dissect.target 3.18.dev5__py3-none-any.whl → 3.18.dev7__py3-none-any.whl

dissect/target/plugins/os/windows/prefetch.py

@@ -1,6 +1,6 @@
 from io import BytesIO
 
-from dissect import cstruct
+from dissect.cstruct import cstruct
 from dissect.util import lzxpress_huffman
 from dissect.util.ts import wintimestamp
 
@@ -33,7 +33,7 @@ GroupedPrefetchRecord = TargetRecordDescriptor(
 )
 
 
-c_prefetch = """
+prefetch_def = """
     struct PREFETCH_HEADER_DETECT {
         char signature[4];
         uint32 size;
@@ -59,14 +59,14 @@ c_prefetch = """
         uint32 volumes_information_offset;
         uint32 number_of_volumes;
         uint32 volumes_information_size;
-        uint32 unknown[2];
+        uint32 unknown0[2];
         uint64 last_run_time;
         uint64 last_run_remains[7];
-        uint64 unknown[2];
+        uint64 unknown1[2];
         uint32 run_count;
-        uint32 unknown;
-        uint32 unknown;
-        char unknown[88];
+        uint32 unknown2;
+        uint32 unknown3;
+        char unknown4[88];
     };
 
     struct FILE_INFORMATION_17 {
@@ -80,9 +80,9 @@ c_prefetch = """
         uint32 number_of_volumes;
         uint32 volumes_information_size;
         uint32 last_run_time;
-        uint32 unknown;
+        uint32 unknown0;
         uint32 run_count;
-        uint32 unknown;
+        uint32 unknown1;
     };
 
     struct FILE_INFORMATION_23 {
@@ -99,9 +99,9 @@ c_prefetch = """
         uint64 last_run_time;
         uint64 last_run_remains[2];
         uint32 run_count;
-        uint32 unknown;
-        uint32 unknown;
-        char unknown[80];
+        uint32 unknown0;
+        uint32 unknown1;
+        char unknown2[80];
     };
 
     struct VOLUME_INFORMATION_17 {
@@ -125,19 +125,19 @@ c_prefetch = """
         uint32 file_reference_size;
         uint32 directory_strings_array_offset;
         uint32 number_of_directory_strings;
-        char unknown[4];
-        char unknown[24];
-        char unknown[4];
-        char unknown[24];
-        char unknown[4];
+        char unknown0[4];
+        char unknown1[24];
+        char unknown2[4];
+        char unknown3[24];
+        char unknown4[4];
     };
 
     struct TRACE_CHAIN_ARRAY_ENTRY_17 {
         uint32 next_array_entry_index;
         uint32 total_block_load_count;
-        uint32 unknown;
-        uint32 unknown;
-        uint32 unknown;
+        uint32 unknown0;
+        uint32 unknown1;
+        uint32 unknown2;
     };
 
     struct FILE_METRICS_ARRAY_ENTRY_17 {
@@ -158,25 +158,24 @@ c_prefetch = """
         uint64 ntfs_reference;
     };
     """
-prefetch = cstruct.cstruct()
-prefetch.load(c_prefetch)
+c_prefetch = cstruct().load(prefetch_def)
 
 prefetch_version_structs = {
-    17: (prefetch.FILE_INFORMATION_17, prefetch.FILE_METRICS_ARRAY_ENTRY_17),
-    23: (prefetch.FILE_INFORMATION_23, prefetch.FILE_METRICS_ARRAY_ENTRY_23),
-    30: (prefetch.FILE_INFORMATION_26, prefetch.FILE_METRICS_ARRAY_ENTRY_23),
+    17: (c_prefetch.FILE_INFORMATION_17, c_prefetch.FILE_METRICS_ARRAY_ENTRY_17),
+    23: (c_prefetch.FILE_INFORMATION_23, c_prefetch.FILE_METRICS_ARRAY_ENTRY_23),
+    30: (c_prefetch.FILE_INFORMATION_26, c_prefetch.FILE_METRICS_ARRAY_ENTRY_23),
 }
 
 
 class Prefetch:
     def __init__(self, fh):
-        header_detect = prefetch.PREFETCH_HEADER_DETECT(fh.read(8))
+        header_detect = c_prefetch.PREFETCH_HEADER_DETECT(fh.read(8))
         if header_detect.signature == b"MAM\x04":
             fh = BytesIO(lzxpress_huffman.decompress(fh))
 
         self.fh = fh
         self.fh.seek(0)
-        self.header = prefetch.PREFETCH_HEADER(self.fh)
+        self.header = c_prefetch.PREFETCH_HEADER(self.fh)
         self.version = self.identify()
         self.volumes = None
         self.metrics = None

dissect/target/plugins/os/windows/recyclebin.py

@@ -1,6 +1,8 @@
+from __future__ import annotations
+
 from typing import Generator
 
-from dissect import cstruct
+from dissect.cstruct import cstruct
 from dissect.util.ts import wintimestamp
 
 from dissect.target import Target
@@ -21,7 +23,7 @@ RecycleBinRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
     ],
 )
 
-c_recyclebin_i = """
+recyclebin_def = """
 struct header_v1 {
     int64    version;
     int64    file_size;
@@ -37,14 +39,14 @@ struct header_v2 {
 };
 """
 
+c_recyclebin = cstruct().load(recyclebin_def)
+
 
 class RecyclebinPlugin(Plugin):
     """Recyclebin plugin."""
 
