Originally posted by Microsoft employee YongRhee, but since it's now only available on Internet Archive, I wanted to share this copy available online here. These should be useful in troubleshooting kernel modules' memory leaks with Poolmom, like unusually large windows paging file.
More info here:
https://medium.com/@clintcolding/finding-memory-leaks-with-poolmon-3da80e479040
https://lokna.no/?p=1492
Here is the list of pool tags that ships with Windows.
The list will help you check to see what component might be having problems or being affected by an application or driver.
Yong Rhee
“pooltag.txt
This file lists the tags used for pool allocations by kernel-mode components and drivers.
Pooltag.txt is installed with Debugging Tools for Windows (in %windbg%\triage) and with the Windows DDK (in %winddk%\tools\other\platform\poolmon, where the platform is amd64, i386, or ia64).
@GMM - - (Intel video driver) Memory manager
@KCH - - (Intel video driver) Chipset specific service
@MP - - (Intel video driver) Miniport related memory
@SB - - (Intel video driver) Soft BIOS
_ATI - - ATI video driver
_LCD - monitor.sys - Monitor PDO name buffer
8042 - i8042prt.sys - PS/2 kb and mouse
AdSv - vmsrvc.sys - Virtual Machines Additions Service
ARPC - atmarpc.sys - ATM ARP Client
ATMU - atmuni.sys - ATM UNI Call Manager
Atom - - Atom Tables
Abos - - Abiosdsk
AcdM - - TDI AcdObjectInfoG
AcdN - - TDI AcdObjectInfoG
AcpA - acpi.sys - ACPI arbiter data
AcpB - acpi.sys - ACPI buffer data
AcpD - acpi.sys - ACPI device data
AcpE - acpi.sys - ACPI embedded controller data
AcpF - acpi.sys - ACPI interface data
AcpI - acpi.sys - ACPI irp data
AcpL - acpi.sys - ACPI lock data
AcpM - acpi.sys - ACPI miscellaneous data
AcpP - acpi.sys - ACPI power data
AcpO - acpi.sys - ACPI object data
AcpR - acpi.sys - ACPI resource data
AcpS - acpi.sys - ACPI string data
AcpT - acpi.sys - ACPI thermal data
AcpX - acpi.sys - ACPI translation data
Adap - - Adapter objects
Adbe - - Adobe's font driver
AECi - - filter object interface for MS acoustic echo canceller
Afd? - afd.sys - AFD objects
AfdA - afd.sys - Afd EA buffer
AfdB - afd.sys - Afd data buffer
AfdC - afd.sys - Afd connection structure
AfdD - afd.sys - Afd debug data
AfdE - afd.sys - Afd endpoint structure
AfdF - afd.sys - Afd TransmitFile info
AfdG - afd.sys - Afd group table
AfdI - afd.sys - Afd TDI data
AfdL - afd.sys - Afd local address buffer
AfdP - afd.sys - Afd poll info
AfdQ - afd.sys - Afd work queue item
AfdR - afd.sys - Afd remote address buffer
AfdS - afd.sys - Afd security info
AfdT - afd.sys - Afd transport info
AfdW - afd.sys - Afd work item
AfdX - afd.sys - Afd context buffer
Afda - afd.sys - Afd APC buffer (NT 3.51 only)
Afdc - afd.sys - Afd connect data buffer
Afdd - afd.sys - Afd disconnect data buffer
Afdf - afd.sys - Afd TransmitFile debug data
Afdh - afd.sys - Afd address list change buffer
Afdi - afd.sys - Afd "set inline mode" buffer
Afdl - afd.sys - Afd lookaside lists buffer
Afdp - afd.sys - Afd transport IRP buffer
Afdq - afd.sys - Afd routing query buffer
Afdr - afd.sys - Afd ERESOURCE buffer
Afdt - afd.sys - Afd transport address buffer
AleD - tcpip.sys - ALE remote endpoint
Ala4 - tcpip.sys - ALE remote endpoint IPv4 address
Ala6 - tcpip.sys - ALE remote endpoint IPv6 address
Alei - tcpip.sys - ALE arrival/nexthop interface cache
AleU - tcpip.sys - ALE pend context
AleE - tcpip.sys - ALE endpoint context
AlLl - tcpip.sys - ALE remote endpoint LRU
AlCi - tcpip.sys - ALE credential info
AlSP - tcpip.sys - ALE secure socket policy
AlPU - tcpip.sys - ALE secure socket policy update
AlPi - tcpip.sys - ALE peer info
AlP4 - tcpip.sys - ALE peer IPv4 address
AlP6 - tcpip.sys - ALE peer IPv6 address
AlPT - tcpip.sys - ALE peer target
Alep - tcpip.sys - ALE process info
AleS - tcpip.sys - ALE token info
AleP - tcpip.sys - ALE process image path
AleK - tcpip.sys - ALE audit
AleA - tcpip.sys - ALE connection abort context
AlDN - tcpip.sys - ALE endpoint delete notify
AleW - tcpip.sys - ALE enum filter array
AleN - tcpip.sys - ALE notify context
AlSs - tcpip.sys - ALE socket security context
AlPF - tcpip.sys - ALE policy filters
AleL - tcpip.sys - ALE LRU
AleI - tcpip.sys - ALE token ID
AlP5 - tcpip.sys - ALE 5-tuple state
AlE5 - tcpip.sys - ALE 5-tuple temp entry
Aric - tcpip.sys - ALE route inspection context
Adnc - tcpip.sys - ALE endpoint deactivation notification context
Acrc - tcpip.sys - ALE connect request inspection context
Acrl - tcpip.sys - ALE connect redirect layer data
Abrc - tcpip.sys - ALE bind request inspection context
Abrl - tcpip.sys - ALE bind redirect layer data
Afp - - SFM File server
AlCI - nt!alpc - ALPC communication info
AlEv - nt!alpc - ALPC eventlog queue
AlIn - nt!alpc - ALPC Internal allocation
AlHa - nt!alpc - ALPC port handle table
AlMs - nt!alpc - ALPC message
ALPC - nt!alpc - ALPC port objects
AlRe - nt!alpc - ALPC section region
AlRr - nt!Alpc - ALPC resource reserves
AlSc - nt!alpc - ALPC section
AlSe - nt!alpc - ALPC client security
AlVi - nt!alpc - ALPC view
ATmp - AppTag mount point
ATon - AppTag object name
ATub - AppTag user buffer
ATgb - AppTag guid buffer
ATac - AppTag ATR command buffer
ATdi - AppTag cliendata index buffer
ATdt - AppTag cliendata temp buffer
ATFb - AppTag file id buffer
Aml* - - ACPI AMLI Pooltags
APIC - pnpapic.sys - I/O APIC Driver
ArbA - nt!arb - ARBITER_ALLOCATION_STATE_TAG
ArbL - nt!arb - ARBITER_ORDERING_LIST_TAG
ArbM - nt!arb - ARBITER_MISC_TAG
ArbR - nt!arb - ARBITER_RANGE_LIST_TAG
Arp? - - ATM ARP server objects, atmarps.sys
ArpA - - AtmArpS address
ArpB - - AtmArpS buffer space
ArpI - - AtmArpS Interface structure
ArpK - - AtmArpS ARP block
ArpM - - AtmArpS MARS structure
ArpR - - AtmArpS NDIS request
ArpS - - AtmArpS SAP structure
Asy1 - - ndis / ASYNC_IOCTX_TAG
Asy2 - - ndis / ASYNC_INFO_TAG
Asy3 - - ndis / ASYNC_ADAPTER_TAG
Asy4 - - ndis / ASYNC_FRAME_TAG
AtC - - IDE disk configuration
AtD - - atdisk.c
ATIX - - WDM mini drivers for ATI tuner, xbar, etc.
Atk - - Appletalk transport
AtmA - - Atoms
AtmT - - Atom tables
AuxL - - EXIFS Auxlist
AzAp - HDAudio.sys - HD Audio Class Driver (Datastore: audio path)
AzAd - HDAudio.sys - HD Audio Class Driver (AzPcAudDev)
AzCd - HDAudio.sys - HD Audio Class Driver (CodecVendor)
AzCE - HDAudio.sys - HD Audio Class Driver (CEAAudioRender)
AzCm - HDAudio.sys - HD Audio Class Driver (AzCommon)
AzFg - HDAudio.sys - HD Audio Class Driver (Audio Function Group)
Azfg - HDAudio.sys - HD Audio Class Driver (datastore: function group)
AzJd - HDAudio.sys - HD Audio Class Driver (JackDetector)
AzMa - HDAudio.sys - HD Audio Class Driver (Main)
AzMi - HDAudio.sys - HD Audio Class Driver (micin, MixedCapture)
AzMu - HDAudio.sys - HD Audio Class Driver (MuxedCapture)
AzMx - HDAudio.sys - HD Audio Class Driver (AzMixerport)
AzLd - HDAudio.sys - HD Audio Class Driver (Datastore: logical device)
AzLi - HDAudio.sys - HD Audio Class Driver (CDIn,AUXIn, linein)
AzLg - HDAudio.sys - HD Audio Class Driver (debug)
AzLs - HDAudio.sys - HD Audio Class Driver (DLTest)
AzPd - HDAudio.sys - HD Audio Class Driver (AzDma)
AzPx - HDAudio.sys - HD Audio Class Driver (AzPower)
AzRr - HDAudio.sys - HD Audio Class Driver (RedirectedRender)
AzRR - HDAudio.sys - HD Audio Class Driver (SpdifEmbeddedRender, SpdifOut, Headphone, HBDAout)
AzSd - HDAudio.sys - HD Audio Class Driver (subdevicegraph)
AzSi - HDAudio.sys - HD Audio Class Driver (SpdifIn)
AzSt - HDAudio.sys - HD Audio Class Driver (AzWaveCyclicStream, HdaWaveRTstream)
AzTs - HDAudio.sys - HD Audio Class Driver (TestSet1000, TestSet1001)
AzUT - HDAudio.sys - HD Audio Class Driver (TestSet0004)
AzWd - HDAudio.sys - HD Audio Class Driver (AzWidget)
AzWp - HDAudio.sys - HD Audio Class Driver (AzWaveport, HdaWaveRTminiport)
Bat? - - Battery Class drivers
BatC - - Composite battery driver
BatM - - Control method battery driver
BatS - - Smart battery driver
Batt - - Battery class driver
BCSP - bthbcsp.sys - Bluetooth BCSP minidriver
BCDK - nt!init - Kernel boot configuration data.
BIG - nt!mm - Large session pool allocations (ntos\ex\pool.c)
BlCc - blkcache.sys - Block Cache Driver
Bmfd - - Font related stuff
BT3C - bt3c.sys - Bluetooth 3COM minidriver
BT8x - - WDM mini drivers for Brooktree 848,829, etc.
BTHP - bthport.sys - Bluetooth port driver (generic)
BthS - bthport.sys - Bluetooth port driver (security)
BTME - bthenum.sys - Bluetooth enumerator
BTMO - bthmodem.sys - Bluetooth modem
BTPT - - Bluetooth transport protocol library
BTSR - bthser.sys - Bluetooth serial minidriver
BTUR - bthuart.sys - Bluetooth UART minidriver
Bu* - - burneng.sys from adaptec
BvHI - netiobvt.sys - BVT HT Items
BvHT - netiobvt.sys - BVT HT Tables
Call - nt!ex - kernel callback object signature
call - - debugging call tables
CBRe - - CallbackRegistration
CBSI - cbsi.sys - Common Block Store
Cc - nt!cc - Cache Manager allocations (catch-all)
CcBc - nt!cc - Cache Manager Bcb from pool
CcBm - nt!cc - Cache Manager Bitmap
CcBn - nt!cc - Cache Manager Bcb trim notification entry
CcBr - nt!cc - Cache Manager Bitmap range
CcBz - nt!cc - Cache Manager Bcb Zone
CcDw - nt!cc - Cache Manager Deferred Write
CcEv - nt!cc - Cache Manager Event
CcFn - nt!cc - Cache Manager File name for popups
CcMb - nt!cc - Cache Manager Mbcb
CcOb - nt!cc - Cache Manager Overlap Bcb
CcPB - nt!ccpf - Prefetcher trace buffer
CcPC - nt!ccpf - Prefetcher context
CcPD - nt!ccpf - Prefetcher trace dump
CcPF - nt!ccpf - Prefetcher file name
CcPI - nt!ccpf - Prefetcher intermediate table
CcPL - nt!ccpf - Prefetcher read list
CcPM - nt!ccpf - Prefetcher metadata
CcPS - nt!ccpf - Prefetcher scenario
CcPT - nt!ccpf - Prefetcher trace
CcPc - nt!cc - Cache Manager Private Cache Map
CcPf - nt!ccpf - Prefetcher
CcPh - nt!ccpf - Prefetcher header preallocation
CcPp - nt!ccpf - Prefetcher instructions
CcPq - nt!ccpf - Prefetcher query buffer
CcPs - nt!ccpf - Prefetcher section table
CcPv - nt!ccpf - Prefetcher volume info
CcPw - nt!ccpf - Prefetcher boot worker
CcSc - nt!cc - Cache Manager Shared Cache Map
CcVa - nt!cc - Cache Manager Initial array of Vacbs
CcVl - nt!cc - Cache Manager Vacb Level structures (large streams)
CcVp - nt!cc - Cache Manager Array of Vacb pointers for a cached stream
CctX - - EXIFX FCB Commit CTX
CcWq - nt!cc - Cache Manager Work Queue Item
CcWK - nt!cc - Kernel Cache Manager lookaside list
CcWk - nt!cc - Kernel Cache Manager lookaside list
CcZe - nt!cc - Cache Manager Buffer of Zeros
CDmp - crashdmp.sys - Crashdump driver
CdA - - CdAudio filter driver
Cdcc - cdfs.sys - CDFS Ccb
Cddn - cdfs.sys - CDFS CdName in dirent
Cdee - cdfs.sys - CDFS Search expression for enumeration
Cdfd - cdfs.sys - CDFS Data Fcb
Cdfi - cdfs.sys - CDFS Index Fcb
Cdfl - cdfs.sys - CDFS Filelock
CdFn - cdfs.sys - CDFS Filename buffer
Cdfn - cdfs.sys - CDFS Nonpaged Fcb
Cdfs - cdfs.sys - CDFS General Allocation
Cdft - cdfs.sys - CDFS Fcb Table entry
Cdgs - cdfs.sys - CDFS Generated short name
Cdic - cdfs.sys - CDFS Irp Context
Cdil - cdfs.sys - CDFS Irp Context lite
Cdio - cdfs.sys - CDFS Io context for async reads
Cdma - cdfs.sys - CDFS Mcb array
Cdpe - cdfs.sys - CDFS Prefix Entry
CdPn - cdfs.sys - CDFS CdName in path entry
Cdpn - cdfs.sys - CDFS Prefix Entry name
Cdsp - cdfs.sys - CDFS Buffer for spanning path table
Cdtc - cdfs.sys - CDFS TOC
Cdun - cdfs.sys - CDFS Buffer for upcased name
Cdvd - cdfs.sys - CDFS Buffer for volume descriptor
Cdvp - cdfs.sys - CDFS Vpb allocated in filesystem
CIcr - ci.dll - Code Integrity allocations for image integrity checking
CIsc - ci.dll - Code Integrity core dll
CIha - ci.dll - Code Integrity hashes
ClfA - clfs.sys - CLFS Log container lookaside list
ClfB - clfs.sys - CLFS Log base file lookaside list
ClfC - clfs.sys - CLFS Log physical FCB lookaside list
ClfD - clfs.sys - CLFS Log virtual FCB lookaside list
ClfE - clfs.sys - CLFS Log CCB lookaside list
ClfF - clfs.sys - CLFS Log flush element lookaside list
ClfG - clfs.sys - CLFS Log I/O Request lookaside list
ClfH - clfs.sys - CLFS Log I/O control block lookaside list
ClfI - clfs.sys - CLFS Log marshal buffer lookaside list
ClfJ - clfs.sys - CLFS Log MDL reference
ClfK - clfs.sys - CLFS Log read completion element
ClfL - clfs.sys - CLFS Log base file image (obsolete)
ClfN - clfs.sys - CLFS Log base file lock
ClfO - clfs.sys - CLFS Log zero page
ClfP - clfs.sys - CLFS Log request state
ClfS - clfs.sys - CLFS Log base file snapshot
Clfs - clfs.sys - CLFS General buffer, or owner page lookaside list
CM - nt!cm - Configuration Manager (registry)
CmcD - hal.dll - HAL CMC Driver Log
CmcK - hal.dll - HAL CMC Kernel Log
CmcT - hal.dll - HAL CMC temporary Log
CMCa - nt!cm - Configuration Manager Cache (registry)
CMDc - nt!cm - Configuration Manager Cache (registry)
CMkb - nt!cm - registry key control blocks
CMpb - nt!cm - registry post blocks
CMnb - nt!cm - registry notify blocks
CMpe - nt!cm - registry post events
CMpa - nt!cm - registry post apcs
CMsb - nt!cm - registry stash buffer
CmVn - nt!cm - captured value name
CMVw - nt!cm - registry mapped view of file
CMVa - nt!cm - value cache value tag
CMVI - nt!cm - value index cache tag
CMSc - nt!cm - security cache pooltag
CMSb - nt!cm - internal stash buffer pool tag
CMNb - nt!cm - Configuration Manager Name Tag
CMIn - nt!cm - Configuration Manager Index Hint Tag
CMDa - nt!cm - value data cache pool tag
CMAl - nt!cm - internal registry memory allocator pool tag
CMA1 - nt!cm - Configuration Manager Audit Tag 1
CMA2 - nt!cm - Configuration Manager Audit Tag 2
CMA3 - nt!cm - Configuration Manager Audit Tag 3
CMA4 - nt!cm - Configuration Manager Audit Tag 4
CMIx - nt!cm - Configuration Manager Intent Lock Tag
CMUw - nt!cm - Configuration Manager Unit of Work Tag
CMTr - nt!cm - Configuration Manager Transaction Tag
CMRm - nt!cm - Configuration Manager Resource Manager Tag
CM?? - nt!cm - Internal Configuration manager allocations
Cngb - ksecdd.sys - CNG kmode crypto pool tag
COMX - serial.sys - serial driver allocations
Cont - - Contiguous physical memory allocations for device drivers
CopW - - EXIFS CopyOnWrite
Covr - nt!cov - Code Coverage pool tag
CpeD - hal.dll - HAL CPE Driver Log
CpeK - hal.dll - HAL CMC Kernel Log
CpeT - hal.dll - HAL CPE temporary Log
CPnp - classpnp.sys - ClassPnP transfer packets
Crsp - ksecdd.sys - CredSSP kernel mode client allocations
CrtH - - EXIFS Create Header
Cryp - ksecdd.sys - Crypto allocations
CSdk - - Cluster Disk Filter driver
CSnt - - Cluster Network driver
CTE - - Common transport environment (ntos\inc\cxport.h, used by tdi)
Cvli - - EXIFS Cached Volume Info
D2d - - Device Object to DosName rtns (ntos\rtl\dev2dos.c)
D3Dd - - DX D3D driver (embedded in a display driver like s3mvirge.dll)
D851 - - 8514a video driver
Dacl - - Temp allocations for object DACLs
Dati - - ati video driver
DbCb - nt!dbg - Debug Print Callbacks
DbLo - - Debug logging
dcam - - WDM mini driver for IEEE 1394 digital camera
Dcdd - cdd.dll - Canonical display driver
Dcl - - cirrus video driver
Ddk - - Default for driver allocated memory (user's of ntddk.h)
Devi - - Device objects
Dh 0 - - DirectDraw/3D default object
Dh 1 - - DirectDraw/3D DirectDraw object
Dh 2 - - DirectDraw/3D Surface object
Dh 3 - - DirectDraw/3D Direct3D context object
Dh 4 - - DirectDraw/3D VideoPort object
Dh 5 - - DirectDraw/3D MotionComp object
Dfb - - framebuf video driver
DfC? - dfsc.sys - DFS Client allocations
DfCa - dfsc.sys - DFS Client PERUSERTABLE
DfCb - dfsc.sys - DFS Client REFCONTEXT
DfCc - dfsc.sys - DFS Client CONNECTION
DfCd - dfsc.sys - DFS Client CURRENTDC
DfCe - dfsc.sys - DFS Client CSCEA
DfCf - dfsc.sys - DFS Client FILENAME
DfCg - dfsc.sys - DFS Client PREFIXCACHE
DfCh - dfsc.sys - DFS Client HASH
DfCi - dfsc.sys - DFS Client INPUTBUFFER
DfCj - dfsc.sys - DFS Client REFERRALNAME
DfCj - dfsc.sys - DFS Client REWRITTENNAME
DfCl - dfsc.sys - DFS Client DCLIST
DfCm - dfsc.sys - DFS Client CMCONTEXT
DfCn - dfsc.sys - DFS Client DOMAINNAME
DfCp - dfsc.sys - DFS Client PATH
DfCq - dfsc.sys - DFS Client REGSTRING
DfCr - dfsc.sys - DFS Client REFERRAL
DfCs - dfsc.sys - DFS Client SHARENAME
DfCt - dfsc.sys - DFS Client TREECONNECT
DfCu - dfsc.sys - DFS Client USETABLE
DfCv - dfsc.sys - DFS Client SERVERNAME
DfCw - dfsc.sys - DFS Client TARGETINFO
DfCx - dfsc.sys - DFS Client CREDENTIALS
DfCy - dfsc.sys - DFS Client REMOTEENTRY
DfCz - dfsc.sys - DFS Client DOMAINREFERRAL
Dfs - - Distributed File System
dfsr - - RDBSS IRP allocation
Dfsm - - Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdi\gre
dFVE - dumpfve.sys - Full Volume Encryption crash dump filter (Bitlocker Drive Encryption)
Dict - storport.sys - StorCreateDictionary storport!_STOR_DICTIONARY.Entries
Dire - - Directory objects
Dlck - - deadlock verifier (part of driver verifier) structures
Dlmp - - Video utility library for Vista display drivers
Dmga - - mga (matrox) video driver
DmH? - - DirectMusic hardware synthesizer
DmpS - dumpsvc.sys - Crashdump Service Driver
DmS? - - DirectMusic kernel software synthesizer
Dndt - - Device node
Dnod - - Device node structure
DOPE - - Device Object Power Extension (po component)
DpDc - FsDepends.sys - FsDepends Dependency Context Block
DpDl - FsDepends.sys - FsDepends Dependency List Block
DpPl - FsDepends.sys - FsDepends Parent Link Block
DPrf - - Disk performance filter driver
DPwr - nt!pnp - PnP power management
Dprt - dxgkrnl.sys - Video port for Vista display drivers
Dps5 - - NT5 PostScript printer driver
Dpsh - - Postcript driver heap memory
Dpsi - - psidisp video driver
Dpsm - - Postcript driver memory
Dqv - - qv (qvision) video driver
DpVc - FsDepends.sys - FsDepends Volume Context Block
DrDr - rdpdr.sys - Global object
DrEx - rdpdr.sys - Exchange object
DrIC - rdpdr.sys - I/O context object
Driv - - Driver objects
Drsd - - Rasdd Printer Driver Pool Tag.
