"documentation\": \"document pdf\", \"type\": \"i\"}, {\"name\": \"PE_DLL\", \"kind\": \"value\", \"documentation\": \"executable windows win32 pe pedll\", \"type\": \"i\"}, {\"name\": \"PE_EXE\", \"kind\": \"value\", \"documentation\": \"executable windows win32 pe peexe\", \"type\": \"i\"}, {\"name\": \"PERL\", \"kind\": \"value\", \"documentation\": \"source perl \", \"type\": \"i\"}, {\"name\": \"PHP\", \"kind\": ",
"\"value\", \"documentation\": \"source php\", \"type\": \"i\"}, {\"name\": \"PKG\", \"kind\": \"value\", \"documentation\": \"executable mac pkg\", \"type\": \"i\"}, {\"name\": \"PNG\", \"kind\": \"value\", \"documentation\": \"multimedia image png\", \"type\": \"i\"}, {\"name\": \"PPSX\", \"kind\": \"value\", \"documentation\": \"document msoffice presentation powerpoint slideshow ppsx\", \"type\": \"i\"}, {\"name\": \"PPT\", \"kind\": \"value\", \"documentation\": \"document msoffice presentation powerpoint ppt\", \"type\": \"i\"}, {\"name\": \"PPTX\", \"kind\": \"value\", \"documentation\": \"document msoffice presentation powerpoint pptx\", \"type\": \"i\"}, {\"name\": \"PS\", \"kind\": \"value\", \"documentation\": \"document ps postscript\", \"type\": \"i\"}, {\"name\": \"PSD\", \"kind\": \"value\", \"documentation\": \"multimedia image photoshop psd\", \"type\": \"i\"}, {\"name\": \"PYTHON\", \"kind\": \"value\", \"documentation\": \"source python\", \"type\": \"i\"}, {\"name\": \"QUICKTIME\", \"kind\": \"value\", \"documentation\": \"multimedia video quicktime qt\", \"type\": \"i\"}, {\"name\": \"RAR\", \"kind\": \"value\", \"documentation\": \"compressed rar\", \"",
"type\": \"i\"}, {\"name\": \"RM\", \"kind\": \"value\", \"documentation\": \"multimedia video realmedia rm\", \"type\": \"i\"}, {\"name\": \"ROM\", \"kind\": \"value\", \"documentation\": \"rom bios firmware\", \"type\": \"i\"}, {\"name\": \"RPM\", \"kind\": \"value\", \"documentation\": \"linux rpm\", \"type\": \"i\"}, {\"name\": \"RTF\", \"kind\": \"value\", \"documentation\": \"document msoffice text word rtf\", \"type\": \"i\"}, {\"name\": \"RUBY\", \"kind\": \"value\", \"documentation\": \"source ruby\", \"type\": \"i\"}, {\"name\": \"RZIP\", \"kind\": \"value\", \"documentation\": \"compressed rzip\", \"type\": \"i\"}, {\"name\": \"SCRIPT\", \"kind\": \"value\", \"documentation\": \"script\", \"type\": \"i\"}, {\"name\": \"SEVENZIP\", \"kind\": \"value\", \"documentation\": \"compressed 7zip\", \"type\": \"i\"}, {\"name\": \"SHELLSCRIPT\", \"kind\": \"value\", \"documentation\": \"script shell\", \"type\": \"i\"}, {\"name\": \"SVG\", \"kind\": \"value\", \"documentation\": \"multimedia image svg\", \"type\": \"i\"}, {\"name\": \"SWF\", \"kind\": \"value\", \"documentation\": \"internet flash swf\", \"type\": \"i\"}, {\"name\": \"SYMBIAN\", \"kind\": \"value\", \"documentation\": \"executab",
"le mobile symbian\", \"type\": \"i\"}, {\"name\": \"T3GP\", \"kind\": \"value\", \"documentation\": \"multimedia video 3gp\", \"type\": \"i\"}, {\"name\": \"TAR\", \"kind\": \"value\", \"documentation\": \"compressed tar\", \"type\": \"i\"}, {\"name\": \"TARGA\", \"kind\": \"value\", \"documentation\": \"multimedia image targa\", \"type\": \"i\"}, {\"name\": \"TEXT\", \"kind\": \"value\", \"documentation\": \"text\", \"type\": \"i\"}, {\"name\": \"TIFF\", \"kind\": \"value\", \"documentation\": \"multimedia image tiff\", \"type\": \"i\"}, {\"name\": \"TORRENT\", \"kind\": \"value\", \"documentation\": \"link internet bittorrent\", \"type\": \"i\"}, {\"name\": \"TTF\", \"kind\": \"value\", \"documentation\": \"font truetype ttf\", \"type\": \"i\"}, {\"name\": \"WAV\", \"kind\": \"value\", \"documentation\": \"multimedia audio wav\", \"type\": \"i\"}, {\"name\": \"WINCE\", \"kind\": \"value\", \"documentation\": \"executable mobile wince\", \"type\": \"i\"}, {\"name\": \"WMA\", \"kind\": \"value\", \"documentation\": \"multimedia audio wma\", \"type\": \"i\"}, {\"name\": \"WMV\", \"kind\": \"value\", \"documentation\": \"multimedia video wmv\", \"type\": \"i\"}, {\"name\": \"WOFF\", \"kind\": \"",
"value\", \"documentation\": \"font openfont woff\", \"type\": \"i\"}, {\"name\": \"XLS\", \"kind\": \"value\", \"documentation\": \"document msoffice spreadsheet excel xls\", \"type\": \"i\"}, {\"name\": \"XLSX\", \"kind\": \"value\", \"documentation\": \"document msoffice spreadsheet excel xlsx\", \"type\": \"i\"}, {\"name\": \"XML\", \"kind\": \"value\", \"documentation\": \"internet xml\", \"type\": \"i\"}, {\"name\": \"XPI\", \"kind\": \"value\", \"documentation\": \"browser extension firefox xpi\", \"type\": \"i\"}, {\"name\": \"XWD\", \"kind\": \"value\", \"documentation\": \"multimedia image xwd\", \"type\": \"i\"}, {\"name\": \"ZIP\", \"kind\": \"value\", \"documentation\": \"compressed zip\", \"type\": \"i\"}, {\"name\": \"ZLIB\", \"kind\": \"value\", \"documentation\": \"compressed zlib\", \"type\": \"i\"}, {\"name\": \"APPLESCRIPT\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"APPLESCRIPT_COMPILED\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"BAT\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"BLACKHOLE\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"CRT",
"\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"CSV\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"DWG\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"DXF\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"EPS\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"FLA\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"GOLANG\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"INI\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"IPS\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"JMOD\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"JSON\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"LZFSE\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"M3U\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"M4\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"MAKEFILE\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name",
"\": \"MKV\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"OBJETIVEC\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"ONE_NOTE\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"PEM\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"PGP\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"POWERSHELL\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"PYC\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"PYTHON_PKG\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"PYTHON_WHL\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"SGML\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"SQL\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"SQUASHFS\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"UNKNOWN\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"UNUSED_CLJ\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"UNUSED_NEKO\", \"kind",
"\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"UNUSED_OOXML\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"UNUSED_PDB\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"UNUSED_THREEDS\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"UNUSED_WER\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"VBA\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"VHD\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"WEBM\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"WEBP\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}, {\"name\": \"ZST\", \"kind\": \"value\", \"documentation\": \"\", \"type\": \"i\"}]}, {\"kind\": \"struct\", \"name\": \"BehaviourTrait\", \"attributes\": [{\"kind\": \"value\", \"name\": \"BIG_UPSTREAM\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CHECKS_BIOS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CHECKS_CPU_NAME\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CHECKS_",
"DISK_SPACE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CHECKS_GPS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CHECKS_HOSTNAME\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CHECKS_MEMORY_AVAILABLE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CHECKS_NETWORK_ADAPTERS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CHECKS_PCI_BUS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CHECKS_USB_BUS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CLIPBOARD\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CRYPTO\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"DECRYPTS_EXE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"DETECT_DEBUG_ENVIRONMENT\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"DIRECT_CPU_CLOCK_ACCESS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"EXECUTES_DROPPED_FILE\", \"documentation\": \"\", \"type\": \"i\"}, {\"",
"kind\": \"value\", \"name\": \"FTP_COMMUNICATION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"HOSTS_MODIFIER\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"INSTALLS_BROWSER_EXTENSION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IRC_COMMUNICATION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"LONG_SLEEPS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_ANTI_ANALYSIS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_COPY_FILE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_CREATE_DIR\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_CREATE_FILE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_CREATE_OLE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_DOWNLOAD_URL\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_ENUM_WINDOWS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_ENVIRON\",",
" \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_HANDLE_FILE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_HIDE_APP\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_OPEN_FILE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_POWERSHELL\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_REGISTRY\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_RUN_DLL\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_RUN_FILE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_SAVE_WORKBOOK\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_SEND_KEYS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACRO_WRITE_FILE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MYSQL_COMMUNICATION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"OBFUSCATED\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": ",
"\"PASSWORD_DIALOG\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"PERSISTENCE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"REFLECTION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RUNTIME_MODULES\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SELF_DELETE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SENDS_SMS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SMTP_COMMUNICATION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SSH_COMMUNICATION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUDO\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUSPICIOUS_DNS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUSPICIOUS_UDP\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"TELEPHONY\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"TELNET_COMMUNICATION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"TUNNELING\",",
" \"documentation\": \"\", \"type\": \"i\"}]}, {\"kind\": \"struct\", \"name\": \"BehaviourVerdict\", \"attributes\": [{\"kind\": \"value\", \"name\": \"ADWARE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"BANKER\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CLEAN\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"EVADER\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"EXPLOIT\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"GREYWARE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MALWARE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"PHISHING\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RANSOM\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RAT\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SPREADER\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"TROJAN\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"UNKNOWN_VERDICT\", \"documentation\": \"\", \"t",
"ype\": \"i\"}]}, {\"kind\": \"struct\", \"name\": \"Http\", \"attributes\": [{\"kind\": \"struct\", \"name\": \"Method\", \"attributes\": [{\"kind\": \"value\", \"name\": \"GET\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"HEAD\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"PATCH\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"POST\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"PUT\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"DELETE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"TRACE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"OPTIONS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"CONNECT\", \"documentation\": \"\", \"type\": \"i\"}]}]}, {\"kind\": \"struct\", \"name\": \"Net\", \"attributes\": [{\"kind\": \"struct\", \"name\": \"Protocol\", \"attributes\": [{\"kind\": \"value\", \"name\": \"ICMP\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IGMP\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"TCP\", \"",
"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"UDP\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"ESP\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"AH\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"L2TP\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SCTP\", \"documentation\": \"\", \"type\": \"i\"}]}]}, {\"kind\": \"struct\", \"name\": \"metadata\", \"attributes\": [{\"kind\": \"struct\", \"name\": \"analysis_stats\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Number of antivirus engines that detected the file as malicious.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Number of antivirus engines that didn't detected the file.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Number of antivirus engines that failed scanning the file.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Number of antivirus engines that don't support the file's type.\", ",
"\"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"exiftool\", \"documentation\": \"Dictionary that contains the information generated by ExifTool for the file being scanned. Both keys and values are strings. ExifTool generates numeric values for some properties, but values in YARA dictionaries must have the same time, therefore they are converted to strings.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"first_submission_date\", \"documentation\": \"Date on which the file was submitted to VirusTotal for the first time, as a UNIX timestamp.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"file_name\", \"documentation\": \"File's name as it was last submitted to VirusTotal.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_size\", \"documentation\": \"File size in bytes.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"One of the types listed in the file types table (vt.FileType).\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"file_type_tags\", \"documentation\": \"Tags associated to the file's type, as listed in the file ty",
"pes table.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"goresym\", \"attributes\": [{\"kind\": \"value\", \"name\": \"version\", \"documentation\": \"Version of the Golang compiler used.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"arch\", \"documentation\": \"Target architecture for a Golang binary.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"os\", \"documentation\": \"Target OS for a Golang binary.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"build_id\", \"documentation\": \"Build ID of Golang binary.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"build_info\", \"attributes\": [{\"kind\": \"array\", \"name\": \"deps\", \"documentation\": \"Golang binary's dependencies.\", \"structure\": {\"kind\": \"struct\", \"name\": \"deps\", \"attributes\": [{\"kind\": \"value\", \"name\": \"path\", \"documentation\": \"Golang package path.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"version\", \"documentation\": \"Version of the dependency package used.\", \"type\": \"s\"}]}}, {\"kind\": \"value\", \"name\": \"path\", \"documentation\": \"Golang package path.\", \"type\": \"s\"}, {\"kind\": \"dictionary\", \"name\": \"sett",
"ings\", \"documentation\": \"Dictionary where keys are setting names and values are the setting value.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"summary\", \"attributes\": [{\"kind\": \"value\", \"name\": \"num_dependencies\", \"documentation\": \"Total number of dependencies for a Golang binary.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"num_interfaces\", \"documentation\": \"Total number of interfaces in a Golang binary.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"num_types\", \"documentation\": \"Total number of types in a Golang binary.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"num_std_functions\", \"documentation\": \"Number of functions from standard library used by a Golang binary.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"num_user_functions\", \"documentation\": \"Number of user-defined functions in a Golang binary.\", \"type\": \"i\"}]}]}, {\"kind\": \"value\", \"name\": \"imphash\", \"documentation\": \"File's import hash.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"new_file\", \"documentation\": \"(Boolean) True if the file is being submitted to V",
"irusTotal for the first time.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"magic\", \"documentation\": \"File's type as returned by Linux's file command.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"main_icon\", \"attributes\": [{\"kind\": \"value\", \"name\": \"dhash\", \"documentation\": \"Hash that clusters together files with similar icons or thumbnails.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"raw_md5\", \"documentation\": \"MD5 of the icon associated to the file.\", \"type\": \"s\"}]}, {\"kind\": \"array\", \"name\": \"malware_families\", \"documentation\": \"List of family names produced from a malware config extraction process. Samples with malware configs can be obtained searching have:malware_config, family names will be displayed in the detections tab under \\\"Malware config detection\\\" or in the details tab under \\\"Malware configuration file\\\" where there is the full report.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"md5\", \"documentation\": \"File's MD5.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"sha1\", \"documentation\": \"File's SHA1.\", \"t",
