%FILES%
usr/
usr/bin/
usr/bin/volatility-extra
usr/share/
usr/share/doc/
usr/share/doc/volatility-extra/
usr/share/doc/volatility-extra/README.md
usr/share/volatility-extra/
usr/share/volatility-extra/AdamBridge/
usr/share/volatility-extra/AdamBridge/README.md
usr/share/volatility-extra/AdamBridge/__init__.py
usr/share/volatility-extra/AdamBridge/linux_xwindows.py
usr/share/volatility-extra/AdamBridge/ndispktscan.py
usr/share/volatility-extra/AleksanderOsterud/
usr/share/volatility-extra/AleksanderOsterud/Capabilities-example.pdf
usr/share/volatility-extra/AleksanderOsterud/MemoryDecompression.zip
usr/share/volatility-extra/AleksanderOsterud/MemoryDecompressionV09 User Guide.pdf
usr/share/volatility-extra/AlessandroDeVito/
usr/share/volatility-extra/AlessandroDeVito/README.md
usr/share/volatility-extra/AlessandroDeVito/__init__.py
usr/share/volatility-extra/AlessandroDeVito/chrome_ragamuffin.py
usr/share/volatility-extra/AlessandroDeVito/libchrome_5803029110.py
usr/share/volatility-extra/AlessandroDeVito/libchrome_600311290.py
usr/share/volatility-extra/AndreasSchuster/
usr/share/volatility-extra/AndreasSchuster/__init__.py
usr/share/volatility-extra/AndreasSchuster/poisonivy.py
usr/share/volatility-extra/AndrewCook/
usr/share/volatility-extra/AndrewCook/__init__.py
usr/share/volatility-extra/AndrewCook/saveconfig.py
usr/share/volatility-extra/AngeloMirabella/
usr/share/volatility-extra/AngeloMirabella/README.md
usr/share/volatility-extra/BlaineStancill/
usr/share/volatility-extra/BlaineStancill/README.md
usr/share/volatility-extra/CemGurkok/
usr/share/volatility-extra/CemGurkok/README.md
usr/share/volatility-extra/CemGurkok/__init__.py
usr/share/volatility-extra/CemGurkok/bitcoin.py
usr/share/volatility-extra/CesarePizzi/
usr/share/volatility-extra/CesarePizzi/README.md
usr/share/volatility-extra/CesarePizzi/Volatility_Plugin_Powershell.pdf
usr/share/volatility-extra/CesarePizzi/powersh.py
usr/share/volatility-extra/CsabaBarta/
usr/share/volatility-extra/CsabaBarta/README.md
usr/share/volatility-extra/CsabaBarta/__init__.py
usr/share/volatility-extra/CsabaBarta/baseline.py
usr/share/volatility-extra/CsabaBarta/indx.py
usr/share/volatility-extra/CsabaBarta/logfile.py
usr/share/volatility-extra/CsabaBarta/malprocfind.py
usr/share/volatility-extra/CsabaBarta/usnjrnl.py
usr/share/volatility-extra/DatQuoc/
usr/share/volatility-extra/DatQuoc/LinuxFirefox.py
usr/share/volatility-extra/DatQuoc/Readme.pdf
usr/share/volatility-extra/DatQuoc/__init__.py
usr/share/volatility-extra/DaveLasalle/
usr/share/volatility-extra/DaveLasalle/README.md
usr/share/volatility-extra/DaveLasalle/__init__.py
usr/share/volatility-extra/DaveLasalle/apihooksdeep.py
usr/share/volatility-extra/DaveLasalle/chromehistory.py
usr/share/volatility-extra/DaveLasalle/firefoxhistory.py
usr/share/volatility-extra/DaveLasalle/idxparser.py
usr/share/volatility-extra/DaveLasalle/malfinddeep.py
usr/share/volatility-extra/DaveLasalle/prefetch.py
usr/share/volatility-extra/DaveLasalle/sqlite_help.py
usr/share/volatility-extra/DaveLasalle/ssdeepscan.py
usr/share/volatility-extra/DaveLasalle/trustrecords.py
usr/share/volatility-extra/DaveLasalle/uninstallinfo.py
usr/share/volatility-extra/DavidQuesada/
usr/share/volatility-extra/DavidQuesada/README.md
