From 21d66839fe942aeb327572f7056850ea813d396d Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Sat, 7 Jun 2025 21:56:36 +0300
Subject: [PATCH] use class name with module name?

---
 .../framework/plugins/windows/unhooked_system_calls.py        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py
index a0864e38d..fa88f5523 100644
--- a/volatility3/framework/plugins/windows/unhooked_system_calls.py
+++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py
@@ -3,7 +3,7 @@
 #
 import logging
 from volatility3.framework import interfaces, deprecation
-from volatility3.plugins.windows.malware import unhooked_system_calls
+from volatility3.plugins.windows import malware
 
 vollog = logging.getLogger(__name__)
 
@@ -11,7 +11,7 @@ vollog = logging.getLogger(__name__)
 class unhooked_system_calls(
     interfaces.plugins.PluginInterface,
     deprecation.PluginRenameClass,
-    replacement_class=unhooked_system_calls.UnhookedSystemCalls,
+    replacement_class=malware.unhooked_system_calls.UnhookedSystemCalls,
     removal_date="2026-06-07",
 ):
     """Detects hooked ntdll.dll stub functions in Windows processes (deprecated)."""