"ype\": \"s\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"File's SHA256.\", \"type\": \"s\"}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Dictionary where keys are antivirus names and values are malware signatures. The casing for both antivirus names and signatures is exactly as they appear in the web reports or API responses.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ssdeep\", \"documentation\": \"File's ssdeep hash.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"subfile\", \"documentation\": \"(Boolean) True if the file being scanned is not the one submitted to VirusTotal but one derived from it. For example, when a PE file packed with UPX is submitted to VirusTotal, both the original file and the unpacked file are scanned. This is true for the unpacked file and false for the original packed one.\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"submitter\", \"attributes\": [{\"kind\": \"value\", \"name\": \"city\", \"documentation\": \"City from where the file was submitted, referred to the last submission. All low",
"ercases.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Country from where the file was submitted, referred to the last submission. This is a two-letter ISO 3166 country code, in uppercase.\", \"type\": \"s\"}]}, {\"kind\": \"array\", \"name\": \"tags\", \"documentation\": \"File's tags.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"telfhash\", \"documentation\": \"File's telfhash.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"tlsh\", \"documentation\": \"File's tlsh hash.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"times_submitted\", \"documentation\": \"Number of times the file has been submitted to VirusTotal. This is 1 for the first submission.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"unique_sources\", \"documentation\": \"Number of unique sources that have submitted this file.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"vhash\", \"documentation\": \"File's vhash.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"itw\", \"attributes\": [{\"kind\": \"struct\", \"name\": \"url\", \"attributes\": [{\"kind\": \"value\", \"name\": \"raw\", \"documentation",
"\": \"The URL in canonical form.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"path\", \"documentation\": \"Path part of the current URL.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"query\", \"documentation\": \"Raw URL query string.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"hostname\", \"documentation\": \"Hostname part of the current URL.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"new_url\", \"documentation\": \"(Boolean) Wether the URL is observed for the first time or not.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"first_submission_date\", \"documentation\": \"UNIX UTC timestamp for the URL's first submission date.\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"params\", \"documentation\": \"Parsed URL GET params.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"port\", \"documentation\": \"The port in which the URL is accessed.\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"trackers\", \"documentation\": \"All trackers found in the URL.\", \"structure\": {\"kind\": \"struct\", \"name\": \"trackers\", \"attributes\": [{\"kind\": \"value\", \"name\": \"name\", \"documentat",
"ion\": \"Tracker name.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"id\", \"documentation\": \"Tracker assigned unique ID.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"url\", \"documentation\": \"URL the tracker is loaded from.\", \"type\": \"s\"}]}}, {\"kind\": \"dictionary\", \"name\": \"response_headers\", \"documentation\": \"Headers returned when making a request to the URL.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"number_of_response_headers\", \"documentation\": \"Amount of response headers.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"response_code\", \"documentation\": \"HTTP status code seen when making a request to the URL.\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"cookies\", \"documentation\": \"Request cookies.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"favicon\", \"attributes\": [{\"kind\": \"value\", \"name\": \"raw_md5\", \"documentation\": \"MD5 hash of the URL's favicon. To find a property raw md5 search VT for its URL and check details. Retrieving raw_md5.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"dhash\", \"documentation\": \"The URL's favic",
"on dhash. To find a property dhash search VT for its URL and check details. Retrieving dhash.\", \"type\": \"s\"}]}, {\"kind\": \"array\", \"name\": \"outgoing_links\", \"documentation\": \"Links included in the URL's response pointing to URLs from other domains.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"redirects\", \"documentation\": \"List of redirecting URLs visited until reaching the final one.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"html_title\", \"documentation\": \"Text found under the URL's returned HTML <title> tag.\", \"type\": \"s\"}, {\"kind\": \"dictionary\", \"name\": \"html_meta_tags\", \"documentation\": \"Values found under the meta tags in the returned HTML.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"tags\", \"documentation\": \"Tags defining interesting features of the URL.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\":",
" \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"categories\", \"documentation\": \"Content categories of its domain by engine.\", \"type\":",
" \"s\"}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"downloaded_file\", \"documentation\": \"Metadata from the latest file downloaded from the URL.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"Latest downloaded fil",
"e SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": ",
"\"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"communicating_file\", \"documentation\": \"Signature returned by the engine.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously ",
"seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"Latest downloaded file SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"ty",
"pe\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}]}, {\"kind\": \"array\", \"name\": \"embedded_resources\", \"documentation\": \"Embedded resources.\", \"structure\": {\"kind\": \"struct\", \"name\": \"embedded_resources\", \"attributes\": [{\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"d",
"ocumentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"value\", \"nam",
"e\": \"file_type\", \"documentation\": \"Resource file type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}]}}, {\"kind\": \"struct\", \"name\": \"submitter\", \"attributes\": [{\"kind\": \"value\", \"name\": \"city\", \"documentation\": \"City from where the file was submitted, referred to the last submission. All lowercases.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Country from where the file was submitted, referred to the last submission. This is a two-letter ISO 3166 country code, in uppercase.\", \"type\": \"s\"}]}]}, {\"kind\": \"struct\", \"name\": \"ip\", \"attributes\": [{\"kind\": \"value\", \"name\": \"raw\", \"documentation\": \"The raw IP as string.\", \"type\": \"s\"}, {\"kind\": \"dictionary\", \"name\": \"whois\", \"documentation\": \"Whois record in key, value format.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"whois_raw\", \"documentation\": \"Whole IP whois as a string for pattern matching.\", \"type\": \"s\"}",
", {\"kind\": \"value\", \"name\": \"new_whois\", \"documentation\": \"(Boolean) IP has an updated whois.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"reverse_lookup\", \"documentation\": \"Domain observed resolving to this IP address for first time. Creating a feed of domain IP resolutions.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"jarm\", \"documentation\": \"TLS fingerprint.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"https_certificate\", \"attributes\": [{\"kind\": \"value\", \"name\": \"thumbprint\", \"documentation\": \"Certificate thumbprint.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"subject\", \"attributes\": [{\"kind\": \"value\", \"name\": \"common_name\", \"documentation\": \"Common name, also known as the Fully Qualified Domain Name (FQDN), of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Two-letter country code that identifies the country of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organization\", \"documentation\": \"The organization to which the certificate",
" has been issued.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organizational_unit\", \"documentation\": \"Additional information about the certified organization.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"locality\", \"documentation\": \"The city where the certified organization is located.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"state\", \"documentation\": \"The state where the certified organization is located.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"validity\", \"attributes\": [{\"kind\": \"value\", \"name\": \"not_after\", \"documentation\": \"Timestamp after which the certificate is no longer valid, in seconds since the Unix epoch.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"not_before\", \"documentation\": \"Timestamp at which the certificate becomes valid, in seconds since the Unix epoch.\", \"type\": \"i\"}]}, {\"kind\": \"value\", \"name\": \"subject_alternative_name\", \"documentation\": \"Subject alternative name.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"signature\", \"documentation\": \"Certificate singature.\", \"type\": \"s\"}, {\"kind\": \"v",