     def __init__(self, target: Target) -> None:
         super().__init__(target)
-        self.recyclebin_parser = cstruct.cstruct()
-        self.recyclebin_parser.load(c_recyclebin_i)
 
     def check_compatible(self) -> None:
         for fs_entry in self.target.fs.path("/").iterdir():
@@ -131,11 +133,11 @@ class RecyclebinPlugin(Plugin):
             return "unknown"
         return parent_path.name
 
-    def select_header(self, data: bytes) -> cstruct.Structure:
+    def select_header(self, data: bytes) -> c_recyclebin.header_v1 | c_recyclebin.header_v2:
         """Selects the correct header based on the version field in the header"""
 
-        header_version = self.recyclebin_parser.uint64(data[:8])
+        header_version = c_recyclebin.uint64(data[:8])
         if header_version == 2:
-            return self.recyclebin_parser.header_v2
+            return c_recyclebin.header_v2
         else:
-            return self.recyclebin_parser.header_v1
+            return c_recyclebin.header_v1

dissect/target/plugins/os/windows/regf/auditpol.py

@@ -1,14 +1,12 @@
 import io
 
-from dissect import cstruct
+from dissect.cstruct import cstruct
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
 
-c_adtev = cstruct.cstruct()
-c_adtev.load(
-    """
+adtev_def = """
 struct header {
     uint16  unk0;
     uint16  unk1;
@@ -18,7 +16,8 @@ struct header {
     uint16  unk3;
 };
 """
-)
+
+c_adtev = cstruct().load(adtev_def)
 
 POLICY_CATEGORIES = [
     "System",

dissect/target/plugins/os/windows/regf/bam.py

@@ -5,13 +5,12 @@ from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
 
-c_bamdef = """
+bam_def = """
     struct entry {
         uint64 ts;
     };
     """
-c_bam = cstruct()
-c_bam.load(c_bamdef)
+c_bam = cstruct().load(bam_def)
 
 BamDamRecord = TargetRecordDescriptor(
     "windows/registry/bam",

dissect/target/plugins/os/windows/regf/cit.py

@@ -212,8 +212,7 @@ typedef struct _CIT_DP_DATA {
 } CIT_DP_DATA;
 """
 
-c_cit = cstruct()
-c_cit.load(cit_def)
+c_cit = cstruct().load(cit_def)
 
 
 CITSystemRecord = TargetRecordDescriptor(

dissect/target/plugins/os/windows/regf/recentfilecache.py

@@ -1,10 +1,10 @@
-from dissect import cstruct
+from dissect.cstruct import cstruct
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
 
-c_recent_files_def = """
+recent_files_def = """
     struct header {
         uint32  magic;
         uint32  unk0;
@@ -18,8 +18,7 @@ c_recent_files_def = """
         wchar   path[length + 1];
     };
     """
-c_recent_files = cstruct.cstruct()
-c_recent_files.load(c_recent_files_def)
+c_recent_files = cstruct().load(recent_files_def)
 
 RecentFileCacheRecord = TargetRecordDescriptor(
     "windows/recentfilecache",

dissect/target/plugins/os/windows/regf/shellbags.py

@@ -243,8 +243,7 @@ struct EXTENSION_BLOCK_HEADER {
     uint32  signature;
 };
 """
-c_bag = cstruct()
-c_bag.load(bag_def)
+c_bag = cstruct().load(bag_def)
 
 DELEGATE_ITEM_IDENTIFIER = b"\x74\x1a\x59\x5e\x96\xdf\xd3\x48\x8d\x67\x17\x33\xbc\xee\x28\xba"
 

dissect/target/plugins/os/windows/regf/shimcache.py

@@ -21,7 +21,7 @@ ShimcacheRecord = TargetRecordDescriptor(
     ],
 )
 
-c_shimdef = """
+shim_def = """
 struct NT61_HEADER {
     uint32 magic;
     uint32 num_entries;
@@ -99,8 +99,7 @@ struct WIN10_ENTRY_DATA {
     uint64 ts;
 };
 """
-c_shim = cstruct()
-c_shim.load(c_shimdef)
+c_shim = cstruct().load(shim_def)
 
 MAGIC_NT61 = 0xBADC0FEE
 MAGIC_NT52 = 0xBADC0FFE

dissect/target/plugins/os/windows/regf/userassist.py

@@ -1,6 +1,6 @@
 import codecs
 
-from dissect import cstruct
+from dissect.cstruct import cstruct
 from dissect.util.ts import wintimestamp
 
 from dissect.target.exceptions import RegistryValueNotFoundError, UnsupportedPluginError
@@ -14,13 +14,13 @@ from dissect.target.plugin import Plugin, export
 
 userassist_def = """
 struct VERSION5_ENTRY {
-    char padding[4];
+    char padding0[4];
     uint32 number_of_executions;
     uint32 application_focus_count;
     uint32 application_focus_duration;
-    char padding[44];
+    char padding1[44];
     uint64 timestamp;
-    char padding[4];
+    char padding2[4];
 };
 
 struct VERSION3_ENTRY {
@@ -29,8 +29,7 @@ struct VERSION3_ENTRY {
     uint64  timestamp;
 };
 """
-c_userassist = cstruct.cstruct()
-c_userassist.load(userassist_def)
+c_userassist = cstruct().load(userassist_def)
 