Dtga - - tga video driver
Dump - - Bugcheck dump allocations
Dun5 - - NT5 Universal printer driver
DUQD - mpsdrv.sys - MPSDRV upcall user request
DV?? - - RDR2 DAV MiniRedir Tags
DVCx - - AsyncEngineContext, DAV MiniRedir
DVEx - - Exchange, DAV MiniRedir
DVFi - - FileInfo, DAV MiniRedir
DVFn - - FileName, DAV MiniRedir
DVRw - - ReadWrite, DAV MiniRedir
DVSc - - SrvCall, DAV MiniRedir
DVSh - - SharedHeap, DAV MiniRedir
Dvga - - vga 16 color video driver
Dvg2 - - vga 256 color video driver
Dvg6 - - vga 64K color video driver
Dvgr - - vga for risc video driver
DW32 - - W32 video driver
Dwd - - wd90c24a video driver
Dwp9 - - weitekp9 video driver
Dxga - - XGA video driver
DxgK - dxgkrnl.sys - Vista display driver support
Efsm - - EFS driver
Efsc - - EFS driver
Efst - - EXIFS FS Statistics
Envr - - Environment strings
Err - - Error strings
EtwA - nt!etw - Etw APC
EtwG - nt!etw - Etw Guid
EtwD - nt!etw - Etw DataBlock
EtwS - nt!etw - Etw DataSource
EtwR - nt!etw - Etw Registration
EtwC - nt!etw - Etw Realtime Consumer
EtwB - nt!etw - Etw Buffer
EtwP - nt!etw - Etw Pool
EtwQ - nt!etw - Etw Queue
Etwq - nt!etw - Etw ReplyQueue
Etwr - nt!etw - Etw ReplyQueue Entry
EtwL - nt!etw - ETW_LOGGER_CONTEXT
Etwp - nt!etw - ETW per-processor block
EtwW - nt!etw - ETW work item
Etwm - nt!etw - ETW stack tracing bit-map
EtwF - nt!etw - ETW schematized filter
Evel - - EFS file system filter driver lookaside list
Even - - Event objects
Evid - - Rtl Event ID's
ExWl - - Executive worker list entry
Fat - fastfat.sys - Fat File System allocations
FatB - fastfat.sys - Fat allocation bitmaps
FatC - fastfat.sys - Fat Ccbs
FatD - fastfat.sys - Fat pool dirents
FatE - fastfat.sys - Fat EResources
FatF - fastfat.sys - Fat Fcbs
FatI - fastfat.sys - Fat IrpContexts
FatL - fastfat.sys - Fat FAT entry lookup buffer on verify
FatN - fastfat.sys - Fat Nonpaged Fcbs
FatO - fastfat.sys - Fat I/O buffer
FatP - fastfat.sys - Fat output for query retrieval pointers (caller frees)
FatQ - fastfat.sys - Fat buffered user buffer
FatR - fastfat.sys - Fat repinned Bcb
FatS - fastfat.sys - Fat stashed Bpb
FatT - fastfat.sys - Fat directory allocation bitmaps
FatV - fastfat.sys - Fat Vcb stat bucket
Fatv - fastfat.sys - Fat events
FatW - fastfat.sys - Fat FAT windowing structure
FatX - fastfat.sys - Fat IO contexts
Fatb - fastfat.sys - Fat Bcb arrays
Fatd - fastfat.sys - Fat EA data
Fate - fastfat.sys - Fat EA set headers
Fatf - fastfat.sys - Fat deferred flush contexts
Fati - fastfat.sys - Fat IO run descriptor
Fatn - fastfat.sys - Fat filename buffer
Fatr - fastfat.sys - Fat verification-time rootdir snapshot
Fats - fastfat.sys - Fat verification-time boot sector
Fatv - fastfat.sys - Fat backpocket Vpb
Fatx - fastfat.sys - Fat delayed close contexts
Fcbl - - EXIFS FCBlock
fboX - - EXIFS FOBXVF List
Feiv - netio.sys - WFP filter engine incoming values
Fecc - netio.sys - WFP filter engine classify context
Fecf - netio.sys - WFP filter engine callout context
File - - File objects
FIcn - fileinfo.sys - FileInfo FS-filter Create Retry Path
FIcp - fileinfo.sys - FileInfo FS-filter Extra Create Parameter
FIcs - fileinfo.sys - FileInfo FS-filter Stream Context
FIcv - fileinfo.sys - FileInfo FS-filter Volume Context
FIOc - fileinfo.sys - FileInfo FS-filter Prefetch Open Context
FIou - fileinfo.sys - FileInfo FS-filter User Open Context
FIof - fileinfo.sys - FileInfo FS-filter File Object Context
FIPc - fileinfo.sys - FileInfo FS-filter Prefetch Context
FIvn - fileinfo.sys - FileInfo FS-filter Volume Name
FIvp - fileinfo.sys - FileInfo FS-filter Volume Properties
FlmC - tcpip.sys - Framing Layer Client Contexts
FlmP - tcpip.sys - Framing Layer Provider Contexts
Flng - tcpip.sys - Framing Layer Generic Buffers (Tunnel/Port change notifications, ACLs)
FlpC - tcpip.sys - Framing Layer Client Contexts
FlpI - tcpip.sys - Framing Layer Interfaces
FlpM - tcpip.sys - Framing Layer Multicast Groups
FlpS - tcpip.sys - Framing Layer Serialized Requests
Fl6D - tcpip.sys - FL6t DataLink Addresses
Fl4D - tcpip.sys - FL4t DataLink Addresses
FlSB - tcpip.sys - Framing Layer Stack Block
Flop - - floppy driver
Flst - - EXIFS Freelist
FLex - - exclusive file lock
FLfl - - exported (non-private) file lock
FLli - - per-file lock information
FLln - - shared lock tree node
FLsh - - shared file lock
FLwl - - waiting lock
FM?? - fltmgr.sys - Unrecognized FltMgr tag (update pooltag.w)
FMac - fltmgr.sys - ASCII String buffers
FMas - fltmgr.sys - ASYNC_IO_COMPLETION_CONTEXT structure
FMcb - fltmgr.sys - FLT_CCB structure
FMcr - fltmgr.sys - Context registration structures
FMct - fltmgr.sys - TRACK_COMPLETION_NODES structure
FMdl - fltmgr.sys - Array of DEVICE_OBJECT pointers
FMea - fltmgr.sys - EA buffer for create
FMfc - fltmgr.sys - FLTMGR_FILE_OBJECT_CONTEXT structure
FMfi - fltmgr.sys - Fast IO dispatch table
FMfk - fltmgr.sys - Byte Range Lock structure
FMfl - fltmgr.sys - FLT_FILTER structure
FMfn - fltmgr.sys - NAME_CACHE_NODE structure
FMfr - fltmgr.sys - FLT_FRAME structure
FMfz - fltmgr.sys - FILE_LIST_CTRL structure
FMib - fltmgr.sys - Irp SYSTEM buffers
FMic - fltmgr.sys - IRP_CTRL structure
FMin - fltmgr.sys - FLT_INSTANCE name
FMil - fltmgr.sys - IRP_CTRL completion node stack
FMis - fltmgr.sys - FLT_INSTANCE structure
FMla - fltmgr.sys - Per-processor IRPCTRL lookaside lists
FMnc - fltmgr.sys - NAME_CACHE_CREATE_CTRL structure
FMng - fltmgr.sys - NAME_GENERATION_CONTEXT structure
FMol - fltmgr.sys - OPLOCK_CONTEXT structure
FMos - fltmgr.sys - Operation status ctrl structure
FMpl - fltmgr.sys - Cache aware pushLock
FMpr - fltmgr.sys - FLT_PRCB structure
FMrl - fltmgr.sys - FLT_OBJECT rundown logs
FMrp - fltmgr.sys - Reparse point data buffer
FMrr - fltmgr.sys - Per-processor Cache-aware rundown ref structure
FMsd - fltmgr.sys - Security descriptors
FMsl - fltmgr.sys - STREAM_LIST_CTRL structure
FMtn - fltmgr.sys - Temporary file names
FMtr - fltmgr.sys - Temporary Registry information
FMts - fltmgr.sys - Tree Stack
FMus - fltmgr.sys - Unicode string
FMvf - fltmgr.sys - FLT_VERIFIER_EXTENSION structure
FMvj - fltmgr.sys - FLT_VERIFIER_OBJECT structure
FMvo - fltmgr.sys - FLT_VOLUME structure
FMwi - fltmgr.sys - Work item structures
FMcn - fltmgr.sys - Non paged context extension structures.
FMtp - fltmgr.sys - Non Paged tx vol context structures.
FMlp - fltmgr.sys - Paged stream list control entry structures.
Fsb - netio.sys - Fixed-Size Block pool
Fsrc - fsrec.sys - Filesystem recognizer (fsrec.sys)
Fstb - - ntos\fstub
FstB - - ntos\fstub
FsVg - fsvga.sys - International VGA support
flnk - - font link tag used in ntgdi\gre
FS?? - nt!fsrtl - Unrecoginzed File System Run Time allocations (update pooltag.w)
FSeh - nt!fsrtl - File System Run Time Extra Create Parameter Entry
FSel - nt!fsrtl - File System Run Time Extra Create Parameter List
FSfm - nt!fsrtl - File System Run Time Fast Mutex Lookaside List
FSim - nt!fsrtl - File System Run Time Mcb Initial Mapping Lookaside List
FSrt - nt!fsrtl - File System Run Time allocations (DO NOT USE!)
FSmg - nt!fsrtl - File System Run Time
FSrd - nt!fsrtl - File System Run Time
FSrm - nt!fsrtl - File System Run Time
FSrn - nt!fsrtl - File System Run Time
FSrN - nt!fsrtl - File System Run Time
FSro - nt!fsrtl - File System Run Time
FSrs - nt!fsrtl - File System Run Time Work Item for low-stack posting
FSun - nt!fsrtl - File System Run Time
FOCX - nt!fsrtl - File System Run Time File Object Context structure
FTrc - - Fault tolerance Slist tag.
FtC - - Fault tolerance driver
FtM - - Fault tolerance driver
FtS - - Fault tolerance driver
FtT - - Fault tolerance driver
FtU - - Fault tolerance driver
FtV - - Fault tolerance driver
FtpA - mpsdrv.sys - MPSDRV FTP protocol analyzer
FwfD - mpsdrv.sys - MPSDRV driver buffer for flattening NET_BUFFFER
FwSD - tcpip.sys - WFP security descriptor
FVE? - fvevol.sys - Full Volume Encryption Filter Driver (Bitlocker Drive Encryption)
FVE0 - fvevol.sys - General allocations
FVEc - fvevol.sys - Cryptographic allocations
FVEl - fvevol.sys - FVELIB allocations
FVEp - fvevol.sys - Write buffers
FVEr - fvevol.sys - Reserved mapping addresses
FVEv - fvevol.sys - Conversion allocations
FVEw - fvevol.sys - Worker threads
FVEx - fvevol.sys - Read/write control structures
FxDr - wdf01000.sys - KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable.
FxLg - wdf01000.sys - KMDF IFR log tag
FxL? - wdfldr.sys - KMDF Loader Pool allocation
Fwpp - fwpkclnt.sys - Windows Filtering Platform export driver.
Fwpn - fwpkclnt.sys - WFP NBL info
Fwpi - fwpkclnt.sys - WFP injector info
Fwpx - fwpkclnt.sys - WFP NBL tagged context
Fwpd - fwpkclnt.sys - WFP delayed injection context
Fwpc - fwpkclnt.sys - WFP injection call context
G??? - - Gdi Objects
G - - Gdi Generic allocations
Gcac - - Gdi glyph cache
Gcap - - Gdi capture buffer
Gcsl - - Gdi string resource script names
Gdbr - - Gdi driver brush realization
Gdd - - Gdi ddraw PKEY_VALUE_FULL_INFORMATION
Gdda - - Gdi ddraw attach list
GddD - - Gdi ddraw dummy page
Gdde - - Gdi ddraw event
Gddf - - Gdi ddraw driver heaps
Gddp - - Gdi ddraw driver caps
Gddv - - Gdi ddraw driver video memory list
Gdxd - - Gdi ddraw VPE directdraw object
Gdxs - - Gdi ddraw VPE surface, videoport, capture object
Gdxx - - Gdi ddraw VPE DXAPI object
Gdev - - Gdi GDITAG_DEVMODE
GDev - - Gdi pdev
Gdrs - - Gdi GDITAG_DRVSUP
Gebr - - Gdi ENGBRUSH
gEdg - - Gdi gradient fill triangle
Gffv - - Gdi FONTFILEVIEW
gFil - - Gdi FILEVIEW
GFil - - Gdi engine descriptor list
Gfsb - - Gdi font sustitution list
Gfsm - - Gdi Fast mutex
Ggdv - - Gdi GDITAG_GDEVICE
Gglb - - Gdi temp buffer
Ggls - - Gdi glyphset
Ggb - - Gdi glyph bits
Ggbl - - Gdi look aside buffers
Ghmg - - Gdi handle manager objects
Gini - - Gdi fast mutex
Gldv - - Gdi Ldev
Glnk - - Gdi PFELINK
Gmap - - Gdi font map signature table
Gpff - - Gdi physical font file
Gpft - - Gdi font table
Gsem - - Gdi Semaphores
Gsp - - Gdi sprite
Gspr - - Gdi sprite grow range
Gtmp - - Gdi temporary allocations
Gtmw - - Gdi TMW_INTERNAL
Gxlt - - Gdi Xlate
Gfcb - - EXIFS Grow FCB
Hal - hal.dll - Hardware Abstraction Layer
HalV - ntoskrnl.exe - Driver Verifier DMA checking
Hpfs - - Pinball (aka Hpfs) allocations
HisC - - histogram filter driver
Hist - - histogram filter driver
HidP - - HID Parser
HidC - - HID Class
HdCl - - HID Client Sample Driver
HpMM - pnpmem.sys - HotPlug Memory Driver
HCID - bthport.sys - Bluetooth port driver HCI debug
HCIT - bthport.sys - Bluetooth port driver (HCI)
HcRs - hcaport.sys - HCAPORT_TAG_RESOURCE_LIST
HcEv - hcaport.sys - HCAPORT_TAG_EVENT
HcdI - hcaport.sys - HCAPORT_TAG_HWID
HcEn - hcaport.sys - HCAPORT_TAG_ENUM
HcMc - hcaport.sys - HCAPORT_TAG_MISC
HcDr - hcaport.sys - HCAPORT_TAG_DEVICE_RELATIONS
HcBm - hcaport.sys - HCAPORT_TAG_BITMAP
HcOb - hcaport.sys - HCAPORT_TAG_OBJECT
HcCq - hcaport.sys - HCAPORT_TAG_CQUEUE
HcPr - hcaport.sys - HCAPORT_TAG_PROTD
HPmi - hcaport.sys - HCAPORT_TAG_PMI_EXTENSION
HcMa - hcaport.sys - HCAPORT_TAG_MAD
HcMp - hcaport.sys - HCAPORT_TAG_MINIPORT
HcCm - hcaport.sys - HCAPORT_TAG_CM
HcUc - hcaport.sys - HCAPORT_TAG_UCONTEXT
HcMr - hcaport.sys - HCAPORT_TAG_REMOVE_LOCK
Hmgo - hcaport.sys - HCAPORT_TAG_WQ_MG_INFO
Hioc - hcaport.sys - HCAPORT_TAG_IOC_SERVICE_TABLE
hSVD - mrxdav.sys - Shared Heap Tag
HTab - - Hash Table pool
HT01 - - GDI Halftone AddCachedDCI() for CurCDCIData
HT02 - - GDI Halftone GetCachedDCI() for Threshold
HT03 - - GDI Halftone FindCachedSMP() for CurCSMPData
HT04 - - GDI Halftone FindCachedSMP() for CurCSMPBmp
HT05 - - GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI
HT06 - - GDI Halftone pDCIAdjClr() for DEVCLRADJ
HT07 - - GDI Halftone ComputeRGB555LUT() for RGBLUT
HT08 - - GDI Halftone ColorTriadSrcToDev() for RGB-XYZ
HT09 - - GDI Halftone ColorTriadSrcToDev() for CRTX-FD6XYZ Cache
HT10 - - GDI Halftone CreateDyesColorMappingTable() for DevPrims
HT11 - - GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable
HT12 - - GDI Halftone ThresholdsFromYData() for pYData
HT13 - - GDI Halftone ComputeHTCellRegress() for pThresholds
HT14 - - GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine
HT15 - - GDI Halftone CalculateStretch() for PrimColorInfo
Hvlm - nt!Hvl - Temporary MDL for the Hvl component.
HvlP - nt!Hvl - Hypercall marshalling pages for the Hvl component.