"alue\", \"name\": \"serial_number\", \"documentation\": \"Certificate serial number.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"issuer\", \"attributes\": [{\"kind\": \"value\", \"name\": \"common_name\", \"documentation\": \"Common name, also known as the Fully Qualified Domain Name (FQDN), of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Two-letter country code that identifies the country of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organization\", \"documentation\": \"The organization to which the certificate has been issued.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organizational_unit\", \"documentation\": \"Additional information about the certified organization.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"locality\", \"documentation\": \"The city where the certified organization is located.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"state\", \"documentation\": \"The state where the certified organization is located.\", \"type\": \"s\"}]}]}, {\"kind\": \"struct\"",
", \"name\": \"analysis_stats\", \"documentation\": \"Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"t",
"ype_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"downloaded_file\", \"documentation\": \"Metadata from the latest file downloaded from the URL.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL r",
"esolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"Latest downloaded file SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning ti",
"meout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"communicating_file\", \"documentation\": \"Signature returned by the engine.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\",",
" \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"Latest downloaded file SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value",
"\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}]}, {\"kind\": \"value\", \"name\": \"ip_as_owner\", \"documentation\": \"IP AS (Autonomous System) owner.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ip_asn\", \"documentation\": \"Autonomous System Number.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"ip_country\", \"docum",
"entation\": \"IP Country.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ip_as_int\", \"documentation\": \"IP dotless decimal number notation.\", \"type\": \"i\"}]}, {\"kind\": \"struct\", \"name\": \"domain\", \"attributes\": [{\"kind\": \"value\", \"name\": \"raw\", \"documentation\": \"Domain as a string.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"root\", \"documentation\": \"Root part of the domain, ie: sub2.sub.root.tld -> root.tld.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"new_domain\", \"documentation\": \"(Boolean) Domain is first seen in VT, not necessarily still exists.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"first_resolution\", \"documentation\": \"(Boolean) Domain resolves to an IP for first time.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_resolution\", \"documentation\": \"(Boolean) Domain resolves to a different IP.\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"whois\", \"documentation\": \"Whois record in key, value format.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"whois_raw\", \"documentation\": \"Whois record in key, value format.\", \"type\":",
" \"s\"}, {\"kind\": \"value\", \"name\": \"first_whois\", \"documentation\": \"(Boolean) Domain has whois for first time.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_whois\", \"documentation\": \"(Boolean) Domain has whois for first time.\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"https_certificate\", \"attributes\": [{\"kind\": \"value\", \"name\": \"thumbprint\", \"documentation\": \"Certificate thumbprint.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"subject\", \"attributes\": [{\"kind\": \"value\", \"name\": \"common_name\", \"documentation\": \"Common name, also known as the Fully Qualified Domain Name (FQDN), of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Two-letter country code that identifies the country of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organization\", \"documentation\": \"The organization to which the certificate has been issued.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organizational_unit\", \"documentation\": \"Additional information about the c",
"ertified organization.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"locality\", \"documentation\": \"The city where the certified organization is located.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"state\", \"documentation\": \"The state where the certified organization is located.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"validity\", \"attributes\": [{\"kind\": \"value\", \"name\": \"not_after\", \"documentation\": \"Timestamp after which the certificate is no longer valid, in seconds since the Unix epoch.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"not_before\", \"documentation\": \"Timestamp at which the certificate becomes valid, in seconds since the Unix epoch.\", \"type\": \"i\"}]}, {\"kind\": \"value\", \"name\": \"subject_alternative_name\", \"documentation\": \"Subject alternative name.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"signature\", \"documentation\": \"Certificate singature.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"serial_number\", \"documentation\": \"Certificate serial number.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"issuer\", \"attr",
"ibutes\": [{\"kind\": \"value\", \"name\": \"common_name\", \"documentation\": \"Common name, also known as the Fully Qualified Domain Name (FQDN), of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Two-letter country code that identifies the country of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organization\", \"documentation\": \"The organization to which the certificate has been issued.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organizational_unit\", \"documentation\": \"Additional information about the certified organization.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"locality\", \"documentation\": \"The city where the certified organization is located.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"state\", \"documentation\": \"The state where the certified organization is located.\", \"type\": \"s\"}]}]}, {\"kind\": \"value\", \"name\": \"jarm\", \"documentation\": \"TLS fingerprint\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"dns_records\", \"structure\": {\"kind\": \"stru",
"ct\", \"name\": \"dns_records\", \"attributes\": [{\"kind\": \"value\", \"name\": \"value\", \"documentation\": \"DNS record resolution.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"type\", \"documentation\": \"Record type.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"dns_class\", \"documentation\": \"Class (IN, CH or HS).\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ttl\", \"documentation\": \"TTL (in seconds).\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"mname\", \"documentation\": \"Primary name server.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"rname\", \"documentation\": \"E-mail address of the administrator.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"priority\", \"documentation\": \"Priority\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"serial\", \"documentation\": \"Serial number.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"retry\", \"documentation\": \"Number of seconds after which secondary name servers should retry to request the serial number from the master if the master does not respond.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"refresh\", \"documentation\": ",
"\"Seconds after which secondary name servers should query the master for the SOA record, to detect zone changes.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"expire\", \"documentation\": \"Seconds after which secondary name servers should stop answering request for this zone if the master does not respond.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"minimum\", \"documentation\": \"In seconds. Used in calculating the TTL for purposes of negative caching.\", \"type\": \"i\"}]}}, {\"kind\": \"struct\", \"name\": \"favicon\", \"attributes\": [{\"kind\": \"value\", \"name\": \"raw_md5\", \"documentation\": \"MD5 hash of the URL's favicon. To find a property raw md5 search VT for its URL and check details. Retrieving raw_md5.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"dhash\", \"documentation\": \"The URL's favicon dhash. To find a property dhash search VT for its URL and check details. Retrieving dhash.\", \"type\": \"s\"}]}, {\"kind\": \"array\", \"name\": \"tags\", \"documentation\": \"Tags related to the domain object.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"analy",
"sis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kin",
"d\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"categories\", \"documentation\": \"Content categories by engine.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"popularity_ranks\", \"structure\": {\"kind\": \"struct\", \"name\": \"popularity_ranks\", \"attributes\": [{\"kind\": \"value\", \"name\": \"position\", \"documentation\": \"Position of the domain in a specific popularity rank. Low numbers (closer to 1) indicate that the domain is more popular.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"ingestion_time\", \"documentation\": \"UNIX UTC timestamp at which the position in the rank was ingested.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"rank\", \"documentation\": \"Name of the popularity rank.\", \"type\": \"s\"}]}}, {\"kind\": \"value\", \"name\": \"number_of_popularity_ranks\", \"documentation\": \"Number of popularity ranks entries for the domain.\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"root_popularity_ranks\", \"structure\": {\"kind\": \"struct\"",