 UserAssistRecordDescriptor = create_extended_descriptor(
     [

dissect/target/plugins/os/windows/sam.py

@@ -9,14 +9,14 @@ try:
 except ImportError:
     HAS_CRYPTO = False
 
-from dissect import cstruct
+from dissect.cstruct import cstruct
 from dissect.util import ts
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
 
-c_sam_def = """
+sam_def = """
 struct user_F {
   char      unknown1[8];
   uint64    t_last_login;           /* Time of last login */
@@ -166,7 +166,7 @@ struct DOMAIN_ACCOUNT_F {
   uint16 min_password_length;               /* 0x50 */
   uint16 password_history_length;           /* 0x52 */
   uint16 lockout_threshold;                 /* 0x54 */
-  uint16 unknown1_1;                        /* 0x56 */
+  uint16 unknown1_3;                        /* 0x56 */
   uint32 server_state;                      /* 0x58 */
   uint16 server_role;                       /* 0x5c */
   uint16 uas_compability_required;          /* 0x5e */
@@ -207,8 +207,7 @@ struct SAM_HASH_AES {  /* size: >=24 */
 };
 """
 
-c_sam = cstruct.cstruct()
-c_sam.load(c_sam_def)
+c_sam = cstruct().load(sam_def)
 
 SamRecord = TargetRecordDescriptor(
     "windows/registry/sam",

dissect/target/plugins/os/windows/task_helpers/tasks_job.py

@@ -2,7 +2,7 @@ import datetime
 import warnings
 from typing import Iterator, Optional
 
-from dissect import cstruct
+from dissect.cstruct import cstruct
 from flow.record import GroupedRecord
 
 from dissect.target.exceptions import InvalidTaskError
@@ -135,8 +135,7 @@ struct ATJOB_DATA {
 //      uint8       job_signature[64 * s_ver * c_ver];  /*      - calculated job signature. */
 };
 """
-atjob = cstruct.cstruct()
-atjob.load(atjob_def)
+c_atjob = cstruct().load(atjob_def)
 
 
 class AtTask:
@@ -149,7 +148,7 @@ class AtTask:
 
     def __init__(self, job_file: TargetPath, target: Target):
         try:
-            self.at_data = atjob.ATJOB_DATA(job_file.open())
+            self.at_data = c_atjob.ATJOB_DATA(job_file.open())
         except Exception as e:
             raise InvalidTaskError(e)
 

{dissect.target-3.18.dev5.dist-info → dissect.target-3.18.dev7.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.18.dev5
+Version: 3.18.dev7
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -23,36 +23,61 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: COPYRIGHT
 Requires-Dist: defusedxml
-Requires-Dist: dissect.cstruct <4.0.dev,>=3.0.dev
-Requires-Dist: dissect.eventlog <4.0.dev,>=3.0.dev
-Requires-Dist: dissect.evidence <4.0.dev,>=3.0.dev
-Requires-Dist: dissect.hypervisor <4.0.dev,>=3.0.dev
-Requires-Dist: dissect.ntfs <4.0.dev,>=3.4.dev
-Requires-Dist: dissect.regf <4.0.dev,>=3.3.dev
-Requires-Dist: dissect.util <4.0.dev,>=3.0.dev
-Requires-Dist: dissect.volume <4.0.dev,>=3.0.dev
+Requires-Dist: dissect.cstruct <5,>=4.dev
+Requires-Dist: dissect.eventlog <4,>=3
+Requires-Dist: dissect.evidence <4,>=3
+Requires-Dist: dissect.hypervisor <4,>=3
+Requires-Dist: dissect.ntfs <4,>=3.4
+Requires-Dist: dissect.regf <4,>=3.3
+Requires-Dist: dissect.util <4,>=3
+Requires-Dist: dissect.volume <4,>=2
 Requires-Dist: flow.record ~=3.15.0
 Requires-Dist: structlog
 Provides-Extra: cb
 Requires-Dist: dissect.target[full] ; extra == 'cb'
 Requires-Dist: carbon-black-cloud-sdk ~=1.4.3 ; extra == 'cb'
+Provides-Extra: dev
+Requires-Dist: dissect.target[full,mqtt,yara] ; extra == 'dev'
+Requires-Dist: dissect.btrfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
+Requires-Dist: dissect.cim[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.clfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
+Requires-Dist: dissect.cstruct <5.0.dev,>=4.0.dev ; extra == 'dev'
+Requires-Dist: dissect.esedb[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.etl[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.eventlog[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.evidence[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.extfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.fat[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.ffs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.hypervisor[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.jffs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
+Requires-Dist: dissect.ntfs[dev] <4.0.dev,>=3.4.dev ; extra == 'dev'
+Requires-Dist: dissect.regf[dev] <4.0.dev,>=3.3.dev ; extra == 'dev'
+Requires-Dist: dissect.shellitem[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.sql[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.squashfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
+Requires-Dist: dissect.thumbcache[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
+Requires-Dist: dissect.util <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.vmfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.volume[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
+Requires-Dist: dissect.xfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
 Provides-Extra: full
 Requires-Dist: asn1crypto ; extra == 'full'
-Requires-Dist: dissect.btrfs <2.0.dev,>=1.0.dev ; extra == 'full'
-Requires-Dist: dissect.cim <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.clfs <2.0.dev,>=1.0.dev ; extra == 'full'
-Requires-Dist: dissect.esedb <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.etl <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.extfs <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.fat <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.ffs <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.jffs <2.0.dev,>=1.0.dev ; extra == 'full'
-Requires-Dist: dissect.shellitem <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.squashfs <2.0.dev,>=1.0.dev ; extra == 'full'
-Requires-Dist: dissect.sql <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.thumbcache <2.0.dev,>=1.0.dev ; extra == 'full'
-Requires-Dist: dissect.vmfs <4.0.dev,>=3.0.dev ; extra == 'full'
-Requires-Dist: dissect.xfs <4.0.dev,>=3.0.dev ; extra == 'full'
+Requires-Dist: dissect.btrfs <2,>=1 ; extra == 'full'
+Requires-Dist: dissect.cim <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.clfs <2,>=1 ; extra == 'full'
+Requires-Dist: dissect.esedb <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.etl <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.extfs <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.fat <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.ffs <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.jffs <2,>=1 ; extra == 'full'
+Requires-Dist: dissect.shellitem <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.squashfs <2,>=1 ; extra == 'full'
+Requires-Dist: dissect.sql <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.thumbcache <2,>=1 ; extra == 'full'
+Requires-Dist: dissect.vmfs <4,>=3 ; extra == 'full'
+Requires-Dist: dissect.xfs <4,>=3 ; extra == 'full'
 Requires-Dist: ipython ; extra == 'full'
 Requires-Dist: fusepy ; extra == 'full'
 Requires-Dist: pycryptodome ; extra == 'full'