IBCM - wibcm.sys - CM_INSTANCE_TAG Windows Infiniband Communications Manager
CEP - wibcm.sys - CEP_INSTANCE_TAG
CMSH - wibcm.sys - WIBCM_SHARED_TAG
CMWK - wibcm.sys - WIBCM_WORK_TAG
CMWT - wibcm.sys - WIBCM_TIMER_TAG
IBm* - wibms.sys - Windows Infiniband Management Server pool tags
IbPm - wibpm.sys - WIBPM_TAG Windows Infiniband Performance Manager
IbPS - wibpm.sys - WIBPM_SENT_TAG
IbPI - wibpm.sys - WIBPM_ITEM_TAG
IbPA - wibpm.sys - WIBPM_SAMPLE_TAG
IbW0 - wibwmi.sys - WIBWMI0_TAG Windows Infiniband WMI Manager
IbW1 - wibwmi.sys - WIBWMI1_TAG
IbW2 - wibwmi.sys - WIBWMI2_TAG
Ic4c - tcpip.sys - ICMP IPv4 Control data
Ic4h - tcpip.sys - ICMP IPv4 Headers
Ic6c - tcpip.sys - ICMP IPv6 Control data
Ic6h - tcpip.sys - ICMP IPv6 Headers
IBbf - tcpip.sys - IP BVT Buffers
InAD - tcpip.sys - Inet Ancillary Data
IneI - tcpip.sys - Inet Inspects
InF0 - tcpip.sys - Inet Generic Fixed Size Block pool 0
InF1 - tcpip.sys - Inet Generic Fixed Size Block pool 1
InF2 - tcpip.sys - Inet Generic Fixed Size Block pool 2
InIS - tcpip.sys - Inet Inspect Streams
InNA - - Inet Na Clients
InNP - tcpip.sys - Inet Nsi Providers
InPA - tcpip.sys - Inet Port Assignment Arrays
InPa - tcpip.sys - Inet Port Assignments
InPE - tcpip.sys - Inet Port Exclusions
InPP - tcpip.sys - Inet Port pool
InSB - tcpip.sys - Inet stack block
InSC - tcpip.sys - Inet Queued Send Contexts
Ipas - tcpip.sys - IP Buffers for Address Sort
IPbw - tcpip.sys - IP Path Bandwidth information
IPdc - tcpip.sys - IP Destination Cache
IPfg - tcpip.sys - IP Fragment Groups
IPfp - tcpip.sys - IP PreValidated Receives
IPif - tcpip.sys - IP Interfaces
IPlo - tcpip.sys - IP Loopback buffers
IPmf - tcpip.sys - IP Multicast Forwarding Entry pool
IPpo - tcpip.sys - IP Offload buffers
IPpa - tcpip.sys - IP Path information
IPrq - tcpip.sys - IP Request Control data
IPss - tcpip.sys - IP Session State
IPsi - tcpip.sys - IP SubInterfaces
Ipng - tcpip.sys - IP Generic buffers (Address, Interface, Packetize, Route allocations)
IpOl - tcpip.sys - IP Offload Log data
Ippp - tcpip.sys - IP Prefix Policy information
IPre - tcpip.sys - IP Reassembly buffers
Iptt - tcpip.sys - IP Timer Tables
Iptc - tcpip.sys - IP Transaction Context information
Ipur - tcpip.sys - IP Unicast Routes
Ipwi - tcpip.sys - IP Work Item allocations
I4ai - tcpip.sys - IPv4 Local Address Identifiers
I4ba - tcpip.sys - IPv4 Local Broadcast Addresses
I4bf - tcpip.sys - IPv4 Generic Buffers (Source Address List allocations)
I4e - tcpip.sys - IPv4 Echo data
I4ma - tcpip.sys - IPv4 Local Multicast Addresses
I4nb - tcpip.sys - IPv4 Neighbors
I4rd - tcpip.sys - IPv4 Receive Datagrams Arguments
I4ua - tcpip.sys - IPv4 Local Unicast Addresses
I6ai - tcpip.sys - IPv6 Local Address Identifiers
I6aa - tcpip.sys - IPv6 Local Anycast Addresses
I6bf - tcpip.sys - IPv6 Generic Buffers (Source Address List allocations)
I6e - tcpip.sys - IPv6 Echo data
I6ma - tcpip.sys - IPv6 Local Multicast Addresses
I6nb - tcpip.sys - IPv6 Neighbors
I6rd - tcpip.sys - IPv6 Receive Datagrams Arguments
I6ua - tcpip.sys - IPv6 Local Unicast Addresses
IPX - - Nwlnkipx transport
Icp - - I/O completion packets queue on a completion ports
IcpP - - NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers
IdeP - - atapi IDE
IdeX - - PCI IDE
idle - - Power Manager idle handler
Ifs - - Default file system allocations (user's of ntifs.h)
Info - - general system information allocations
Io - nt!io - general IO allocations
IoBo - nt!io - Io boot disk information
IoCc - nt!io - Io completion context
IoDn - nt!io - Io device name info
IoEa - nt!io - Io extended attributes
IoEr - nt!io - Io error log packets
IoFc - nt!io - Io name transmogrify operation
IoFs - nt!io - Io shutdown packet
IoFu - nt!pnp - Io file utils
Ioin - - Io interrupts
IoKB - nt!io - Registry basic key block (temp allocation)
IoNm - nt!io - Io parsing names
IoOp - nt!io - I/O subsystem open packet
IoRb - nt!io - Io remote boot related
IoRi - nt!io - I/O SubSystem Driver Reinitialization Callback Packet
IoRN - nt!io - Registry key name (temp allocation)
IoSD - nt!io - Io system device buffer
IoSe - nt!io - Io security related
IoSh - nt!io - Io shutdown packet
IoSi - nt!io - Io Symbolic Links
IoSn - nt!io - Io Session Notifications
IoSt - nt!io - Io Stream Identifier Context
IoTi - nt!io - Io timers
IoTt - nt!vf - I/O verifier IRP tracking table
IoUs - nt!io - I/O SubSystem completion Context Allocation
Irp - - Io, IRP packets
Irp+ - nt!vf - I/O verifier allocated IRP packets
IrpB - nt!vf - I/O verifier direct I/O double buffer allocation
Irpd - nt!vf - I/O verifier deferred completion context
Irps - nt!vf - I/O verifier per-IRP session tracking data
Irpt - nt!vf - I/O verifier per-IRP tracking data
IrpC - nt!vf - I/O verifier stack contexts
Irpl - nt!io - system large IRP lookaside list
Irps - nt!io - system small IRP lookaside list
Isap - - Pnp Isa bus extender
II?? - - IP in IP tunneling
IIrf - - Free memory
IIdt - - Data
IITn - - Tunnel
IIhd - - Header
IIpk - - Packet
IIsc - - Send Context
IIts - - Transfer Context
IIwc - - Work Context
Im* - - Imapi.sys from adaptec
INTC - - Intel video driver
IPm? - - IP Multicasting
IPmg - - Group
IPms - - Source
IPmo - - Outgoing Interface
IPmm - - Message
IPmf - - Free memory (only in checked builds)
Ip?? - ipsec.sys - IP Security
IpSI - ipsec.sys - initial allocations
IpAT - ipsec.sys - AH headers in transport mode
IpAU - ipsec.sys - AH headers in tunnel mode
IpET - ipsec.sys - ESP headers in transport mode
IpEU - ipsec.sys - ESP headers in tunnel mode
IpHT - ipsec.sys - HUGHES headers in transport mode
IpHU - ipsec.sys - HUGHES headers in tunnel mode
IpAX - ipsec.sys - Key acquire contexts
IpFI - ipsec.sys - Filter blocks
IpSA - ipsec.sys - Security Associations
IpKE - ipsec.sys - keys
IpTI - ipsec.sys - timers
IpSQ - ipsec.sys - stall queues
IpLA - ipsec.sys - lookaside lists
IpBP - ipsec.sys - buffer pools
IpSC - ipsec.sys - send complete context
IpEQ - ipsec.sys - event queue
IpHW - ipsec.sys - hardware accleration items
IpCO - ipsec.sys - IP compression
ItoM - tcpip.sys - IPsec task offload interface
ItoD - tcpip.sys - IPsec task offload delete SA
ItoS - tcpip.sys - IPsec task offload add SA
ItoC - tcpip.sys - IPsec task offload context
ItoO - tcpip.sys - IPsec task offload paramters
Itht - tcpip.sys - IPsec hashtable
ISLe - tcpip.sys - IPsec SA list entry
IsRc - tcpip.sys - IPsec rebalance context
Ikmb - tcpip.sys - IPsec key module blob
Ithp - tcpip.sys - IPsec throttle param
Ipfl - tcpip.sys - IPsec flow handle
Ipap - tcpip.sys - IPsec pend context
Inlc - tcpip.sys - IPsec NL complete context
Iprc - tcpip.sys - IPsec RPC context
Ipis - tcpip.sys - IPsec inbound sequence info
Itok - tcpip.sys - IPsec token
Iser - tcpip.sys - IPsec inbound sequence range
IKeO - tcpip.sys - IPsec key object
I4sa - tcpip.sys - IPsec SADB v4
I4s6 - tcpip.sys - IPsec SADB v6
IHaO - tcpip.sys - IPsec hash object
Ipnc - tcpip.sys - IPsec negotiation context
Icse - tcpip.sys - IPsec NS connection state
Itro - tcpip.sys - IPsec outbound session security context
Itri - tcpip.sys - IPsec inbound packet security context
Ituo - tcpip.sys - IPsec outbound tunnel session security context
Itui - tcpip.sys - IPsec inbound packet tunnel security context
Ipft - tcpip.sys - IPsec filter
Ipwi - tcpip.sys - IPsec work item
Idqf - tcpip.sys - IPsec DOS protection QoS flow
Idpc - tcpip.sys - IPsec DOS protection pacer create
Idst - tcpip.sys - IPsec DOS protection state entry
Ifws - tcpip.sys - IPsec forward state
IpFl - mpsdrv.sys - MPSDRV IP Flow
IrD? - - IrDA TDI and RAS drivers
IU?? - - IIS Utility Driver
IUDl - - Lookaside list allocations
IUcp - - completion port minipackets
KAPC - nt!io - I/O SubSystem HardError APC
KbdC - - Keyboard Class Driver
KCfe - - Kernel COM factory entry
Ke - - Kernel data structures
KeIC - - Kernel Interrupt Object Chain
Key - - Key objects
KMIX - - Kmixer (wdm audio)
KNMI - - Kernel NMI Callback object
KrbC - ksecdd.sys - Kerberos Client package
KSah - - Ks auxiliary stream headers
KSAI - - allocator instance
KSai - - default allocator instance header
KSbi - - event buffered item
KSCI - - clock instance
KSce - - create item entry
KSch - - create handler entry
KSci - - default clock instance header
KScp - - object creation parameters auxiliary copy
KSda - - default allocator
KSdc - - default clock
KSdh - - device header
Kse0 - ksecdd.sys - Security driver allocs for sec package 0
Kse1 - ksecdd.sys - Security driver allocs for sec package 1
Kse2 - ksecdd.sys - Security driver allocs for sec package 2
Kse3 - ksecdd.sys - Security driver allocs for sec package 3
Kse4 - ksecdd.sys - Security driver allocs for sec package 4
Kse5 - ksecdd.sys - Security driver allocs for sec package 5
Kse6 - ksecdd.sys - Security driver allocs for sec package 6
Kse7 - ksecdd.sys - Security driver allocs for sec package 7
Kse8 - ksecdd.sys - Security driver allocs for sec package 8
Kse9 - ksecdd.sys - Security driver allocs for sec package 9
Ksec - ksecdd.sys - Security device driver
KSed - - event dpc item
KSee - - event entry
KSed - - oneshot event deletion dpc
KSep - - irp system buffer event parameter
KseS - ksecdd.sys - Security driver allocs for LSA proper
KSew - - oneshot event deletion workitem
KseZ - ksecdd.sys - Security driver allocs for default sec package
KSqr - - QM quality report
KSer - - QM error report
KSfd - - filter cache data (MSKSSRV)
KsFI - - filter instance
KSns - - null security object
KSnv - - registry name value
KSoh - - object header
KSop - - object creation parameters
KSpc - - port driver instance FsContext
KSPI - - pin instance
KSpp - - irp system buffer property/method/event parameter
KSpt - - pin type list (MSKSSRV)
KSqf - - query information file buffer
KSsc - - port driver stream FsContext
KSsf - - set information file buffer
KSsh - - stream headers
KSsi - - software bus interface
KSsl - - symbolic link buffer (MSKSSRV)
KSsp - - serialized property set
KsoO - - WDM audio stuff
L2CA - bthport.sys - Bluetooth port driver (L2CAP)
L2T0 - - ndis\l2tp / MTAG_FREED
L2T1 - - ndis\l2tp / MTAG_ADAPTERCB
L2T2 - - ndis\l2tp / MTAG_TUNNELCB
L2T3 - - ndis\l2tp / MTAG_VCCB
L2T4 - - ndis\l2tp / MTAG_VCTABLE
L2T5 - - ndis\l2tp / MTAG_WORKITEM
L2T6 - - ndis\l2tp / MTAG_TIMERQ
L2T7 - - ndis\l2tp / MTAG_TIMERQITEM
L2T8 - - ndis\l2tp / MTAG_PACKETPOOL
L2T9 - - ndis\l2tp / MTAG_FBUFPOOL
L2Ta - - ndis\l2tp / MTAG_HBUFPOOL
L2Tb - - ndis\l2tp / MTAG_TDIXRDG
L2Tc - - ndis\l2tp / MTAG_TDIXSDG
L2Td - - ndis\l2tp / MTAG_CTRLRECD
L2Te - - ndis\l2tp / MTAG_CTRLSENT
L2Tf - - ndis\l2tp / MTAG_PAYLRECD
L2Tg - - ndis\l2tp / MTAG_PAYLSENT
L2Th - - ndis\l2tp / MTAG_INCALL
L2Ti - - ndis\l2tp / MTAG_UTIL
L2Tj - - ndis\l2tp / MTAG_ROUTEQUERY
L2Tk - - ndis\l2tp / MTAG_ROUTESET
L2Tl - - ndis\l2tp / MTAG_L2TPPARAMS
L2Tm - - ndis\l2tp / MTAG_TUNNELWORK
L2Tn - - ndis\l2tp / MTAG_TDIXROUTE
LANE - atmlane.sys - LAN Emulation Client for ATM
LB?? - - LM Datagram receiver allocations
LBan - - Server announcement
LBvb - - View buffer
LBma - - Master announce context
LBxp - - Transport
LBxn - - TransportName
LBxm - - Master name
LBtn - - Transport name
LBea - - Ea buffer
LBdi - - POOL_DOMAIN_INFO
LBds - - Send datagram context
LBci - - Connection info
LBmh - - Mailslot header
LBbl - - Backup List
LBsl - - Browser server list
LBbs - - Browser server
LBgb - - GetBackupList request
LBbr - - GetBackupList response
LBmb - - Mailslot Buffer
LBid - - Illegal datagram context
LBbn - - Name
LBnn - - Name name
LBic - - IRP context
LBwi - - Work item
LBel - - Election context
LBbb - - Become backup context
LBbr - - Become backup request
LBpn - - Paged Name
LBpt - - Paged transport
LBse - - Browser security
Lbuf - - EXIFS Large Buffer
LeGe - tcpip.sys - Legacy Registry Mapping Module Buffers
LeoC - - Symantec/Norton AntiVirus filter driver
List - - kernel utilities list allocation
LCam - - WDM mini video capture driver for Logitech camera
Lfs - - Lfs allocations
LfsI - - Lfs allocations
LogA - clfsapimp.sys - CLFS Kernel API test driver
LpcZ - - LPC Zone
LpcM - - Local procedure call message blocks
Lr?? - - LM redirector allocations
Lr - - Generic allocations
Lrcx - - Context blocks of various types
Lrcl - - ConnectListEntries
Lrsl - - ServerListEntries
Lrse - - Security entry
Lrsc - - Search Control Blocks
Lrea - - EA related allocations
Lric - - Instance Control Blocks
Lrfc - - File Control Blocks
Lrfl - - Fcb Locks
Lrfp - - Fcb Paging locks
Lrcn - - Computer Name
Lrdn - - Domain Name
Lr?? - - Buffers used for FsControlFile APIs
Lrlc - - Lock Control Blocks
Lrlb - - Lock Control Block buffers
Lrnf - - Non paged FCB
Lrnt - - Non paged transport
Lrps - - Paged security entry
Lrte - - Transport event.
Lrxx - - Transceive context blocks
Lr!! - - Cancel request context blocks
Lrmt - - MPX table
Lrme - - MPX table entries
Lrsx - - Send contexts
Lraw - - Async write context
Lrwb - - Write behind buffer header
Lrbb - - Write behind buffer
Lrwq - - Work queue item
Lrac - - ACL for redirector
Lrds - - Security Descriptor for redirector
Lrsm - - SMB buffer
Lrds - - Duplicated ansi string
Lrdu - - Duplicated unicode string
Lxpt - - Transport
Lrtc - - Transport connection
Lrna - - Netbios Addresses
Lrca - - Temporary storage used in name canonicalization
Lr2x - - Transact SMB context
Lrpt - - Primary transport server list
Lrso - - Operating system name
Lref - - Reference history (debug only)
LS?? - - LM server allocations
LSac - - BlockTypeAdminCheck
LSas - - BlockTypeAdapterStatus
LSbf - - buffer descriptor
LScd - - comm device
LScn - - connection
LSdb - - data buffer
LSdc - - BlockTypeDirCache
LSdi - - BlockTypeDirectoryInfo
LSep - - endpoint
LSfn - - BlockTypeFSName
LSlf - - LFCB
LSlr - - BlockTypeLargeReadX
LSmf - - MFCB
LSmi - - BlockTypeMisc
LSnh - - nonpaged block header
LSni - - BlockTypeNameInfo
LSop - - oplock break wait
LSpc - - paged connection
LSpm - - paged MFCB
LSpr - - paged RFCB
LSrf - - RFCB
LSsc - - search(core)
LSsd - - BlockTypeShareSecurityDescriptor
LSsf - - BlockTypeDfs
LSsh - - share
LSsp - - search(core complete)
LSsr - - search
LSss - - session
LStb - - table
LStc - - tree connect
LSti - - timer
LStr - - transaction
LSvi - - BlockTypeVolumeInformation
LSwi - - initial work context
LSwn - - normal work context
LSwq - - BlockTypeWorkQueue
LSwr - - raw work context
LSws - - BlockTypeWorkContextSpecial
LSnd - - WDM mini sound driver for Logitech video camera
Luaf - luafv.sys - LUA File Virtualization
LXMK - - kernel mixer line driver (KMXL - looks like they got their tag backwards)
MXF - - DirectMusic (MIDI Transform Filter)
MapP - - PNP map
Mapr - - arc firmware registry routines
McaC - hal.dll - HAL MCA corrected Log
McaD - hal.dll - HAL MCA Driver Log
McaK - hal.dll - HAL MCA Kernel Log
McaP - hal.dll - HAL MCA Log from previous boot
McaT - hal.dll - HAL MCA temporary Log
Mdp - netio.sys - Memory Descriptor Lists
MCAM - - WDM mini driver for Intel USB camera
MCDx - - OpenGL MCD server (mcdsrv32.dll) allocations
MCDd - - OpenGL MCD driver (embedded in a display driver like s3mvirge.dll)
Mdl - - Io, Mdls
MdlP - - MDL per processor lookaside list pointers
MePr - - In-memory print buffer
mkup - mpsdrv.sys - MPSDRV upcall request
Mm - nt!mm - general Mm Allocations
MmAc - nt!mm - Mm access log buffers
MmBk - nt!mm - Mm banked sections
MmCa - nt!mm - Mm control areas for mapped files
MmCd - nt!mm - Mm fork clone descriptors
MmCh - nt!mm - Mm fork clone headers
MmCi - nt!mm - Mm control areas for images
MmCl - nt!mm - Mm fork clone prototype PTEs
MmCm - nt!mm - Calls made to MmAllocateContiguousMemory
MmCr - nt!mm - Mm fork clone roots
MmCt - nt!mm - Mm debug tracing
MmDb - nt!mm - NtMapViewOfSection service
MmDT - nt!mm - Mm debug
MmEx - nt!mm - Mm events
MmHi - nt!mm - Mm image entry - allocated per session
MmHn - nt!mm - Mm sessionwide address name string entry
MmHv - nt!mm - Mm sessionwide address entry
MmIn - nt!mm - Mm inpaged io structures
MmLd - nt!mm - Mm load module database
MmPd - nt!mm - Mm page table commitment bitmaps
MmPg - nt!mm - Mm page table pages at init time
MmRp - nt!mm - Mm repurpose logging
MmRw - nt!mm - Mm read write virtual memory buffers
MmSb - nt!mm - Mm subsections
MmSe - nt!mm - Mm secured VAD allocation
MmSg - nt!mm - Mm segments
MmSt - nt!mm - Mm section object prototype ptes
MmSy - nt!mm - Mm PTE and IO tracking logs
Mmdl - nt!mm - Mm Mdls for flushes
Mmpp - nt!mm - Mm prototype PTEs for pool
Mmpr - nt!mm - Mm physical VAD roots
MmVd - nt!mm - Mm virtual address descriptors for mapped views
MmVs - nt!mm - Mm virtual address descriptors short form (private views)
Mmxx - nt!mm - Mm temporary allocations
MmCx - nt!mm - info for dynamic section extension
MmDm - nt!mm - deferred MmUnlock entries
MmHt - nt!mm - session space PTE data
MmLn - nt!mm - temporary name buffer for driver loads
MmMl - nt!mm - physical memory range information
MmPa - nt!mm - pagefile space deletion slist entries
MmRl - nt!mm - temporary readlists for file prefetch
MmSP - nt!mm - SLIST entries for system PTE NB queues
MmSi - nt!mm - Control area security image stubs
MmSc - nt!mm - subsections used to map data files
MmSd - nt!mm - extended subsections used to map data files
MmSm - nt!mm - segments used to map data files
MmWe - nt!mm - Work entries for writing out modified filesystem pages.
MmWw - nt!mm - Write watch VAD info
Mmpv - nt!mm - Physical view VAD info
Mmww - nt!mm - Write watch bitmap VAD info
MmSW - nt!mm - Store write support
MmCS - nt!mm - Pagefile CRC verification buffer
Mn01 - monitor.sys - ACPI method evaluation output buffer
Mn02 - monitor.sys - Unused
Mn03 - monitor.sys - Raw E-EDID v.1.x byte stream including base block + extension blocks (if any)
Mn04 - monitor.sys - Cached monitor ID WMI data block
Mn05 - monitor.sys - Cached monitor basic display parameters WMI data block
Mn06 - monitor.sys - Cached monitor analog video input parameters WMI data block
Mn07 - monitor.sys - Cached monitor digitial video input parameters WMI data block
Mn08 - monitor.sys - Cached monitor color characteristics WMI data block
Mn09 - monitor.sys - Cached supported monitor source modes WMI data block
Mn0A - monitor.sys - Registry subkey info buffer
Mn0B - monitor.sys - Registry value buffer
Mn0C - monitor.sys - Cached supported monitor frequency ranges WMI data block (overrides from registry)
Mn0D - monitor.sys - Cached supported monitor frequency ranges WMI data block (from E-EDID v.1.x base block)
Mn0E - monitor.sys - Buffer for E-EDID v.1.x base block, if any, populated by miniport
Mn0F - monitor.sys - Buffer for E-EDID v.1.x extension block(s), if any, populated by miniport
MNFf - msnfsflt.sys - NFS FS Filter, filename buffer
MNFi - msnfsflt.sys - NFS FS Filter, instance name buffer
MNFr - msnfsflt.sys - NFS FS Filter, registry access buffer
MNFs - msnfsflt.sys - NFS FS Filter, general string buffer
MNFv - msnfsflt.sys - NFS FS Filter, volume name buffer
MNFC - msnfsflt.sys - NFS FS Filter, callback context
MNFF - msnfsflt.sys - NFS FS Filter, file context
MNFI - msnfsflt.sys - NFS FS Filter, instance context
MNFS - msnfsflt.sys - NFS FS Filter, stream context
MNFT - msnfsflt.sys - NFS FS Filter, thread array
MQAA - mqac.sys - MSMQ driver, AVL allocations
MQAB - mqac.sys - MSMQ driver, CCursor allocations
MQAC - mqac.sys - MSMQ driver, generic allocations
MQAD - mqac.sys - MSMQ driver, CDistribution allocations
MQAG - mqac.sys - MSMQ driver, CGroup allocations
MQAH - mqac.sys - MSMQ driver, Heap allocations
MQAP - mqac.sys - MSMQ driver, CPacket allocations
MQAQ - mqac.sys - MSMQ driver, CQueue allocations
MQAT - mqac.sys - MSMQ driver, CTransaction allocations
MRXx - - Client side caching for SMB
Msdv - - WDM mini driver for IEEE 1394 DV Camera and VCR
MST? - - MSTEE (mstee.sys)
MSTa - - associated stream header
MSTc - - filer connection
MSTd - - data format
MSTf - - filter instance
MSTp - - pin instance
MSTs - - stream header
MuoC - - MOUSE_POOL_TAG Mouse Class Driver
MsFc - - Mailslot CCB, Client control block. Each client with an opened mailslot has one of these
MsFC - - Mailslot root CCB, A client control block for the top level mailslot directory
MsFd - - Mailslot data entry write buffer, This is writes buffered inside mailslots
MsFD - - Mailslot root DCB and its name buffer
MsFf - - Mailslot FCB, File control block, Service side block for each created mailslot.
MsFg - - Mailslot global resource
MsFn - - Mailslot temporary name buffer
MsFN - - Mailslot FCB name buffer, name for each created mailslot
MsFr - - Mailslot read buffer, buffer created for pended reads issued.
MsFt - - Mailslot query template, used for directory queries.
MsFw - - Mailslot work context block, blocks create when we need to timeout reads.
MsvC - ksecdd.sys - Msv/Ntlm client package
Mup - mup.sys - Multiple UNC provider allocations, generic
MupI - mup.sys - Windows Server 2003 and prior versions: DFS Irp Context allocation
MuDn - mup.sys - Device name
MuFc - mup.sys - File Context
MuFn - mup.sys - File name rewrite
MuIc - mup.sys - IRP Context
MuMc - mup.sys - Master context
MuQc - mup.sys - Query context
MuSi - mup.sys - Surrogate info
MuSf - mup.sys - Surrogate file info
MuSr - mup.sys - Surrogate IRP info
MuPe - mup.sys - Known prefix entry
MuPi - mup.sys - Provider info
MuUn - mup.sys - UNC provider
Muta - - Mutant objects
Nbuf - netio.sys - NetIO Memory Descriptor List allocations
NBF - - general NBF allocations
NBFa - - NBF address object
NBFb - - NBF receive buffer
NBFc - - NBF connection object
NBFd - - NBF packet pool descriptor
NBFe - - NBF bind & export names
NBFf - - NBF address file object
NBFg - - NBF registry path name
NBFi - - NBF tdi connection info
NBFk - - NBF loopback buffer
NBFl - - NBF link object
NBFn - - NBF netbios name
NBFo - - NBF config data
NBFp - - NBF packet
NBFq - - NBF query buffer
NBFr - - NBF request
NBFs - - NBF provider stats
NBFt - - NBF connection table
NBFu - - NBF UI frame
NBFw - - NBF work item
NBI - - NwlnkNb transport
NBS - - general NetBIOS allocations
NBSa - - address block
NBSc - - connection block
NBSe - - EA buffer
NBSf - - FCB
NBSl - - LANA block
NBSn - - copy of user NCB
NBSr - - registry allocations
NBSx - - XNS NETONE address (connect block)
NBSy - - NetBIOS address (connect block)
NBSz - - NetBIOS address (listen block)
NBqh - - Non-blocking queue entries used to carry the real data in the queue.
NCSt - - EXIFS NC
ND - ndis.sys - general NDIS allocations
NDDl - ndis.sys - NDIS_TAG_DBG_LOG
NDMb - ndis.sys - NDIS_TAG_MAC_BLOCK
NDPX - ndis.sys - NDIS Proxy allocations
NDPa - ndis.sys - Apple Talk
NDPb - ndis.sys - NBF
NDPi - ndis.sys - NWLNKIPX
NDPn - ndis.sys - NWLNKNB
NDPp - ndis.sys - Packet Scheduler.
NDPs - ndis.sys - NWLNKSPX
NDPt - ndis.sys - TCPIP
NDPw - ndis.sys - WAN_PACKET_TAG
NDTr - ndis.sys - NDIS_TAG_TRANSFER_DATA
NDam - ndis.sys - NdisAllocateMemory
NDan - ndis.sys - adapter name
NDar - ndis.sys - NDIS_TAG_ALLOCATED_RESOURCES
NDas - ndis.sys - NDIS_TAG_ALLOC_SHARED_MEM_ASYNC
NDbi - ndis.sys - NDIS_TAG_BUS_INTERFACE
NDca - ndis.sys - NDIS_TAG_NET_CFG_OPS_ACL
NDch - ndis.sys - NDIS_TAG_CONFIG_HANDLE
NDcm - ndis.sys - NDIS_TAG_CM
NDcn - ndis.sys - NDIS_TAG_CANCEL_DEVICE_NAME
NDco - ndis.sys - NDIS_TAG_CO
NDcs - ndis.sys - NDIS_TAG_NET_CFG_OPS_ID
NDd - ndis.sys - NDIS_TAG_DBG
NDda - ndis.sys - NDIS_TAG_NET_CFG_DACL
NDdb - ndis.sys - DMA block
NDdi - ndis.sys - NDIS_TAG_IM_DEVICE_INSTANCE
NDdl - ndis.sys - NDIS_TAG_DBG_L
NDdp - ndis.sys - NDIS_TAG_DBG_P
NDds - ndis.sys - NDIS_TAG_DBG_S
NDdt - ndis.sys - NDIS_TAG_DFRD_TMR
NDfa - ndis.sys - NDIS_TAG_FILTER_ADDR
NDfb - ndis.sys - NDIS_TAG_LWFILTER_BLOCK
NDfd - ndis.sys - NDIS_TAG_FILE_DESCRIPTOR
NDfi - ndis.sys - NDIS_TAG_FILE_IMAGE
NDfm - ndis.sys - NDIS_TAG_FAKE_MAC
NDfn - ndis.sys - NDIS_TAG_FILE_NAME
NDfv - ndis.sys - NDIS_TAG_LWFILTER_DRIVER
NDif - ndis.sys - NDIS_TAG_IF
NDlb - ndis.sys - lookahead buffer
NDlp - ndis.sys - NDIS_TAG_LOOP_PKT
NDmb - ndis.sys - MAC block
NDmo - ndis.sys - NDIS_TAG_M_OPEN_BLK
NDmr - ndis.sys - map register entry array
NDmt - ndis.sys - NDIS_TAG_MEDIA_TYPE_ARRAY
NDnd - ndis.sys - NDIS_TAG_POOL_NDIS
NDoa - ndis.sys - NDIS_TAG_OID_ARRAY
NDob - ndis.sys - open block
NDoc - ndis.sys - NDIS_TAG_OPEN_CONTEXT
NDof - ndis.sys - NDIS_TAG_OFFLOAD
NDop - ndis.sys - NDIS_TAG_PM_PROT_OFFLOAD
NDpb - ndis.sys - protocol block
NDpc - ndis.sys - NDIS_TAG_PROTOCOL_CONFIGURATION
NDpf - ndis.sys - NDIS_TAG_FILTER
NDpk - ndis.sys - NDIS_TAG_PKT_PATTERN
NDpn - ndis.sys - NDIS_TAG_PARAMETER_NODE
NDpo - ndis.sys - NDIS_TAG_PORT
NDpp - ndis.sys - packet pool
NDpr - ndis.sys - NDIS_TAG_PERIODIC_RECEIVES
NDpw - ndis.sys - NDIS_TAG_WOL_PATTERN
NDqu - ndis.sys - NDIS_TAG_QUEUE
NDrc - ndis.sys - NDIS_TAG_RWL_REFCOUNT
NDrd - ndis.sys - NDIS_TAG_REG_READ_DATA_BUFFER
NDre - ndis.sys - NDIS_TAG_OID_REQUEST
NDrf - ndis.sys - NDIS_TAG_RECEIVE_FILTER
NDrl - ndis.sys - resource list
NDrp - ndis.sys - NDIS_TAG_REGISTRY_PATH
NDrq - ndis.sys - NDIS_TAG_Q_REQ
NDrt - ndis.sys - NDIS_TAG_RST_NBL
NDrw - ndis.sys - NDIS_TAG_RWLOCK
NDsd - ndis.sys - NDIS_TAG_NET_CFG_SEC_DESC
NDse - ndis.sys - NDIS_TAG_SECURITY
NDsg - ndis.sys - NDIS_TAG_DOUBLE_BUFFER_PKT
NDsh - ndis.sys - NDIS_TAG_SHARED_MEMORY
NDsi - ndis.sys - EISA slot information
NDsm - ndis.sys - Cached shared memory descriptor
NDst - ndis.sys - NDIS_TAG_STRING
NDvm - ndis.sys - NDIS_TAG_ALLOC_MEM_VERIFY_ON
NDw0 - ndis.sys - NDIS_TAG_WMI_REG_INFO
NDw1 - ndis.sys - NDIS_TAG_WMI_GUID_TO_OID
NDw2 - ndis.sys - NDIS_TAG_WMI_OID_SUPPORTED_LIST
NDw3 - ndis.sys - NDIS_TAG_WMI_EVENT_ITEM
NDwh - ndis.sys - NDIS_TAG_WRAPPER_HANDLE
NDwi - ndis.sys - NDIS_TAG_WORK_ITEM
NDwr - ndis.sys - NDIS_TAG_WMI_REQUEST
NDwx - ndis.sys - NDIS_TAG_WOL_XLATE
NDxc - ndis.sys - NDIS_TAG_POOL_XLATE
Net - tcpip.sys - NetIO Generic Buffers (iBFT Table allocations)
NeWQ - tcpip.sys - NetIO WorkQueue Data
NEEB - newt_ndis6.sys - NEWT Emulation Bench
NEFT - newt_ndis6.sys - NEWT Filter Object
NEIM - newt_ndis6.sys - NEWT IM Object
NEOD - newt_ndis6.sys - NEWT OID
NEPK - newt_ndis6.sys - NEWT Packet
NEWI - newt_ndis6.sys - NEWT Work Item
Nb?? - - NetBT allocations
Nf?? - nfssvr.sys - NFS (Network File System) allocations
NfR? - nfsrdr.sys - NFS (Network File System) client re-director
Nls - - Nls strings
NlsK - nt!ex - Nls data
Nmdd - - NetMeeting display driver miniport 1 MB block
Nhfs - tcpip.sys - NetIO Hash Function State Data
Navl - tcpip.sys - Network Layer AVL Tree allocations
NLbd - tcpip.sys - Network Layer Buffer Data
NLcc - tcpip.sys - Network Layer Client Contexts
NLpd - tcpip.sys - Network Layer Client Requests
NLcp - tcpip.sys - Network Layer Compartments
NLuh - - Network Layer Ul Handles
NLap - tcpip.sys - Network Layer Netio Helper Function allocations
NLNa - tcpip.sys - Network Layer Network Address Lists
NMhf - netio.sys - Handle Factory pool
NMpt - - Generic AVL Tree allocations
NMRb - tcpip.sys - Network Module Registrar Bindings
NMRc - tcpip.sys - Network Module Registrar Arrays
NMRf - tcpip.sys - Network Module Registrar Filters
NMRg - tcpip.sys - Network Module Registrar Generic Buffers
NMRm - tcpip.sys - Network Module Registrar Modules
NMRn - tcpip.sys - Network Module Registrar Network Protocol Identifiers
Nnbl - netio.sys - NetIO NetBufferLists
Nnbf - netio.sys - NetIO NetBuffers
Nnnn - netio.sys - NetIO NetBuffers And NetBufferLists
Nph1 - netio.sys - NetIO Protocol Header1 Data
Nph2 - netio.sys - NetIO Protocol Header2 Data
None - - call to ExAllocatePool
Npf* - npfs.sys - Npfs Allocations
NpFc - npfs.sys - CCB, client control block
NpFC - npfs.sys - ROOT_DCB CCB
NpFD - npfs.sys - DCB, directory block
NpFg - npfs.sys - Global storage
NpFi - npfs.sys - NPFS client info buffer.
