본 Pool tag에는 서드파티 드라이버의 테그는 없습니다.
분석을 위해서는 직접 드라이버 이름과 맵핑하는 작업이 필요합니다.
서드파티 드라이버의 경우 MPSreport의 MSinfo32 파일의 소프트웨어 부분의 드라이버를 참조하십시오.
디바이스드라이버 목록을 통해 확인이 가능한데... 해당 파일이름이 기억이 않나네요...ㅋ
@GMM - <unknown> - (Intel video driver) Memory manager
@KCH - <unknown> - (Intel video driver) Chipset specific service
@MP - <unknown> - (Intel video driver) Miniport related memory
@SB - <unknown> - (Intel video driver) Soft BIOS
_ATI - <unknown> - ATI video driver
_LCD - monitor.sys - Monitor PDO name buffer
8042 - i8042prt.sys - PS/2 kb and mouse
AdSv - vmsrvc.sys - Virtual Machines Additions Service
ARPC - atmarpc.sys - ATM ARP Client
ATMU - atmuni.sys - ATM UNI Call Manager
Atom - <unknown> - Atom Tables
Abos - <unknown> - Abiosdsk
AcdM - <unknown> - TDI AcdObjectInfoG
AcdN - <unknown> - TDI AcdObjectInfoG
Acp* - acpi.sys - ACPI Pooltags
ACPI - acpi.sys - ACPI
Adap - <unknown> - Adapter objects
Adbe - <unknown> - Adobe's font driver
AECi - <unknown> - filter object interface for MS acoustic echo canceller
Afd? - afd.sys - AFD objects
AfdA - afd.sys - Afd EA buffer
AfdB - afd.sys - Afd data buffer
AfdC - afd.sys - Afd connection structure
AfdD - afd.sys - Afd debug data
AfdE - afd.sys - Afd endpoint structure
AfdF - afd.sys - Afd TransmitFile info
AfdG - afd.sys - Afd group table
AfdI - afd.sys - Afd TDI data
AfdL - afd.sys - Afd local address buffer
AfdP - afd.sys - Afd poll info
AfdQ - afd.sys - Afd work queue item
AfdR - afd.sys - Afd remote address buffer
AfdS - afd.sys - Afd security info
AfdT - afd.sys - Afd transport info
AfdW - afd.sys - Afd work item
AfdX - afd.sys - Afd context buffer
Afda - afd.sys - Afd APC buffer (NT 3.51 only)
Afdc - afd.sys - Afd connect data buffer
Afdd - afd.sys - Afd disconnect data buffer
Afdf - afd.sys - Afd TransmitFile debug data
Afdh - afd.sys - Afd address list change buffer
Afdi - afd.sys - Afd "set inline mode" buffer
Afdl - afd.sys - Afd lookaside lists buffer
Afdp - afd.sys - Afd transport IRP buffer
Afdq - afd.sys - Afd routing query buffer
Afdr - afd.sys - Afd ERESOURCE buffer
Afdt - afd.sys - Afd transport address buffer
Afp - <unknown> - SFM File server
AlCI - nt!alpc - ALPC communication info
AlEv - nt!alpc - ALPC eventlog queue
AlIn - nt!alpc - ALPC Internal allocation
AlHa - nt!alpc - ALPC port handle table
AlMs - nt!alpc - ALPC message
ALPC - nt!alpc - ALPC port objects
AlRe - nt!alpc - ALPC section region
AlRr - nt!Alpc - ALPC resource reserves
AlSc - nt!alpc - ALPC section
AlSe - nt!alpc - ALPC client security
AlVi - nt!alpc - ALPC view
ATmp - AppTag mount point
ATon - AppTag object name
ATub - AppTag user buffer
ATgb - AppTag guid buffer
ATac - AppTag ATR command buffer
ATdi - AppTag cliendata index buffer
ATdt - AppTag cliendata temp buffer
ATFb - AppTag file id buffer
Aml* - <unknown> - ACPI AMLI Pooltags
APIC - pnpapic.sys - I/O APIC Driver
ArbA - nt!arb - ARBITER_ALLOCATION_STATE_TAG
ArbL - nt!arb - ARBITER_ORDERING_LIST_TAG
ArbM - nt!arb - ARBITER_MISC_TAG
ArbR - nt!arb - ARBITER_RANGE_LIST_TAG
Arp? - <unknown> - ATM ARP server objects, atmarps.sys
ArpA - <unknown> - AtmArpS address
ArpB - <unknown> - AtmArpS buffer space
ArpI - <unknown> - AtmArpS Interface structure
ArpK - <unknown> - AtmArpS ARP block
ArpM - <unknown> - AtmArpS MARS structure
ArpR - <unknown> - AtmArpS NDIS request
ArpS - <unknown> - AtmArpS SAP structure
Asy1 - <unknown> - ndis / ASYNC_IOCTX_TAG
Asy2 - <unknown> - ndis / ASYNC_INFO_TAG
Asy3 - <unknown> - ndis / ASYNC_ADAPTER_TAG
Asy4 - <unknown> - ndis / ASYNC_FRAME_TAG
AtC - <unknown> - IDE disk configuration
AtD - <unknown> - atdisk.c
ATIX - <unknown> - WDM mini drivers for ATI tuner, xbar, etc.
Atk - <unknown> - Appletalk transport
AtmA - <unknown> - Atoms
AtmT - <unknown> - Atom tables
AuxL - <unknown> - EXIFS Auxlist
Bat? - <unknown> - Battery Class drivers
BatC - <unknown> - Composite battery driver
BatM - <unknown> - Control method battery driver
BatS - <unknown> - Smart battery driver
Batt - <unknown> - Battery class driver
BCSP - bthbcsp.sys - Bluetooth BCSP minidriver
BCDK - nt!init - Kernel boot configuration data.
BIG - nt!mm - Large session pool allocations (ntos\ex\pool.c)
BlCc - blkcache.sys - Block Cache Driver
Bmfd - <unknown> - Font related stuff
BT3C - bt3c.sys - Bluetooth 3COM minidriver
BT8x - <unknown> - WDM mini drivers for Brooktree 848,829, etc.
BTHP - bthport.sys - Bluetooth port driver (generic)
BthS - bthport.sys - Bluetooth port driver (security)
BTME - bthenum.sys - Bluetooth enumerator
BTMO - bthmodem.sys - Bluetooth modem
BTPT - <unknown> - Bluetooth transport protocol library
BTSR - bthser.sys - Bluetooth serial minidriver
BTUR - bthuart.sys - Bluetooth UART minidriver
Bu* - <unknown> - burneng.sys from adaptec
Call - nt!ex - kernel callback object signature
call - <unknown> - debugging call tables
CBRe - <unknown> - CallbackRegistration
Cc - nt!cc - Cache Manager allocations (catch-all)
CcBc - nt!cc - Cache Manager Bcb from pool
CcBm - nt!cc - Cache Manager Bitmap
CcBn - nt!cc - Cache Manager Bcb trim notification entry
CcBr - nt!cc - Cache Manager Bitmap range
CcBz - nt!cc - Cache Manager Bcb Zone
CcDw - nt!cc - Cache Manager Deferred Write
CcEv - nt!cc - Cache Manager Event
CcFn - nt!cc - Cache Manager File name for popups
CcMb - nt!cc - Cache Manager Mbcb
CcOb - nt!cc - Cache Manager Overlap Bcb
CcPB - nt!ccpf - Prefetcher trace buffer
CcPC - nt!ccpf - Prefetcher context
CcPD - nt!ccpf - Prefetcher trace dump
CcPF - nt!ccpf - Prefetcher file name
CcPI - nt!ccpf - Prefetcher intermediate table
CcPL - nt!ccpf - Prefetcher read list
CcPM - nt!ccpf - Prefetcher metadata
CcPS - nt!ccpf - Prefetcher scenario
CcPT - nt!ccpf - Prefetcher trace
CcPc - nt!cc - Cache Manager Private Cache Map
CcPf - nt!ccpf - Prefetcher
CcPh - nt!ccpf - Prefetcher header preallocation
CcPp - nt!ccpf - Prefetcher instructions
CcPq - nt!ccpf - Prefetcher query buffer
CcPs - nt!ccpf - Prefetcher section table
CcPv - nt!ccpf - Prefetcher volume info
CcPw - nt!ccpf - Prefetcher boot worker
CcSc - nt!cc - Cache Manager Shared Cache Map
CcVa - nt!cc - Cache Manager Initial array of Vacbs
CcVl - nt!cc - Cache Manager Vacb Level structures (large streams)
CcVp - nt!cc - Cache Manager Array of Vacb pointers for a cached stream
CctX - <unknown> - EXIFX FCB Commit CTX
CcWq - nt!cc - Cache Manager Work Queue Item
CcWK - nt!cc - Kernel Cache Manager lookaside list
CcWk - nt!cc - Kernel Cache Manager lookaside list
CcZe - nt!cc - Cache Manager Buffer of Zeros
CdA - <unknown> - CdAudio filter driver