{dissect.target-3.18.dev5.dist-info → dissect.target-3.18.dev7.dist-info}/RECORD

@@ -60,12 +60,12 @@ dissect/target/helpers/mount.py,sha256=JxhUYyEbDnHfzPpfuWy4nV9OwCJPoDSGdHHNiyvd_
 dissect/target/helpers/mui.py,sha256=i-7XoHbu4WO2fYapK9yGAMW04rFlgRispknc1KQIS5Q,22258
 dissect/target/helpers/network_managers.py,sha256=uRh_P8ICbKke2N7eFJ6AS2-I5DmIRiaQUlxR7oqxPaU,24975
 dissect/target/helpers/polypath.py,sha256=h8p7m_OCNiQljGwoZh5Aflr9H2ot6CZr6WKq1OSw58o,2175
-dissect/target/helpers/protobuf.py,sha256=NwKrZD4q9v7J8GnZX9gbzMUMV5pR78eAV17jgWOz_EY,1730
+dissect/target/helpers/protobuf.py,sha256=b4DsnqrRLrefcDjx7rQno-_LBcwtJXxuKf5RdOegzfE,1537
 dissect/target/helpers/record.py,sha256=lWl7k2Mp9Axllm0tXzPGJx2zj2zONsyY_p5g424T0Lc,4826
 dissect/target/helpers/record_modifier.py,sha256=3I_rC5jqvl0TsW3V8OQ6Dltz_D8J4PU1uhhzbJGKm9c,3245
 dissect/target/helpers/regutil.py,sha256=kX-sSZbW8Qkg29Dn_9zYbaQrwLumrr4Y8zJ1EhHXIAM,27337
 dissect/target/helpers/shell_folder_ids.py,sha256=Behhb8oh0kMxrEk6YYKYigCDZe8Hw5QS6iK_d2hTs2Y,24978
-dissect/target/helpers/ssh.py,sha256=LPssHXyfL8QYmLi2vpa3wElsGboLG_A1Y8kvOehpUr4,6338
+dissect/target/helpers/ssh.py,sha256=obB7sqUH0IoUo78NAmHM8TX0pgA_4GHICZ3TA3TW_0E,6324
 dissect/target/helpers/targetd.py,sha256=ELhUulzQ4OgXgHsWhsLgM14vut8Wm6btr7qTynlwKaE,1812
 dissect/target/helpers/utils.py,sha256=r36Bn0UL0E6Z8ajmQrHzC6RyUxTRdwJ1PNsd904Lmzs,4027
 dissect/target/helpers/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -86,7 +86,7 @@ dissect/target/loaders/itunes.py,sha256=rKOhlDRypQBGkuSZudMDS1Mlb9XV6BD5FRvM7tGq
 dissect/target/loaders/kape.py,sha256=t5TfrGLqPeIpUUpXzIl6aHsqXMEGDqJ5YwDCs07DiBA,1237
 dissect/target/loaders/local.py,sha256=Ul-LCd_fY7SyWOVR6nH-NqbkuNpxoZVmffwrkvQElU8,16453
 dissect/target/loaders/log.py,sha256=cCkDIRS4aPlX3U-n_jUKaI2FPSV3BDpfqKceaU7rBbo,1507
-dissect/target/loaders/mqtt.py,sha256=D8AmdOz2atD92z8bhjVFi3tC1H7pYmP4UrOCtMgfwMY,10396
+dissect/target/loaders/mqtt.py,sha256=wba1AFopF4ANvA5YiXd6_8T-5kRBLsiKA5xCPmrD7Xk,16024
 dissect/target/loaders/multiraw.py,sha256=4a3ZST0NwjnfPDxHkcEfAcX2ddUlT_C-rcrMHNg1wp4,1046
 dissect/target/loaders/ova.py,sha256=6h4O-7i87J394C6KgLsPkdXRAKNwtPubzLNS3vBGs7U,744
 dissect/target/loaders/overlay.py,sha256=tj99HKvNG5_JbGfb1WCv4KNSbXXSnEcPQY5XT-JUxn8,992
@@ -117,7 +117,7 @@ dissect/target/plugins/apps/av/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5
 dissect/target/plugins/apps/av/mcafee.py,sha256=YWrsB5kQFtXfhqi6mdMPMVk2qh_KCiOBiaTnbj8mVrM,5440
 dissect/target/plugins/apps/av/sophos.py,sha256=TuO-ggdD5De0UTouzNF7-1iLULIOvr6FDktocnM0aF0,4164
 dissect/target/plugins/apps/av/symantec.py,sha256=I1_zZ2ihKptB2JJ7sYZ7df0AgtK3KhWPsbDkc2m_hPA,14171
-dissect/target/plugins/apps/av/trendmicro.py,sha256=ZhxL4IkzyHfR2xaNIzk-M-v-ITMuLG_yqq_0djqGMjU,4675
+dissect/target/plugins/apps/av/trendmicro.py,sha256=8F4IWYCXG7HEniGridQ4ax82Mrx_20wV_999-8c9ttQ,4666
 dissect/target/plugins/apps/browser/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/apps/browser/brave.py,sha256=EW1ubL10swHeV9CscfpE-SrNZozul_Ewj48LNRaG5Kg,2865
 dissect/target/plugins/apps/browser/browser.py,sha256=rBIwcgdl73gm-8APwx2jEUAYXRniXkqcdMr2UYj_tS8,4118
