diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py
index d19478484..36596721d 100644
--- a/test/plugins/windows/windows.py
+++ b/test/plugins/windows/windows.py
@@ -75,40 +75,66 @@ class TestWindowsPsscan:
 class TestWindowsDlllist:
     def test_windows_generic_dlllist(self, volatility, python, image):
         rc, out, _err = test_volatility.runvol_plugin(
-            "windows.dlllist.DllList", image, volatility, python
+            "windows.dlllist.DllList",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
         )
         assert rc == 0
-        out = out.lower()
-        assert out.count(b"\n") > 10
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 2000
+        expected_rows = [
+            {
+                "Path": "C:\\Windows\\SYSTEM32\\kernel32.dll",
+                "Process": "csrss.exe",
+            },
+            {
+                "Path": "C:\\Windows\\system32\\USER32.dll",
+                "Process": "csrss.exe",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(
+                expected_row, json_out, case_sensitive=False
+            )
 
 
 class TestWindowsModules:
-    def test_windows_generic_modules(self, volatility, python, image):
+    def test_windows_generic_modules(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
         rc, out, _err = test_volatility.runvol_plugin(
-            "windows.modules.Modules", image, volatility, python
+            "windows.modules.Modules",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
         )
         assert rc == 0
-        out = out.lower()
-        assert out.count(b"\n") > 10
-
-
-class TestWindowsHivelist:
-    def test_windows_generic_hivelist(self, volatility, python, image):
-        rc, out, _err = test_volatility.runvol_plugin(
-            "windows.registry.hivelist.HiveList", image, volatility, python
-        )
-        assert rc == 0
-        out = out.lower()
-
-        not_xp = out.find(b"\\systemroot\\system32\\config\\software")
-        if not_xp == -1:
-            assert (
-                out.find(
-                    b"\\device\\harddiskvolume1\\windows\\system32\\config\\software"
-                )
-                != -1
-            )
-        assert out.count(b"\n") > 10
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 110
+        expected_rows = [
+            {
+                "Name": "ntoskrnl.exe",
+                "Offset": 2185216944,
+                "Path": "\\WINDOWS\\system32\\ntoskrnl.exe",
+                "Size": 2179328,
+            },
+            {
+                "Name": "hal.dll",
+                "Offset": 2185216840,
+                "Path": "\\WINDOWS\\system32\\hal.dll",
+                "Size": 81280,
+            },
+            {
+                "Name": "netbios.sys",
+                "Offset": 2182050616,
+                "Path": "\\SystemRoot\\System32\\DRIVERS\\netbios.sys",
+                "Size": 36864,
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
 
 
 class TestWindowsDumpfiles:
@@ -173,14 +199,47 @@ class TestWindowsHandles:
         assert out.count(b"\n") > 500
 
 
-class TestWindowsSvcscan:
-    def test_windows_generic_svcscan(self, volatility, python, image):
+class TestWindowsSvcList:
+    def test_windows_generic_svclist(self, volatility, python, image):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
         rc, out, _err = test_volatility.runvol_plugin(
-            "windows.svcscan.SvcScan", image, volatility, python
+            "windows.svclist.SvcList",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
         )
         assert rc == 0
-        assert out.find(b"Microsoft ACPI Driver") != -1
-        assert out.count(b"\n") > 250
+        json_out = json.loads(out)
+        assert len(json_out) > 250
+        expected_row = {
+            "Binary": "\\Driver\\ACPI",
+            "Display": "ACPI",
+            "Name": "ACPI",
+            "Start": "SERVICE_BOOT_START",
+            "State": "SERVICE_RUNNING",
+            "Type": "SERVICE_KERNEL_DRIVER",
+        }
+        assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsSvcScan:
+    def test_windows_generic_svcscan(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.svcscan.SvcScan",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert len(json_out) > 250
+        expected_rows = [
+            {"Name": "ACPI", "Type": "SERVICE_KERNEL_DRIVER"},
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
 
 
 class TestWindowsThrdscan:
@@ -210,20 +269,47 @@ class TestWindowsPrivileges:
         assert out.count(b"\n") > 20
 
 
-class TestWindowsGetsids:
+class TestWindowsGetSIDs:
     def test_windows_generic_getsids(self, volatility, python, image):
         rc, out, _err = test_volatility.runvol_plugin(
             "windows.getsids.GetSIDs",
             image,
             volatility,
             python,
-            pluginargs=("--pid", "4"),
+            globalargs=("-r", "json"),
         )
         assert rc == 0
-        assert out.find(b"Local System") != -1
-        assert out.find(b"Administrators") != -1
-        assert out.find(b"Everyone") != -1
-        assert out.find(b"Authenticated Users") != -1
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 400
+        expected_rows = [
+            {
