Good morning At the moment I spend most of my brain-cycles on the problem of naming the tags. And stuff like the exit/start time is quite undecided. The current solution has: thread_exit_time proces_exit_time process_create_time thread_create_time socket_create_time (Yes, I collected tags for other modules already) What I prepend is not the plugin name, but the "object" name. By coincidence it is the threads plugin that generates information about thread objects.... Maybe we can clean this a bit. Having only create_time and exit_time it would be easier to generate a kind of chronological event chart. Also with object names prepended (that could be de-duplicated): thread_start_address thread_base_priority thread_priority ssdt_id ssdt_offset ssdt_function idt_target_address driver_size driver_start mutant_thread (thread id of mutant) thread_attached_address thread_owner_address (thread_tag_* are to special for cleanup) file_offset file_start_address symlink_creation_time This is still only a list in a wiki, change is cheap. So please feedback now By the way: Having a rendering module would be cool. Thorsten Sick On 06.07.2012 00:18, AAron Walters wrote: -- Thorsten Sick, Research Avira Operations GmbH & Co. KG Kaplaneiweg 1 88069 Tettnang Germany Phone: +49 7542-500 0 Fax: +49 7542-500 3000 Internet: http://www.avira.com