@@ -127,7 +127,7 @@ dissect/target/plugins/apps/browser/edge.py,sha256=woXzZtHPWmfcV8vbxGKHELKru5JRb
 dissect/target/plugins/apps/browser/firefox.py,sha256=ROrzhI2SV81E63hi5PRtyJveRrBacWNJ9FWZS_ondlk,30929
 dissect/target/plugins/apps/browser/iexplore.py,sha256=g_xw0toaiyjevxO8g9XPCOqc-CXZp39FVquRhPFGdTE,8801
 dissect/target/plugins/apps/container/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-dissect/target/plugins/apps/container/docker.py,sha256=67Eih9AfUbqsP-HlnlwoHi4rSAnVCZWM76sEyO_1m18,15316
+dissect/target/plugins/apps/container/docker.py,sha256=KxQRbKGgxkf3YFBMa7fjeJ7qo8qjFys7zEmfQhDTnLw,15305
 dissect/target/plugins/apps/remoteaccess/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/apps/remoteaccess/anydesk.py,sha256=lHtgINWXfVpPuCTRyQmT2ZO-1vkoqiXZ7coj8cZ8p4c,3185
 dissect/target/plugins/apps/remoteaccess/remoteaccess.py,sha256=UQDmDC4Y-KxYl_8kaAh6SG_BLJZ6SeGnxG0gyD8tzaE,833
@@ -240,38 +240,38 @@ dissect/target/plugins/os/unix/linux/suse/__init__.py,sha256=47DEQpj8HBSa-_TImW-
 dissect/target/plugins/os/unix/linux/suse/_os.py,sha256=eaqgnkbunBJ2Hf_GE96THjfT3ybVIZvtWId-dx3JMV4,575
 dissect/target/plugins/os/unix/linux/suse/zypper.py,sha256=amepAWivvbHFt2AoJUHC8lIeuD5Iy8MFXTWKqTYAEqE,4142
 dissect/target/plugins/os/unix/locate/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-dissect/target/plugins/os/unix/locate/gnulocate.py,sha256=P-YbMFw901p2EBgTaZH6axShfIRRDrCx3APBy6Ii3lE,2934
+dissect/target/plugins/os/unix/locate/gnulocate.py,sha256=N5IF8fYsrKrWsJw8ZPC_Y4wiQqdchgOvKtv-E5-vLec,2922
 dissect/target/plugins/os/unix/locate/locate.py,sha256=uXFcWAqoz_3eNWHhsGoEtkkhmT5J3F1GYvr4uQxi308,122
-dissect/target/plugins/os/unix/locate/mlocate.py,sha256=DhrFgxDQF-fMZaA0WK8Z-5o9i9iDsuTHW7MHJtWwz6o,4485
-dissect/target/plugins/os/unix/locate/plocate.py,sha256=ShU-F9_31rGfMYXqaR_KrHXVxgDDRZMJ_zEMuekw57w,7229
+dissect/target/plugins/os/unix/locate/mlocate.py,sha256=A8U3cqrA8fq8AV-4pkImjwdwQbWY-TspvRQS9bzZRLo,4477
+dissect/target/plugins/os/unix/locate/plocate.py,sha256=PQ-nmpMex6POKEsyqppButAjVxR071urmGcFU1LUQdA,7219
 dissect/target/plugins/os/unix/log/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-dissect/target/plugins/os/unix/log/atop.py,sha256=DdiTf-gVJJvvPbR36khU4388lxQzABaWI-95jLCGgSw,16345
+dissect/target/plugins/os/unix/log/atop.py,sha256=ljvGipVG16qTECnV1kIORykcGH9tTlpDmcMo5CXSPns,16332
 dissect/target/plugins/os/unix/log/audit.py,sha256=OjorWTmCFvCI5RJq6m6WNW0Lhb-poB2VAggKOGZUHK4,3722
 dissect/target/plugins/os/unix/log/auth.py,sha256=l7gCuRdvv9gL0U1N0yrR9hVsMnr4t_k4t-n-f6PrOxg,2388
-dissect/target/plugins/os/unix/log/journal.py,sha256=eiNNVLmKWFj4dTQX8PNRNgKpVwzQWEHEsKyYfGUAPXQ,17376
-dissect/target/plugins/os/unix/log/lastlog.py,sha256=eL_dbB1sPoy0tyavIjT457ZLVfXcCr17GiwDrMEEh8A,2458
+dissect/target/plugins/os/unix/log/journal.py,sha256=auVRfrW4NRU7HguoDLTz4l_IwNdPZLPAqD7jhrOTzH8,17404
+dissect/target/plugins/os/unix/log/lastlog.py,sha256=Wq89wRSFZSBsoKVCxjDofnC4yw9XJ4iOF0XJe9EucCo,2448
 dissect/target/plugins/os/unix/log/messages.py,sha256=CXA-SkMPLaCgnTQg9nzII-7tO8Il_ENQmuYvDxo33rI,4698
-dissect/target/plugins/os/unix/log/utmp.py,sha256=21tvzG977LqzRShV6uAoU-83WDcLUrI_Tv__2ZVi9rw,7756
