From f3e123b4d5510787bad6bfe550994e9de479afd7 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 13 May 2025 17:52:12 -0500
Subject: [PATCH] Windows Thrdscan: Fix broken tuple unpacking

Timeliner fails due to an incorrect unpacking of this tuple, which needs
3 additional target variables for start path, win32 start path, and
win32 start address.
---
 volatility3/framework/plugins/windows/thrdscan.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py
index d5a1a0b07..082b82284 100644
--- a/volatility3/framework/plugins/windows/thrdscan.py
+++ b/volatility3/framework/plugins/windows/thrdscan.py
@@ -190,6 +190,9 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
                 row_dict["PID"],
                 row_dict["TID"],
                 row_dict["StartAddress"],
+                row_dict["StartPath"],
+                row_dict["Win32StartAddress"],
+                row_dict["Win32StartPath"],
                 row_dict["CreateTime"],
                 row_dict["ExitTime"],
             ) = row_data