NpFn - npfs.sys - Name block
NpFq - npfs.sys - Query template buffer used for directory query
NpFr - npfs.sys - DATA_ENTRY records (read/write buffers)
NpFs - npfs.sys - Client security context
NpFw - npfs.sys - Write block
NpFW - npfs.sys - Write block
Npta - - NPT Addresses
Nptx - - NPT Packets
Nptr - - NPT Receive Completes
Npts - - NPT Send sCompletes
NS?? - - Netware server allocations
NSIk - nsi.dll - NSI RPC Tansactions
NSIr - nsi.dll - NSI Generic Buffers
NSpc - nsi.dll - NSI Proxy Contexts
NSpg - nsi.dll - NSI Proxy Generic Buffers
Ntf? - ntfs.sys - NTFS Specific allocation tags
Ntf0 - ntfs.sys - general pool allocation
Ntf9 - ntfs.sys - Large Temporary Buffer
NtfC - ntfs.sys - CCB
Ntfc - ntfs.sys - CCB_DATA
Ntfd - ntfs.sys - DEALLOCATED_CLUSTERS
NtfD - ntfs.sys - DEALLOCATED_RECORDS
NtfE - ntfs.sys - INDEX_CONTEXT
NtfF - ntfs.sys - FCB_INDEX
Ntff - ntfs.sys - FCB_DATA
NtfI - ntfs.sys - NTFS_IO_CONTEXT
Ntfi - ntfs.sys - IRP_CONTEXT
NtfK - ntfs.sys - KEVENT
Ntfk - ntfs.sys - FILE_LOCK
Ntfl - ntfs.sys - LCB
NtfM - ntfs.sys - NTFS_MCB_ENTRY
Ntfm - ntfs.sys - NTFS_MCB_ARRAY
NtfN - ntfs.sys - NUKEM
Ntfn - ntfs.sys - SCB_NONPAGED
Ntfo - ntfs.sys - SCB_INDEX normalized named buffer
NtfQ - ntfs.sys - QUOTA_CONTROL_BLOCK
Ntfq - ntfs.sys - General Allocation with Quota
NtfR - ntfs.sys - READ_AHEAD_THREAD
Ntfr - ntfs.sys - ERESOURCE
NtfS - ntfs.sys - SCB_INDEX
Ntfs - ntfs.sys - SCB_DATA
NtfT - ntfs.sys - SCB_SNAPSHOT
Ntft - ntfs.sys - SCB (Prerestart)
Ntfu - ntfs.sys - DEVICE_MANAGE_DATA_SET_ATTRIBUTES or NTFS_MARK_UNUSED_CONTEXT
NtfV - ntfs.sys - VPB
Ntfv - ntfs.sys - COMPRESSION_SYNC
Ntfw - ntfs.sys - Workspace
Ntfx - ntfs.sys - General Allocation
NtF? - ntfs.sys - NTFS tags based on source module
NtFa - ntfs.sys - AllocSup.c
NtFA - ntfs.sys - AttrSup.c
NtFB - ntfs.sys - BitmpSup.c
NtFC - ntfs.sys - Create.c
NtFD - ntfs.sys - DevioSup.c
NtFd - ntfs.sys - DirCtrl.c
NtFE - ntfs.sys - Ea.c
NtFF - ntfs.sys - FileInfo.c
NtFf - ntfs.sys - FsCtrl.c
NtFH - ntfs.sys - SelfHeal.c
NtFI - ntfs.sys - IndexSup.c
NtFL - ntfs.sys - LogSup.c
NtFM - ntfs.sys - McbSup.c
NtFN - ntfs.sys - NtfsData.c
NtFO - ntfs.sys - ObjIdSup.c
NtFQ - ntfs.sys - QuotaSup.c
NtFR - ntfs.sys - RestrSup.c
NtFS - ntfs.sys - SecurSup.c
NtFs - ntfs.sys - StrucSup.c
NtFU - ntfs.sys - usnsup.c
NtFV - ntfs.sys - VerfySup.c
NtFv - ntfs.sys - ViewSup.c
NtFW - ntfs.sys - Write.c
NulB - tlnull.sys - Null TDI Buffers
NulR - tlnull.sys - Null TDI Requests
NulS - tlnull.sys - Null TDI Sockets
NulE - tlnull.sys - Null Tl Endpoints
Null - tlnull.sys - Null TL Generics
NulI - tlnull.sys - Null TL Indications
Nulr - tlnull.sys - Null Tl Requests
NV - - nVidia video driver
NvLA - - nVidia video driver
NvLa - - nVidia video driver
NvLC - - nVidia video driver
NvLc - - nVidia video driver
NvLD - - nVidia video driver
NvLd - - nVidia video driver
NvLE - - nVidia video driver
NvLH - - nVidia video driver
NvLm - - nVidia video driver
NvLP - - nVidia video driver
NvLp - - nVidia video driver
NvLR - - nVidia video driver
NvLr - - nVidia video driver
NvLS - - nVidia video driver
NvLs - - nVidia video driver
NvLT - - nVidia video driver
Nwcs - - Client Services for NetWare
NwFw - - ntos\tdi\fwd
ObSq - nt!ob - object security descriptors (query)
ObCi - nt!ob - captured information for ObCreateObject
ObCI - nt!ob - object creation lookaside list
ObDi - nt!ob - object directory
ObHd - nt!ob - object handle count data base
ObNm - nt!ob - object names
ObNM - nt!ob - name buffer per processor lookaside pointers
ObRt - nt!ob - object reference stack tracing
ObZn - nt!ob - object zone
ObjT - nt!ob - object type objects
Obtb - nt!ob - object tables via EX handle.c
ObTR - nt!ob - object table ERESOURCEs
Obeb - nt!ob - object tables extra bit tables via EX handle.c
ObDm - nt!ob - object device map
ObSc - nt!ob - Object security descriptor cache block
ObSt - nt!ob - Object Manager temporary storage
OHCI - - Open Host Controller Interface for USB
ohci - - 1394 OHCI host controller driver
OlmC - tcpip.sys - Offload Manager Connections
OlmI - tcpip.sys - Offload Manager Interfaces
Ovfl - - The internal pool tag table has overflowed - usually this is a result of nontagged allocations being made
OvfL - - EXIFS FCBOVF List
PaeD - - PAE top level directory allocation blocks
ParC - - Parallel class driver
ParL - - Parallel link driver
ParP - - Parallel port driver
ParV - - ParVdm driver for vdm<->parallel port communciation
PciB - pci.sys - PnP pci bus enumerator
Pccr - pacer.sys - PACER Filter Clone Requests
Pcfc - pacer.sys - PACER Filter Contexts
Pcfl - pacer.sys - PACER Flows
Pcge - pacer.sys - PACER Generic Buffers (DACL, SID allocations)
Pcle - pacer.sys - PACER Lines
Pclt - pacer.sys - PACER Line Tables
Pcna - pacer.sys - PACER Filter Network Addresses
Pcnt - pacer.sys - PACER NetBufferTimes
Pcop - pacer.sys - PACER Original Packet Contexts
Pcpc - pacer.sys - PACER Packet Contexts
Pcsb - pacer.sys - PACER Send Buffers
Pcta - pacer.sys - PACER Timer Units
Pctw - pacer.sys - PACER Timer Wheels
Pcwc - pacer.sys - PACER WAN NetworkBufferList CTXs
PcCi - - WDM audio port class adapter device object stuff
PcCr - - WDM audio stuff
PcDi - - WDM audio stuff
PcDm - - DirectMusic MXF objects (WDM audio)
PcFM - - WDM audio FM synthesizer
PcFp - - WDM audio stuff
PcIc - - WDM audio stuff
PcIl - - WDM audio stuff
PcNw - - WDM audio stuff
PcPc - - WDM audio stuff
PcPr - - WDM audio stuff
PcSX - - WDM audio stuff
PcSl - - WDM audio stuff
PcSt - - WDM audio stuff
PcSx - - WDM audio stuff
PcUs - - WDM audio stuff
Pcmc - pcmcia.sys - Pcmcia bus enumerator, general structures
Pcic - - Pcmcia bus enumerator, PCIC/Cardbus controller specific structures
Pcdb - - Pcmcia bus enumerator, Databook controller specific structures
Petw - pacer.sys - PACER ETW
Pf?? - nt!pf - Pf Allocations
PfAL - nt!pf - Pf Application launch event data
PfAS - nt!pf - Pf Prefetch support array
PfDq - nt!pf - Pf Directory query buffers
PfED - nt!pf - Pf Generic event data
PfEL - nt!pf - Pf Event logging buffers
PfET - nt!pf - Pf Entry info tables
PfFH - nt!pf - Pf RpContext FileKeyHash buckets
PfFK - nt!pf - Pf RpContext FileKeyHashEntry
PfLB - nt!pf - Pf Log buffers
PfMP - nt!pf - Pf Prefetch metadata buffers
PfNL - nt!pf - Pf Name logging buffers
PfOB - nt!pf - Pf Oplock buffers
PfPB - nt!pf - Pf Pfn query buffers
PfRL - nt!pf - Pf Prefetch read list
PfRQ - nt!pf - Pf Prefetch request buffers
PfSA - nt!pf - Pf Prefetch support array
PfTD - nt!pf - Pf Trace Dump
PfTt - nt!pf - Pf Translation tables
PfVA - nt!pf - Pf VA prefetching buffers
PfVH - nt!pf - Pf Prefetch volume handles
Pfcs - pacer.sys - PACER Flow Counter Sets
Pfhc - pacer.sys - PACER File Handle Contexts
PcwC - nt!pcw - PCW Counter set
PcwR - nt!pcw - PCW provider Registration
PcwI - nt!pcw - PCW counter set Instance
PcwQ - nt!pcw - PCW Query item
PcwS - nt!pcw - PCW System call buffer
PcwT - nt!pcw - PCW Temporary (short-lived) buffer
Pgm? - - Pgm (Pragmatic General Multicast) protocol: RMCast.sys
Plcp - - Cache aware pushlock list (array of puchlock addresses)
Plcl - - Cache aware pushlock entry. One per processor
PlMp - storport.sys - PortpReadDriverParameterEntry
PlRB - storport.sys - PortAllocateRegistryBuffer storport!_PORT_REGISTRY_INFO.Buffer
PmpA - portmap.sys - Portmap address list
PmpC - portmap.sys - Portmap device context
PmpM - portmap.sys - Portmap mapping
PmpR - portmap.sys - Portmap RPCB
PmAT - partmgr.sys - Partition Manager attributes table cache
PmDD - partmgr.sys - Partition Manager device descriptor
PmIB - partmgr.sys - Partition Manager buffer for IOCTL processing
PmME - partmgr.sys - Partition Manager migration entry
PmPE - partmgr.sys - Partition Manager partition entry
PmPT - partmgr.sys - Partition Manager partition table cache
PmRL - partmgr.sys - Partition Manager remove lock
PmRP - partmgr.sys - Partition Manager registry path
PmRR - partmgr.sys - Partition Manager removal relations
PmSD - partmgr.sys - Partition Manager snapshot data cache
PmTE - partmgr.sys - Partition Manager table entry
PmVE - partmgr.sys - Partition Manager volume entry
PNCH - - Power Notify Channel
PNCL - - Power Notify channel list
PNDP - - Power Abort Dpc Routine
PNI - - Power Notify Instance
PoEa - raspppoe.sys - MTAG_ADAPTER
PoEb - raspppoe.sys - MTAG_BINDING
PoEc - raspppoe.sys - MTAG_BUFFERPOOL
PoEd - raspppoe.sys - MTAG_PACKETPOOL
PoEe - raspppoe.sys - MTAG_PPPOEPACKET
PoEf - raspppoe.sys - MTAG_TAPIPROV
PoEg - raspppoe.sys - MTAG_LINE
PoEh - raspppoe.sys - MTAG_CALL
PoEi - raspppoe.sys - MTAG_HANDLETABLE
PoEj - raspppoe.sys - MTAG_HANDLECB
PoEk - raspppoe.sys - MTAG_TIMERQ
PoEl - raspppoe.sys - MTAG_FREED
PoEm - raspppoe.sys - MTAG_LLIST_WORKITEMS
PoEu - raspppoe.sys - MTAG_UTIL
Pool - - Pool tables, etc.
PooL - - Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures
Port - - Port objects
PoSL - - Power shutdown event list
PPMd - - Processor Drivers (Processor Power Management).
PPMi - nt!po - Kernel Processor Power Management Idle States.
PPMp - nt!po - Kernel Processor Power Management Perf States.
PPMw - nt!po - Kernel Processor Power Management WMI interface.
Prof - - Profile objects
POWI - nt!po - Power Work Item (executive worker thread work item entry)
PSwt - nt!po - Power switch structure
PSTA - nt!po - Po registered system state
PDss - nt!po - Po device system state
PpTg - mpsdrv.sys - MPSDRV PPTP GRE analyzer
PpTt - mpsdrv.sys - MPSDRV PPTP TCP analyzer
Prcr - processr.sys - Processr driver allocations
Proc - nt!ps - Process objects
Ps - nt!ps - general ps allocations
Psap - nt!ps - Block used to hold a user mode APC while its queued to a thread
PsAp - nt!ps - Process APC queued by user mode process
PsCa - nt!ps - APC queued at thread create time.
PsCr - nt!ps - Working set change record (temporary allocation)
PsEx - nt!ps - Process exit APC
PsFn - nt!ps - Captured image file name buffer (temporary allocation)
PsHl - nt!ps - Captured list of handles to inherit in child process (temporary allocation)
PsIm - nt!ps - Thread impersonation (PS_IMPERSONATE_INFORMATION, pre-Vista)
PsJa - nt!ps - Job access control state
Psjb - nt!ps - Job set array (temporary allocation)
PsLd - nt!ps - Process LDT information blocks
PsPb - nt!ps - Captured process parameter block (temporary allocation)
PsQb - nt!ps - Process quota block
PsRl - nt!ps - Captured memory reserve list (temporary allocation)
PsSb - nt!ps - Initial process parameter block (temporary allocation)
PsSd - nt!ps - Augmented thread security descriptor (temporary allocation)
PsTf - nt!ps - Job object token filter
Pstb - nt!ps - Process tables via EX handle.c
Psta - nt!ps - Power management system state
PsTp - nt!ps - Thread termination port block
PsWs - nt!ps - Process working set watch array
PSE3 - pse36.sys - Physical Size Extension driver
Pnp0 - nt!pnp - PNPMGR rebalance resource request table
Pnp1 - nt!pnp - PNPMGR IRP completion context
Pnp2 - nt!pnp - PNPMGR device action request
Pnp3 - nt!pnp - PNPMGR dock serial numbers
Pnp4 - nt!pnp - PNPMGR dock state
Pnp5 - nt!pnp - PNPMGR assign resources context
Pnp6 - nt!pnp - PNPMGR resource request
Pnp7 - nt!pnp - PNPMGR deferred notify entry
Pnp8 - nt!pnp - PNPMGR async target device change notify
Pnp9 - nt!pnp - PNPMGR HW profile notify
PnpA - nt!pnp - PNPMGR HW profile event
PnpB - nt!pnp - PNPMGR setup notify
PnpC - nt!pnp - PNPMGR target device notify
PnpD - nt!pnp - PNPMGR device class notify
PnpE - nt!pnp - PNPMGR veto name
PnpF - nt!pnp - PNPMGR eject data
PnpG - nt!pnp - PNPMGR generic
PnpH - nt!pnp - PNPMGR service name
PnpI - nt!pnp - PNPMGR instance path
PnPb - nt!pnp - PnP BIOS resource manipulation
PpEB - nt!pnp - PNP_POOL_EVENT_BUFFER
PpEE - nt!pnp - PNP_DEVICE_EVENT_ENTRY_TAG
PpEL - nt!pnp - PNP_DEVICE_EVENT_LIST_TAG
PpLg - nt!pnp - PnP last good.
PpUB - nt!pnp - PNP_USER_BLOCK_TAG
PpWI - nt!pnp - PNP_DEVICE_WORK_ITEM_TAG
Ppcd - nt!pnp - PnP critical device database
Ppcr - nt!pnp - plug-and-play critical allocations
Ppdd - nt!pnp - new Plug-And-Play driver entries and IRPs
Ppde - nt!pnp - routines to perform device removal
Ppei - nt!pnp - Eisa related code
Ppen - nt!pnp - routines to perform device enumeration
Ppin - nt!pnp - plug-and-play initialization
Ppio - nt!pnp - plug-and-play IO system APIs
PPMi - nt!po - Processor Power Manager Idle States
PPMp - nt!po - Processor Power Manager Perf States
PPMw - nt!po - Processor Power Manager WMI Interface
Ppre - nt!pnp - resource allocation and translation
Pprl - nt!pnp - routines to manipulate relations list
Ppsu - nt!pnp - plug-and-play subroutines for the I/O system
PPTP - - PPTP_MEMORYPOOL_TAG
PPT0 - - PPTP_TDIADDR_TAG
PPT1 - - PPTP_TDICONN_TAG
PPT2 - - PPTP_CONNINFO_TAG
PPT3 - - PPTP_ADDRINFO_TAG
PPT4 - - PPTP_TIMEOUT_TAG
PPT5 - - PPTP_TIMER_TAG
PPT6 - - PPTP_TDICOTS_TAG
PPT7 - - PPTP_WRKQUEUE_TAG
PPT8 - - PPTP_SEND_CTRLDATA_TAG
PPT9 - - PPTP_SEND_ACKDATA_TAG
PPTa - - PPTP_SEND_DGRAMDESC_TAG
PPTb - - PPTP_TDICLTS_TAG
PPTc - - PPTP_RECV_CTRLDESC_TAG
PPTd - - PPTP_RECV_CTRLDATA_TAG
PPTe - - PPTP_RECV_DGRAMDESC_TAG
PPTf - - PPTP_RECV_DGRAMDATA_TAG
PPTg - - PPTP_RECVDESC_TAG
PPTh - - PPTP_ENGINE_TAG
PPTi - - PPTP_RECVDATA_TAG
PRF? - nt!wdi - Performance Allocations
PRFd - nt!wdi - Performance Diagnostics Structures
PSC? - - Packet Scheduler (PSCHED) Tags
PSC0 - - NDIS Request
PSC1 - - GPC Client Vc
PSC2 - - WanLink
PSC3 - - Miscellaneous allocations
PSC4 - - WMI
PSCa - - Adapter
PSCb - - CallParameters
PSCc - - PipeContext
PSCd - - FlowContext
PSCe - - ClassMapContext
PSCf - - Adapter Profile
PSCg - - Component
PX1 - - ndis ProviderEventLookaside
p2?? - perm2dll.dll - Permedia2 display driver
p2d3 - perm2dll.dll - Permedia2 display driver - d3d.c
p2d6 - perm2dll.dll - Permedia2 display driver - d3ddx6.c
p2de - perm2dll.dll - Permedia2 display driver - debug.c
p2ds - perm2dll.dll - Permedia2 display driver - d3dstate.c
p2dt - perm2dll.dll - Permedia2 display driver - d3dtxman.c
p2su - perm2dll.dll - Permedia2 display driver - ddsurf.c
p2en - perm2dll.dll - Permedia2 display driver - enable.c
p2fi - perm2dll.dll - Permedia2 display driver - fillpath.c
p2he - perm2dll.dll - Permedia2 display driver - heap.c
p2hw - perm2dll.dll - Permedia2 display driver - hwinit.c
p2cx - perm2dll.dll - Permedia2 display driver - p2ctxt.c
p2pa - perm2dll.dll - Permedia2 display driver - palette.c
p2pe - perm2dll.dll - Permedia2 display driver - permedia.c
p2tx - perm2dll.dll - Permedia2 display driver - textout.c
P3D? - perm3dd.dll - Permedia3 display driver - DirectDraw/3D
P3G? - perm3dd.dll - Permedia3 display driver
PSHD - pshed.dll - PSHED
PSPi - pshed.dll - PSHED Plug-in
Ppcs - pacer.sys - PACER Pipe Counter Sets
Pwff - pacer.sys - PACER WFP Filters
Pwmi - pacer.sys - PACER WMI notifications
PX1 - ndproxy.sys - PX_EVENT_TAG
PX2 - ndproxy.sys - PX_VCTABLE_TAG
PX3 - ndproxy.sys - PX_ADAPTER_TAG
PX4 - ndproxy.sys - PX_CLSAP_TAG
PX5 - ndproxy.sys - PX_CMSAP_TAG
PX6 - ndproxy.sys - PX_PARTY_TAG
PX7 - ndproxy.sys - PX_COCALLPARAMS_TAG
PX8 - ndproxy.sys - PX_REQUEST_TAG
PX9 - ndproxy.sys - PX_PROVIDER_TAG
PXa - ndproxy.sys - PX_ENUMLINE_TAG
PXb - ndproxy.sys - PX_TAPILINE_TAG
PXc - ndproxy.sys - PX_ENUMADDR_TAG
PXd - ndproxy.sys - PX_TAPIADDR_TAG
PXe - ndproxy.sys - PX_TAPICALL_TAG
PXf - ndproxy.sys - PX_LINECALLINFO_TAG
PXg - ndproxy.sys - PX_CMAF_TAG
PXh - ndproxy.sys - PX_CLAF_TAG
PXi - ndproxy.sys - PX_VC_TAG
PXj - ndproxy.sys - PX_TRANSLATE_CALL_TAG
PXk - ndproxy.sys - PX_TRANSLATE_SAP_TAG
PXl - ndproxy.sys - PX_LINETABLE_TAG
Qnam - - EXIFS Query Name
Qp?? - - Generic Packet Classifier (MSGPC)
Qppn - - Queued Notifications
Qppi - - Pending Irp structures
Qpci - - CfInfo
Qpct - - Client blocks
Qppa - - Pattern blocks
Qphf - - HandleFactory
Qpph - - PathHash
Qprz - - Rhizome
Qppd - - GenPatternDb
Qpfd - - FragmentDb
Qpcf - - ClassificationFamily
Qpcd - - CfInfoData
Qpcb - - ClassificationBlock
Qppt - - Protocol
Qpdg - - Debug
QuU2 - mpsdrv.sys - MPSDRV upcall response
RAWb - nt!RAW - RAW file system buffer
Ra12 - storport.sys - RaidBusEnumeratorAllocateUnitResources storport!_BUS_ENUM_RESOURCES.DataBuffer
RaAM - storport.sys - RaidAllocateAddressMapping storport!_MAPPED_ADDRESS
RaCD - storport.sys - RaUnitScsiGetDumpPointersIoctl
RaDf - storport.sys - RaidInitializeDeferredQueue storport!_RAID_DEFERRED_QUEUE.FreeList
RaDI - storport.sys - RaidUnitGetDeviceId
RaDR - storport.sys - RaidpBuildAdapterBusRelations storport!_DEVICE_RELATIONS
RaDS - storport.sys - StorCreateAnsiString storport!_STRING.Buffer
RaEt - storport.sys - RaidBusEnumeratorProcessBusUnit
RaHI - storport.sys - RaSaveDriverInitData storport!_HW_INITIALIZATION_DATA
RaME - storport.sys - RiAllocateMiniportDeviceExtension
RaPC - storport.sys - RaInitializeConfiguration storport!_PORT_CONFIGURATION_INFORMATION.AccessRanges
RaPD - storport.sys - RaidGetPortData storport!RaidpPortData
RaRL - storport.sys - RaidInitializeResourceList storport!_RAID_RESOURCE_LIST
RaRl - storport.sys - RaidBusEnumeratorAllocateReportLunsResources storport!_BUS_ENUM_RESOURCES.DataBuffer
RaRS - storport.sys - RaidUnitAllocateResources
RaSI - storport.sys - StorUnmapSenseInfo storport!_EXTENDED_REQUEST_BLOCK.Srb.SenseInfoBuffer
RaSN - storport.sys - RaidBusEnumeratorAllocateUnitResources storport!_BUS_ENUM_RESOURCES.SenseInfo
RaSr - storport.sys - RaidAllocateSrb storport!_SCSI_REQUEST_BLOCK
RaTM - storport.sys - RaInitializeTagList storport!_QUEUE_TAG_LIST.Buffer
RaTQ - storport.sys - RaUnitQueryDeviceTextIrp
RaUE - storport.sys - RaidUnitAllocateResources
RaWM - storport.sys - RaidAdapterWmiDeferredRoutine
RaDA - tcpip.sys - Raw Socket Discretionary ACLs
RaEW - tcpip.sys - Raw Socket Endpoint Work Queue Contexts
RaJP - tcpip.sys - Raw Socket Join Path Contexts
RaMI - tcpip.sys - Raw Socket Message Indication Tags
RaPM - tcpip.sys - Raw Socket Partial Memory Descriptor List Tag
RaSM - tcpip.sys - Raw Socket Send Messages Requests
RaSL - tcpip.sys - Raw Socket Send Message Lists
RawE - tcpip.sys - Raw Socket Endpoints
RawN - tcpip.sys - Raw Socket Nsi
RB?? - - RedBook Filter Driver, static allocations
RBEv - - RedBook - Thread Events
RBRl - - RedBook - Remove lock
RBRg - - RedBook - driverExtension->RegistryPath
RBSe - - RedBook - Serialization tracking for checked builds
RBWa - - RedBook - Wait block for system thread
rb?? - - RedBook Filter Driver, dynamic allocations
rbBu - - RedBook - Buffer for read/stream
rbIr - - RedBook - Irp for read/stream
rbIp - - RedBook - Irp pointer block
rbMd - - RedBook - Mdl for read/stream
rbMp - - RedBook - Mdl pointer block
rbRc - - RedBook - Read completion context
rbRx - - RedBook - Read Xtra info
rbSc - - RedBook - Stream completion context
rbSx - - RedBook - Stream Xtra info
rbTo - - RedBook - Cached table of contents
Rcp? - sacdrv.sys - SAC Driver (Headless)
RcpA - sacdrv.sys - Internal memory mgr alloc block
RcpI - sacdrv.sys - Internal memory mgr initial heap block
RcpS - sacdrv.sys - Security related block
RDPD - rdpdr.sys - Device list object
ReEv - - Resource Event
ReSe - - Resource Semaphore
ReTa - - Resource Extended Table
ReTr - - Per ETHREAD EXECUTIVE Resource tracking.