+dissect/target/plugins/os/unix/log/utmp.py,sha256=1nPHIaBUHt_9z6PDrvyqg4huKLihUaWLrMmgMsbaeIo,7755
 dissect/target/plugins/os/windows/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/windows/_os.py,sha256=g5XGtruvyWx4YAhMpGZnAaIFWQqLNQpee_Ot7ROmD8w,12606
 dissect/target/plugins/os/windows/activitiescache.py,sha256=Q2aILnhJ2rp2AwEbWwyBuSLjMbGqaYJTsavSbfkcFKE,6741
-dissect/target/plugins/os/windows/adpolicy.py,sha256=rvsvywChfms7d2kMwXRVHZaf8zJ46WmMwYplGAYEax8,6984
+dissect/target/plugins/os/windows/adpolicy.py,sha256=fULRFO_I_QxAn6G9SCwlLL-TLVliS13JEGnGotf7lSA,6983
 dissect/target/plugins/os/windows/amcache.py,sha256=ZZNOs3bILTf0AGkDkhoatndl0j39DXkstN7oOyxJECU,27188
 dissect/target/plugins/os/windows/catroot.py,sha256=wHW_p4M0aFonZJ2xZFIbgLbJopdCIXO9jVrGPHLsMLc,11105
 dissect/target/plugins/os/windows/cim.py,sha256=jsrpu6TZpBUh7VWI9AV2Ib5bebTwsvqOwRfa5gjJd7c,3056
 dissect/target/plugins/os/windows/clfs.py,sha256=begVsZ-CY97Ksh6S1g03LjyBgu8ERY2hfNDWYPj0GXI,4872
-dissect/target/plugins/os/windows/credhist.py,sha256=FX_pW-tU9esdvDTSx913kf_CpGE_1jbD6bkjDb-cxHk,7069
-dissect/target/plugins/os/windows/datetime.py,sha256=tuBOkewmbCW8sFXcYp5p82oM5RCsVwmtC79BDCTLz8k,9472
-dissect/target/plugins/os/windows/defender.py,sha256=Vp_IP6YKm4igR765WvXJrHQ3RMu7FJKM3VOoR8AybV8,23737
+dissect/target/plugins/os/windows/credhist.py,sha256=YSjuyd53Augdy_lKKzZHtx5Ozt0HzF6LDYIOb-8P1Pw,7058
+dissect/target/plugins/os/windows/datetime.py,sha256=YKHUZU6lkKJocq15y0yCwvIIOb1Ej-kfvEBmHbrdIGw,9467
+dissect/target/plugins/os/windows/defender.py,sha256=lHHhyi8YqNTmBu3qbH7yskMAYcarYouPxKtBQLtXnnE,23713
 dissect/target/plugins/os/windows/env.py,sha256=-u9F9xWy6PUbQmu5Tv_MDoVmy6YB-7CbHokIK_T3S44,13891
 dissect/target/plugins/os/windows/generic.py,sha256=BSvDPfB9faU0uquMj0guw5tnR_97Nn0XAEE4k05BFSQ,22273
 dissect/target/plugins/os/windows/lnk.py,sha256=On1k0PODYggQM1j514qFepBACCV2Z2u61Q4Ba6e3Y2c,8179
 dissect/target/plugins/os/windows/locale.py,sha256=yXVdclpUqss9h8Nq7N4kg3OHwWGDfjdfiLiUZR3wqv8,2324
-dissect/target/plugins/os/windows/notifications.py,sha256=64xHHueHwtJCc8RTAF70oa0RxvqfCu_DBPWRSZBnYZc,17386
-dissect/target/plugins/os/windows/prefetch.py,sha256=bDoJOWRp6vIHe1lf9HXNuNg5iyh5YqVw9s0P562VfKo,10460
-dissect/target/plugins/os/windows/recyclebin.py,sha256=7UFjZg1NHWJyfjthhMBpQd3kGG8ZXe7H4Cu9U3QzjOs,4929
+dissect/target/plugins/os/windows/notifications.py,sha256=T1CIvQgpW__qDR0Rq5zpeWmRWwjNDpvdMnvJJ_6tZXs,17378
+dissect/target/plugins/os/windows/prefetch.py,sha256=v4OgSKMwcihz0SOuA0o0Ec8wsAKuiuEmJolqZmHFgJA,10491
+dissect/target/plugins/os/windows/recyclebin.py,sha256=zx58hDCvcrD_eJl9nJmr_i80krSN03ya8nQzWFr2Tw0,4917
 dissect/target/plugins/os/windows/registry.py,sha256=EfqUkgbzaqTuq1kIPYNG1TfvJxhJE5X-TEjV3K_xsPU,12814
-dissect/target/plugins/os/windows/sam.py,sha256=NTL6dez30i_E3R0mNmnYXMYc62DHqICWvpXy9g_2RY0,15478
+dissect/target/plugins/os/windows/sam.py,sha256=NwKzfP_ae8SXgCoj_apa-29ZeFxeQsGidJ6llF1khP8,15468
 dissect/target/plugins/os/windows/services.py,sha256=MoVPJ1GKpPaJrGd2DYtuHEmKqC2uOKRc5SZKB12goSs,6068
 dissect/target/plugins/os/windows/sru.py,sha256=sOM7CyMkW8XIXzI75GL69WoqUrSK2X99TFIfdQR2D64,17767
 dissect/target/plugins/os/windows/startupinfo.py,sha256=kl8Y7M4nVfmJ71I33VCegtbHj-ZOeEsYAdlNbgwtUOA,3406