Cdcc - cdfs.sys - CDFS Ccb
Cddn - cdfs.sys - CDFS CdName in dirent
Cdee - cdfs.sys - CDFS Search expression for enumeration
Cdfd - cdfs.sys - CDFS Data Fcb
Cdfi - cdfs.sys - CDFS Index Fcb
Cdfl - cdfs.sys - CDFS Filelock
CdFn - cdfs.sys - CDFS Filename buffer
Cdfn - cdfs.sys - CDFS Nonpaged Fcb
Cdfs - cdfs.sys - CDFS General Allocation
Cdft - cdfs.sys - CDFS Fcb Table entry
Cdgs - cdfs.sys - CDFS Generated short name
Cdic - cdfs.sys - CDFS Irp Context
Cdil - cdfs.sys - CDFS Irp Context lite
Cdio - cdfs.sys - CDFS Io context for async reads
Cdma - cdfs.sys - CDFS Mcb array
Cdpe - cdfs.sys - CDFS Prefix Entry
CdPn - cdfs.sys - CDFS CdName in path entry
Cdpn - cdfs.sys - CDFS Prefix Entry name
Cdsp - cdfs.sys - CDFS Buffer for spanning path table
Cdtc - cdfs.sys - CDFS TOC
Cdun - cdfs.sys - CDFS Buffer for upcased name
Cdvd - cdfs.sys - CDFS Buffer for volume descriptor
Cdvp - cdfs.sys - CDFS Vpb allocated in filesystem
CIcr - ci.dll - Code Integrity allocations for image integrity checking
CIsc - ci.dll - Code Integrity core dll
CIha - ci.dll - Code Integrity hashes
ClfA - clfs.sys - CLFS_CONTAINER_TAG
ClfB - clfs.sys - CLFS_BASEFILE_TAG
ClfC - clfs.sys - CLFS_LOGFCBPHYSICAL_TAG
ClfD - clfs.sys - CLFS_LOGFCBVIRTUAL_TAG
ClfE - clfs.sys - CLFS_LOGCCB_TAG
ClfF - clfs.sys - CLFS_FLUSHELT_TAG
ClfG - clfs.sys - CLFS_REQUEST_TAG
ClfH - clfs.sys - CLFS_IOCB_TAG
ClfI - clfs.sys - CLFS_MARSHALBUFFER_TAG
Clfs - clfs.sys - CLFS_TAG
CM - nt!cm - Configuration Manager (registry)
CmcD - hal.dll - HAL CMC Driver Log
CmcK - hal.dll - HAL CMC Kernel Log
CmcT - hal.dll - HAL CMC temporary Log
CMCa - nt!cm - Configuration Manager Cache (registry)
CMDc - nt!cm - Configuration Manager Cache (registry)
CMkb - nt!cm - registry key control blocks
CMpb - nt!cm - registry post blocks
CMnb - nt!cm - registry notify blocks
CMpe - nt!cm - registry post events
CMpa - nt!cm - registry post apcs
CMsb - nt!cm - registry stash buffer
CmVn - nt!cm - captured value name
CMVw - nt!cm - registry mapped view of file
CMVa - nt!cm - value cache value tag
CMVI - nt!cm - value index cache tag
CMSc - nt!cm - security cache pooltag
CMSb - nt!cm - internal stash buffer pool tag
CMNb - nt!cm - notification block pool tag
CMIn - nt!cm - index hint pool tag
CM?? - nt!cm - Internal Configuration manager allocations
CMDa - nt!cm - value data cache pool tag
CMAl - nt!cm -internal registry memory allocator pool tag
Cngb - ksecdd.sys - CNG kmode crypto pool tag
COMX - serial.sys - serial driver allocations
Cont - <unknown> - Contiguous physical memory allocations for device drivers
CopW - <unknown> - EXIFS CopyOnWrite
Covr - nt!cov - Code Coverage pool tag
CpeD - hal.dll - HAL CPE Driver Log
CpeK - hal.dll - HAL CMC Kernel Log
CpeT - hal.dll - HAL CPE temporary Log
CPnp - classpnp.sys - ClassPnP transfer packets
Crsp - ksecdd.sys - CredSSP kernel mode client allocations
CrtH - <unknown> - EXIFS Create Header
Cryp - ksecdd.sys - Crypto allocations
CSdk - <unknown> - Cluster Disk Filter driver
CSnt - <unknown> - Cluster Network driver
CTE - <unknown> - Common transport environment (ntos\inc\cxport.h, used by tdi)
Cvli - <unknown> - EXIFS Cached Volume Info
D2d - <unknown> - Device Object to DosName rtns (ntos\rtl\dev2dos.c)
D3Dd - <unknown> - DX D3D driver (embedded in a display driver like s3mvirge.dll)
D851 - <unknown> - 8514a video driver
Dacl - <unknown> - Temp allocations for object DACLs
Dati - <unknown> - ati video driver
DbCb - nt!dbg - Debug Print Callbacks
DbLo - <unknown> - Debug logging
dcam - <unknown> - WDM mini driver for IEEE 1394 digital camera
Dcdd - cdd.dll - Canonical display driver
Dcl - <unknown> - cirrus video driver
Ddk - <unknown> - Default for driver allocated memory (user's of ntddk.h)
Devi - <unknown> - Device objects
Dh 0 - <unknown> - DirectDraw/3D default object
Dh 1 - <unknown> - DirectDraw/3D DirectDraw object
Dh 2 - <unknown> - DirectDraw/3D Surface object
Dh 3 - <unknown> - DirectDraw/3D Direct3D context object
Dh 4 - <unknown> - DirectDraw/3D VideoPort object
Dh 5 - <unknown> - DirectDraw/3D MotionComp object
Dfb - <unknown> - framebuf video driver
DfC? - dfsc.sys - DFS Client allocations
DfCa - dfsc.sys - DFS Client PERUSERTABLE
DfCb - dfsc.sys - DFS Client REFCONTEXT
DfCc - dfsc.sys - DFS Client CONNECTION
DfCd - dfsc.sys - DFS Client CURRENTDC
DfCe - dfsc.sys - DFS Client CSCEA
DfCf - dfsc.sys - DFS Client FILENAME
DfCg - dfsc.sys - DFS Client PREFIXCACHE
DfCh - dfsc.sys - DFS Client HASH
DfCi - dfsc.sys - DFS Client INPUTBUFFER
DfCj - dfsc.sys - DFS Client REFERRALNAME
DfCj - dfsc.sys - DFS Client REWRITTENNAME
DfCl - dfsc.sys - DFS Client DCLIST
DfCm - dfsc.sys - DFS Client CMCONTEXT
DfCn - dfsc.sys - DFS Client DOMAINNAME
DfCp - dfsc.sys - DFS Client PATH
DfCq - dfsc.sys - DFS Client REGSTRING
DfCr - dfsc.sys - DFS Client REFERRAL
DfCs - dfsc.sys - DFS Client SHARENAME
DfCt - dfsc.sys - DFS Client TREECONNECT
DfCu - dfsc.sys - DFS Client USETABLE
DfCv - dfsc.sys - DFS Client SERVERNAME
DfCw - dfsc.sys - DFS Client TARGETINFO
DfCx - dfsc.sys - DFS Client CREDENTIALS
DfCy - dfsc.sys - DFS Client REMOTEENTRY
DfCz - dfsc.sys - DFS Client DOMAINREFERRAL
Dfs - <unknown> - Distributed File System
dfsr - <unknown> - RDBSS IRP allocation
Dfsm - <unknown> - Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdi\gre
dFVE - dumpfve.sys - Full Volume Encryption crash dump filter (Bitlocker Drive Encryption)
Dire - <unknown> - Directory objects
Dlck - <unknown> - deadlock verifier (part of driver verifier) structures
Dlmp - <unknown> - Video utility library for Vista display drivers
Dmga - <unknown> - mga (matrox) video driver
DmH? - <unknown> - DirectMusic hardware synthesizer
DmpS - dumpsvc.sys - Crashdump Service Driver
DmS? - <unknown> - DirectMusic kernel software synthesizer
Dndt - <unknown> - Device node
Dnod - <unknown> - Device node structure
DOPE - <unknown> - Device Object Power Extension (po component)
DPrf - <unknown> - Disk performance filter driver
DPwr - nt!pnp - PnP power management
Dprt - dxgkrnl.sys - Video port for Vista display drivers
Dps5 - <unknown> - NT5 PostScript printer driver
Dpsh - <unknown> - Postcript driver heap memory
Dpsi - <unknown> - psidisp video driver
Dpsm - <unknown> - Postcript driver memory
Dqv - <unknown> - qv (qvision) video driver
DrDr - rdpdr.sys - Global object
DrEx - rdpdr.sys - Exchange object
DrIC - rdpdr.sys - I/O context object
Driv - <unknown> - Driver objects
Drsd - <unknown> - Rasdd Printer Driver Pool Tag.