+                "Name": "Local System",
+                "Process": "csrss.exe",
+                "SID": "S-1-5-18",
+            },
+            {
+                "Name": "Administrators",
+                "Process": "csrss.exe",
+                "SID": "S-1-5-32-544",
+            },
+            {
+                "Name": "Everyone",
+                "Process": "csrss.exe",
+                "SID": "S-1-1-0",
+            },
+            {
+                "Name": "Authenticated Users",
+                "Process": "csrss.exe",
+                "SID": "S-1-5-11",
+            },
+            {
+                "Name": "System Mandatory Level",
+                "Process": "csrss.exe",
+                "SID": "S-1-16-16384",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
 
 
 class TestWindowsEnvars:
@@ -253,16 +339,23 @@ class TestWindowsCallbacks:
 
 
 class TestWindowsVadwalk:
-    def test_windows_generic_vadwalk(self, volatility, python, image):
+    def test_windows_specific_vadwalk(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
         rc, out, _err = test_volatility.runvol_plugin(
-            "windows.vadwalk.VadWalk", image, volatility, python
+            "windows.vadwalk.VadWalk",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+            pluginargs=("--pid", "4"),
         )
         assert rc == 0
-        assert out.find(b"Vad") != -1
-        assert out.find(b"VadS") != -1
-        assert out.find(b"Vadl") != -1
-        assert out.find(b"VadF") != -1
-        assert out.find(b"0x0") != -1
+        json_out = json.loads(out)
+        expected_rows = test_volatility.load_test_data(
+            "windows.vadwalk.VadWalk", "WINDOWS10_GENERIC"
+        )
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
 
 
 class TestWindowsDevicetree:
@@ -324,3 +417,989 @@ class TestWindowsVadyarascan:
         )
         assert rc == 0
         assert out.count(b"\n") > 10
+
+
+class TestWindowsAmcache:
+    def test_windows_generic_amcache(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.amcache.Amcache",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 100
+        # Win10+ expected package names
+        expected_rows = [
+            {
+                "Path": "C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy",
+                "ProductName": "Microsoft.Windows.StartMenuExperienceHost",
+            },
+            {
+                "Path": "C:\\Windows\\SystemApps\\Microsoft.Windows.FileExplorer_cw5n1h2txyewy",
+                "ProductName": "c5e2524a-ea46-4f67-841f-6a9465d9d515",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsBigPools:
+    def test_windows_generic_bigpools(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.bigpools.BigPools",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 2000
+        expected_rows = [
+            {
+                "PoolType": "PagedPool",
+            },
+            {
+                "PoolType": "PagedPoolCacheAligned",
+            },
+            {
+                "PoolType": "NonPagedPoolNx",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+# FIXME: Empty on WIN10 and XP samples
+# class TestWindowsCachedump:
+#     def test_windows_generic_cachedump(self, volatility, python, image):
+#         rc, out, _err = test_volatility.runvol_plugin(
+#             "windows.cachedump.Cachedump",
+#             image,
+#             volatility,
+#             python,
+#             globalargs=("-r", "json"),
+#         )
+#         assert rc == 0
+#         json_out = json.loads(out)
+
+
+class TestWindowsCmdLine:
+    def test_windows_generic_cmdline(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.cmdline.CmdLine",
+            image,
+            volatility,
+            python,
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 20
+        out = out.lower()
+        assert (
+            out.find(b"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p".lower())
+            != -1
+        )
+        assert (
+            out.count(
+                b"C:\\Windows\\system32\\svchost.exe -k LocalServiceNetworkRestricted -p".lower()
+            )
+            > 3
+        )
+
+
+class TestWindowsCmdScan:
+    def test_windows_specific_cmdscan(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.cmdscan.CmdScan",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        expected_row = {
+            "Process": "conhost.exe",
+            "Property": "_COMMAND_HISTORY",
+        }
+        assert test_volatility.match_output_row(expected_row, json.loads(out))
+
+
+class TestWindowsConsoles:
+    def test_windows_specific_consoles(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.consoles.Consoles",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        expected_row = {
+            "Process": "conhost.exe",
+            "Property": "_CONSOLE_INFORMATION",
+        }
+        assert test_volatility.match_output_row(expected_row, json.loads(out))
+
+
+class TestWindowsCrashinfo:
+    def test_windows_specific_crashinfo(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.crashinfo.Crashinfo",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        expected_row = {
+            "BitmapHeaderSize": 176128,
+            "BitmapPages": 511191,
+            "BitmapSize": 1310720,