usr/share/volatility-extra/DavidQuesada/dash_volatility.xml
usr/share/volatility-extra/DimaPshoul/
usr/share/volatility-extra/DimaPshoul/DimaPshoul - Volatility Contest 2016 Submission.pdf
usr/share/volatility-extra/DimaPshoul/README.md
usr/share/volatility-extra/DimaPshoul/__init__.py
usr/share/volatility-extra/DimaPshoul/callstacks.py
usr/share/volatility-extra/DimaPshoul/malfofind.py
usr/share/volatility-extra/DimaPshoul/malthfind.py
usr/share/volatility-extra/ESET_Browserhooks/
usr/share/volatility-extra/ESET_Browserhooks/README.md
usr/share/volatility-extra/ESET_Browserhooks/__init__.py
usr/share/volatility-extra/ESET_Browserhooks/browserhooks.py
usr/share/volatility-extra/ESET_Browserhooks/browserhooks_documentation.pdf
usr/share/volatility-extra/EWF/
usr/share/volatility-extra/EWF/__init__.py
usr/share/volatility-extra/EWF/ewf.py
usr/share/volatility-extra/ElmarNabigaev/
usr/share/volatility-extra/ElmarNabigaev/README.md
usr/share/volatility-extra/ElmarNabigaev/vmtools.py
usr/share/volatility-extra/EnumFunc/
usr/share/volatility-extra/EnumFunc/__init__.py
usr/share/volatility-extra/EnumFunc/enumfunc.py
usr/share/volatility-extra/FabienPerigaud/
usr/share/volatility-extra/FabienPerigaud/README.md
usr/share/volatility-extra/FabienPerigaud/__init__.py
usr/share/volatility-extra/FabienPerigaud/plugx.py
usr/share/volatility-extra/FabioPagani/
usr/share/volatility-extra/FabioPagani/README.md
usr/share/volatility-extra/FabioPagani/volc.zip
usr/share/volatility-extra/GlennEdwards/
usr/share/volatility-extra/GlennEdwards/README.md
usr/share/volatility-extra/GlennEdwards/__init__.py
usr/share/volatility-extra/GlennEdwards/system_info.py
usr/share/volatility-extra/JPCERT/
usr/share/volatility-extra/JPCERT/LICENSE.txt
usr/share/volatility-extra/JPCERT/README.md
usr/share/volatility-extra/JPCERT/__init__.py
usr/share/volatility-extra/JPCERT/apt17scan.py
usr/share/volatility-extra/JamaalSpeights/
usr/share/volatility-extra/JamaalSpeights/README.md
usr/share/volatility-extra/JamaalSpeights/__init__.py
usr/share/volatility-extra/JamaalSpeights/msdecompress.py
usr/share/volatility-extra/JamesHall_KevinBreen/
usr/share/volatility-extra/JamesHall_KevinBreen/README.md
usr/share/volatility-extra/JamesHall_KevinBreen/__init__.py
usr/share/volatility-extra/JamesHall_KevinBreen/usbstor.py
usr/share/volatility-extra/JeffBryner/
usr/share/volatility-extra/JeffBryner/README.md
usr/share/volatility-extra/JeffBryner/__init__.py
usr/share/volatility-extra/JeffBryner/facebook.py
usr/share/volatility-extra/JeffBryner/twitter.py
usr/share/volatility-extra/JoeGreenwood/
usr/share/volatility-extra/JoeGreenwood/README.md
usr/share/volatility-extra/JoeGreenwood/__init__.py
usr/share/volatility-extra/JoeGreenwood/attributeht.py
usr/share/volatility-extra/KSLGroup_Threadmap/
usr/share/volatility-extra/KSLGroup_Threadmap/README.md
usr/share/volatility-extra/KSLGroup_Threadmap/__init__.py
usr/share/volatility-extra/KSLGroup_Threadmap/threadmap documentation.pdf
usr/share/volatility-extra/KSLGroup_Threadmap/threadmap.py
usr/share/volatility-extra/KevinBreen/
usr/share/volatility-extra/KevinBreen/README.md
usr/share/volatility-extra/KevinBreen/__init__.py
usr/share/volatility-extra/KevinBreen/lastpass.py
usr/share/volatility-extra/KudelskiSecurity/