RefT - - Bluetooth reference tracking
Rf?? - - Bluetooth RFCOMM TDI driver
RfAD - rfcomm.sys - RFCOMM Address
RfBB - rfcomm.sys - RFCOMM BRB
RfBT - rfcomm.sys - RFCOMM (bthport)
RfCB - rfcomm.sys - RCOMMM
RfCH - rfcomm.sys - RFCOMM channel
RfCN - rfcomm.sys - RFCOMM connect
RfDA - rfcomm.sys - RFCOMM data
RfFR - rfcomm.sys - RFCOMM frame
RfRX - rfcomm.sys - RFCOMM receive
RfPP - rfcomm.sys - RFCOMM pnp
RfWR - rfcomm.sys - RFCOMM worker
RhHi - tcpip.sys - Reference History Pool
Rind - tcpip.sys - Raw Socket Receive Indications
RKRW - mpsdrv.sys - MPSDRV work item
RTLF - mpsdrv.sys - MPSDRV filter
RmPt - netio.sys - Rtl Mapping Page Table Entries
RpcL - msrpc.sys - debugging log data - present on checked builds only
RpcM - msrpc.sys - all msrpc.sys allocations not covered elsewhere
Rpcr - msrpc.sys - not currently used
RRle - - RTL_RANGE_LIST_ENTRY_TAG
RRlm - - RTL_RANGE_LIST_MISC_TAG
RtPi - - Temp allocation for product type key
Rpcl - msrpc.sys - MSRpc memory logging - checked build only
Rpcm - msrpc.sys - MSRpc memory allocations
Rpcr - msrpc.sys - MSRpc resources
Rpcs - msrpc.sys - Memory shared b/n MSRpc and caller
RPrt - rstorprt.sys - Remote Storage Port Driver
Rqrv - - Registry query buffer
RS?? - - Remote Storage
RSFS - - Recall Queue
RSFN - - File Name
RSSE - - Security info
RSWQ - - Work Queue
RSQI - - Queue info
RSLT - - Long term data
RSIO - - Ioctl Queue
RSFO - - File Obj queue
RSVO - - Validate Queue
RSER - - Error log data
RtlT - nt!rtl - Temporary RTL allocation
RWan - rawwan.sys - Raw WAN driver
R300 - - ATI video driver
RX00 - - ATI video driver
Rx?? - - Rdr2 rdbss.sys stuff
RxSc - - SrvCall
RxNr - - NetRoot
RxVn - - VNetRoot
RxFc - - FCB
RxSo - - SrvOpen
RxFx - - Fobx
RxNf - - nonpaged FCB
RxWq - - work queue
RxBm - - buffering manager
RxMs - - misc.
RxIr - - RxContext (IrpContext)
RxMx - - minirdr dispatch table
RxNc - - NameCache (not currently used)
RxCt - - connection engine transport
RxCa - - connection engine address
RxCc - - connection engine connection
RxCv - - connection engine VC
RxCd - - connection engine TDI
RxSp - - srvcall calldown params (special build only)
RxVp - - vnetroot calldown params (special build only)
RxTm - - timer context (special build only)
RxDc - - querydirectory pattern (special build only)
RxCx - - connection engine misc. (special build only)
S3 - - S3 video driver
SBad - - bad block simulator - simbad.c
sbp2 - - Sbp2 1394 storage port driver
SC?? - - Smart card driver tags
SCLb - - Smart card driver library
SCB8 - - Bull CP8 Transac serial reader
SCB3 - - Bull SmarTlp PnP
SCS4 - - SCM Microsystems pcmcia reader
SCl0 - - Litronic 220
Sc?? - - Mass storage driver tags
ScB? - classpnp.sys - ClassPnP misc allocations
ScB1 - classpnp.sys - Query registry parameters
ScB2 - classpnp.sys - Registry path
ScB4 - classpnp.sys - Storage descriptor header
ScB5 - classpnp.sys - FDO relations
ScC? - classpnp.sys - ClassPnP misc allocations
ScC1 - classpnp.sys - Registry path buffer
ScC2 - classpnp.sys - PDO relations
ScC6 - classpnp.sys - START_UNIT completion context
ScC7 - classpnp.sys - Sense info buffer
ScC8 - classpnp.sys - Registry value name
ScC9 - classpnp.sys - Device Control SRB
ScC? - cdrom.sys - CdRom
ScCA - cdrom.sys - Autorun disable functionality
ScCa - cdrom.sys - Media change detection
ScSB - cdrom.sys - Scratch buffer (usually 64k)
ScCC - cdrom.sys - Ioctl GET_CONFIGURATION
ScCc - cdrom.sys - Context of completion routine
ScCD - cdrom.sys - Adaptor & Device descriptor buffer
ScCd - cdrom.sys - Disc information
ScCe - cdrom.sys - Request sync event
ScCF - cdrom.sys - Feature descriptor
ScCG - cdrom.sys - GESN buffer
ScCI - cdrom.sys - Sense info buffers
ScCi - cdrom.sys - Cached inquiry buffer
ScCM - cdrom.sys - Mode data buffer
SCCO - cdrom.sys - Set stream buffer
ScCo - cdrom.sys - Device Notification buffer
ScCp - cdrom.sys - Play active checks
ScCr - cdrom.sys - Registry string
ScCS - cdrom.sys - Srb allocation
ScCs - cdrom.sys - Assorted string data
ScCU - cdrom.sys - Update capacity path
ScCu - cdrom.sys - Read buffer for dvd key
ScCV - cdrom.sys - Read buffer for dvd/rpc2 check
ScCv - cdrom.sys - Read buffer for rpc2 check
ScCX - cdrom.sys - Security descriptor
ScD? - - Disk
ScD - - generic tag
ScDa - - SMART
ScDA - - Info Exceptions
ScDC - - disable cache paths
ScDb - classpnp.sys - ClassPnP debug globals buffer
ScDc - - disk allocated completion c
ScDG - - disk geometry buffer
ScDg - - update disk geometry paths
ScDI - - sense info buffers
ScDp - - pnp ids
ScDM - - mode data buffer
ScDM - - mbr checksum code
ScDN - - disk name code
ScDP - - read capacity buffer
ScDp - - disk partition lists
ScDS - - srb allocation
ScDs - - start device paths
ScDU - - update capacity path
ScDW - - work-item context
ScMC - - medium changer allocations
ScIO - classpnp.sys - ClassPnP device control
ScL? - classpnp.sys - Classpnp
ScLA - classpnp.sys - allocation to check for autorun disable
ScLF - classpnp.sys - File Object Extension
ScLc - classpnp.sys - Cache filters
ScLf - classpnp.sys - Fault prediction
ScLm - classpnp.sys - Mount
ScLM - classpnp.sys - Media Change Detection
ScLq - classpnp.sys - Release queue
ScLw - classpnp.sys - WMI
ScLW - classpnp.sys - Power
ScNo - classpnp.sys - ClassPnP notification
ScP? - - Scsiport
ScPa - - Hold registry data
ScPA - - Access Ranges
ScPb - - Get Bus Dat Holder
ScPB - - Queuetag BitMap
ScPc - - Fake common buffer
ScPC - - reset bus code
ScPd - - Pnp id strings
ScPD - - SRB_DATA allocations
ScPE - - Scatter gather lists
ScPG - - Global memory
ScPh - - HwDevice Ext
ScPi - - Sense Info
ScPI - - Init data chain
ScPl - - remove lock tracking
ScPL - - scatter gather lists
ScPm - - address mapping lists
ScPM - - scatter gather lists
ScPp - - device & adapter enable
ScpP - - scsi PortConfig copies
ScPq - - inquiry data
ScPQ - - request sense
ScPr - - resource list copy
ScPS - - registry allocations
ScPt - - legacy request rerouting
ScPT - - interface mapping
ScPu - - device relation structs
ScPv - - KEVENT
ScPV - - Device map allocations
ScPw - - Wmi Events
ScPW - - Wmi Requests
ScPx - - Report Luns
ScPY - - Report Targets
ScPZ - - Device name buffer
ScR? - - Partition Manager
ScRi - - IOCTL buffer
ScRp - - Partition entry
ScRr - - Remove lock
ScRt - - Table entry
ScRv - - Dependant volume relations lists
ScRV - - Volume entry
ScRw - - Power mgmt private work item
ScS2 - classpnp.sys - Sense interpretation data
ScsC - - non-pnp SCSI CdRom
ScsD - - non-pnp SCSI Disk
ScsH - - non-pnp SCSI from class.h (class2)
ScsI - - non-pnp SCSI port internal
ScsL - - non-pnp SCSI class.c driver allocations
ScsP - - non-pnp SCSI port.c
Scs$ - - Tag for pnp class driver's SRB lookaside list
ScUn - - Default Tag for pnp class driver allocations
ScV? - - Dvd functionality in cdrom.sys
ScVk - - read buffer for DVD keys
ScVK - - write buffer for DVD keys
ScVS - - buffer for reads of DVD on-disk structures
ScWs - classpnp.sys - Working set
SdCc - - ObsSecurityDescriptorCache / SECURITY_DESCRIPTOR_CACHE_ENTRIES
Sdba - - Application compatibility Sdb* allocations
Sdp? - - Bluetooth SDP functionality in BTHPORT.sys
SdpC - bthport.sys - Bluetooth SDP client connection
SdpD - bthport.sys - Bluetooth SDP database
SdpI - bthport.sys - Bluetooth port driver (SDP)
Se - nt!se - General security allocations
SeAc - nt!se - Security ACL
SeAi - nt!se - Security Audit Work Item
SeAp - nt!se - Security Audit Parameter Record
SeCL - nt!se - Security CONTEXT_TAG
SeDb - nt!se - Temp directory query buffer to delete logon session symbolic links.
SeFS - nt!se - SEP_FILE_SYSTEM_NOTIFY_CONTEXT
SeHa - nt!se - Temp directory query buffer to delete logon session symbolic links.
SeLs - nt!se - Security Logon Session
SeLu - nt!se - Security LUID and Attributes array
SeLS - nt!se - Security Logon Session tracking array
SeLw - nt!se - Security LSA Work Item
SeOn - nt!se - Security Captured Object Name information
SeOt - nt!se - Captured object type array. Used by access check code
SePa - nt!se - Process audit image names and captured polity structures
SePh - nt!se - Dummy image page hash structure. Used when CI is disabled.
SePr - nt!se - Security Privilege Set
SeSa - nt!se - Security SID and Attributes
SeSc - nt!se - Captured Security Descriptor
SeSd - nt!se - Security Descriptor
SeSi - nt!se - Security SID
SeTa - nt!se - Security Temporary Array
SeTd - nt!se - Security Token dynamic part
SeTI - ksecdd.sys - Security TargetInfo
SeTn - nt!se - Security Captured Type Name information
SeUs - nt!se - Security Captured Unicode string
Sect - - Section objects
Sema - - Semaphore objects
Senm - - Serenum (RS-232 serial bus enumerator)
SimB - - Simbad (bad sector simulation driver) allocations
SIfs - - Default tag for user's of ntsrv.h
sidg - - GDI spooler events
Sis - - Single Instance Store (dd\sis\filter)
SisB - - SIS per file object break event
SisC - - SIS common store file object
SisF - - SIS per file object
SisL - - SIS per link object
SisS - - SIS SCB
Setp - - SETUPDD SpMemAlloc calls
SRdm - scsirdma.sys - Infiniband SRP driver
StCc - netio.sys - WFP stream inspection call context
StDa - netio.sys - WFP stream inspection data
StFc - netio.sys - WFP stream filter conditions
StCx - netio.sys - WFP stream internal callout context
Stdq - netio.sys - WFP stream DPC queue
SV?? - - Synthetic Video Driver
SVLb - - Generic Synthetic Video Driver Kernel-Mode Library
SVXD - synvidxd.dll - WDDM Synthetic Video Display Driver
SVXM - synvidxm.sys - WDDM Synthetic Video Miniport Driver
SVid - synthvid.sys - LDDM Synthetic Video Miniport Driver
SW?? - - Software Bus Enumerator
SWbi - - bus ID
SWbr - - bus reference
SWda - - POOLTAG_DEVICE_ASSOCIATION
SWdn - - device name
SWdr - - device reference
SWdr - - POOLTAG_DEVICE_DRIVER_REGISTRY
SWfd - - POOLTAG_DEVICE_FDOEXTENSION
SWid - - device ID
SWii - - instance ID
SWip - - POOLTAG_DEVICE_INTERFACEPATH
SWki - - key information
SWpd - - POOLTAG_DEVICE_PDOEXTENSION
SWre - - relations
SWrp - - reparse string
SWrs - - reference string
Sm?? - - rdr2 smb mini
SmCe - - smbmini connection engine
SmMm - - smbmini managed datastructures
SmAd - - session setup/admin exchange
SmRw - - read/write path
SmTr - - transact exchange
SmMs - - misc.
SmTp - - server transport tag
SmRb - - remote boot
SmFc - - fsctl structures (special build only)
SmDc - - dir query buffer (special build only)
SmPi - - pipeinfo buffer (special build only)
SmDO - - deferred open context (special build only)
SmQP - - params for directory query transact (special build only)
SmRx - - minirdr generated RxContext (special build only)
SmVr - - VNetroot (special build only)
SmSr - - Server (special build only)
SmSe - - Session (special build only)
SmNr - - NetRoot (special build only)
SmMa - - mid atlas (special build only)
SmMt - - mailslot buffer (special build only)
SmVc - - smbmini connectionengine VC (special build only)
SmEc - - echo buffer (special build only)
SmKs - - Kerberos blob (special build only)
SPX - - Nwlnkspx transport
SQOS - - Security quality of service in IO
Sr?? - sr.sys - System Restore file system filter driver
SrCo - sr.sys - SR's control object
SrSC - sr.sys - Stream contexts
SrDB - sr.sys - Debug information for lookup blob
SrDL - sr.sys - Device list
SrFE - sr.sys - File information buffer
SrFN - sr.sys - File name
SrHB - sr.sys - Hash bucket
SrHH - sr.sys - Hash header
SrHK - sr.sys - Hash key
SrLB - sr.sys - Log buffer
SrLC - sr.sys - Logging context
SrLE - sr.sys - Log entry
SrLT - sr.sys - Lookup blob
SrMP - sr.sys - Mount point information
SrOI - sr.sys - Overwrite information
SrPC - sr.sys - Persistant configuration information
SrRB - sr.sys - Rename buffer
SrRG - sr.sys - Logger context
SrRH - sr.sys - Reparse data size
SrRR - sr.sys - Registry information
SrSD - sr.sys - Security data information
SrST - sr.sys - Stream data information
SrTI - sr.sys - Directory delete information
SrWI - sr.sys - Work queue item
SslC - ksecdd.sys - SSL kernel mode client allocations
ST* - - New MMC compliant storage drivers
Stac - - Stack Trace Database - i386 checked and built with NTNOFPO=1 only
StEl - storport.sys - PortpErrorInitRecords storport!_STORAGE_TRACE_CONTEXT_INTERNAL.ErrorLogRecords
Strg - - Dynamic Translated strings
Strm - - Streams and streams transports allocations
StTc - storport.sys - PortTraceInitTracing storport!_STORAGE_TRACE_CONTEXT_INTERNAL
SwMi - - SWMidi KS filter (WDM Audio)
Symb - - Symbolic link objects
Symt - - Symbolic link target strings
SYPK - syspart.lib - Kernel mode system partition detection allocations
SYSA - - Sysaudio (wdm audio)
TAPI - - ntos\ndis\ndistapi
TcAR - tcpip.sys - TCP Abort Requests
TcBW - tcpip.sys - TCP Bandwidth Allocations
TcCM - tcpip.sys - TCP Congestion Control Manager Contexts
TcCR - tcpip.sys - TCP Connect Requests
TcCC - tcpip.sys - TCP Create And Connect Tcb Pool
TcDD - tcpip.sys - TCP Debug Delivery Buffers
TcDQ - tcpip.sys - TCP Delay Queues
TcDR - tcpip.sys - TCP Disconnect Requests
TcEW - tcpip.sys - TCP Endpoint Work Queue Contexts
TcFR - tcpip.sys - TCP FineRTT Buffers
TcHT - tcpip.sys - TCP Hash Tables
TcIn - tcpip.sys - TCP Inputs
TcLS - tcpip.sys - TCP Listener SockAddrs
TcLW - tcpip.sys - TCP Listener Work Queue Contexts
TcpA - tcpip.sys - TCP DMA buffers
TcpB - tcpip.sys - TCP Offload Blocks
TcDM - tcpip.sys - TCP Delayed Delivery Memory Descriptor Lists
TcDN - tcpip.sys - TCP Delayed Delivery Network Buffer Lists
TcpE - tcpip.sys - TCP Endpoints
TcpI - tcpip.sys - TCP ISN buffers
TcpL - tcpip.sys - TCP Listeners
TcpM - tcpip.sys - TCP Offload Miscellaneous buffers
TcpN - tcpip.sys - TCP Name Service Interfaces
TcOD - tcpip.sys - TCP Offload Devices
TcpO - tcpip.sys - TCP Offload Requests
TcpP - tcpip.sys - TCP Processor Arrays
TcPt - tcpip.sys - TCP Partitions
Tcpt - tcpip.sys - TCP Timers
TcRA - tcpip.sys - TCP Reassembly Data
TcRB - tcpip.sys - TCP Reassembly Buffers
TcRD - tcpip.sys - TCP Receive DPC Data
TcRe - tcpip.sys - TCP Recovery Buffers
TcRH - tcpip.sys - TCP Reassembly Headers
TcRL - tcpip.sys - TCP Create And Connect Tcb Rate Limit Pool
TcRR - tcpip.sys - TCP Receive Requests
TcRW - tcpip.sys - TCP Receive Window Tuning Blocks
TcSa - tcpip.sys - TCP Sack Data
TcSR - tcpip.sys - TCP Send Requests
TcST - tcpip.sys - TCP Syn TCBs
TcTW - tcpip.sys - TCP Time Wait TCBs
TcUD - tcpip.sys - TCP Urgent Delivery Buffers
TcWQ - tcpip.sys - TCP TCB Work Queue Contexts
TcWS - tcpip.sys - TCP Window Scaling Diagnostics
TC?? - TCP - TCP/IP network protocol