@@ -281,10 +281,10 @@ dissect/target/plugins/os/windows/thumbcache.py,sha256=23YjOjTNoE7BYITmg8s9Zs8Wi
 dissect/target/plugins/os/windows/ual.py,sha256=TYF-R46klEa_HHb86UJd6mPrXwHlAMOUTzC0pZ8uiq0,9787
 dissect/target/plugins/os/windows/wer.py,sha256=ogecvKYxAvDXLptQj4cn0JLn1FxaXjeSuJWs4JgkoZs,8656
 dissect/target/plugins/os/windows/dpapi/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-dissect/target/plugins/os/windows/dpapi/blob.py,sha256=oFhksgx2BAaeAbpPwOM-o0Dw5MKaMLGMF6ETdxIS708,5051
+dissect/target/plugins/os/windows/dpapi/blob.py,sha256=j3MMROXroes7pr_VLt8Xv6WEpv19hlgDpOxOJyZMRvo,5044
 dissect/target/plugins/os/windows/dpapi/crypto.py,sha256=_F1F2j1chQw-KLqfWvgL2mCkF3HSvdVnM78OZ0ph9hc,9337
 dissect/target/plugins/os/windows/dpapi/dpapi.py,sha256=NrLtx61m8PXsB3CzxUQgc1BKkaAVBOre1oEfGvqgtuw,7130
-dissect/target/plugins/os/windows/dpapi/master_key.py,sha256=nq6IpNLxE2UwuCTfc5BdKkn17g6AlVL4rpPUfwWf_8I,6127
+dissect/target/plugins/os/windows/dpapi/master_key.py,sha256=oUuUfvMXmhRrgIs1CXTR6CdETKNYZwoStXSqtDdil78,6111
 dissect/target/plugins/os/windows/exchange/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/windows/exchange/exchange.py,sha256=ofoapuDQXefIX4sTzwNboyk5RztN2JEyw1OWl5cx-wo,1564
 dissect/target/plugins/os/windows/log/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -297,24 +297,24 @@ dissect/target/plugins/os/windows/log/schedlgu.py,sha256=JaP8H8eTEypWXhx2aFSR_IM
 dissect/target/plugins/os/windows/regf/7zip.py,sha256=Vc336zhS6R8W98GGlLtPJ_OR0vEP014QnBtYwbx_HUo,3217
 dissect/target/plugins/os/windows/regf/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/windows/regf/appxdebugkeys.py,sha256=X8MYLcD76pIZoIWwS_DgUp6q6pi2WO7jhZeoc4uGLak,3966
-dissect/target/plugins/os/windows/regf/auditpol.py,sha256=62WMlZwSzBb-99ujaeGkkOBui5qHOkvMHfACsqCmC0A,5140
-dissect/target/plugins/os/windows/regf/bam.py,sha256=iELyDeA-tdT6eXMZ5HHIVSAjH6vDvmS47D2xr4iX7Y8,2084
-dissect/target/plugins/os/windows/regf/cit.py,sha256=vErcoGfslyuZsaZiGbSGm6KxnJmUjobMwoy03jb6774,38244
+dissect/target/plugins/os/windows/regf/auditpol.py,sha256=qAVYurAECRbTzopOgempCK2dOpeJ-a-pGNhHYJEtbP4,5149
+dissect/target/plugins/os/windows/regf/bam.py,sha256=zS2vheHp4HEfrAhcIR06GoTq8Ofwhe3zd8uMPj7Y61Q,2076
+dissect/target/plugins/os/windows/regf/cit.py,sha256=d8euaR9gyCZIQG8PwHEQR4_wB8l0ZUUUYYCQbHHfLzA,38238
 dissect/target/plugins/os/windows/regf/clsid.py,sha256=M121yHQgRDSGtXeShiB-RUuk_toHOFHLYwbHAP9SS8U,3632
 dissect/target/plugins/os/windows/regf/firewall.py,sha256=-RUFjY4D-ua72vyvOTJyg-MpUbk9Syfo4TfgA7bV7Us,3172
 dissect/target/plugins/os/windows/regf/mru.py,sha256=HYg4UnbsjvzZKS9qcqxkocUeIGQieMLXPjkjgZ1qbTY,13560
 dissect/target/plugins/os/windows/regf/muicache.py,sha256=-1IYfNpFjjk4WYyFUBJGLl7ahEGeUKqlaI1QwPNnfjA,3738
 dissect/target/plugins/os/windows/regf/nethist.py,sha256=QHbG9fmZNmjSVhrgqMvMo12YBaQedzeToS7ZD9eIJ28,3111
-dissect/target/plugins/os/windows/regf/recentfilecache.py,sha256=5JheHDmYc7udH-ZF7PwVTm0HfRY43diW0pmyyfHWZK0,1869
+dissect/target/plugins/os/windows/regf/recentfilecache.py,sha256=goS6ajLIh6ZU-Gq4tupoxBoQCfMDp2qJgg-Nn5qFIsY,1850
 dissect/target/plugins/os/windows/regf/regf.py,sha256=D1GrljF-sV8cWIjWJ3zH7k52i1OWD8poEC_PIeZMEis,3419