", \"name\": \"popularity_ranks\", \"attributes\": [{\"kind\": \"value\", \"name\": \"position\", \"documentation\": \"Position of the root domain in a specific popularity rank. Low numbers (closer to 1) indicate that the domain is more popular.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"ingestion_time\", \"documentation\": \"UNIX UTC timestamp at which the position in the rank was ingested.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"rank\", \"documentation\": \"Name of the popularity rank.\", \"type\": \"s\"}]}}, {\"kind\": \"value\", \"name\": \"number_of_root_popularity_ranks\", \"documentation\": \"Number of popularity ranks entries for the root domain.\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Dictionary where keys are antivirus names and values are malware signatures (in lowercase).\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"downloaded_file\", \"documentation\": \"Metadata from the latest file downloaded from the URL.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates",
" that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"Latest downloaded file SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind",
"\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"ty",
"pe\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"communicating_file\", \"documentation\": \"Signature returned by the engine.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"Latest downloaded file SHA256.\"",
", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of",
" engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}]}]}]}]}, {\"kind\": \"struct\", \"name\": \"behaviour\", \"attributes\": [{\"kind\": \"array\", \"name\": \"calls_highlighted\", \"documentation\": \"API calls that are worth remarking because they are suspicious (e.g. \\\"android.media.AudioRecord.startRecording\\\", \\\"GetTickCount\\\").\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"text_highlighted\", \"documentation\": \"Text that can provide further context about the file, this might be windows titles, dialogs, outputs streams, etc.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"text_decoded\", \"documentation\": \"Strings that are either encoded or decoded during the observed time frame, we just record the decoded strings in plain form.\", \"type\": \"s\"}, {\"kind\": \"arra",
"y\", \"name\": \"traits\", \"documentation\": \"List that contains a subset of the values listed in the behaviour traits table.\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"invokes\", \"documentation\": \"\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"verdicts\", \"documentation\": \"Some sandboxes produce a verdict based on the file behaviour. This list contains one or more of the values listed in the behaviour verdicts table.\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"verdicts_labels\", \"documentation\": \"List that contains the verdicts labels based on the file behaviour sandboxes.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"mitre_attack_techniques\", \"documentation\": \"String containing the mitre attack techniques.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"files_attribute_changed\", \"documentation\": \"Paths of the files whose attributes have changed.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"files_copied\", \"documentation\": \"Structures with information about files that have been copied.\", \"structure\": {\"kind\": \"struct\", \"name\": \"fil",
"es_copied\", \"attributes\": [{\"kind\": \"value\", \"name\": \"source\", \"documentation\": \"Path where the file was copied from.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"destination\", \"documentation\": \"Path where the file was copied to.\", \"type\": \"s\"}]}}, {\"kind\": \"array\", \"name\": \"files_deleted\", \"documentation\": \"Paths of the files that have been deleted.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"files_dropped\", \"documentation\": \"Structures with information about files that have been dropped.\", \"structure\": {\"kind\": \"struct\", \"name\": \"files_dropped\", \"attributes\": [{\"kind\": \"value\", \"name\": \"path\", \"documentation\": \"Path of the dropped file.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"SHA-256 of the dropped file.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"type\", \"documentation\": \"Type of the dropped file.\", \"type\": \"i\"}]}}, {\"kind\": \"array\", \"name\": \"files_opened\", \"documentation\": \"Paths of the files that have been opened.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"files_written\", \"docume",
"ntation\": \"Paths of the files that have been written.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"dns_lookups\", \"documentation\": \"List of DNS resolutions performed.\", \"structure\": {\"kind\": \"struct\", \"name\": \"dns_lookups\", \"attributes\": [{\"kind\": \"value\", \"name\": \"hostname\", \"documentation\": \"Hostname in the DNS lookup request.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"List of IP address returned for the requested hostname.\", \"documentation\": \"List of IP address returned for the requested hostname.\", \"type\": \"s\"}]}}, {\"kind\": \"value\", \"name\": \"hosts_file\", \"documentation\": \"Content of the \\\"hosts\\\" file.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"ip_traffic\", \"documentation\": \"List of established IP connections.\", \"structure\": {\"kind\": \"struct\", \"name\": \"ip_traffic\", \"attributes\": [{\"kind\": \"value\", \"name\": \"destination_ip\", \"documentation\": \"Destination IP address.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"destination_ip_as_int\", \"documentation\": \"Destination IP address dotless decimal number notation.\", \"ty",
"pe\": \"i\"}, {\"kind\": \"value\", \"name\": \"destination_ip_asn\", \"documentation\": \"Destination IP Autonomous System Number.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"destination_port\", \"documentation\": \"Destination port.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"transport_layer_protocol\", \"documentation\": \"One of the constants listed in network protocols (vt.Net.Protocol).\", \"type\": \"i\"}]}}, {\"kind\": \"array\", \"name\": \"http_conversations\", \"documentation\": \"List of HTTP requests performed.\", \"structure\": {\"kind\": \"struct\", \"name\": \"http_conversations\", \"attributes\": [{\"kind\": \"value\", \"name\": \"url\", \"documentation\": \"Requested URL.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"request_method\", \"documentation\": \"One of the constants listed in vt.Http.Method.\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"request_headers\", \"documentation\": \"HTTP request headers. Notice that dictionary keys are case-sensitive and therefore request_headers[\\\"user-agent\\\"] is not the same than request_headers[\\\"User-Agent\\\"]. The header ",
"name appears as reported by the sandbox.\", \"type\": \"s\"}, {\"kind\": \"dictionary\", \"name\": \"response_headers\", \"documentation\": \"HTTP response headers. Notice that dictionary keys are case-sensitive and therefore request_headers[\\\"user-agent\\\"] is not the same than request_headers[\\\"User-Agent\\\"]. The header name appears as reported by the sandbox.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"response_status_code\", \"documentation\": \"HTTP status code returned by the server.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"response_body_filetype\", \"documentation\": \"HTTP status code returned by the server.\", \"type\": \"i\"}]}}, {\"kind\": \"array\", \"name\": \"smtp_conversations\", \"documentation\": \"List of SMTP requests performed.\", \"structure\": {\"kind\": \"struct\", \"name\": \"smtp_conversations\", \"attributes\": [{\"kind\": \"value\", \"name\": \"hostname\", \"documentation\": \"Host name of the SMTP server.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"destination_ip\", \"documentation\": \"IP address of the SMTP server.\", \"type\": \"i\"}, {\"kind\": \"value\"",
", \"name\": \"destination_port\", \"documentation\": \"Port number of the SMTP server (usually 25).\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"smtp_from\", \"documentation\": \"MAIL FROM: field in the SMTP protocol.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"smtp_to\", \"documentation\": \"MAIL TO: field in the SMTP protocol.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"message_from\", \"documentation\": \"\\\"from\\\" field in message header.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"message_to\", \"documentation\": \"\\\"to\\\" field in message header.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"message_cc\", \"documentation\": \"\\\"cc\\\" field in message header.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"message_bcc\", \"documentation\": \"\\\"bcc\\\" field in message header.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"timestamp\", \"documentation\": \"Message timestamp. Example: \\\"Thu, 16 Jul 2020 6:1:58 GMT\\\".\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"subject\", \"documentation\": \"Message subject.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"html_body\", \"doc",
