Volatility3 and YaraScan plugin: seemingly unrealistic results I am using Volatility3 and specifically the YaraScan command to test a memory dump.