
config = {
    "vmName":"Win10_Sandbox", # name of registered virtualbox vm
    "host" : "192.168.0.15",  #ip of remote host
    "port":22,  # port of ssh
    "user":"user", # windows username
    "password":"xxxxxxxxx", #password of windows user
    "keyPath":"/home/user/.ssh/id_rsa", # filepath of ssh private key
    "loggerName":"SandboxAnalysis",
    "logDirPath":"/home/user/SandboxAnalysisLogs/", # location to store log files
    "runExecFromDir":"C:/Users/user/Desktop/",
    "newSampleFileName" : "mysecureapplication.exe",
    "downloadRemoteDirAfterProcessing" : "C:/logs/",
    "downloadLocalDirAfterProcessing" : "/media/user/HDD2/SampleLogs/",
    "runtime" : 600,
    "execWithExternalCallback" : True, #if True, then LauncherAddon via MitmProxy (must be then enabled) will execute sample, if false then sandboxLib will execute sample
    "enableMitmProxy" : True,
    "enableCnCsimulation" : True
}



preProcessingCmds = [
                                        "net start w32time",
                                        "w32tm /resync /force",
                                        #"C:\\PathTools\\tracelog.exe -start WalletProtectionMiniFilter -guid C:/WalletProtectionMiniFilter/WalletProtectionMiniFilter.ctl -flag 1 -rt",
                                        #"C:\\PathTools\\tracefmt.exe -rt WalletProtectionMiniFilter -p C:/WalletProtectionMiniFilter/ -o C:/logs/WalletProtectionMiniFilter.txt -display -nosummary",
                                        #"fltmc load WalletProtectionMiniFilter",
                                        "C:\\PathTools\\tracelog.exe -start FilesystemMon -guid C:/FilesystemMon/FilesystemMon.ctl -flag 1 -rt",
                                        "C:\\PathTools\\tracefmt.exe -rt FilesystemMon -p C:/FilesystemMon/ -o C:/logs/FilesystemMon.txt -nosummary", #no -display
                                        "fltmc load FilesystemMon"
                                    ]

postProcessingCmds = [
                                        "fltmc unload FilesystemMon",
                                        "C:\\PathTools\\tracelog.exe -stop FilesystemMon",
                                        #"fltmc unload WalletProtectionMiniFilter",
                                        #"C:\\PathTools\\tracelog.exe -stop WalletProtectionMiniFilter",
                                        "move C:\\Users\\user\\Desktop\\*.txt C:/logs"
                                    ]


afterExecCmds = [
                                        #"C:\\WindowInteraction\WindowInteraction.exe",
                                        #"C:\\ClipboardMonitor\ClipboardMonitor.exe",
                                        #"C:\\ClipboardHijackingProtection\\ClipboardHijackingProtection.exe",

                                    ]
##################################################################################