Dtga - <unknown> - tga video driver
Dump - <unknown> - Bugcheck dump allocations
Dun5 - <unknown> - NT5 Universal printer driver
DUQD - mpsdrv.sys - MPSDRV upcall user request
DV?? - <unknown> - RDR2 DAV MiniRedir Tags
DVCx - <unknown> - AsyncEngineContext, DAV MiniRedir
DVEx - <unknown> - Exchange, DAV MiniRedir
DVFi - <unknown> - FileInfo, DAV MiniRedir
DVFn - <unknown> - FileName, DAV MiniRedir
DVRw - <unknown> - ReadWrite, DAV MiniRedir
DVSc - <unknown> - SrvCall, DAV MiniRedir
DVSh - <unknown> - SharedHeap, DAV MiniRedir
Dvga - <unknown> - vga 16 color video driver
Dvg2 - <unknown> - vga 256 color video driver
Dvg6 - <unknown> - vga 64K color video driver
Dvgr - <unknown> - vga for risc video driver
DW32 - <unknown> - W32 video driver
Dwd - <unknown> - wd90c24a video driver
Dwp9 - <unknown> - weitekp9 video driver
Dxga - <unknown> - XGA video driver
DxgK - dxgkrnl.sys - Vista display driver support
Efsm - <unknown> - EFS driver
Efsc - <unknown> - EFS driver
Efst - <unknown> - EXIFS FS Statistics
Envr - <unknown> - Environment strings
Err - <unknown> - Error strings
EtwA - nt!etw - Etw APC
EtwG - nt!etw - Etw Guid
EtwD - nt!etw - Etw DataBlock
EtwS - nt!etw - Etw DataSource
EtwR - nt!etw - Etw Registration
EtwC - nt!etw - Etw Realtime Consumer
EtwB - nt!etw - Etw Buffer
EtwP - nt!etw - Etw Pool
EtwQ - nt!etw - Etw Queue
Etwq - nt!etw - Etw ReplyQueue
Etwr - nt!etw - Etw ReplyQueue Entry
EtwL - nt!etw - ETW_LOGGER_CONTEXT
Etwp - nt!etw - ETW per-processor block
Evel - <unknown> - EFS file system filter driver lookaside list
Even - <unknown> - Event objects
Evid - <unknown> - Rtl Event ID's
ExWl - <unknown> - Executive worker list entry
Fat - fastfat.sys - Fat File System allocations
FatB - fastfat.sys - Fat allocation bitmaps
FatC - fastfat.sys - Fat Ccbs
FatD - fastfat.sys - Fat pool dirents
FatE - fastfat.sys - Fat EResources
FatF - fastfat.sys - Fat Fcbs
FatI - fastfat.sys - Fat IrpContexts
FatL - fastfat.sys - Fat FAT entry lookup buffer on verify
FatN - fastfat.sys - Fat Nonpaged Fcbs
FatO - fastfat.sys - Fat I/O buffer
FatP - fastfat.sys - Fat output for query retrieval pointers (caller frees)
FatQ - fastfat.sys - Fat buffered user buffer
FatR - fastfat.sys - Fat repinned Bcb
FatS - fastfat.sys - Fat stashed Bpb
FatT - fastfat.sys - Fat directory allocation bitmaps
FatV - fastfat.sys - Fat Vcb stat bucket
Fatv - fastfat.sys - Fat events
FatW - fastfat.sys - Fat FAT windowing structure
FatX - fastfat.sys - Fat IO contexts
Fatb - fastfat.sys - Fat Bcb arrays
Fatd - fastfat.sys - Fat EA data
Fate - fastfat.sys - Fat EA set headers
Fatf - fastfat.sys - Fat deferred flush contexts
Fati - fastfat.sys - Fat IO run descriptor
Fatn - fastfat.sys - Fat filename buffer
Fatr - fastfat.sys - Fat verification-time rootdir snapshot
Fats - fastfat.sys - Fat verification-time boot sector
Fatv - fastfat.sys - Fat backpocket Vpb
Fatx - fastfat.sys - Fat delayed close contexts
Fcbl - <unknown> - EXIFS FCBlock
fboX - <unknown> - EXIFS FOBXVF List
File - <unknown> - File objects
FIcn - fileinfo.sys - FileInfo FS-filter Create Retry Path
FIcp - fileinfo.sys - FileInfo FS-filter Extra Create Parameter
FIcs - fileinfo.sys - FileInfo FS-filter Stream Context
FIcv - fileinfo.sys - FileInfo FS-filter Volume Context
FIOc - fileinfo.sys - FileInfo FS-filter Prefetch Open Context
FIou - fileinfo.sys - FileInfo FS-filter User Open Context
FIof - fileinfo.sys - FileInfo FS-filter File Object Context
FIPc - fileinfo.sys - FileInfo FS-filter Prefetch Context
FIvn - fileinfo.sys - FileInfo FS-filter Volume Name
FIvp - fileinfo.sys - FileInfo FS-filter Volume Properties
Flop - <unknown> - floppy driver
Flst - <unknown> - EXIFS Freelist
FLex - <unknown> - exclusive file lock
FLfl - <unknown> - exported (non-private) file lock
FLli - <unknown> - per-file lock information
FLln - <unknown> - shared lock tree node
FLsh - <unknown> - shared file lock
FLwl - <unknown> - waiting lock
FM?? - fltmgr.sys - Unrecognized FltMgr tag (update pooltag.w)
FMac - fltmgr.sys - ASCII String buffers
FMas - fltmgr.sys - ASYNC_IO_COMPLETION_CONTEXT structure
FMcb - fltmgr.sys - FLT_CCB structure
FMcr - fltmgr.sys - Context registration structures
FMct - fltmgr.sys - TRACK_COMPLETION_NODES structure
FMdl - fltmgr.sys - Array of DEVICE_OBJECT pointers
FMea - fltmgr.sys - EA buffer for create
FMfc - fltmgr.sys - FLTMGR_FILE_OBJECT_CONTEXT structure
FMfi - fltmgr.sys - Fast IO dispatch table
FMfk - fltmgr.sys - Byte Range Lock structure
FMfl - fltmgr.sys - FLT_FILTER structure
FMfn - fltmgr.sys - NAME_CACHE_NODE structure
FMfr - fltmgr.sys - FLT_FRAME structure
FMfz - fltmgr.sys - FILE_LIST_CTRL structure
FMib - fltmgr.sys - Irp SYSTEM buffers
FMic - fltmgr.sys - IRP_CTRL structure
FMin - fltmgr.sys - FLT_INSTANCE name
FMil - fltmgr.sys - IRP_CTRL completion node stack
FMis - fltmgr.sys - FLT_INSTANCE structure
FMla - fltmgr.sys - Per-processor IRPCTRL lookaside lists
FMnc - fltmgr.sys - NAME_CACHE_CREATE_CTRL structure
FMng - fltmgr.sys - NAME_GENERATION_CONTEXT structure
FMol - fltmgr.sys - OPLOCK_CONTEXT structure
FMos - fltmgr.sys - Operation status ctrl structure
FMpl - fltmgr.sys - Cache aware pushLock
FMpr - fltmgr.sys - FLT_PRCB structure
FMrl - fltmgr.sys - FLT_OBJECT rundown logs
FMrp - fltmgr.sys - Reparse point data buffer
FMrr - fltmgr.sys - Per-processor Cache-aware rundown ref structure
FMsd - fltmgr.sys - Security descriptors
FMsl - fltmgr.sys - STREAM_LIST_CTRL structure
FMtn - fltmgr.sys - Temporary file names
FMtr - fltmgr.sys - Temporary Registry information
FMts - fltmgr.sys - Tree Stack
FMus - fltmgr.sys - Unicode string
FMvf - fltmgr.sys - FLT_VERIFIER_EXTENSION structure
FMvj - fltmgr.sys - FLT_VERIFIER_OBJECT structure
FMvo - fltmgr.sys - FLT_VOLUME structure
FMwi - fltmgr.sys - Work item structures
FMcn - fltmgr.sys - Non paged context extension structures.
FMtp - fltmgr.sys - Non Paged tx vol context structures.
FMlp - fltmgr.sys - Paged stream list control entry structures.