+            "Comment": "PAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGE",
+            "DirectoryTableBase": 4610162688,
+            "DumpType": "Bitmap Dump (0x5)",
+            "MachineImageType": 34404,
+            "MajorVersion": 15,
+            "MinorVersion": 19041,
+            "NumberProcessors": 1,
+            "Signature": "PAGE",
+            "SystemTime": "2025-03-06T17:59:20+00:00",
+            "SystemUpTime": "0:11:23.199374",
+            "__children": [],
+        }
+        assert test_volatility.match_output_row(expected_row, json.loads(out))
+
+
+class TestWindowsDriverIrp:
+    def test_windows_generic_driverirp(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.driverirp.DriverIrp",
+            image,
+            volatility,
+            python,
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 2000
+        assert out.count(b"ntoskrnl") > 400
+        for irp in test_volatility.load_test_data(
+            "windows.driverirp.DriverIrp", "GENERIC"
+        ):
+            assert out.find(irp.encode()) != -1
+
+
+class TestWindowsDriverScan:
+    def test_windows_generic_driverscan(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.driverscan.DriverScan",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 50
+        expected_rows = [
+            {
+                "Name": "\\Driver\\ACPI_HAL",
+                "Service Key": "\\Driver\\ACPI_HAL",
+            },
+            {
+                "Name": "\\Driver\\Tcpip",
+                "Service Key": "Tcpip",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsGetServiceSIDs:
+    def test_windows_generic_getservicesids(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.getservicesids.GetServiceSIDs",
+            image,
+            volatility,
+            python,
+        )
+        assert rc == 0
+        assert out.count(b"S-1-5-80-") > 90
+
+
+class TestWindowsIAT:
+    def test_windows_generic_iat(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.iat.IAT",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 2000
+        expected_rows = [
+            {
+                "Function": "NtTerminateProcess",
+                "Library": "ntdll.dll",
+                "Name": "csrss.exe",
+            },
+            {
+                "Function": "RtlSetHeapInformation",
+                "Library": "ntdll.dll",
+                "Name": "csrss.exe",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsInfo:
+    def test_windows_specific_info(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.info.Info",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        expected_rows = test_volatility.load_test_data(
+            "windows.info.Info", "WINDOWS10_GENERIC"
+        )
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsJobLinks:
+    def test_windows_specific_joblinks(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.joblinks.JobLinks",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 30
+        expected_row = {
+            "Active": 1,
+            "JobLink": None,
+            "JobSess": 2,
+            "Name": "taskhostw.exe",
+            "Offset(V)": 145201782567040,
+            "PID": 4304,
+            "PPID": 1008,
+            "Process": "(Original Process)",
+            "Sess": 2,
+            "Term": 0,
+            "Total": 1,
+            "Wow64": False,
+            "__children": [
+                {
+                    "Active": 0,
+                    "JobLink": "Yes",
+                    "JobSess": 0,
+                    "Name": "taskhostw.exe",
+                    "Offset(V)": 145201782567040,
+                    "PID": 4304,
+                    "PPID": 1008,
+                    "Process": "C:\\Windows\\system32\\taskhostw.exe",
+                    "Sess": 2,
+                    "Term": 0,
+                    "Total": 0,
+                    "Wow64": False,
+                    "__children": [],
+                }
+            ],
+        }
+
+        assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsKPCRs:
+    def test_windows_generic_kpcrs(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.kpcrs.KPCRs",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        assert test_volatility.count_entries_flat(json.loads(out)) > 0
+
+
+class TestWindowsLdrModules:
+    def test_windows_generic_ldrmodules(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.ldrmodules.LdrModules",
+            image,
+            volatility,
+            python,
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 800
+        out = out.lower()
+        assert out.find(b"\\Windows\\System32\\ntdll.dll".lower()) > 10
+
+
+class TestWindowsLsadump:
+    def test_windows_specific_lsadump(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.lsadump.Lsadump",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 5
+        expected_row = {
+            "Hex": "01 00 00 00 2b 2b f1 09 a3 b3 4b af 02 19 5a 61 2f 09 3a 88 03 52 51 64 8a 6c d2 a8 34 07 cb 61 41 ca a4 5d f1 fb 4c e0 41 72 69 32",
+            "Key": "DPAPI_SYSTEM",
+        }
+
+        assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsMBRScan:
+    def test_windows_specific_mbrscan(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.mbrscan.MBRScan",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 4300