"umentation\": \"Message body in HTML form.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"txt_body\", \"documentation\": \"Message body in text form.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"x_mailer\", \"documentation\": \"Program used for sending the email. Same than \\\"X-Mailer\\\" header.\", \"type\": \"s\"}]}}, {\"kind\": \"array\", \"name\": \"tls\", \"documentation\": \"TLS attributes.\", \"structure\": {\"kind\": \"struct\", \"name\": \"tls\", \"attributes\": [{\"kind\": \"dictionary\", \"name\": \"issuer\", \"documentation\": \"Issuer of the certificate used.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ja3\", \"documentation\": \"ja3 hash of the connection.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ja3s\", \"documentation\": \"ja3s hash of the connection.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"serial_number\", \"documentation\": \"Serial number of the certificate used.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"sni\", \"documentation\": \"Server Name Indication of the connection.\", \"type\": \"s\"}, {\"kind\": \"dictionary\", \"name\": \"subject\", \"documentation\": \"Issuer of t",
"he certificate used.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"thumbprint\", \"documentation\": \"Thumbprint of the certificate used.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"version\", \"documentation\": \"TLS version used.\", \"type\": \"s\"}]}}, {\"kind\": \"array\", \"name\": \"permissions_checked\", \"documentation\": \"Permissions checked by the application.\", \"structure\": {\"kind\": \"struct\", \"name\": \"permissions_checked\", \"attributes\": [{\"kind\": \"value\", \"name\": \"permission\", \"documentation\": \"Permission checked, example: \\\"android.permission.INTERNET\\\".\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"owner\", \"documentation\": \"\", \"type\": \"s\"}]}}, {\"kind\": \"array\", \"name\": \"permissions_requested\", \"documentation\": \"Permissions requested by the application.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"command_executions\", \"documentation\": \"Commands executed, including their command-line arguments.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"modules_loaded\", \"documentation\": \"Modules or libraries dynamically loaded (e.g. DLLs loaded w",
"ith LoadLibrary in Windows, DEX and .class files dynamically loaded in Android).\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"mutexes_created\", \"documentation\": \"Mutexes created.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"mutexes_opened\", \"documentation\": \"Mutexes opened.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"processes_created\", \"documentation\": \"Processes created.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"processes_injected\", \"documentation\": \"Processes in which some kind of code was injected. For instance, in Window this is commonly done using CreateRemoteThread.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"processes_killed\", \"documentation\": \"Processes that were explicitly killed.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"processes_terminated\", \"documentation\": \"Processes that terminated during the observed time, not necessarily killed.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"signals_hooked\", \"documentation\": \"Signals hooked. In Windows this includes the windows messages hooked with SetWindowsHook an",
"d the string contains both the hook type and the function used (i.e \\\"WH_KEYBOARD - SetWindowsHook\\\").\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"signals_observed\", \"documentation\": \"From the signals hooked which were actually observed.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"services_bound\", \"documentation\": \"Service binding applies only to Android. A bind operation takes a component, an action, and potentially multiple extras.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"services_created\", \"documentation\": \"Services created. In some OSes services are simply any program that runs in the background without user interaction.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"services_opened\", \"documentation\": \"Services opened.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"services_started\", \"documentation\": \"Services started.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"services_stopped\", \"documentation\": \"Services stopped.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"registry_keys_deleted\", \"documentation\": \"Deleted regist",
"ry keys.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"registry_keys_opened\", \"documentation\": \"Opened registry keys.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"registry_keys_set\", \"documentation\": \"Modified registry keys and their new values.\", \"structure\": {\"kind\": \"struct\", \"name\": \"registry_keys_set\", \"attributes\": [{\"kind\": \"value\", \"name\": \"key\", \"documentation\": \"Registry key.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"value\", \"documentation\": \"New value for registry key.\", \"type\": \"s\"}]}}, {\"kind\": \"array\", \"name\": \"shared_preferences_lookups\", \"documentation\": \"Shared preferences that have been read.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"shared_preferences_sets\", \"documentation\": \"Shared preferences that have been modified.\", \"structure\": {\"kind\": \"struct\", \"name\": \"shared_preferences_sets\", \"attributes\": [{\"kind\": \"value\", \"name\": \"key\", \"documentation\": \"Shared preference key.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"value\", \"documentation\": \"New value for preference.\", \"type\": \"s\"}]}}, {\"kind\"",
": \"array\", \"name\": \"system_property_lookups\", \"documentation\": \"System properties that have been read.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"system_property_sets\", \"documentation\": \"System properties that have been modified.\", \"structure\": {\"kind\": \"struct\", \"name\": \"system_property_sets\", \"attributes\": [{\"kind\": \"value\", \"name\": \"key\", \"documentation\": \"Property key.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"value\", \"documentation\": \"New value for property.\", \"type\": \"s\"}]}}, {\"kind\": \"array\", \"name\": \"windows_hidden\", \"documentation\": \"Information about windows that have been hidden. The string contains the caption of the hidden Window and the name of the process owning the window.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"windows_searched\", \"documentation\": \"Windows that have been searched for (e.g. using FindWindow). The strings can contain the window's name, the window's class name, or both.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"net\", \"attributes\": [{\"kind\": \"struct\", \"name\": \"url\", \"attri",
"butes\": [{\"kind\": \"value\", \"name\": \"raw\", \"documentation\": \"The URL in canonical form.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"path\", \"documentation\": \"Path part of the current URL.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"query\", \"documentation\": \"Raw URL query string.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"hostname\", \"documentation\": \"Hostname part of the current URL.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"new_url\", \"documentation\": \"(Boolean) Wether the URL is observed for the first time or not.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"first_submission_date\", \"documentation\": \"UNIX UTC timestamp for the URL's first submission date.\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"params\", \"documentation\": \"Parsed URL GET params.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"port\", \"documentation\": \"The port in which the URL is accessed.\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"trackers\", \"documentation\": \"All trackers found in the URL.\", \"structure\": {\"kind\": \"struct\", \"name\": \"trackers\", \"att",
"ributes\": [{\"kind\": \"value\", \"name\": \"name\", \"documentation\": \"Tracker name.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"id\", \"documentation\": \"Tracker assigned unique ID.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"url\", \"documentation\": \"URL the tracker is loaded from.\", \"type\": \"s\"}]}}, {\"kind\": \"dictionary\", \"name\": \"response_headers\", \"documentation\": \"Headers returned when making a request to the URL.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"number_of_response_headers\", \"documentation\": \"Amount of response headers.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"response_code\", \"documentation\": \"HTTP status code seen when making a request to the URL.\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"cookies\", \"documentation\": \"Request cookies.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"favicon\", \"attributes\": [{\"kind\": \"value\", \"name\": \"raw_md5\", \"documentation\": \"MD5 hash of the URL's favicon. To find a property raw md5 search VT for its URL and check details. Retrieving raw_md5.\", \"type\": \"s\"}, {\"kind\": \"va",