TCh? - - TCP/IP header pools
TCPC - - TCP connection pool
TCPT - - TCB pool
TCPY - - SYN-TCB pool
TCPr - - TCP request pool
TDIc - - TDI resource
TDId - - TDI resource
TDIe - - TDI resource
TDIf - - TDI resource
TDIg - - TDI resource
TDIk - - TDI resource
TDIu - - TDI resource
TDIv - - TDI resource
Tdat - - NB Data
TdxC - tdx.sys - TDX Connections
TdCI - tdx.sys - TDX Connection Information
Tdxc - tdx.sys - TDX Control Channels
Tdxo - tdx.sys - TDX Device Objects
Tdx - tdx.sys - TDX Generic Buffers (Address, Entity information, Interface change allocations)
TdxI - tdx.sys - TDX IO Control Buffers
TdxM - tdx.sys - TDX Message Indication Buffers
Tdxn - tdx.sys - TDX Net Addresses
TdxR - tdx.sys - TDX Received Data
Tdxp - tdx.sys - TDX Reserved Page Tables Entries
TdxB - tdx.sys - TDX Transport Layer Buffers
Tdxt - tdx.sys - TDX Transport Layer Clients
TdxP - tdx.sys - TDX Transport Layer Providers
Tdxm - tdx.sys - TDX Transport Layer TDI Mappings
TdxA - tdx.sys - TDX Transport Addresses
TdxT - tdx.sys - TDX Transport Provider Contexts
Tedd - tcpip.sys - TCP/IP Event Data Descriptors
thdd - - DirectDraw/3D handle manager table
Thre - nt!ps - Thread objects
Time - nt!ke - Timer objects
TmDn - nt!tm - Tm Dynamic Name
TmEn - nt!tm - Tm KENLISTMENT object
TmLo - nt!tm - Tm Log Entries
TmNo - nt!tm - Tm Notification
TmPa - nt!tm - Tm Propagate Argument
TmPb - nt!tm - Tm Propagation Buffer
TmPe - nt!tm - Tm Enlistment Pointers
TmPi - nt!tm - Tm Protocol Information
TmPo - nt!tm - Tm Propagation Output
TmPp - nt!tm - Tm Protocol Pointers
TmPr - nt!tm - Tm Protocol
TmPx - nt!tm - Tm Protocol Array
TmRi - nt!tm - Tm Recovery Information
TmRm - nt!tm - Tm KRESOURCEMANAGER object
TmRq - nt!tm - Tm Propagation Request
TmRr - nt!tm - Tm KTM_RESTART_RECORD
TmTm - nt!tm - Tm KTRANSACTIONMANAGER object
TmTx - nt!tm - Tm KTRANSACTION object
Tnbl - - NB Lists
Tnbt - - NB Pool
TNbl - tcpip.sys - TCP Send NetBufferLists
Toke - nt!se - Token objects
TOBJ - rdpdr.sys - Topology object
TpWc - nt!ex - Threadpool minipacket context
TpWo - nt!ex - Threadpool worker factory objects
TQoS - tcpip.sys - TL QoS Client Data
Tran - - EXIFS Translate
Trcd - netiobvt.sys - NB Control Data
TSBV - - WDM mini driver for Toshiba 750 capture
TSdd - rdpdd.sys - RDPDD - Hydra Display Driver
TSch - rdpwd.sys - RDPWD - Hydra char conversion
TSic - termdd.sys - Terminal Services - ICA_POOL_TAG
TSlc - rdpwd.sys - RDPWD - Hydra Licensing
TSmc - - PDMCS - Hydra MCS Protocol Driver
Tspk - ksecdd.sys - TS Package kernel mode client allocations
TSq - - Terminal Services - Queue - TSQ_TAG
TSrp - termdd.sys - Terminal Services - RP_ALLOC_TAG
TSwd - rdpwd.sys - RDPWD - Hydra Winstation Driver
Ttnc - tcpip.sys - WFP tunnel nexthop context
Tsmp - tcpip.sys - TCP Send Memory Descriptor Lists
TSNb - tcpip.sys - TCP Send NetBuffers
TTsp - tcpip.sys - TCP TCB Sends
TtCo - - TTCP Connections
TtcC - - TTCP Controllers
TtcL - - TTCP Listeners
TtcM - - TTCP Mappings
TtcN - - TTCP NPIs
TtcW - - TTCP Work Items
Ttfd - - TrueType Font driver
TTFC - - Font file cache
Thrm - - Thermal zone structure
Tun4 - - Tunnel cache allocation for long file name
TunL - - Tunnel cache lookaside-allocated elements
TunP - - Tunnel cache oddsized pool-allocated elements
TunK - - Tunnel cache temporary key value
TuSB - tunnel.sys - Tunnel stack block
TWTa - tcpip.sys - Echo Request Timer Table
TWTs - netiobvt.sys - BVT TW Generic Buffers
Txcl - ntfs.sys - TXF_CLR_RESERVATION_CHUNK
Txdl - ntfs.sys - TXF_DELETED_LINK
Txdr - ntfs.sys - TXF_DEFAULT_READER_SECTION
Txfc - ntfs.sys - TXF_FCB
Txfe - ntfs.sys - TXF_FCB_EXTENSION
Txfi - ntfs.sys - TXF_FCB_INFO
Txfl - ntfs.sys - TXF_FCB_CLEANUP
Txfo - ntfs.sys - TXF_FO
Txfq - ntfs.sys - Txf quota block
Txgd - ntfs.sys - TxfData global structure
Txis - ntfs.sys - TXF_ISO_SNAPSHOT
Txlf - ntfs.sys - TXF_FCB (large)
Txls - ntfs.sys - TXF_CANCEL_LSN
Txre - ntfs.sys - TXF_TOPS_RANGE_ENTRY
Txsc - ntfs.sys - TXF_SCB
Txsp - ntfs.sys - TXF_SAVEPOINT
Txsp - ntfs.sys - TXF_SCB_PTR
Txtc - ntfs.sys - TXF_TRANS_CANCEL_LIST
Txtr - ntfs.sys - TXF_TRANS (Txf transaction context)
Txvc - ntfs.sys - TXF_VCB
Txvd - ntfs.sys - TXF_VSCB_TO_DEREF
Txvf - ntfs.sys - TXF_VSCB_FILE_SIZES
Txvl - ntfs.sys - TXF_VSCB
Type - - Type objects
UCAM - - USB digital camera library
Udf1 - udfs.sys - Udfs file set descriptor buffer
Udf2 - udfs.sys - Udfs volmume recognition sequence descriptor buffer
Udf3 - udfs.sys - Udfs volume descriptor sequence descriptor buffer
Udf4 - udfs.sys - Udfs logical volume integrity descriptor buffer
UdfB - udfs.sys - Udfs dynamic name buffer
UdfC - udfs.sys - Udfs CRC table
UdfD - udfs.sys - Udfs FID buffer for view spanning
UdfF - udfs.sys - Udfs nonpaged Fcb
UdfI - udfs.sys - Udfs IO context
UdfL - udfs.sys - Udfs IRP context lite (delayed close)
UdfN - udfs.sys - Udfs normalized full filename
UdfS - udfs.sys - Udfs short file name
UdfT - udfs.sys - Udfs generic table entry
Udfa - udfs.sys - Udfs AD buffer
Udfb - udfs.sys - Udfs IO buffer
Udfc - udfs.sys - Udfs IRP context
Udfd - udfs.sys - Udfs file Scb
Udfe - udfs.sys - Udfs enumeration match expression
Udff - udfs.sys - Udfs Fcb
Udfi - udfs.sys - Udfs directory Scb
Udfl - udfs.sys - Udfs Lcb
Udfn - udfs.sys - Udfs Nonpaged Scb
Udfp - udfs.sys - Udfs Pcb
Udfs - udfs.sys - Udfs Sparing Mcb
Udft - udfs.sys - Udfs CDROM TOC
Udfv - udfs.sys - Udfs Vpb
UdfV - udfs.sys - Udfs VMCB dirty sector bitmap
Udfx - udfs.sys - Udfs Ccb
UdAE - tcpip.sys - UDP Activate Endpoints
UdJP - tcpip.sys - UDP Join Path Contexts
UdEW - tcpip.sys - UDP Endpoint Work Queue Contexts
UdMI - tcpip.sys - UDP Message Indications
UDNb - tcpip.sys - UDP NetBuffers
UdpA - tcpip.sys - UDP Endpoints
UdpH - tcpip.sys - UDP Headers
UdPM - tcpip.sys - UDP Partial Memory Descriptor Lists
UdpN - tcpip.sys - UDP Name Service Interfaces
UdSM - tcpip.sys - UDP Send Messages Requests
UNbl - tcpip.sys - UDP NetBufferLists
Udp - - Udp protocol (TCP/IP driver)
Ufsc - - User FULLSCREEN
UHCD - - Universal Host Controller (USB - Intel Controller)
UHUB - - Universal Serial Bus Hub
Ul?? - http.sys - tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??";
Uc?? - http.sys - i.e., the case of the leading "Ul" or "Uc" has been reversed.
Ucac - http.sys - Auth Cache Pool
UcCO - http.sys - Client Connection
Ucmp - http.sys - Multipart String Buffer
Ucre - http.sys - Receive Response
Ucrp - http.sys - Response App Buffer
Ucrq - http.sys - Request Pool
UcSc - http.sys - Common Server Information
UcSN - http.sys - Server name
UcSP - http.sys - Process Server Information
UcSp - http.sys - Sspi Pool
UcST - http.sys - Server info table
Uctd - http.sys - Response Tdi Buffer
Ucte - http.sys - Entity Pool
Ucto - http.sys - Tdi Objects Pool
UlAB - http.sys - Auxiliary Buffer
UlAO - http.sys - App Pool Object
UlAP - http.sys - App Pool Process
UlBL - http.sys - Binary Log File Entry
UlBO - http.sys - Outstanding i/o
UlCC - http.sys - Control Channel
UlCE - http.sys - Config Group Tree Entry
UlCH - http.sys - Config Group Tree Header
UlCI - http.sys - Config Group URL Info
UlCJ - http.sys - Config Group Object Pool
UlCK - http.sys - Chunk Tracker
UlCL - http.sys - Config Group LogDir
UlCl - http.sys - Connection RefTraceLog
UlCO - http.sys - Connection
UlCT - http.sys - Config Group Timestamp
UlCY - http.sys - Connection Count Entry
UlDB - http.sys - Debug
UlDC - http.sys - Data Chunks array
UlDO - http.sys - Disconnect Object
UlDR - http.sys - Deferred Remove Item
UlDT - http.sys - Debug Thread Pool
UlEP - http.sys - Endpoint
UlFA - http.sys - Force Abort Work Item
UlFC - http.sys - File Cache Entry
Ulfc - http.sys - Uri Filter Context
UlFD - http.sys - Noncached File Data
UlFP - http.sys - Filter Process
UlFR - http.sys - Dummy Filter Receive Buffer
UlFT - http.sys - Filter Channel
UlFU - http.sys - Full Tracker
UlFW - http.sys - Filter Write Tracker
UlHC - http.sys - Http Connection
UlHc - http.sys - Http Connection RefTraceLog
UlHL - http.sys - Internal Request RefTraceLog
UlHR - http.sys - Internal Request
UlHT - http.sys - Hash Table
UlHV - http.sys - Header Value
UlIC - http.sys - Irp Context
UlID - http.sys - Conn ID Table
UlIR - http.sys - Internal Response
UlLD - http.sys - Log Field
UlLF - http.sys - Log File Entry
UlLG - http.sys - Log Generic
UlLH - http.sys - Log File Handle
UlLL - http.sys - Log File Buffer
UlLS - http.sys - Ansi Log Data Buffer
UlLT - http.sys - Binary Log Data Buffer
UlNO - http.sys - NSGO Pool
UlNP - http.sys - Non-Paged Data
UlOE - http.sys - Endpoint OwnerRefTraceLog PoolTag
UlOR - http.sys - Owner RefTrace Signature
UlOT - http.sys - Opaque ID Table
UlPB - http.sys - APool Proc Binding
UlPL - http.sys - Pipeline
UlQF - http.sys - TCI Filter
UlQG - http.sys - TCI Generic
UlQI - http.sys - TCI Interface
UlQL - http.sys - TCI Flow
UlQT - http.sys - TCI Tracker
UlQW - http.sys - TCI WMI
UlRB - http.sys - Receive Buffer
UlRD - http.sys - Registry Data
UlRE - http.sys - Request Body Buffer
UlRP - http.sys - Request Buffer
UlRR - http.sys - Request Buffer References
UlRS - http.sys - Non-Paged Resource
UlRT - http.sys - RefTraceLog PoolTag
UlSC - http.sys - SSL Cert Data
UlSD - http.sys - Security Data
UlSl - http.sys - StringLog Buffer PoolTag
UlSL - http.sys - StringLog PoolTag
UlSO - http.sys - Site Counter Entry
UlSS - http.sys - Simple Status Item
UlTA - http.sys - Address Pool
UlTD - http.sys - UL_TRANSPORT_ADDRESS
UlTT - http.sys - Thread Tracker
UlUB - http.sys - URL Buffer
UlUC - http.sys - Uri Cache Entry
UlUH - http.sys - HTTP Unknown Header
UlUL - http.sys - URL
UlUM - http.sys - URL Map
UlVH - http.sys - Virtual Host
UlWC - http.sys - Work Context
UlWI - http.sys - Work Item
UndP - - EXIFS Underlying Path
UMD? - WUDFRd.sys - UMDF pool allocation
USBB - bthusb.sys - Bluetooth USB minidriver
USBD - - Universal Serial Bus Class Driver
Vad - nt!mm - Mm virtual address descriptors
VadF - nt!mm - VADs created by a FreeVM splitting
Vadl - nt!mm - Mm virtual address descriptors (long)
VadS - nt!mm - Mm virtual address descriptors (short)
VBus - vmbus.sys - Virtual Machine Bus Driver
VcCh - rdpdr.sys - Dynamic Virtual channel object
VcFl - rdpdr.sys - Dynamic Virtual file object
VcMn - rdpdr.sys - Dynamic Virtual manager object
VcSn - rdpdr.sys - Dynamic Virtual session object
VDM - nt!vdm - ntos\vdm
VdPN - dxgkrnl.sys - Video display mode management
Vepp - nt!Vf - Verifier Pool Tracking information
VfAT - nt!Vf - Verifier AVL trees
VfIT - nt!Vf - Verifier Import Address Table information
VfPT - nt!Vf - Verifier Allocate/Free Pool stack traces
VMdl - nt!Vf - MDL allocated using the Driver Verifier version of IoAllocateMdl
VNod - nt!Vf - Deadlock Verifier nodes
VRes - nt!Vf - Deadlock Verifier resources
VStr - nt!Vf - String buffer allocated by the Driver Verifier version of Rtl String APIs
VHDa - vhdmp.sys - VHD generic allocator
VHDA - vhdmp.sys - VHD generic allocator pool
VHDb - vhdmp.sys - VHD Block Allocation Table
VHDf - vhdmp.sys - VHD file entry
VHDh - vhdmp.sys - VHD header
VHDi - vhdmp.sys - VHD IO Range
VHDI - vhdmp.sys - VHD IO Range pool
VHDl - vhdmp.sys - VHD LUN
VHDm - vhdmp.sys - VHD bitmap
VHDn - vhdmp.sys - VHD filename
VHDo - vhdmp.sys - VHD footer
VHDp - vhdmp.sys - VHD filepath
VHDr - vhdmp.sys - VHD read buffer
VHDs - vhdmp.sys - VHD sector map
VHDS - vhdmp.sys - VHD symbolic link
VHDt - vhdmp.sys - VHD tracking information
VHDw - vhdmp.sys - VHD work item
VHDy - vhdmp.sys - VHD dynamic header
VidL - videoprt.sys - VideoPort Allocation List (FDO_EXTENSION)
VidR - videoprt.sys - VideoPort Allocation on behalf of Miniport
ViMm - dxgkrnl.sys - Video memory manager
virt - vmm.sys - Virtual Machine Manager (VPC/VS)
ViSh - dxgkrnl.sys - Video scheduler
VM?? - volmgr.sys - Volume Manager
VM - volmgr.sys - General allocations
Vm?? - volmgrx.sys - Volume Manager Extension
Vm - volmgrx.sys - General allocations
VmBl - volmgrx.sys - Raw configuration blocks
VmBu - volmgrx.sys - I/O buffers
VmCc - volmgrx.sys - Configuration copies
VmCo - volmgrx.sys - Configurations
VmCp - volmgrx.sys - Copies
VmCr - volmgrx.sys - Completion routine contexts
VmDc - volmgrx.sys - Device changes
VmDd - volmgrx.sys - Disk devices
VmDh - volmgrx.sys - Disk headers
VmLa - volmgrx.sys - Drive layouts
VmLb - volmgrx.sys - Log blocks
VmLc - volmgrx.sys - Log copies
VmLo - volmgrx.sys - Logs
VmLr - volmgrx.sys - Log raw content
VmMm - volmgrx.sys - Mirror emergency mappings
VmNe - volmgrx.sys - Notification entries
VmOb - volmgrx.sys - I/O objects
VmP0 - volmgrx.sys - Packets
VmP1 - volmgrx.sys - Small packets
VmP2 - volmgrx.sys - Large packets
VmP3 - volmgrx.sys - Huge packets
VmPa - volmgrx.sys - Packs
VmPd - volmgrx.sys - Physical disks
VmPs - volmgrx.sys - Arrays of packets
VmRb - volmgrx.sys - Raw record buffers
VmRc - volmgrx.sys - Raw configurations
VmRe - volmgrx.sys - Records
VmRi - volmgrx.sys - Record information
VmRm - volmgrx.sys - RAID-5 emergency mappings
VmRr - volmgrx.sys - Raw records
VmTa - volmgrx.sys - I/O tasks
VmTc - volmgrx.sys - Table of contents
VmTe - volmgrx.sys - Table of contents entries
VmTx - volmgrx.sys - Transactions
VmUe - volmgrx.sys - User entries
VmVd - volmgrx.sys - Volume devices
VmWi - volmgrx.sys - Work items
VoS? - volsnap.sys - VolSnap (Volume Snapshot Driver)
VoSa - volsnap.sys - Application information allocations
VoSb - volsnap.sys - Buffer allocations
VoSc - volsnap.sys - Snapshot context allocations
VoSd - volsnap.sys - Diff area volume allocations
VoSf - volsnap.sys - Diff area file allocations
VoSh - volsnap.sys - Bit history allocations
VoSi - volsnap.sys - Io status block allocations
VoSm - volsnap.sys - Bitmap allocations
VoSo - volsnap.sys - Old heap entry allocations
VoSp - volsnap.sys - Pnp id allocations
VoSr - volsnap.sys - Device relations allocations
VoSs - volsnap.sys - Short term allocations
VoSt - volsnap.sys - Temp table allocations
VoSw - volsnap.sys - Work queue allocations
VoSx - volsnap.sys - Dispatch context allocations
Vpb - - Io, vpb's
Vprt - videoprt.sys - Video port for legacy (pre-Vista) display drivers
VraP - - parallel class driver
Vtfd - - Font file/context
vTDR - dxgkrnl.sys - Video timeout detection/recovery
Wait - - NtWaitForMultipleObjects
Wan? - - NdisWan Tags (PPP Framing module for Remote Access)
WanA - - BundleCB
WanB - - ProtocolCB/LinkCB
WanC - - DataDesc
WanD - - WanRequest
WanE - - LoopbackDesc
WanG - - MiniportCB
WanH - - OpenCB
WanI - - IoPacket
WanJ - - LineUpInfo
WanK - - Unicode String Buffer
WanL - - Protocol Table