 dissect/target/plugins/os/windows/regf/runkeys.py,sha256=-2HcdnVytzCt1xwgAI8rHDnwk8kwLPWURumvhrGnIHU,4278
-dissect/target/plugins/os/windows/regf/shellbags.py,sha256=EKBWBjxvSfxc7WFKmICZs8QUJnjhsCKesjl_NHEnSUo,25621
-dissect/target/plugins/os/windows/regf/shimcache.py,sha256=0THEJQtMHACAI70jrThMCrxAVgQv5XxqkRD1MY03VpE,10003
+dissect/target/plugins/os/windows/regf/shellbags.py,sha256=t6874fvnZoQ05H0-G95-a8RpmCWjz0dli6hHGu5jBEQ,25615
+dissect/target/plugins/os/windows/regf/shimcache.py,sha256=no78i0nxbnfgDJ5TpDZNAJggCigD_zLrXNYss7gdg2Q,9994
 dissect/target/plugins/os/windows/regf/trusteddocs.py,sha256=3yvpBDM-Asg0rvGN2TwALGRm9DYogG6TxRau9D6FBbw,3700
 dissect/target/plugins/os/windows/regf/usb.py,sha256=hR5fnqy_sint1YyWgm1-AMhGQ4MxJOH_Wz0vbYzr9p4,7213
-dissect/target/plugins/os/windows/regf/userassist.py,sha256=36uI_tSGUx-lOUZ1Io_2ofHTLHzriFA3F6XMR61H0wc,5500
+dissect/target/plugins/os/windows/regf/userassist.py,sha256=bSioEQdqUxdGwkdgMUfDIY2_pzrl9PdxPjmzmMaIwHs,5490
 dissect/target/plugins/os/windows/task_helpers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-dissect/target/plugins/os/windows/task_helpers/tasks_job.py,sha256=-dCkJnyEiWG9nCK378-GswM5EXelrA_g3zDHLhSQMu0,21199
+dissect/target/plugins/os/windows/task_helpers/tasks_job.py,sha256=7w3UGOiTAUQkP3xQ3sj4X3MTgHUJmmfdgiEadWmYquI,21197
 dissect/target/plugins/os/windows/task_helpers/tasks_records.py,sha256=vpCyKqLQSzI5ymD1h5P6RncLEE47YtmjDFwKA16dVZ4,4046
 dissect/target/plugins/os/windows/task_helpers/tasks_xml.py,sha256=oOsYse2-BrliVQRXlHD1-89hsmNrJqg42DJy681AW0U,15268
 dissect/target/tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -340,10 +340,10 @@ dissect/target/volumes/luks.py,sha256=OmCMsw6rCUXG1_plnLVLTpsvE1n_6WtoRUGQbpmu1z
 dissect/target/volumes/lvm.py,sha256=wwQVR9I3G9YzmY6UxFsH2Y4MXGBcKL9aayWGCDTiWMU,2269
 dissect/target/volumes/md.py,sha256=j1K1iKmspl0C_OJFc7-Q1BMWN2OCC5EVANIgVlJ_fIE,1673
 dissect/target/volumes/vmfs.py,sha256=-LoUbn9WNwTtLi_4K34uV_-wDw2W5hgaqxZNj4UmqAQ,1730
-dissect.target-3.18.dev5.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
-dissect.target-3.18.dev5.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
-dissect.target-3.18.dev5.dist-info/METADATA,sha256=wBA3ehlJ0xuwPlvLfhY13YfMg2Fm8w8XIzeWGK5-Ksk,11299
-dissect.target-3.18.dev5.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-dissect.target-3.18.dev5.dist-info/entry_points.txt,sha256=tvFPa-Ap-gakjaPwRc6Fl6mxHzxEZ_arAVU-IUYeo_s,447
-dissect.target-3.18.dev5.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
-dissect.target-3.18.dev5.dist-info/RECORD,,
+dissect.target-3.18.dev7.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
+dissect.target-3.18.dev7.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
+dissect.target-3.18.dev7.dist-info/METADATA,sha256=QdjX1XeAbDN3B7UZr8WzmJzjVQzvv8GSxqOH-5LgBgg,12722
+dissect.target-3.18.dev7.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+dissect.target-3.18.dev7.dist-info/entry_points.txt,sha256=tvFPa-Ap-gakjaPwRc6Fl6mxHzxEZ_arAVU-IUYeo_s,447
+dissect.target-3.18.dev7.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
+dissect.target-3.18.dev7.dist-info/RECORD,,