"lue\", \"name\": \"dhash\", \"documentation\": \"The URL's favicon dhash. To find a property dhash search VT for its URL and check details. Retrieving dhash.\", \"type\": \"s\"}]}, {\"kind\": \"array\", \"name\": \"outgoing_links\", \"documentation\": \"Links included in the URL's response pointing to URLs from other domains.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"redirects\", \"documentation\": \"List of redirecting URLs visited until reaching the final one.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"html_title\", \"documentation\": \"Text found under the URL's returned HTML <title> tag.\", \"type\": \"s\"}, {\"kind\": \"dictionary\", \"name\": \"html_meta_tags\", \"documentation\": \"Values found under the meta tags in the returned HTML.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"tags\", \"documentation\": \"Tags defining interesting features of the URL.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine retur",
"ning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"categories\", \"documentation\"",
": \"Content categories of its domain by engine.\", \"type\": \"s\"}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"downloaded_file\", \"documentation\": \"Metadata from the latest file downloaded from the URL.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"",
"name\": \"sha256\", \"documentation\": \"Latest downloaded file SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\":",
" \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"communicating_file\", \"documentation\": \"Signature returned by the engine.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(B",
"oolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"Latest downloaded file SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amou",
"nt of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}]}, {\"kind\": \"array\", \"name\": \"embedded_resources\", \"documentation\": \"Embedded resources.\", \"structure\": {\"kind\": \"struct\", \"name\": \"embedded_resources\", \"attributes\": [{\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", ",
"\"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the",
" file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Resource file type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}]}}, {\"kind\": \"struct\", \"name\": \"submitter\", \"attributes\": [{\"kind\": \"value\", \"name\": \"city\", \"documentation\": \"City from where the file was submitted, referred to the last submission. All lowercases.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Country from where the file was submitted, referred to the last submission. This is a two-letter ISO 3166 country code, in uppercase.\", \"type\": \"s\"}]}]}, {\"kind\": \"struct\", \"name\": \"ip\", \"attributes\": [{\"kind\": \"value\", \"name\": \"raw\", \"documentation\": \"The raw IP as string.\", \"type\": \"s\"}, {\"kind\": \"dictionary\", \"name\": \"whois\", \"documentation\": \"Whois record in key, value format.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"whois_raw\", \"documentation\": \"Whole I",
"P whois as a string for pattern matching.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"new_whois\", \"documentation\": \"(Boolean) IP has an updated whois.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"reverse_lookup\", \"documentation\": \"Domain observed resolving to this IP address for first time. Creating a feed of domain IP resolutions.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"jarm\", \"documentation\": \"TLS fingerprint.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"https_certificate\", \"attributes\": [{\"kind\": \"value\", \"name\": \"thumbprint\", \"documentation\": \"Certificate thumbprint.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"subject\", \"attributes\": [{\"kind\": \"value\", \"name\": \"common_name\", \"documentation\": \"Common name, also known as the Fully Qualified Domain Name (FQDN), of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Two-letter country code that identifies the country of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organization\", \"do",
"cumentation\": \"The organization to which the certificate has been issued.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organizational_unit\", \"documentation\": \"Additional information about the certified organization.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"locality\", \"documentation\": \"The city where the certified organization is located.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"state\", \"documentation\": \"The state where the certified organization is located.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"validity\", \"attributes\": [{\"kind\": \"value\", \"name\": \"not_after\", \"documentation\": \"Timestamp after which the certificate is no longer valid, in seconds since the Unix epoch.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"not_before\", \"documentation\": \"Timestamp at which the certificate becomes valid, in seconds since the Unix epoch.\", \"type\": \"i\"}]}, {\"kind\": \"value\", \"name\": \"subject_alternative_name\", \"documentation\": \"Subject alternative name.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"signature\", \"documentati",
"on\": \"Certificate singature.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"serial_number\", \"documentation\": \"Certificate serial number.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"issuer\", \"attributes\": [{\"kind\": \"value\", \"name\": \"common_name\", \"documentation\": \"Common name, also known as the Fully Qualified Domain Name (FQDN), of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Two-letter country code that identifies the country of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organization\", \"documentation\": \"The organization to which the certificate has been issued.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organizational_unit\", \"documentation\": \"Additional information about the certified organization.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"locality\", \"documentation\": \"The city where the certified organization is located.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"state\", \"documentation\": \"The state where the certified organi",
"zation is located.\", \"type\": \"s\"}]}]}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analys",
"is process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"downloaded_file\", \"documentation\": \"Metadata from the latest file downloaded from the URL.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not bee",
"n previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"Latest downloaded file SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"t",
"imeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"communicating_file\", \"documentation\": \"Signature returned by the engine.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded fro",
"m that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"Latest downloaded file SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning sus",
"picious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}]}, {\"kind\": \"value\", \"name\": \"ip_as_owner\", \"documentation\": \"IP AS (Autonomous System) owner.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ip_asn\", \"documentation\": \"Autonomous System Number.\", \"typ",
"e\": \"i\"}, {\"kind\": \"value\", \"name\": \"ip_country\", \"documentation\": \"IP Country.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ip_as_int\", \"documentation\": \"IP dotless decimal number notation.\", \"type\": \"i\"}]}, {\"kind\": \"struct\", \"name\": \"domain\", \"attributes\": [{\"kind\": \"value\", \"name\": \"raw\", \"documentation\": \"Domain as a string.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"root\", \"documentation\": \"Root part of the domain, ie: sub2.sub.root.tld -> root.tld.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"new_domain\", \"documentation\": \"(Boolean) Domain is first seen in VT, not necessarily still exists.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"first_resolution\", \"documentation\": \"(Boolean) Domain resolves to an IP for first time.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_resolution\", \"documentation\": \"(Boolean) Domain resolves to a different IP.\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"whois\", \"documentation\": \"Whois record in key, value format.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"whois_raw\", \"docum",
"entation\": \"Whois record in key, value format.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"first_whois\", \"documentation\": \"(Boolean) Domain has whois for first time.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_whois\", \"documentation\": \"(Boolean) Domain has whois for first time.\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"https_certificate\", \"attributes\": [{\"kind\": \"value\", \"name\": \"thumbprint\", \"documentation\": \"Certificate thumbprint.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"subject\", \"attributes\": [{\"kind\": \"value\", \"name\": \"common_name\", \"documentation\": \"Common name, also known as the Fully Qualified Domain Name (FQDN), of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Two-letter country code that identifies the country of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organization\", \"documentation\": \"The organization to which the certificate has been issued.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organizational_uni",
