diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py new file mode 100644 index 000000000..65ef041db --- /dev/null +++ b/volatility3/framework/plugins/windows/amcache.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import amcache + +vollog = logging.getLogger(__name__) + + +class Amcache(amcache.Amcache): + """Extract information on executed applications from the AmCache (deprecated).""" + + _required_framework_version = (2, 0, 0) + _version = (2, 0, 0) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.amcache.Amcache" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py new file mode 100644 index 000000000..73ab7c87b --- /dev/null +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import cachedump + +vollog = logging.getLogger(__name__) + + +class Cachedump(cachedump.Cachedump): + """Dumps lsa secrets from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 2) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.cachedump.Cachedump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py new file mode 100644 index 000000000..c875dda50 --- /dev/null +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import hashdump + +vollog = logging.getLogger(__name__) + + +class Hashdump(hashdump.Hashdump): + """Dumps user hashes from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 1, 1) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.hashdump.Hashdump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py new file mode 100644 index 000000000..65e58cc25 --- /dev/null +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import lsadump + +vollog = logging.getLogger(__name__) + + +class Lsadump(lsadump.Lsadump): + """Dumps lsa secrets from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.lsadump.Lsadump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py new file mode 100644 index 000000000..4b32f6be7 --- /dev/null +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -0,0 +1,24 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import scheduled_tasks + +vollog = logging.getLogger(__name__) + + +class ScheduledTasks(scheduled_tasks.ScheduledTasks): + """Decodes scheduled task information from the Windows registry, including \ +information about triggers, actions, run times, and creation times (deprecated).""" + + _required_framework_version = (2, 11, 0) + _version = (2, 0, 0) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.scheduled_tasks.ScheduledTasks" + ) + ) + return super().__getattr__(*args, **kwargs)