usr/share/volatility-extra/KudelskiSecurity/README.md
usr/share/volatility-extra/KudelskiSecurity/__init__.py
usr/share/volatility-extra/KudelskiSecurity/dyrescan.py
usr/share/volatility-extra/MarianoGraziano/
usr/share/volatility-extra/MarianoGraziano/README.md
usr/share/volatility-extra/MarianoGraziano/__init__.py
usr/share/volatility-extra/MarianoGraziano/kstackps.py
usr/share/volatility-extra/MikeAuty/
usr/share/volatility-extra/MikeAuty/__init__.py
usr/share/volatility-extra/MikeAuty/scanprof.py
usr/share/volatility-extra/MonnappaKa/
usr/share/volatility-extra/MonnappaKa/README.md
usr/share/volatility-extra/MonnappaKa/__init__.py
usr/share/volatility-extra/MonnappaKa/ghostrat.py
usr/share/volatility-extra/MonnappaKa/hollowfind.py
usr/share/volatility-extra/MonnappaKa/linux_mem_diff.py
usr/share/volatility-extra/MonnappaKa/psinfo.py
usr/share/volatility-extra/NCCGroup/
usr/share/volatility-extra/NCCGroup/README.md
usr/share/volatility-extra/NCCGroup/__init__.py
usr/share/volatility-extra/NCCGroup/fwhooks.py
usr/share/volatility-extra/NichlasHolm/
usr/share/volatility-extra/NichlasHolm/README.md
usr/share/volatility-extra/NichlasHolm/__init__.py
usr/share/volatility-extra/NichlasHolm/carve_packets.py
usr/share/volatility-extra/NickGk/
usr/share/volatility-extra/NickGk/LICENSE.txt
usr/share/volatility-extra/NickGk/README.md
usr/share/volatility-extra/NickGk/__init__.py
usr/share/volatility-extra/NickGk/facebook_extractor.py
usr/share/volatility-extra/PSDispScan/
usr/share/volatility-extra/PSDispScan/__init__.py
usr/share/volatility-extra/PSDispScan/psdispscan.py
usr/share/volatility-extra/PageCheck/
usr/share/volatility-extra/PageCheck/__init__.py
usr/share/volatility-extra/PageCheck/pagecheck.py
usr/share/volatility-extra/PhilipHuppert/
usr/share/volatility-extra/PhilipHuppert/README.md
usr/share/volatility-extra/PhilipHuppert/__init__.py
usr/share/volatility-extra/PhilipHuppert/openvpn.py
usr/share/volatility-extra/PhilipHuppert/rsakey.py
usr/share/volatility-extra/PhilipHuppert/vol-livemigration/
usr/share/volatility-extra/PhilipHuppert/vol-livemigration/LICENSE
usr/share/volatility-extra/PhilipHuppert/vol-livemigration/README.md
usr/share/volatility-extra/PhilipHuppert/vol-livemigration/__init__.py
usr/share/volatility-extra/PhilipHuppert/vol-livemigration/extract.py
usr/share/volatility-extra/PhilipHuppert/vol-livemigration/vmotion.py
usr/share/volatility-extra/RopFind/
usr/share/volatility-extra/RopFind/README.md
usr/share/volatility-extra/ShachafAtun/
usr/share/volatility-extra/ShachafAtun/README.md
usr/share/volatility-extra/Shemulator/
usr/share/volatility-extra/Shemulator/README.md
usr/share/volatility-extra/Shemulator/shemulator.py
usr/share/volatility-extra/Shemulator/shemulator_api.py
usr/share/volatility-extra/ShimcacheMemory/
usr/share/volatility-extra/ShimcacheMemory/README.md
usr/share/volatility-extra/ShimcacheMemory/__init__.py
usr/share/volatility-extra/ShimcacheMemory/shimcachemem.py
usr/share/volatility-extra/ShuseiTomonaga/
usr/share/volatility-extra/ShuseiTomonaga/README.md
usr/share/volatility-extra/SlaviParpulev/
usr/share/volatility-extra/SlaviParpulev/__init__.py
usr/share/volatility-extra/SlaviParpulev/psempire.py
usr/share/volatility-extra/StanislasLejay/
usr/share/volatility-extra/StanislasLejay/README.md
usr/share/volatility-extra/StanislasLejay/__init__.py
usr/share/volatility-extra/StanislasLejay/linux/
usr/share/volatility-extra/StanislasLejay/linux/__init__.py
usr/share/volatility-extra/StanislasLejay/linux/get_profile.py
usr/share/volatility-extra/StanislasLejay/profilescan.py
usr/share/volatility-extra/TeamDecepticon/
usr/share/volatility-extra/TeamDecepticon/[VAC] 2018_REPORT_DECEPTICON.pdf
usr/share/volatility-extra/TeamMalGround/
usr/share/volatility-extra/TeamMalGround/2018 Volatility Analysis Contest Report_MalGround.pdf
usr/share/volatility-extra/Team_HSLFL/
usr/share/volatility-extra/Team_HSLFL/[VAC2019] Report - Team HSLFS.pdf
usr/share/volatility-extra/ThomasChopitea/
usr/share/volatility-extra/ThomasChopitea/README.md
usr/share/volatility-extra/ThomasChopitea/__init__.py
usr/share/volatility-extra/ThomasChopitea/autoruns.py
usr/share/volatility-extra/ThomasWhite/
usr/share/volatility-extra/ThomasWhite/README.md
usr/share/volatility-extra/ThomasWhite/__init__.py
usr/share/volatility-extra/ThomasWhite/bitlocker.py
usr/share/volatility-extra/ThomasWhite/filevault2.py
usr/share/volatility-extra/TomSpencer/
usr/share/volatility-extra/TomSpencer/README.md
usr/share/volatility-extra/TomSpencer/__init__.py
usr/share/volatility-extra/TomSpencer/usnparser.py
usr/share/volatility-extra/TranVienHa/
usr/share/volatility-extra/TranVienHa/README.md
usr/share/volatility-extra/TranVienHa/__init__.py
usr/share/volatility-extra/TranVienHa/osint.conf
usr/share/volatility-extra/TranVienHa/osint.py
usr/share/volatility-extra/TranVienHa/whitelist.txt
usr/share/volatility-extra/TyperHalfpop/
usr/share/volatility-extra/TyperHalfpop/README.md
usr/share/volatility-extra/TyperHalfpop/__init__.py
usr/share/volatility-extra/TyperHalfpop/findevilinfo.py
usr/share/volatility-extra/TyperHalfpop/findevilmem.py
usr/share/volatility-extra/TyperHalfpop/findevilproc.py
usr/share/volatility-extra/WMDF/
usr/share/volatility-extra/WMDF/README.md
usr/share/volatility-extra/WMDF/WMDF.pdf
usr/share/volatility-extra/WindowsToastNotifications/
usr/share/volatility-extra/WindowsToastNotifications/20190927_Toast Notifications_Writeup.pdf
usr/share/volatility-extra/WindowsToastNotifications/README.md
usr/share/volatility-extra/WindowsToastNotifications/toastplugin.py
usr/share/volatility-extra/WyattRoersma/
usr/share/volatility-extra/WyattRoersma/README.md
usr/share/volatility-extra/WyattRoersma/__init__.py
usr/share/volatility-extra/WyattRoersma/hpv.py
usr/share/volatility-extra/YingLi/
usr/share/volatility-extra/YingLi/README.md
usr/share/volatility-extra/YingLi/__init__.py
usr/share/volatility-extra/YingLi/python_strings.py
usr/share/volatility-extra/YingLi/ssh_agent_key.py
usr/share/volatility-extra/ZeusScan/
usr/share/volatility-extra/ZeusScan/__init__.py
usr/share/volatility-extra/ZeusScan/zeusscan.py
usr/share/volatility-extra/__init__.py
usr/share/volatility-extra/aim4r/
usr/share/volatility-extra/aim4r/LICENSE.txt
usr/share/volatility-extra/aim4r/README.md
usr/share/volatility-extra/aim4r/VolDiff.py
usr/share/volatility-extra/aim4r/__init__.py
usr/share/volatility-extra/itayk/
usr/share/volatility-extra/itayk/__init__.py
usr/share/volatility-extra/itayk/antianalysis.py
usr/share/volatility-extra/itayk/apifinder.py