Fsrc - fsrec.sys - Filesystem recognizer (fsrec.sys)
Fstb - <unknown> - ntos\fstub
FstB - <unknown> - ntos\fstub
FsVg - fsvga.sys - International VGA support
flnk - <unknown> - font link tag used in ntgdi\gre
FS?? - nt!fsrtl - Unrecoginzed File System Run Time allocations (update pooltag.w)
FSeh - nt!fsrtl - File System Run Time Extra Create Parameter Entry
FSel - nt!fsrtl - File System Run Time Extra Create Parameter List
FSfm - nt!fsrtl - File System Run Time Fast Mutex Lookaside List
FSim - nt!fsrtl - File System Run Time Mcb Initial Mapping Lookaside List
FSrt - nt!fsrtl - File System Run Time allocations (DO NOT USE!)
FSmg - nt!fsrtl - File System Run Time
FSrd - nt!fsrtl - File System Run Time
FSrm - nt!fsrtl - File System Run Time
FSrn - nt!fsrtl - File System Run Time
FSrN - nt!fsrtl - File System Run Time
FSro - nt!fsrtl - File System Run Time
FSrs - nt!fsrtl - File System Run Time Work Item for low-stack posting
FSun - nt!fsrtl - File System Run Time
FOCX - nt!fsrtl - File System Run Time File Object Context structure
FTrc - <unknown> - Fault tolerance Slist tag.
FtC - <unknown> - Fault tolerance driver
FtM - <unknown> - Fault tolerance driver
FtS - <unknown> - Fault tolerance driver
FtT - <unknown> - Fault tolerance driver
FtU - <unknown> - Fault tolerance driver
FtV - <unknown> - Fault tolerance driver
<unknown>
FtpA - mpsdrv.sys - MPSDRV FTP protocol analyzer
FwfD - mpsdrv.sys - MPSDRV driver buffer for flattening NET_BUFFFER
FVE? - fvevol.sys - Full Volume Encryption Filter Driver (Bitlocker Drive Encryption)
FVE0 - fvevol.sys - General allocations
FVEc - fvevol.sys - Cryptographic allocations
FVEl - fvevol.sys - FVELIB allocations
FVEp - fvevol.sys - Write buffers
FVEr - fvevol.sys - Reserved mapping addresses
FVEv - fvevol.sys - Conversion allocations
FVEw - fvevol.sys - Worker threads
FVEx - fvevol.sys - Read/write control structures
FxDr - wdf01000.sys - KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable.
FxLg - wdf01000.sys - KMDF IFR log tag
FxL? - wdfldr.sys - KMDF Loader Pool allocation
Fwpp - fwpkclnt.sys - Windows Filtering Platform export driver.
G??? - <unknown> - Gdi Objects
G - <unknown> - Gdi Generic allocations
Gcac - <unknown> - Gdi glyph cache
Gcap - <unknown> - Gdi capture buffer
Gcsl - <unknown> - Gdi string resource script names
Gdbr - <unknown> - Gdi driver brush realization
Gdd - <unknown> - Gdi ddraw PKEY_VALUE_FULL_INFORMATION
Gdda - <unknown> - Gdi ddraw attach list
GddD - <unknown> - Gdi ddraw dummy page
Gdde - <unknown> - Gdi ddraw event
Gddf - <unknown> - Gdi ddraw driver heaps
Gddp - <unknown> - Gdi ddraw driver caps
Gddv - <unknown> - Gdi ddraw driver video memory list
Gdwd - win32k.sys - Gdi watchdog support objects
Gdxd - <unknown> - Gdi ddraw VPE directdraw object
Gdxs - <unknown> - Gdi ddraw VPE surface, videoport, capture object
Gdxx - <unknown> - Gdi ddraw VPE DXAPI object
Gdev - <unknown> - Gdi GDITAG_DEVMODE
GDev - <unknown> - Gdi pdev
Gdrs - <unknown> - Gdi GDITAG_DRVSUP
Gebr - <unknown> - Gdi ENGBRUSH
gEdg - <unknown> - Gdi gradient fill triangle
Gffv - <unknown> - Gdi FONTFILEVIEW
gFil - <unknown> - Gdi FILEVIEW
GFil - <unknown> - Gdi engine descriptor list
Gfsb - <unknown> - Gdi font sustitution list
Gfsm - <unknown> - Gdi Fast mutex
Ggdv - <unknown> - Gdi GDITAG_GDEVICE
Gglb - <unknown> - Gdi temp buffer
Ggls - <unknown> - Gdi glyphset
Ggb - <unknown> - Gdi glyph bits
Ggbl - <unknown> - Gdi look aside buffers
Ghmg - <unknown> - Gdi handle manager objects
Gini - <unknown> - Gdi fast mutex
Gh?? - win32k.sys - Gdi Handle manager specific object types: defined in w32\ntgdi\inc\ntgdistr.h
Gla? - win32k.sys - Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdi\inc\ntgdistr.h
Gldv - <unknown> - Gdi Ldev
Glnk - <unknown> - Gdi PFELINK
Gmap - <unknown> - Gdi font map signature table
Gpff - <unknown> - Gdi physical font file
Gpft - <unknown> - Gdi font table
Gsem - <unknown> - Gdi Semaphores
Gsp - <unknown> - Gdi sprite
Gspr - <unknown> - Gdi sprite grow range
Gtmp - <unknown> - Gdi temporary allocations
Gtmw - <unknown> - Gdi TMW_INTERNAL
Gxlt - <unknown> - Gdi Xlate
Gfcb - <unknown> - EXIFS Grow FCB
Hal - hal.dll - Hardware Abstraction Layer
HalV - ntoskrnl.exe - Driver Verifier DMA checking
Hpfs - <unknown> - Pinball (aka Hpfs) allocations
HisC - <unknown> - histogram filter driver
Hist - <unknown> - histogram filter driver
HidP - <unknown> - HID Parser
HidC - <unknown> - HID Class
HdCl - <unknown> - HID Client Sample Driver
HpMM - pnpmem.sys - HotPlug Memory Driver
HCID - bthport.sys - Bluetooth port driver HCI debug
HCIT - bthport.sys - Bluetooth port driver (HCI)
HcRs - hcaport.sys - HCAPORT_TAG_RESOURCE_LIST
HcEv - hcaport.sys - HCAPORT_TAG_EVENT
HcdI - hcaport.sys - HCAPORT_TAG_HWID
HcEn - hcaport.sys - HCAPORT_TAG_ENUM
HcMc - hcaport.sys - HCAPORT_TAG_MISC
HcDr - hcaport.sys - HCAPORT_TAG_DEVICE_RELATIONS
HcBm - hcaport.sys - HCAPORT_TAG_BITMAP
HcOb - hcaport.sys - HCAPORT_TAG_OBJECT
HcCq - hcaport.sys - HCAPORT_TAG_CQUEUE
HcPr - hcaport.sys - HCAPORT_TAG_PROTD
HPmi - hcaport.sys - HCAPORT_TAG_PMI_EXTENSION
HcMa - hcaport.sys - HCAPORT_TAG_MAD
HcMp - hcaport.sys - HCAPORT_TAG_MINIPORT
HcCm - hcaport.sys - HCAPORT_TAG_CM
HcUc - hcaport.sys - HCAPORT_TAG_UCONTEXT
HcMr - hcaport.sys - HCAPORT_TAG_REMOVE_LOCK
Hmgo - hcaport.sys - HCAPORT_TAG_WQ_MG_INFO
Hioc - hcaport.sys - HCAPORT_TAG_IOC_SERVICE_TABLE
hSVD - mrxdav.sys - Shared Heap Tag
HT01 - <unknown> - GDI Halftone AddCachedDCI() for CurCDCIData
HT02 - <unknown> - GDI Halftone GetCachedDCI() for Threshold
HT03 - <unknown> - GDI Halftone FindCachedSMP() for CurCSMPData
HT04 - <unknown> - GDI Halftone FindCachedSMP() for CurCSMPBmp
HT05 - <unknown> - GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI
HT06 - <unknown> - GDI Halftone pDCIAdjClr() for DEVCLRADJ
HT07 - <unknown> - GDI Halftone ComputeRGB555LUT() for RGBLUT
HT08 - <unknown> - GDI Halftone ColorTriadSrcToDev() for RGB-XYZ
HT09 - <unknown> - GDI Halftone ColorTriadSrcToDev() for CRTX-FD6XYZ Cache
HT10 - <unknown> - GDI Halftone CreateDyesColorMappingTable() for DevPrims
HT11 - <unknown> - GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable
HT12 - <unknown> - GDI Halftone ThresholdsFromYData() for pYData
HT13 - <unknown> - GDI Halftone ComputeHTCellRegress() for pThresholds
HT14 - <unknown> - GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine
HT15 - <unknown> - GDI Halftone CalculateStretch() for PrimColorInfo
Hvlm - nt!Hvl - Temporary MDL for the Hvl component.
HvlP - nt!Hvl - Hypercall marshalling pages for the Hvl component.
