diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index 6a404ae0f..8c479bff0 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -206,7 +206,7 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): sections = sections, progress_callback = progress_callback) # Flatten the generator - hits = list(hits) + hits = sorted(list(hits), key = lambda x: tests.index(x[0])) if hits: # TODO: Decide which to use if there are multiple options test, page_map_offset = hits[0]