+        expected_rows = [
+            {
+                "Bootcode MD5": "dbcef88b4d770658b0050bf20b2d3061",
+                "Disk Signature": "82-78-77-32",
+                "Full MBR MD5": "8eea93bb1c63863f6e7f95b084411672",
+                "Potential MBR at Physical Offset": 154029739,
+            },
+            {
+                "Bootcode MD5": "591213a9dfef595735e419eff6eeb39d",
+                "Disk Signature": "7a-74-60-53",
+                "Full MBR MD5": "4e00711a5014941f5ad8b3a4cde69c9c",
+                "Potential MBR at Physical Offset": 437808348,
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsMemmap:
+    def test_windows_specific_memmap(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.memmap.Memmap",
+            image,
+            volatility,
+            python,
+            pluginargs=("--pid", "504"),
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 12000
+
+
+class TestWindowsMFTscan:
+    def test_windows_specific_mftscan_ads_xp(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.mftscan.ADS",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        expected_rows = [
+            {
+                "ADS Filename": "Zone.Identifier",
+                "Filename": "libby_hoeler_part1.wmv",
+                "Hexdump": '"\n5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a [ZoneTransfer]..\n5a 6f 6e 65 49 64 3d 33 0d 0a                   ZoneId=3..      "',
+                "MFT Type": "DATA",
+                "Offset": 55926304,
+                "Record Number": 323,
+                "Record Type": "FILE",
+            },
+            {
+                "ADS Filename": "Zone.Identifier",
+                "Filename": "NetZeroQuickHelpLite.exe",
+                "Hexdump": '"\n5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a [ZoneTransfer]..\n5a 6f 6e 65 49 64 3d 33 0d 0a                   ZoneId=3..      "',
+                "MFT Type": "DATA",
+                "Offset": 56102400,
+                "Record Number": 347,
+                "Record Type": "FILE",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+    def test_windows_specific_mftscan_ads_win10(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.mftscan.ADS",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        expected_rows = [
+            {
+                "ADS Filename": "$Max",
+                "Filename": "$UsnJrnl",
+                "Hexdump": '"\n00 00 00 02 00 00 00 00 00 00 80 00 00 00 00 00 ................\nb9 dd f0 cc df 73 db 01 00 00 00 00 00 00 00 00 .....s.........."',
+                "MFT Type": "DATA",
+                "Offset": 1058018088,
+                "Record Number": 107240,
+                "Record Type": "FILE",
+            },
+            {
+                "ADS Filename": "$Config",
+                "Filename": "$Repair",
+                "Hexdump": '"\n01 00 00 00 03 00 00 00                         ........        "',
+                "MFT Type": "DATA",
+                "Offset": 5009678688,
+                "Record Number": 28,
+                "Record Type": "FILE",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+    def test_windows_specific_mftscan_mftscan(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.mftscan.MFTScan",
+            image,
+            volatility,
+            python,
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 15000
+        assert out.count(b"STANDARD_INFORMATION") > 5000
+        assert out.count(b"FILE_NAME") > 11000
+
+    def test_windows_specific_mftscan_residentdata_win10(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.mftscan.ResidentData",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 850
+        expected_rows = [
+            {
+                "Filename": "index",
+                "Hexdump": '"\n30 5c 72 a7 1b 6d fb fc 09 00 00 00 00 00 00 00 0\\r..m..........\n00 00 00 00 00 00 00 00                         ........        "',
+                "MFT Type": "DATA",
+                "Offset": 4961536280,
+                "Record Number": 116474,
+                "Record Type": "FILE",
+            },
+            {
+                "Filename": "0.2.filtertrie.intermediate.txt",
+                "Hexdump": '"\n30 09 32 0d 0a                                  0.2..           "',
+                "MFT Type": "DATA",
+                "Offset": 619242944,
+                "Record Number": 113013,
+                "Record Type": "FILE",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsModScan:
+    def test_windows_generic_modscan(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.modscan.ModScan",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 90
+        expected_rows = [
+            {
+                "Name": "ntoskrnl.exe",
+                "Offset": 37733296,
+                "Path": "\\WINDOWS\\system32\\ntoskrnl.exe",
+                "Size": 2179328,
+            },
+            {
+                "Name": "hal.dll",
+                "Offset": 37733192,
+                "Path": "\\WINDOWS\\system32\\hal.dll",
+                "Size": 81280,
+            },
+            {
+                "Name": "netbios.sys",
+                "Offset": 34566968,
+                "Path": "\\SystemRoot\\System32\\DRIVERS\\netbios.sys",