IBCM - wibcm.sys - CM_INSTANCE_TAG Windows Infiniband Communications Manager
CEP - wibcm.sys - CEP_INSTANCE_TAG
CMSH - wibcm.sys - WIBCM_SHARED_TAG
CMWK - wibcm.sys - WIBCM_WORK_TAG
CMWT - wibcm.sys - WIBCM_TIMER_TAG
IBm* - wibms.sys - Windows Infiniband Management Server pool tags
IbPm - wibpm.sys - WIBPM_TAG Windows Infiniband Performance Manager
IbPS - wibpm.sys - WIBPM_SENT_TAG
IbPI - wibpm.sys - WIBPM_ITEM_TAG
IbPA - wibpm.sys - WIBPM_SAMPLE_TAG
IbW0 - wibwmi.sys - WIBWMI0_TAG Windows Infiniband WMI Manager
IbW1 - wibwmi.sys - WIBWMI1_TAG
IbW2 - wibwmi.sys - WIBWMI2_TAG
IPX - <unknown> - Nwlnkipx transport
Icp - <unknown> - I/O completion packets queue on a completion ports
IcpP - <unknown> - NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers
IdeP - <unknown> - atapi IDE
IdeX - <unknown> - PCI IDE
idle - <unknown> - Power Manager idle handler
Ifs - <unknown> - Default file system allocations (user's of ntifs.h)
Info - <unknown> - general system information allocations
Io - nt!io - general IO allocations
IoCc - nt!io - Io completion context
IoEa - nt!io - Io extended attributes
IoEr - nt!io - Io error log packets
IoFc - nt!io - Io name transmogrify operation
IoFs - nt!io - Io shutdown packet
IoFu - nt!pnp - Io file utils
IoKB - <unknown> - Registry basic key block (temp allocation)
IoNm - nt!io - Io parsing names
IoRb - nt!io - Io remote boot related
IoRN - nt!io - Registry key name (temp allocation)
IoSe - nt!io - Io security related
IoSh - nt!io - Io shutdown packet
IoSt - nt!io - Io Stream Identifier Context
IoTi - nt!io - Io timers
IoTt - nt!vf - I/O verifier IRP tracking table
Ioin - <unknown> - Io interrupts
IoOp - nt!io - I/O subsystem open packet
IoRi - nt!io - I/O SubSystem Driver Reinitialization Callback Packet
IoUs - nt!io - I/O SubSystem completion Context Allocation
Irp - <unknown> - Io, IRP packets
Irp+ - nt!vf - I/O verifier allocated IRP packets
IrpB - nt!vf - I/O verifier direct I/O double buffer allocation
Irpd - nt!vf - I/O verifier deferred completion context
Irps - nt!vf - I/O verifier per-IRP session tracking data
Irpt - nt!vf - I/O verifier per-IRP tracking data
IrpC - nt!vf - I/O verifier stack contexts
Irpl - nt!io - system large IRP lookaside list
Irps - nt!io - system small IRP lookaside list
Isap - <unknown> - Pnp Isa bus extender
II?? - <unknown> - IP in IP tunneling
IIrf - <unknown> - Free memory
IIdt - <unknown> - Data
IITn - <unknown> - Tunnel
IIhd - <unknown> - Header
IIpk - <unknown> - Packet
IIsc - <unknown> - Send Context
IIts - <unknown> - Transfer Context
IIwc - <unknown> - Work Context
Im* - <unknown> - Imapi.sys from adaptec
INTC - <unknown> - Intel video driver
IPm? - <unknown> - IP Multicasting
IPmg - <unknown> - Group
IPms - <unknown> - Source
IPmo - <unknown> - Outgoing Interface
IPmm - <unknown> - Message
IPmf - <unknown> - Free memory (only in checked builds)
Ip?? - ipsec.sys - IP Security
IpSI - ipsec.sys - initial allocations
IpAT - ipsec.sys - AH headers in transport mode
IpAU - ipsec.sys - AH headers in tunnel mode
IpET - ipsec.sys - ESP headers in transport mode
IpEU - ipsec.sys - ESP headers in tunnel mode
IpHT - ipsec.sys - HUGHES headers in transport mode
IpHU - ipsec.sys - HUGHES headers in tunnel mode
IpAX - ipsec.sys - Key acquire contexts
IpFI - ipsec.sys - Filter blocks
IpSA - ipsec.sys - Security Associations
IpKE - ipsec.sys - keys
IpTI - ipsec.sys - timers
IpSQ - ipsec.sys - stall queues
IpLA - ipsec.sys - lookaside lists
IpBP - ipsec.sys - buffer pools
IpSC - ipsec.sys - send complete context
IpEQ - ipsec.sys - event queue
IpHW - ipsec.sys - hardware accleration items
IpCO - ipsec.sys - IP compression
ItoM - tcpip.sys - IPsec task offload interface
ItoD - tcpip.sys - IPsec task offload delete SA
ItoS - tcpip.sys - IPsec task offload add SA
ItoC - tcpip.sys - IPsec task offload context
ItoO - tcpip.sys - IPsec task offload paramters
IpFl - mpsdrv.sys - MPSDRV IP Flow
IrD? - <unknown> - IrDA TDI and RAS drivers
IU?? - <unknown> - IIS Utility Driver
IUDl - <unknown> - Lookaside list allocations
IUcp - <unknown> - completion port minipackets
KAPC - nt!io - I/O SubSystem HardError APC
KbdC - <unknown> - Keyboard Class Driver
KCfe - <unknown> - Kernel COM factory entry
Ke - <unknown> - Kernel data structures
KeIC - <unknown> - Kernel Interrupt Object Chain
Key - <unknown> - Key objects
KMIX - <unknown> - Kmixer (wdm audio)
KNMI - <unknown> - Kernel NMI Callback object
KrbC - ksecdd.sys - Kerberos Client package
KSah - <unknown> - Ks auxiliary stream headers
KSAI - <unknown> - allocator instance
KSai - <unknown> - default allocator instance header
KSbi - <unknown> - event buffered item
KSCI - <unknown> - clock instance
KSce - <unknown> - create item entry
KSch - <unknown> - create handler entry
KSci - <unknown> - default clock instance header
KScp - <unknown> - object creation parameters auxiliary copy
KSda - <unknown> - default allocator
KSdc - <unknown> - default clock
KSdh - <unknown> - device header
Kse0 - ksecdd.sys - Security driver allocs for sec package 0
Kse1 - ksecdd.sys - Security driver allocs for sec package 1
Kse2 - ksecdd.sys - Security driver allocs for sec package 2
Kse3 - ksecdd.sys - Security driver allocs for sec package 3
Kse4 - ksecdd.sys - Security driver allocs for sec package 4
Kse5 - ksecdd.sys - Security driver allocs for sec package 5
Kse6 - ksecdd.sys - Security driver allocs for sec package 6
Kse7 - ksecdd.sys - Security driver allocs for sec package 7
Kse8 - ksecdd.sys - Security driver allocs for sec package 8
Kse9 - ksecdd.sys - Security driver allocs for sec package 9
Ksec - ksecdd.sys - Security device driver
KSed - <unknown> - event dpc item
KSee - <unknown> - event entry
KSed - <unknown> - oneshot event deletion dpc
KSep - <unknown> - irp system buffer event parameter
KseS - ksecdd.sys - Security driver allocs for LSA proper
KSew - <unknown> - oneshot event deletion workitem
KseZ - ksecdd.sys - Security driver allocs for default sec package
KSqr - <unknown> - QM quality report
KSer - <unknown> - QM error report
KSfd - <unknown> - filter cache data (MSKSSRV)
KsFI - <unknown> - filter instance
KSns - <unknown> - null security object
KSnv - <unknown> - registry name value
KSoh - <unknown> - object header
KSop - <unknown> - object creation parameters
KSpc - <unknown> - port driver instance FsContext
KSPI - <unknown> - pin instance
KSpp - <unknown> - irp system buffer property/method/event parameter
KSpt - <unknown> - pin type list (MSKSSRV)
KSqf - <unknown> - query information file buffer
KSsc - <unknown> - port driver stream FsContext
KSsf - <unknown> - set information file buffer
KSsh - <unknown> - stream headers
KSsi - <unknown> - software bus interface
KSsl - <unknown> - symbolic link buffer (MSKSSRV)
KSsp - <unknown> - serialized property set
KsoO - <unknown> - WDM audio stuff
L2CA - bthport.sys - Bluetooth port driver (L2CAP)
L2T0 - <unknown> - ndis\l2tp / MTAG_FREED
L2T1 - <unknown> - ndis\l2tp / MTAG_ADAPTERCB
L2T2 - <unknown> - ndis\l2tp / MTAG_TUNNELCB
L2T3 - <unknown> - ndis\l2tp / MTAG_VCCB
L2T4 - <unknown> - ndis\l2tp / MTAG_VCTABLE
L2T5 - <unknown> - ndis\l2tp / MTAG_WORKITEM
L2T6 - <unknown> - ndis\l2tp / MTAG_TIMERQ
L2T7 - <unknown> - ndis\l2tp / MTAG_TIMERQITEM
L2T8 - <unknown> - ndis\l2tp / MTAG_PACKETPOOL
L2T9 - <unknown> - ndis\l2tp / MTAG_FBUFPOOL
L2Ta - <unknown> - ndis\l2tp / MTAG_HBUFPOOL
L2Tb - <unknown> - ndis\l2tp / MTAG_TDIXRDG
L2Tc - <unknown> - ndis\l2tp / MTAG_TDIXSDG
L2Td - <unknown> - ndis\l2tp / MTAG_CTRLRECD
L2Te - <unknown> - ndis\l2tp / MTAG_CTRLSENT
L2Tf - <unknown> - ndis\l2tp / MTAG_PAYLRECD
L2Tg - <unknown> - ndis\l2tp / MTAG_PAYLSENT
L2Th - <unknown> - ndis\l2tp / MTAG_INCALL
L2Ti - <unknown> - ndis\l2tp / MTAG_UTIL
L2Tj - <unknown> - ndis\l2tp / MTAG_ROUTEQUERY
