diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index 78676bc0d..be54300ff 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -38,8 +38,8 @@ class PebMasquerade(interfaces.plugins.PluginInterface): ), ] - @staticmethod - def _get_cmdline_image(cmdline: str) -> Union[str, PureWindowsPath]: + @classmethod + def _get_cmdline_image(cls, cmdline: str) -> Union[str, PureWindowsPath]: """Extract the executable path from a command line string. Args: @@ -71,8 +71,10 @@ class PebMasquerade(interfaces.plugins.PluginInterface): return "" - @staticmethod - def _are_paths_equal(device_path: str, drive_path: str) -> Tuple[bool, str, str]: + @classmethod + def _are_paths_equal( + cls, device_path: str, drive_path: str + ) -> Tuple[bool, str, str]: """Compare two paths to see if they are equal, ignoring drive/device root and case. Args: