diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py
index 4272b64d2..0f44ba533 100644
--- a/test/plugins/windows/windows.py
+++ b/test/plugins/windows/windows.py
@@ -58,6 +58,14 @@ class TestWindowsPslist:
         }
         assert test_volatility.match_output_row(expected_row, json.loads(out))
 
+class TestWindowsTimeliner:
+    def test_windows_specific_timeliner(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "timeliner.Timeliner", image, volatility, python
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 10
 
 class TestWindowsPsscan:
     def test_windows_specific_psscan(self, volatility, python):
diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py
index d5a1a0b07..082b82284 100644
--- a/volatility3/framework/plugins/windows/thrdscan.py
+++ b/volatility3/framework/plugins/windows/thrdscan.py
@@ -190,6 +190,9 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
                 row_dict["PID"],
                 row_dict["TID"],
                 row_dict["StartAddress"],
+                row_dict["StartPath"],
+                row_dict["Win32StartAddress"],
+                row_dict["Win32StartPath"],
                 row_dict["CreateTime"],
                 row_dict["ExitTime"],
             ) = row_data