L2Tk - <unknown> - ndis\l2tp / MTAG_ROUTESET
L2Tl - <unknown> - ndis\l2tp / MTAG_L2TPPARAMS
L2Tm - <unknown> - ndis\l2tp / MTAG_TUNNELWORK
L2Tn - <unknown> - ndis\l2tp / MTAG_TDIXROUTE
LANE - atmlane.sys - LAN Emulation Client for ATM
LB?? - <unknown> - LM Datagram receiver allocations
LBan - <unknown> - Server announcement
LBvb - <unknown> - View buffer
LBma - <unknown> - Master announce context
LBxp - <unknown> - Transport
LBxn - <unknown> - TransportName
LBxm - <unknown> - Master name
LBtn - <unknown> - Transport name
LBea - <unknown> - Ea buffer
LBdi - <unknown> - POOL_DOMAIN_INFO
LBds - <unknown> - Send datagram context
LBci - <unknown> - Connection info
LBmh - <unknown> - Mailslot header
LBbl - <unknown> - Backup List
LBsl - <unknown> - Browser server list
LBbs - <unknown> - Browser server
LBgb - <unknown> - GetBackupList request
LBbr - <unknown> - GetBackupList response
LBmb - <unknown> - Mailslot Buffer
LBid - <unknown> - Illegal datagram context
LBbn - <unknown> - Name
LBnn - <unknown> - Name name
LBic - <unknown> - IRP context
LBwi - <unknown> - Work item
LBel - <unknown> - Election context
LBbb - <unknown> - Become backup context
LBbr - <unknown> - Become backup request
LBpn - <unknown> - Paged Name
LBpt - <unknown> - Paged transport
LBse - <unknown> - Browser security
Lbuf - <unknown> - EXIFS Large Buffer
LeoC - <unknown> - Symantec/Norton AntiVirus filter driver
List - <unknown> - kernel utilities list allocation
LCam - <unknown> - WDM mini video capture driver for Logitech camera
Lfs - <unknown> - Lfs allocations
LfsI - <unknown> - Lfs allocations
LogA - clfs.sys - CLFS_APITEST_TAG
LpcZ - <unknown> - LPC Zone
LpcM - <unknown> - Local procedure call message blocks
Lr?? - <unknown> - LM redirector allocations
Lr - <unknown> - Generic allocations
Lrcx - <unknown> - Context blocks of various types
Lrcl - <unknown> - ConnectListEntries
Lrsl - <unknown> - ServerListEntries
Lrse - <unknown> - Security entry
Lrsc - <unknown> - Search Control Blocks
Lrea - <unknown> - EA related allocations
Lric - <unknown> - Instance Control Blocks
Lrfc - <unknown> - File Control Blocks
Lrfl - <unknown> - Fcb Locks
Lrfp - <unknown> - Fcb Paging locks
Lrcn - <unknown> - Computer Name
Lrdn - <unknown> - Domain Name
Lr?? - <unknown> - Buffers used for FsControlFile APIs
Lrlc - <unknown> - Lock Control Blocks
Lrlb - <unknown> - Lock Control Block buffers
Lrnf - <unknown> - Non paged FCB
Lrnt - <unknown> - Non paged transport
Lrps - <unknown> - Paged security entry
Lrte - <unknown> - Transport event.
Lrxx - <unknown> - Transceive context blocks
Lr!! - <unknown> - Cancel request context blocks
Lrmt - <unknown> - MPX table
Lrme - <unknown> - MPX table entries
Lrsx - <unknown> - Send contexts
Lraw - <unknown> - Async write context
Lrwb - <unknown> - Write behind buffer header
Lrbb - <unknown> - Write behind buffer
Lrwq - <unknown> - Work queue item
Lrac - <unknown> - ACL for redirector
Lrds - <unknown> - Security Descriptor for redirector
Lrsm - <unknown> - SMB buffer
Lrds - <unknown> - Duplicated ansi string
Lrdu - <unknown> - Duplicated unicode string
Lxpt - <unknown> - Transport
Lrtc - <unknown> - Transport connection
Lrna - <unknown> - Netbios Addresses
Lrca - <unknown> - Temporary storage used in name canonicalization
Lr2x - <unknown> - Transact SMB context
Lrpt - <unknown> - Primary transport server list
Lrso - <unknown> - Operating system name
Lref - <unknown> - Reference history (debug only)
LS?? - <unknown> - LM server allocations
LSac - <unknown> - BlockTypeAdminCheck
LSas - <unknown> - BlockTypeAdapterStatus
LSbf - <unknown> - buffer descriptor
LScd - <unknown> - comm device
LScn - <unknown> - connection
LSdb - <unknown> - data buffer
LSdc - <unknown> - BlockTypeDirCache
LSdi - <unknown> - BlockTypeDirectoryInfo
LSep - <unknown> - endpoint
LSfn - <unknown> - BlockTypeFSName
LSlf - <unknown> - LFCB
LSlr - <unknown> - BlockTypeLargeReadX
LSmf - <unknown> - MFCB
LSmi - <unknown> - BlockTypeMisc
LSnh - <unknown> - nonpaged block header
LSni - <unknown> - BlockTypeNameInfo
LSop - <unknown> - oplock break wait
LSpc - <unknown> - paged connection
LSpm - <unknown> - paged MFCB
LSpr - <unknown> - paged RFCB
LSrf - <unknown> - RFCB
LSsc - <unknown> - search(core)
LSsd - <unknown> - BlockTypeShareSecurityDescriptor
LSsf - <unknown> - BlockTypeDfs
LSsh - <unknown> - share
LSsp - <unknown> - search(core complete)
LSsr - <unknown> - search
LSss - <unknown> - session
LStb - <unknown> - table
LStc - <unknown> - tree connect
LSti - <unknown> - timer
LStr - <unknown> - transaction
LSvi - <unknown> - BlockTypeVolumeInformation
LSwi - <unknown> - initial work context
LSwn - <unknown> - normal work context
LSwq - <unknown> - BlockTypeWorkQueue
LSwr - <unknown> - raw work context
LSws - <unknown> - BlockTypeWorkContextSpecial
LSnd - <unknown> - WDM mini sound driver for Logitech video camera
Luaf - luafv.sys - LUA File Virtualization
LXMK - <unknown> - kernel mixer line driver (KMXL - looks like they got their tag backwards)
MXF - <unknown> - DirectMusic (MIDI Transform Filter)
MapP - <unknown> - PNP map
Mapr - <unknown> - arc firmware registry routines
McaC - hal.dll - HAL MCA corrected Log
McaD - hal.dll - HAL MCA Driver Log
McaK - hal.dll - HAL MCA Kernel Log
McaP - hal.dll - HAL MCA Log from previous boot
McaT - hal.dll - HAL MCA temporary Log
MCAM - <unknown> - WDM mini driver for Intel USB camera
MCDx - <unknown> - OpenGL MCD server (mcdsrv32.dll) allocations
MCDd - <unknown> - OpenGL MCD driver (embedded in a display driver like s3mvirge.dll)
Mdl - <unknown> - Io, Mdls
MdlP - <unknown> - MDL per processor lookaside list pointers
MePr - <unknown> - In-memory print buffer
mkup - mpsdrv.sys - MPSDRV upcall request
Mm - nt!mm - general Mm Allocations
MmAc - nt!mm - Mm access log buffers
MmBk - nt!mm - Mm banked sections
MmCa - nt!mm - Mm control areas for mapped files
MmCd - nt!mm - Mm fork clone descriptors
MmCh - nt!mm - Mm fork clone headers
MmCi - nt!mm - Mm control areas for images
MmCl - nt!mm - Mm fork clone prototype PTEs
MmCm - nt!mm - Calls made to MmAllocateContiguousMemory
MmCr - nt!mm - Mm fork clone roots
MmCt - nt!mm - Mm debug tracing
MmDb - nt!mm - NtMapViewOfSection service
MmDT - nt!mm - Mm debug
MmEx - nt!mm - Mm events
MmHi - nt!mm - Mm image entry - allocated per session
MmHn - nt!mm - Mm sessionwide address name string entry
MmHv - nt!mm - Mm sessionwide address entry
MmIn - nt!mm - Mm inpaged io structures
MmLd - nt!mm - Mm load module database
MmPd - nt!mm - Mm page table commitment bitmaps
MmPg - nt!mm - Mm page table pages at init time
MmRp - nt!mm - Mm repurpose logging
MmRw - nt!mm - Mm read write virtual memory buffers
MmSb - nt!mm - Mm subsections
MmSe - nt!mm - Mm secured VAD allocation
MmSg - nt!mm - Mm segments
MmSt - nt!mm - Mm section object prototype ptes
MmSy - nt!mm - Mm PTE and IO tracking logs
Mmdl - nt!mm - Mm Mdls for flushes
Mmpp - nt!mm - Mm prototype PTEs for pool
Mmpr - nt!mm - Mm physical VAD roots
MmVd - nt!mm - Mm virtual address descriptors for mapped views
MmVs - nt!mm - Mm virtual address descriptors short form (private views)
Mmxx - nt!mm - Mm temporary allocations
MmCx - nt!mm - info for dynamic section extension
MmDm - nt!mm - deferred MmUnlock entries
MmHt - nt!mm - session space PTE data
MmLn - nt!mm - temporary name buffer for driver loads
MmMl - nt!mm - physical memory range information
MmPa - nt!mm - pagefile space deletion slist entries
MmRl - nt!mm - temporary readlists for file prefetch
MmSP - nt!mm - SLIST entries for system PTE NB queues
MmSi - nt!mm - Control area security image stubs
MmSc - nt!mm - subsections used to map data files
MmSd - nt!mm - extended subsections used to map data files
MmSm - nt!mm - segments used to map data files
MmWe - nt!mm - Work entries for writing out modified filesystem pages.
MmWw - nt!mm - Write watch VAD info
Mmpv - nt!mm - Physical view VAD info
Mmww - nt!mm - Write watch bitmap VAD info
Mn01 - monitor.sys - ACPI method evaluation output buffer
Mn02 - monitor.sys - Unused
Mn03 - monitor.sys - Raw E-EDID v.1.x byte stream including base block + extension blocks (if any)
Mn04 - monitor.sys - Cached monitor ID WMI data block
Mn05 - monitor.sys - Cached monitor basic display parameters WMI data block
Mn06 - monitor.sys - Cached monitor analog video input parameters WMI data block
Mn07 - monitor.sys - Cached monitor digitial video input parameters WMI data block
Mn08 - monitor.sys - Cached monitor color characteristics WMI data block
Mn09 - monitor.sys - Cached supported monitor source modes WMI data block
Mn0A - monitor.sys - Registry subkey info buffer
Mn0B - monitor.sys - Registry value buffer
Mn0C - monitor.sys - Cached supported monitor frequency ranges WMI data block (overrides from registry)
Mn0D - monitor.sys - Cached supported monitor frequency ranges WMI data block (from E-EDID v.1.x base block)
Mn0E - monitor.sys - Buffer for E-EDID v.1.x base block, if any, populated by miniport
Mn0F - monitor.sys - Buffer for E-EDID v.1.x extension block(s), if any, populated by miniport
MNFf - msnfsflt.sys - NFS FS Filter, filename buffer
MNFi - msnfsflt.sys - NFS FS Filter, instance name buffer
MNFr - msnfsflt.sys - NFS FS Filter, registry access buffer
MNFs - msnfsflt.sys - NFS FS Filter, general string buffer
MNFv - msnfsflt.sys - NFS FS Filter, volume name buffer
MNFC - msnfsflt.sys - NFS FS Filter, callback context
MNFF - msnfsflt.sys - NFS FS Filter, file context
MNFI - msnfsflt.sys - NFS FS Filter, instance context
MNFS - msnfsflt.sys - NFS FS Filter, stream context
MNFT - msnfsflt.sys - NFS FS Filter, thread array
MQAA - mqac.sys - MSMQ driver, AVL allocations
MQAB - mqac.sys - MSMQ driver, CCursor allocations
MQAC - mqac.sys - MSMQ driver, generic allocations
MQAD - mqac.sys - MSMQ driver, CDistribution allocations
MQAG - mqac.sys - MSMQ driver, CGroup allocations
MQAH - mqac.sys - MSMQ driver, Heap allocations
MQAP - mqac.sys - MSMQ driver, CPacket allocations
MQAQ - mqac.sys - MSMQ driver, CQueue allocations
MQAT - mqac.sys - MSMQ driver, CTransaction allocations
MRXx - <unknown> - Client side caching for SMB
Msdv - <unknown> - WDM mini driver for IEEE 1394 DV Camera and VCR
MST? - <unknown> - MSTEE (mstee.sys)
MSTa - <unknown> - associated stream header
MSTc - <unknown> - filer connection
MSTd - <unknown> - data format
MSTf - <unknown> - filter instance
MSTp - <unknown> - pin instance
MSTs - <unknown> - stream header
MuoC - <unknown> - MOUSE_POOL_TAG Mouse Class Driver
MsFc - <unknown> - Mailslot CCB, Client control block. Each client with an opened mailslot has one of these
MsFC - <unknown> - Mailslot root CCB, A client control block for the top level mailslot directory
MsFd - <unknown> - Mailslot data entry write buffer, This is writes buffered inside mailslots
MsFD - <unknown> - Mailslot root DCB and its name buffer
MsFf - <unknown> - Mailslot FCB, File control block, Service side block for each created mailslot.
MsFg - <unknown> - Mailslot global resource
MsFn - <unknown> - Mailslot temporary name buffer
MsFN - <unknown> - Mailslot FCB name buffer, name for each created mailslot
MsFr - <unknown> - Mailslot read buffer, buffer created for pended reads issued.
MsFt - <unknown> - Mailslot query template, used for directory queries.
MsFw - <unknown> - Mailslot work context block, blocks create when we need to timeout reads.
MsvC - ksecdd.sys - Msv/Ntlm client package
Mup - mup.sys - Multiple UNC provider allocations, generic
MupI - mup.sys - Windows Server 2003 and prior versions: DFS Irp Context allocation
MuDn - mup.sys - Device name
MuFc - mup.sys - File Context
MuFn - mup.sys - File name rewrite
MuIc - mup.sys - IRP Context
MuMc - mup.sys - Master context
MuQc - mup.sys - Query context
MuSi - mup.sys - Surrogate info
MuSf - mup.sys - Surrogate file info
MuSr - mup.sys - Surrogate IRP info
MuPe - mup.sys - Known prefix entry
MuPi - mup.sys - Provider info
MuUn - mup.sys - UNC provider
Muta - <unknown> - Mutant objects
NBF - <unknown> - general NBF allocations
NBFa - <unknown> - NBF address object
NBFb - <unknown> - NBF receive buffer
NBFc - <unknown> - NBF connection object
NBFd - <unknown> - NBF packet pool descriptor
NBFe - <unknown> - NBF bind & export names
NBFf - <unknown> - NBF address file object
NBFg - <unknown> - NBF registry path name
NBFi - <unknown> - NBF tdi connection info
NBFk - <unknown> - NBF loopback buffer
NBFl - <unknown> - NBF link object
NBFn - <unknown> - NBF netbios name
NBFo - <unknown> - NBF config data
NBFp - <unknown> - NBF packet
NBFq - <unknown> - NBF query buffer
NBFr - <unknown> - NBF request
NBFs - <unknown> - NBF provider stats
NBFt - <unknown> - NBF connection table
NBFu - <unknown> - NBF UI frame
NBFw - <unknown> - NBF work item
NBI - <unknown> - NwlnkNb transport
NBS - <unknown> - general NetBIOS allocations
NBSa - <unknown> - address block
NBSc - <unknown> - connection block
NBSe - <unknown> - EA buffer
NBSf - <unknown> - FCB
NBSl - <unknown> - LANA block
NBSn - <unknown> - copy of user NCB
NBSr - <unknown> - registry allocations
NBSx - <unknown> - XNS NETONE address (connect block)
NBSy - <unknown> - NetBIOS address (connect block)
NBSz - <unknown> - NetBIOS address (listen block)
NBqh - <unknown> - Non-blocking queue entries used to carry the real data in the queue.
NCSt - <unknown> - EXIFS NC
ND - ndis.sys - general NDIS allocations
NDDl - ndis.sys - NDIS_TAG_DBG_LOG
NDMb - ndis.sys - NDIS_TAG_MAC_BLOCK
NDPX - ndis.sys - NDIS Proxy allocations
NDPa - ndis.sys - Apple Talk
NDPb - ndis.sys - NBF
NDPi - ndis.sys - NWLNKIPX
NDPn - ndis.sys - NWLNKNB
NDPp - ndis.sys - Packet Scheduler.