+                "Size": 36864,
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsMutantScan:
+    def test_windows_specific_mutantscan(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.mutantscan.MutantScan",
+            image,
+            volatility,
+            python,
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 350
+
+
+class TestWindowsNetScan:
+    def test_windows_specific_netscan(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.netscan.NetScan",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 100
+        expected_rows = [
+            {
+                "Created": "2025-03-06T17:56:53+00:00",
+                "ForeignAddr": "13.107.246.254",
+                "ForeignPort": 443,
+                "LocalAddr": "10.0.0.4",
+                "LocalPort": 49929,
+                "Offset": 145201667934000,
+                "Owner": "SearchApp.exe",
+                "PID": 5644,
+                "Proto": "TCPv4",
+                "State": "CLOSE_WAIT",
+            },
+            {
+                "Created": "2025-03-06T17:50:02+00:00",
+                "ForeignAddr": "168.63.129.16",
+                "ForeignPort": 80,
+                "LocalAddr": "10.0.0.4",
+                "LocalPort": 49689,
+                "Offset": 145201778694688,
+                "Owner": "WindowsAzureGu",
+                "PID": 1944,
+                "Proto": "TCPv4",
+                "State": "CLOSED",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsNetStat:
+    def test_windows_specific_netstat(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.netstat.NetStat",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 70
+        expected_rows = [
+            {
+                "Created": "2025-03-06T17:56:53+00:00",
+                "ForeignAddr": "13.107.246.254",
+                "ForeignPort": 443,
+                "LocalAddr": "10.0.0.4",
+                "LocalPort": 49929,
+                "Offset": 145201667934000,
+                "Owner": "SearchApp.exe",
+                "PID": 5644,
+                "Proto": "TCPv4",
+                "State": "CLOSE_WAIT",
+            },
+            {
+                "Created": "2025-03-06T17:50:02+00:00",
+                "ForeignAddr": "168.63.129.16",
+                "ForeignPort": 80,
+                "LocalAddr": "10.0.0.4",
+                "LocalPort": 49688,
+                "Offset": 145201778506032,
+                "Owner": "WindowsAzureGu",
+                "PID": 1944,
+                "Proto": "TCPv4",
+                "State": "ESTABLISHED",
+            },
+        ]
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsPESymbols:
+    def test_windows_specific_pe_symbols_processes(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.pe_symbols.PESymbols",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+            pluginargs=(
+                "--source",
+                "processes",
+                "--module",
+                "ntdll.dll",
+                "--symbol",
+                "NtProtectVirtualMemory",
+            ),
+        )
+        assert rc == 0
+        expected_row = {
+            "Address": 2089868982,
+            "Module": "ntdll.dll",
+            "Symbol": "NtProtectVirtualMemory",
+        }
+
+        assert test_volatility.match_output_row(expected_row, json.loads(out))
+
+    def test_windows_specific_pe_symbols_kernel(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.pe_symbols.PESymbols",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+            pluginargs=(
+                "--source",
+                "kernel",
+                "--module",
+                "ntoskrnl.exe",
+                "--symbol",
+                "ZwOpenThread",
+            ),
+        )
+        assert rc == 0
+        expected_row = {
+            "Address": 2152583356,
+            "Module": "ntoskrnl.exe",
+            "Symbol": "ZwOpenThread",
+        }
+
+        assert test_volatility.match_output_row(expected_row, json.loads(out))
+
+
+class TestWindowsPoolScanner:
+    def test_windows_specific_poolscanner(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.poolscanner.PoolScanner",
+            image,
+            volatility,
+            python,
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 4800
+        assert out.find(b"_FILE_OBJECT") != -1
+        assert out.find(b"_ETHREAD") != -1
+        assert out.find(b"_RTL_ATOM_TABLE") != -1
+        assert out.find(b"_KMUTANT") != -1
+
+
+class TestWindowsPsTree:
+    def test_windows_specific_pstree(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.pstree.PsTree",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 110
+        expected_row = test_volatility.load_test_data(
+            "windows.pstree.PsTree", "WINDOWS10_GENERIC"
+        )
+
+        assert test_volatility.match_output_row(
+            expected_row, json_out, children_recursive=True
+        )
+
+
+class TestWindowsRegistry:
+    def test_windows_specific_registry_certificates(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.registry.certificates.Certificates",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 30
+        expected_row = {
+            "Certificate ID": "ProtectedRoots",
+            "Certificate path": "Software\\Microsoft\\SystemCertificates",