WanM - - Connection Table
WanN - - NdisPacketPool Desc
WanQ - - DataBuffer
WanR - - WanPacket
WanS - - AfCB/SapCB/VcCB
WanT - - Transform Driver
WanV - - RC4 Encryption Context
WanW - - SHA Encryption
WanX - - Send Compression Context
WanY - - Recv Compression Context
WanZ - - Protocol Specific Info
Wdm - - WDM
WDMA - - WDM Audio
Wdog - watchdog.sys - Watchdog object/context allocation
Wfp? - netio.sys - Windows Filtering Platform Tags
WfpF - netio.sys - WFP filters
WfpM - netio.sys - WFP filter match buffers
WfpI - netio.sys - WFP index
WfpH - netio.sys - WFP hash
WfpR - netio.sys - WFP RPC
WfpC - netio.sys - WFP callouts
WfpS - netio.sys - WFP startup
WfpL - netio.sys - WFP fast cache
WfpE - netio.sys - WFP extension
Wfpn - netio.sys - WFP NBL info container
WfTi - - WFP timer
WfSt - - WFP string
werk - - WER kernel mode reporting allocation
WimF - wimfsf.sys - WIM Boot Filter
WlBs - writelog.sys - Writelog block store
WlFc - writelog.sys - Writelog fsd context
WlGc - writelog.sys - Writelog global context
WlIb - writelog.sys - Writelog I/O buffer
WlLb - writelog.sys - Writelog library buffer
WlCb - writelog.sys - Writelog checkpoint buffer
WlPw - writelog.sys - Writelog planned write
WlMh - writelog.sys - Writelog marker header
WlMp - writelog.sys - Writelog marker payload
WlDt - writelog.sys - Writelog drain target
Wmii - - Wmi InstId chunks
Wmij - - Wmi GuidMaps
Wmim - - Wmi KM to UM Notification Buffers
Wmin - - Wmi Notification Slot Chunks
Wmip - - Wmi General purpose allocation
Wmiq - - Wmi NBQ Blocks
Wmis - - Wmi SysId allocations
Wmit - - Wmi Trace
Wmiw - - Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL
Wmiz - - Wmi MCA Insertions debug code
WmiA - - Wmi ACPI mapper
WmiC - - Wmi Create Pump Thread Work Item
WmiD - - Wmi Registration DataSouce
WmiG - - Allocation of WMIGUID
WmiI - - Wmi Instance Names
WmiL - - WmiLIb
WmiN - - Wmi Notification Notification Packet
WmiR - - Wmi Registration info blocks
WmDS - - Wmi DataSource chunks
WmGE - - Wmi GuidEntry chunks
WmIS - - Wmi InstanceSet chunks
WmMR - - Wmi MofResouce chunks
WMca - - WMI MCA Handling
Wrp? - - WanArp Tags (ARP module for Remote Access)
Wrpa - - WAN_ADAPTER_TAG
Wrpi - - WAN_INTERFACE_TAG
Wrpr - - WAN_REQUEST_TAG
Wrps - - WAN_STRING_TAG
Wrpc - - WAN_CONN_TAG
Wrpw - - WAN_PACKET_TAG
Wrpf - - FREE_TAG (checked builds only)
Wrpd - - WAN_DATA_TAG
Wrph - - WAN_HEADER_TAG
Wrpn - - WAN_NOTIFICATION_TAG
WvCy - - WDM Audio WaveCyc port
WvPc - - WDM Audio WavePCI port
xCVD - mrxdav.sys - AsyncEngineContext Tag
XDR? - rpcxdr.sys - NFS (Network File System) XDR driver
xSMB - smbmrx.sys - IFSKIT sample SMB mini-redirector
XWan - - ndis\usrwan allocations
Xtra - - EXIFS Extra Create
ZsaB - - EXIFS ZeroBlock
Adbe - win32k.sys - GDITAG_ATM_FONT
Bmfd - win32k.sys - GDITAG_BMP_FONT
Dfsm - win32k.sys - GDITAG_ENG_EVENT
DwmL - win32k!HwndLookupAllocTableData - GDITAG_DWM_HWND_LOOKUP
DWMv - win32k.sys - GDITAG_DWM_VALIDATION
Dxdd - win32k!DxLddmSharedPrimaryLockNotification - GDITAG_LOCKED_PRIMARY
Gadb - win32k!XDCOBJ::bAddColorTransform - GDITAG_DC_COLOR_TRANSFORM
Gadd - win32k.sys - GDITAG_DC_FONT
Galp - win32k!AlphaScanLineBlend - GDITAG_ALPHABLEND
Gbaf - win32k.sys - GDITAG_BRUSH_FREELIST
Gbdl - win32k!BRUSH::bAddIcmDIB - GDITAG_ICM_DIB_LIST
Gcac - win32k.sys - GDITAG_FONTCACHE
Gcsl - win32k!InitializeScripts - GDITAG_SCRIPTS
Gcwc - win32k!ConvertToAndFromWideChar - GDITAG_CHAR_TO_WIDE_CHAR
Gdbr - win32k!BRUSHOBJ_pvAllocRbrush - GDITAG_RBRUSH
Gdcf - win32k.sys - GDITAG_DC_FREELIST
GDcs - win32k!GreDwmStartup - GDITAG_DWMSTATE
Gdev - win32k.sys - GDITAG_DEVMODE
GDev - win32k.sys - GDITAG_PDEV
Gdfm - win32k!DoFontManagement - GDITAG_HGLYPH_ARRAY
Gdrs - win32k.sys - GDITAG_DRVSUP
Gdrv - win32k!EngCreateClip - GDITAG_CLIPOBJ
Gdtd - win32k!GreAcquireSemaphoreAndValidate - GDITAG_SEMAPHORE_VALIDATE
Gdwd - win32k.sys - GDITAG_WATCHDOG
Gebr - win32k!EngRealizeBrush - GDITAG_ENGBRUSH
Gedd - win32k.sys - GDITAG_ENUM_DISPLAY_DEVICES
Gedg - win32k!bFill - GDITAG_EDGE
gEdg - win32k!bTriangleMesh - GDITAG_TRIANGLEDATA
Geto - win32k.sys - GDITAG_TEXTOUT
Gfdf - win32k!InitializeDefaultFamilyFonts - GDITAG_FONT_DEFAULT_FAMILY
Gffv - win32k.sys - GDITAG_FONTFILEVIEW
Gfid - win32k.sys - GDITAG_UNIVERSAL_FONT_ID
GFil - win32k.sys - GDITAG_FILEPATH
Gfil - win32k.sys - GDITAG_MAPFILE
GFld - win32k.sys - GDITAG_FLOODFILL
Gfnt - win32k!RFONTOBJ::bRealizeFont - GDITAG_RFONT
Gfsb - win32k.sys - GDITAG_FONT_SUB
Gfsf - win32k!bInitStockFontsInternal - GDITAG_FONT_STOCKFONT
Gfsm - win32k!GreCreateFastMutex - GDITAG_FAST_MUTEX
Gful - win32k.sys - GDITAG_FULLSCREEN
Gfvi - win32k!bUnloadAllButPermanentFonts - GDITAG_FONTVICTIM
Ggb - win32k!RFONTOBJ::pgbCheckGlyphCache - GDITAG_GLYPHBLOCK
Ggdv - win32k.sys - GDITAG_GDEVICE
Ggls - win32k.sys - GDITAG_GLYPHSET
Ggly - win32k.sys - GDITAG_HGLYPH
Gh?: - win32k.sys - GDITAG_HMGR_LFONT_TYPE
Gh?; - win32k.sys - GDITAG_HMGR_RFONT_TYPE
Gh?@ - win32k.sys - GDITAG_HMGR_BRUSH_TYPE
Gh?> - win32k.sys - GDITAG_HMGR_ICMCXF_TYPE
Gh?0 - win32k.sys - GDITAG_HMGR_DEF_TYPE
Gh?1 - win32k.sys - GDITAG_HMGR_DC_TYPE
Gh?4 - win32k.sys - GDITAG_HMGR_RGN_TYPE
Gh?5 - win32k.sys - GDITAG_HMGR_SURF_TYPE
Gh?6 - win32k.sys - GDITAG_HMGR_CLIENTOBJ_TYPE
Gh?7 - win32k.sys - GDITAG_HMGR_PATH_TYPE
Gh?8 - win32k.sys - GDITAG_HMGR_PAL_TYPE
Gh?9 - win32k.sys - GDITAG_HMGR_ICMLCS_TYPE
Gh?A - win32k.sys - GDITAG_HMGR_UMPD_TYPE
Gh?B - win32k.sys - GDITAG_HMGR_HLSURF_TYPE
Gh?E - win32k.sys - GDITAG_HMGR_META_TYPE
Gh?L - win32k.sys - GDITAG_HMGR_DRVOBJ_TYPE
Gh?? - win32k.sys - GDITAG_HMGR_SPRITE_TYPE
Gh00 - win32k.sys - GDITAG_HMGR_START
Ghab - win32k!FHOBJ::bAddPFELink - GDITAG_PFE_HASHBUCKET
Ghas - win32k!FHMEMOBJ::FHMEMOBJ - GDITAG_PFE_HASHTABLE
Ghml - win32k.sys - GDITAG_HMGR_LOCK
Ghtc - win32k!bSetHTSrcSurfInfo - GDITAG_HALFTONE_COLORTRIAD
Ghtm - win32k.sys - GDITAG_HMGR_TEMP
Gi2c - win32k.sys - GDITAG_DDCCI
Gicm - win32k.sys - GDITAG_ICM
Gkbm - win32k.sys - GDITAG_KMODE_BITMAP
Gla: - win32k.sys - GDITAG_HMGR_LOOKASIDE_LFONT_TYPE
Gla; - win32k.sys - GDITAG_HMGR_LOOKASIDE_RFONT_TYPE
Gla@ - win32k.sys - GDITAG_HMGR_LOOKASIDE_BRUSH_TYPE
Gla0 - win32k.sys - GDITAG_HMGR_LOOKASIDE_START
Gla1 - win32k.sys - GDITAG_HMGR_LOOKASIDE_DC_TYPE
Gla4 - win32k.sys - GDITAG_HMGR_LOOKASIDE_RGN_TYPE
Gla5 - win32k.sys - GDITAG_HMGR_LOOKASIDE_SURF_TYPE
Gla8 - win32k.sys - GDITAG_HMGR_LOOKASIDE_PAL_TYPE
Gldv - win32k.sys - GDITAG_LDEV
Glid - win32k!GetLanguageID - GDITAG_LOCALEINFO
Glnk - win32k!FHOBJ::bAddPFELink - GDITAG_PFE_LINK
Gmap - win32k!InitializeFontSignatures - GDITAG_FONT_MAPPER
Gmso - win32k!MULTISORTBLTORDER::MULTISORTBLTORDER - GDITAG_DISPURF_SORT
Gmul - win32k!MULTIFONT::MULTIFONT - GDITAG_MULTIFONT
Gnls - win32k.sys - GDITAG_NLS
Gogl - win32k!iOpenGLExtEscape - GDITAG_OPENGL
GOPM - win32k.sys - GDITAG_OPM
GPal - win32k.sys - GDITAG_PALETTE
Gpan - win32k.sys - GDITAG_PANNING_PDEV
Gpat - win32k.sys - GDITAG_PATHOBJ
Gpfe - win32k!PFFMEMOBJ::bAllocPFEData - GDITAG_PFF_INDEXES
Gpff - win32k.sys - GDITAG_PFF
Gpft - win32k!pAllocateAndInitializePFT - GDITAG_PFT
Gpgb - win32k!EngPlgBlt - GDITAG_PLGBLT_DATA
Gpid - win32k!NtGdiSetPUMPDOBJ - GDITAG_PRINTCLIENTID
Gppo - win32k!XCLIPOBJ::ppoGetPath - GDITAG_CLIP_PATHOBJ
Gppt - win32k!PROXYPORT::PROXYPORT - GDITAG_PROXYPORT
Gpre - win32k!pSpCreatePresent - GDITAG_PRESENT
Gqnk - win32k!bComputeQuickLookup - GDITAG_LFONT_QUICKLOOKUP
Grgb - win32k.sys - GDITAG_PALETTE_RGB_XLATE
Grgn - win32k.sys - GDITAG_REGION
Gsem - win32k.sys - GDITAG_SEMAPHORE
Gsp - win32k!pSpCreateSprite - GDITAG_SPRITE
Gspm - win32k.sys - GDITAG_METASPRITE
Gspr - win32k.sys - GDITAG_SPRITESCAN
Gsta - win32k.sys - GDITAG_STACKTRACE
Gsth - win32k.sys - GDITAG_STRETCHBLT
Gsty - win32k!GreExtCreatePen - GDITAG_PENSTYLE
Gsux - win32k.sys - GDITAG_SFM
Gtmp - win32k.sys - GDITAG_TEMP
GTmp - win32k!AllocFreeTmpBuffer - GDITAG_TEMP_THREADLOCK
Gtmw - win32k!bIFIMetricsToTextMetricW - GDITAG_TEXTMETRICS
Gtvp - win32k!PFFOBJ::bAddPvtData - GDITAG_PFF_DATA
Gtvt - win32k!bTriangleMesh - GDITAG_TRIANGLE_MESH
Gtxt - win32k.sys - GDITAG_TEXT
Gubm - win32k.sys - GDITAG_UMODE_BITMAP
GUma - win32k!GDIEngUserMemAllocNodeAlloc - GDITAG_ENG_USER_MEM_ALLOC_TABLE
Gump - win32k.sys - GDITAG_UMPD
Gvds - win32k!MulEnablePDEV - GDITAG_HDEV
GVdv - win32k.sys - GDITAG_VDEV
GVms - win32k!MulSaveScreenBits - GDITAG_MULTISAVEBITS
GVsf - win32k!MulCreateDeviceBitmap - GDITAG_MDSURF
Gwnd - win32k.sys - GDITAG_WNDOBJ
Gxlt - win32k.sys - GDITAG_PXLATE
Gxpd - win32k!XUMPDOBJ::XUMPDOBJ - GDITAG_UMPDOBJ
knlf - win32k.sys - GDITAG_FONT_LINK
PASf - win32k.sys - GDITAG_PANNING_SURFACE
PSlo - win32k.sys - GDITAG_PANNING_SHADOWLOCK
Ssrl - win32k.sys - GDITAG_SINGLEREADERLOCK
TTFC - win32k.sys - GDITAG_TT_FONT_CACHE
Ttfd - win32k.sys - GDITAG_TT_FONT
Vtfd - win32k.sys - GDITAG_VF_FONT
W32l - win32k!W32PIDLOCK::vInit - GDITAG_W32PIDLOCK
GHpl - win32k!HmgCreate - GDITAG_HANDLEPUSHLOCK
Ucal - win32k!DriverEntry - USERTAG_SERVICE_TABLE
Umam - win32k!UpdateDesktopThresholds - USERTAG_MONITOR_MARGIN
Urdr - win32k!SetRedirectionBitmap - USERTAG_REDIRECT
Usac - win32k!_CreateAcceleratorTable - USERTAG_ACCEL
Usai - win32k!zzzAttachThreadInput - USERTAG_ATTACHINFO
Usal - win32k!InitSwitchWndInfo - USERTAG_ALTTAB
Usbg - win32k!xxxLogClipData - USERTAG_DEBUG
Uscb - win32k!_ConvertMemHandle - USERTAG_CLIPBOARD
Uscc - win32k!AllocCallbackMessage - USERTAG_CALLBACK
Uscd - win32k!SetWindowCompositionInfo - USERTAG_COMPOSITIONPROP
Usci - win32k!InitSystemThread - USERTAG_CLIENTTHREADINFO
Uscl - win32k!ClassAlloc - USERTAG_CLASS
Uscm - win32k!InitScancodeMap - USERTAG_SCANCODEMAP
Uscp - win32k!CreateDIBPalette - USERTAG_CLIPBOARDPALETTE
Uscr - win32k!NtUserSetSysColors - USERTAG_COLORS
Usct - win32k!CkptRestore - USERTAG_CHECKPT
Uscu - win32k!_CreateEmptyCursorObject - USERTAG_CURSOR
Uscv - win32k!NtUserSetSysColors - USERTAG_COLORVALUES
Usd1 - win32k!FreeListAdd - USERTAG_DDE1
Usd2 - win32k!_DdeSetQualityOfService - USERTAG_DDE2
Usd4 - win32k!AddPublicObject - USERTAG_DDE4
Usd5 - win32k!xxxCsEvent - USERTAG_DDE5
Usd6 - win32k!xxxCsEvent - USERTAG_DDE6
Usd7 - win32k!xxxCsEvent - USERTAG_DDE7
Usd8 - win32k!xxxMessageEvent - USERTAG_DDE8
Usd9 - win32k!xxxCsDdeInitialize - USERTAG_DDE9
UsdA - win32k!NewConversation - USERTAG_DDEa
UsdB - win32k!Createpxs - USERTAG_DDEb
Usdc - win32k!CreateCacheDC - USERTAG_DCE
UsdD - win32k!NtUserfnDDEINIT - USERTAG_DDEd
UsdE - win32k!xxxClientCopyDDEIn1 - USERTAG_DDE
UsDI - win32k!CreateDeviceInfo - USERTAG_DEVICEINFO
Usdi - win32k!CreateMonitor - USERTAG_DISPLAYINFO
Usds - win32k!xxxDragObject - USERTAG_DRAGDROP
Usdv - win32k!NtUserfnINDEVICECHANGE - USERTAG_DEVICECHANGE
UsEC - win32k!AddWEFCOMPInvalidateSListEntry - USERTAG_WSEXCOMPINVALID
User - win32k!InitCreateUserCrit - USERTAG_ERESOURCE
Usev - win32k!xxxPollAndWaitForSingleObject - USERTAG_EVENT
Usft - win32k!CreateValidTouchInputInfo - USERTAG_FORWARDTOUCHMESSAGE
Usgh - win32k!NtUserUserHandleGrantAccess - USERTAG_GRANTEDHANDLES
Usgi - win32k!NtUserSendGestureInput - USERTAG_GESTUREINFO
Usgl - win32k!CreateShadowTL - USERTAG_GLOBALTHREADLOCK
Usgt - win32k!AddGhost - USERTAG_GHOST
Usha - win32k!AllocateHidData - USERTAG_HIDDATA
UshD - Win32k!AllocateHidDesc - USERTAG_HIDDESC
Ushk - win32k!_RegisterHotKey - USERTAG_HOTKEY
Usih - win32k!SetImeHotKey - USERTAG_IMEHOTKEY
Usim - win32k!CreateInputContext - USERTAG_IME
Usjb - win32k!CreateW32Job - USERTAG_W32JOB
Usjx - win32k!JobCalloutAddProcess - USERTAG_W32JOBEXTRA
Uskb - win32k!xxxLoadKeyboardLayoutEx - USERTAG_KBDLAYOUT
Uske - win32k!GetKbdExId - USERTAG_KBDEXID
Uskf - win32k!LoadKeyboardLayoutFile - USERTAG_KBDFILE
Usks - win32k!PostUpdateKeyStateEvent - USERTAG_KBDSTATE
Uskt - win32k!ReadLayoutFile - USERTAG_KBDTABLE
Usla - win32k!InitLockRecordLookaside - USERTAG_LOOKASIDE
Usld - win32k!GrowLogIfNecessary - USERTAG_LOGDESKTOP
Uslr - win32k!InitLockRecordLookaside - USERTAG_LOCKRECORD
Usmg - win32k!Magxxx - USERTAG_MAGNIFICATION
Usmi - win32k!MirrorRegion - USERTAG_MIRROR
Usml - win32k!MsgLookupTableAlloc - USERTAG_MESSAGE_FILTER
Usmr - win32k!SnapshotMonitorRects - USERTAG_MONITORRECTS
Usms - win32k!xxxMoveSize - USERTAG_MOVESIZE
Usmt - win32k!xxxMNAllocMenuState - USERTAG_MENUSTATE
Usna - win32k!UserPostNKAPC - USERTAG_NKAPC
Usny - win32k!CreateNotify - USERTAG_NOTIFY
Uspb - win32k!fnPOWERBROADCAST - USERTAG_POWERBROADCAST
Uspi - win32k!MapDesktop - USERTAG_PROCESSINFO
Uspm - win32k!MNAllocPopup - USERTAG_POPUPMENU
Uspn - win32k!CreateProfileUserName - USERTAG_PROFILEUSERNAME
Uspo - win32k!QueuePowerRequest - USERTAG_POWER
Uspp - win32k!AllocateAndLinkHidTLCInfo - USERTAG_PNP
Uspr - win32k!GetPrivateProfileStruct - USERTAG_PROFILE
Uspw - win32k!WindowArray_Add - USERTAG_WINDOWARRAY
Usqm - win32k!_WinSqmAllocate - USERTAG_SQM
Usqm - win32k!InitQEntryLookaside - USERTAG_QMSG
Usqu - win32k!InitQEntryLookaside - USERTAG_Q
Usrt - win32k!xxxDrawMenuItemText - USERTAG_RTL
Ussa - win32k!xxxBroadcastMessage - USERTAG_SMS_ASYNC
Ussb - win32k!CreateSpb - USERTAG_SPB
Ussc - win32k!xxxInterSendMsgEx - USERTAG_SMS_CAPTURE
Ussd - win32k!xxxAddShadow - USERTAG_SHADOW
Usse - win32k!SetDisconnectDesktopSecurity - USERTAG_SECURITY
Ussi - win32k!NtUserSendInput - USERTAG_SENDINPUT
Ussj - win32k!NtUserSendTouchInput - USERTAG_SENDTOUCHINPUT
Ussm - win32k!InitSMSLookaside - USERTAG_SMS
Usss - win32k!xxxBroadcastMessage - USERTAG_SMS_STRING
Usst - win32k!xxxSBTrackInit - USERTAG_SCROLLTRACK
Ussw - win32k!_BeginDeferWindowPos - USERTAG_SWP
Ussy - win32k!xxxDesktopThread - USERTAG_SYSTEM
Ustd - win32k!TrackAddDesktop - USERTAG_TRACKDESKTOP
Usti - win32k!AllocateW32Thread - USERTAG_THREADINFO
Ustk - win32k!HeavyAllocPool - USERTAG_STACK
Ustm - win32k!InternalSetTimer - USERTAG_TIMER
Usto - win32k!xxxConnectService - USERTAG_TOKEN
Usts - win32k!_Win32CreateSection - USERTAG_SECTION
Ustx - win32k!NtUserDrawCaptionTemp - USERTAG_TEXT
Usty - win32k!NtUserResolveDesktopForWOW - USERTAG_TEXT2
Ustz - win32k!AllocTouchInputInfo - USERTAG_TOUCHINPUTINFO
Usub - win32k!NtUserToUnicodeEx - USERTAG_UNICODEBUFFER
Usus - win32k!MsgSQMGetMsgList - USERTAG_UIPI_SQM
Usvi - win32k!ResizeVisExcludeMemory - USERTAG_VISRGN
Usvl - win32k!VWPLAdd - USERTAG_VWPL
Uswd - win32k!xxxCreateWindowEx - USERTAG_WINDOW
Uswe - win32k!_SetWinEventHook - USERTAG_WINEVENT
Uswl - win32k!BuildHwndList - USERTAG_WINDOWLIST
Uswo - win32k!zzzInitTask - USERTAG_WOWTDB
Uswp - win32k!xxxRegisterUserHungAppHandlers - USERTAG_WOWPROCESSINFO
Uswt - win32k!xxxUserNotifyProcessCreate - USERTAG_WOWTHREADINFO
.