"t\", \"documentation\": \"Additional information about the certified organization.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"locality\", \"documentation\": \"The city where the certified organization is located.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"state\", \"documentation\": \"The state where the certified organization is located.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"validity\", \"attributes\": [{\"kind\": \"value\", \"name\": \"not_after\", \"documentation\": \"Timestamp after which the certificate is no longer valid, in seconds since the Unix epoch.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"not_before\", \"documentation\": \"Timestamp at which the certificate becomes valid, in seconds since the Unix epoch.\", \"type\": \"i\"}]}, {\"kind\": \"value\", \"name\": \"subject_alternative_name\", \"documentation\": \"Subject alternative name.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"signature\", \"documentation\": \"Certificate singature.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"serial_number\", \"documentation\": \"Certificate serial number.\", ",
"\"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"issuer\", \"attributes\": [{\"kind\": \"value\", \"name\": \"common_name\", \"documentation\": \"Common name, also known as the Fully Qualified Domain Name (FQDN), of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"country\", \"documentation\": \"Two-letter country code that identifies the country of the subject that is certified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organization\", \"documentation\": \"The organization to which the certificate has been issued.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"organizational_unit\", \"documentation\": \"Additional information about the certified organization.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"locality\", \"documentation\": \"The city where the certified organization is located.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"state\", \"documentation\": \"The state where the certified organization is located.\", \"type\": \"s\"}]}]}, {\"kind\": \"value\", \"name\": \"jarm\", \"documentation\": \"TLS fingerprint\", \"type\": \"s\"}, {\"kind\": \"ar",
"ray\", \"name\": \"dns_records\", \"structure\": {\"kind\": \"struct\", \"name\": \"dns_records\", \"attributes\": [{\"kind\": \"value\", \"name\": \"value\", \"documentation\": \"DNS record resolution.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"type\", \"documentation\": \"Record type.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"dns_class\", \"documentation\": \"Class (IN, CH or HS).\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ttl\", \"documentation\": \"TTL (in seconds).\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"mname\", \"documentation\": \"Primary name server.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"rname\", \"documentation\": \"E-mail address of the administrator.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"priority\", \"documentation\": \"Priority\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"serial\", \"documentation\": \"Serial number.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"retry\", \"documentation\": \"Number of seconds after which secondary name servers should retry to request the serial number from the master if the master does not respond.\", \"type\": \"i\"}",
", {\"kind\": \"value\", \"name\": \"refresh\", \"documentation\": \"Seconds after which secondary name servers should query the master for the SOA record, to detect zone changes.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"expire\", \"documentation\": \"Seconds after which secondary name servers should stop answering request for this zone if the master does not respond.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"minimum\", \"documentation\": \"In seconds. Used in calculating the TTL for purposes of negative caching.\", \"type\": \"i\"}]}}, {\"kind\": \"struct\", \"name\": \"favicon\", \"attributes\": [{\"kind\": \"value\", \"name\": \"raw_md5\", \"documentation\": \"MD5 hash of the URL's favicon. To find a property raw md5 search VT for its URL and check details. Retrieving raw_md5.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"dhash\", \"documentation\": \"The URL's favicon dhash. To find a property dhash search VT for its URL and check details. Retrieving dhash.\", \"type\": \"s\"}]}, {\"kind\": \"array\", \"name\": \"tags\", \"documentation\": \"Tags related to the domain o",
"bject.\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that f",
"ailed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"categories\", \"documentation\": \"Content categories by engine.\", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"popularity_ranks\", \"structure\": {\"kind\": \"struct\", \"name\": \"popularity_ranks\", \"attributes\": [{\"kind\": \"value\", \"name\": \"position\", \"documentation\": \"Position of the domain in a specific popularity rank. Low numbers (closer to 1) indicate that the domain is more popular.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"ingestion_time\", \"documentation\": \"UNIX UTC timestamp at which the position in the rank was ingested.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"rank\", \"documentation\": \"Name of the popularity rank.\", \"type\": \"s\"}]}}, {\"kind\": \"value\", \"name\": \"number_of_popularity_ranks\", \"documentation\": \"Number of popularity ranks entries for the domain.\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\":",
" \"root_popularity_ranks\", \"structure\": {\"kind\": \"struct\", \"name\": \"popularity_ranks\", \"attributes\": [{\"kind\": \"value\", \"name\": \"position\", \"documentation\": \"Position of the root domain in a specific popularity rank. Low numbers (closer to 1) indicate that the domain is more popular.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"ingestion_time\", \"documentation\": \"UNIX UTC timestamp at which the position in the rank was ingested.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"rank\", \"documentation\": \"Name of the popularity rank.\", \"type\": \"s\"}]}}, {\"kind\": \"value\", \"name\": \"number_of_root_popularity_ranks\", \"documentation\": \"Number of popularity ranks entries for the root domain.\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Dictionary where keys are antivirus names and values are malware signatures (in lowercase).\", \"type\": \"s\"}, {\"kind\": \"struct\", \"name\": \"downloaded_file\", \"documentation\": \"Metadata from the latest file downloaded from the URL.\", \"attributes\": [{\"kind\": \"value\", \"na",
"me\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sha256\", \"documentation\": \"Latest downloaded file SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis st",
"ats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amoun",
"t of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}, {\"kind\": \"dictionary\", \"name\": \"signatures\", \"documentation\": \"Signature returned by the engine.\", \"type\": \"s\"}]}, {\"kind\": \"struct\", \"name\": \"communicating_file\", \"documentation\": \"Signature returned by the engine.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"new_for_vt\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen in VT.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_url\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from that particular URL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_domain\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the URL's domain.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"new_for_ip\", \"documentation\": \"(Boolean) Indicates that the file has not been previously seen being downloaded from the IP the URL resolves to.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"sh",
"a256\", \"documentation\": \"Latest downloaded file SHA256.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"file_type\", \"documentation\": \"Latest downloaded file's type (one of the types listed in the file types table).\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"analysis_stats\", \"documentation\": \"Latest downloaded file analysis stats. Analysis Stats Struct info.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"malicious\", \"documentation\": \"Amount of engine returning malicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"suspicious\", \"documentation\": \"Amount of engine returning suspicious in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"undetected\", \"documentation\": \"Amount of engine returning undetected in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"harmless\", \"documentation\": \"Amount of engine returning harmless in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timeout\", \"documentation\": \"Amount of engine returning timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", ",
"\"name\": \"confirmed_timeout\", \"documentation\": \"Amount of engine returning confirmed timeout in the analysis.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"failure\", \"documentation\": \"Amount of engine that failed during the analysis process.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type_unsupported\", \"documentation\": \"Amount of engine that do not support the file/IoC type.\", \"type\": \"i\"}]}]}]}]}]}"
    };

    Gmodule_vt() : ModuleContent("vt")
    {
        std::string content;
        content.reserve(module_content_size);
        for (std::size_t i = 0; i < 108; ++i)
            content += module_content_parts[i];
        setContent(std::move(content));
    }
 };

 } // namespace modules

 } // namespace yaramod