+            "Certificate section": "Root",
+        }
+        assert test_volatility.match_output_row(expected_row, json_out)
+
+    def test_windows_generic_registry_hivelist(self, volatility, python, image):
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.registry.hivelist.HiveList", image, volatility, python
+        )
+        assert rc == 0
+        out = out.lower()
+
+        not_xp = out.find(b"\\systemroot\\system32\\config\\software")
+        if not_xp == -1:
+            assert (
+                out.find(
+                    b"\\device\\harddiskvolume1\\windows\\system32\\config\\software"
+                )
+                != -1
+            )
+        assert out.count(b"\n") > 10
+
+    def test_windows_specific_registry_hivescan(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.registry.hivescan.HiveScan",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        expected_rows = test_volatility.load_test_data(
+            "windows.registry.hivescan.HiveScan", "WINDOWS10_GENERIC"
+        )
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+    def test_windows_specific_registry_printkey(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.registry.printkey.PrintKey",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 450
+        expected_rows = test_volatility.load_test_data(
+            "windows.registry.printkey.PrintKey", "WINDOWS10_GENERIC"
+        )
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+    def test_windows_specific_registry_userassist(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.registry.userassist.UserAssist",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 35
+        expected_row = test_volatility.load_test_data(
+            "windows.registry.userassist.UserAssist", "WINDOWS10_GENERIC"
+        )
+        assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsSessions:
+    def test_windows_specific_sessions(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.sessions.Sessions",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 115
+        expected_rows = test_volatility.load_test_data(
+            "windows.sessions.Sessions", "WINDOWS10_GENERIC"
+        )
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsShimcacheMem:
+    def test_windows_specific_shimcachemem(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.shimcachemem.ShimcacheMem",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        expected_rows = test_volatility.load_test_data(
+            "windows.shimcachemem.ShimcacheMem", "WINDOWS10_GENERIC"
+        )
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsSSDT:
+    def test_windows_specific_ssdt(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.ssdt.SSDT",
+            image,
+            volatility,
+            python,
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 770
+        assert out.find(b"ntoskrnl") != -1
+        assert out.find(b"Nt") != -1
+        assert out.find(b"xHal") != -1
+
+
+class TestWindowsThreads:
+    def test_windows_specific_threads(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.threads.Threads",
+            image,
+            volatility,
+            python,
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 1730
+
+
+class TestWindowsTimers:
+    def test_windows_specific_timers(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.timers.Timers",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        expected_rows = test_volatility.load_test_data(
+            "windows.timers.Timers", "WINDOWSXP_GENERIC"
+        )
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsVadInfo:
+    def test_windows_specific_vadinfo(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.vadinfo.VadInfo",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+            pluginargs=("--pid", "4"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        expected_rows = test_volatility.load_test_data(
+            "windows.vadinfo.VadInfo", "WINDOWS10_GENERIC"
+        )
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsVerInfo:
+    def test_windows_specific_verinfo(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.verinfo.VerInfo",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        assert test_volatility.count_entries_flat(json_out) > 125
+        expected_row = {
+            "Base": 2152558592,
+            "Build": 2622,
+            "Major": 5,
+            "Minor": 1,
+            "Name": "ntoskrnl.exe",
+            "Product": 2600,
+            "__children": [],
+        }
+        assert test_volatility.match_output_row(expected_row, json_out)
+
+
+class TestWindowsVirtMap:
+    def test_windows_specific_virtmap(self, volatility, python):
+        image = WindowsSamples.WINDOWS10_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "windows.virtmap.VirtMap",
+            image,
+            volatility,
+            python,
+            globalargs=("-r", "json"),
+        )
+        assert rc == 0
+        json_out = json.loads(out)
+        expected_rows = test_volatility.load_test_data(
+            "windows.virtmap.VirtMap", "WINDOWS10_GENERIC"
+        )
+        for expected_row in expected_rows:
+            assert test_volatility.match_output_row(expected_row, json_out)