NDPs - ndis.sys - NWLNKSPX
NDPt - ndis.sys - TCPIP
NDPw - ndis.sys - WAN_PACKET_TAG
NDam - ndis.sys - NdisAllocateMemory
NDan - ndis.sys - adapter name
NDco - ndis.sys - NDIS_TAG_CO
NDd - ndis.sys - NDIS_TAG_DBG
NDdb - ndis.sys - DMA block
NDdl - ndis.sys - NDIS_TAG_DBG_L
NDdp - ndis.sys - NDIS_TAG_DBG_P
NDds - ndis.sys - NDIS_TAG_DBG_S
NDdt - ndis.sys - NDIS_TAG_DFRD_TMR
NDfa - ndis.sys - NDIS_TAG_FILTER_ADDR
NDlb - ndis.sys - lookahead buffer
NDlp - ndis.sys - NDIS_TAG_LOOP_PKT
NDmb - ndis.sys - MAC block
NDmr - ndis.sys - map register entry array
NDoa - ndis.sys - NDIS_TAG_OID_ARRAY
NDob - ndis.sys - open block
NDpb - ndis.sys - protocol block
NDpf - ndis.sys - NDIS_TAG_FILTER
NDpk - ndis.sys - NDIS_TAG_PKT_PATTERN
NDpp - ndis.sys - packet pool
NDrl - ndis.sys - resource list
NDrp - ndis.sys - NDIS_TAG_REGISTRY_PATH
NDrq - ndis.sys - NDIS_TAG_Q_REQ
NDsi - ndis.sys - EISA slot information
NDsm - ndis.sys - Cached shared memory descriptor
NDst - ndis.sys - NDIS_TAG_STRING
NDw0 - ndis.sys - NDIS_TAG_WMI_REG_INFO
NDw1 - ndis.sys - NDIS_TAG_WMI_GUID_TO_OID
NDw2 - ndis.sys - NDIS_TAG_WMI_OID_SUPPORTED_LIST
NDw3 - ndis.sys - NDIS_TAG_WMI_EVENT_ITEM
NDwi - ndis.sys - NDIS_TAG_WORK_ITEM
Nb?? - <unknown> - NetBT allocations
Nf?? - nfssvr.sys - NFS (Network File System) allocations
NfR? - nfsrdr.sys - NFS (Network File System) client re-director
Nls - <unknown> - Nls strings
NlsK - nt!ex - Nls data
Nmdd - <unknown> - NetMeeting display driver miniport 1 MB block
None - <unknown> - call to ExAllocatePool
Npf* - npfs.sys - Npfs Allocations
NpFc - npfs.sys - CCB, client control block
NpFC - npfs.sys - ROOT_DCB CCB
NpFD - npfs.sys - DCB, directory block
NpFg - npfs.sys - Global storage
NpFi - npfs.sys - NPFS client info buffer.
NpFn - npfs.sys - Name block
NpFq - npfs.sys - Query template buffer used for directory query
NpFr - npfs.sys - DATA_ENTRY records (read/write buffers)
NpFs - npfs.sys - Client security context
NpFw - npfs.sys - Write block
NpFW - npfs.sys - Write block
NS?? - <unknown> - Netware server allocations
Ntf? - ntfs.sys - NTFS Specific allocation tags
Ntf0 - ntfs.sys - general pool allocation
Ntf9 - ntfs.sys - Large Temporary Buffer
NtfC - ntfs.sys - CCB
Ntfc - ntfs.sys - CCB_DATA
NtfD - ntfs.sys - DEALLOCATED_RECORDS
NtfE - ntfs.sys - INDEX_CONTEXT
NtfF - ntfs.sys - FCB_INDEX
Ntff - ntfs.sys - FCB_DATA
NtfI - ntfs.sys - NTFS_IO_CONTEXT
Ntfi - ntfs.sys - IRP_CONTEXT
NtfK - ntfs.sys - KEVENT
Ntfk - ntfs.sys - FILE_LOCK
Ntfl - ntfs.sys - LCB
NtfM - ntfs.sys - NTFS_MCB_ENTRY
Ntfm - ntfs.sys - NTFS_MCB_ARRAY
NtfN - ntfs.sys - NUKEM
Ntfn - ntfs.sys - SCB_NONPAGED
Ntfo - ntfs.sys - SCB_INDEX normalized named buffer
NtfQ - ntfs.sys - QUOTA_CONTROL_BLOCK
Ntfq - ntfs.sys - General Allocation with Quota
NtfR - ntfs.sys - READ_AHEAD_THREAD
Ntfr - ntfs.sys - ERESOURCE
NtfS - ntfs.sys - SCB_INDEX
Ntfs - ntfs.sys - SCB_DATA
NtfT - ntfs.sys - SCB_SNAPSHOT
Ntft - ntfs.sys - SCB (Prerestart)
NtfV - ntfs.sys - VPB
Ntfv - ntfs.sys - COMPRESSION_SYNC
Ntfw - ntfs.sys - Workspace
Ntfx - ntfs.sys - General Allocation
NtF? - ntfs.sys - NTFS tags based on source module
NtFa - ntfs.sys - AllocSup.c
NtFA - ntfs.sys - AttrSup.c
NtFB - ntfs.sys - BitmpSup.c
NtFC - ntfs.sys - Create.c
NtFD - ntfs.sys - DevioSup.c
NtFd - ntfs.sys - DirCtrl.c
NtFE - ntfs.sys - Ea.c
NtFF - ntfs.sys - FileInfo.c
NtFf - ntfs.sys - FsCtrl.c
NtFH - ntfs.sys - SelfHeal.c
NtFI - ntfs.sys - IndexSup.c
NtFL - ntfs.sys - LogSup.c
NtFM - ntfs.sys - McbSup.c
NtFN - ntfs.sys - NtfsData.c
NtFO - ntfs.sys - ObjIdSup.c
NtFQ - ntfs.sys - QuotaSup.c
NtFR - ntfs.sys - RestrSup.c
NtFS - ntfs.sys - SecurSup.c
NtFs - ntfs.sys - StrucSup.c
NtFU - ntfs.sys - usnsup.c
NtFV - ntfs.sys - VerfySup.c
NtFv - ntfs.sys - ViewSup.c
NtFW - ntfs.sys - Write.c
NV - <unknown> - nVidia video driver
NvLA - <nvlddmkm.sys> - nVidia video driver
NvLa - <nvlddmkm.sys> - nVidia video driver
NvLC - <nvlddmkm.sys> - nVidia video driver
NvLc - <nvlddmkm.sys> - nVidia video driver
NvLD - <nvlddmkm.sys> - nVidia video driver
NvLd - <nvlddmkm.sys> - nVidia video driver
NvLE - <nvlddmkm.sys> - nVidia video driver
NvLH - <nvlddmkm.sys> - nVidia video driver
NvLm - <nvlddmkm.sys> - nVidia video driver
NvLP - <nvlddmkm.sys> - nVidia video driver
NvLp - <nvlddmkm.sys> - nVidia video driver
NvLR - <nvlddmkm.sys> - nVidia video driver
NvLr - <nvlddmkm.sys> - nVidia video driver
NvLS - <nvlddmkm.sys> - nVidia video driver
NvLs - <nvlddmkm.sys> - nVidia video driver
NvLT - <nvlddmkm.sys> - nVidia video driver
Nwcs - <unknown> - Client Services for NetWare
NwFw - <unknown> - ntos\tdi\fwd
ObSq - nt!ob - object security descriptors (query)
ObCi - nt!ob - captured information for ObCreateObject
ObCI - nt!ob - object creation lookaside list
ObDi - nt!ob - object directory
ObHd - nt!ob - object handle count data base
ObNm - nt!ob - object names
ObNM - nt!ob - name buffer per processor lookaside pointers
ObRt - nt!ob - object reference stack tracing
ObZn - nt!ob - object zone
ObjT - nt!ob - object type objects
Obtb - nt!ob - object tables via EX handle.c
ObTR - nt!ob - object table ERESOURCEs
Obeb - nt!ob - object tables extra bit tables via EX handle.c
ObDm - nt!ob - object device map
ObSc - nt!ob - Object security descriptor cache block
ObSt - nt!ob - Object Manager temporary storage
OHCI - <unknown> - Open Host Controller Interface for USB
ohci - <unknown> - 1394 OHCI host controller driver
Ovfl - <unknown> - The internal pool tag table has overflowed - usually this is a result of nontagged allocations being made
OvfL - <unknown> - EXIFS FCBOVF List
PaeD - <unknown> - PAE top level directory allocation blocks
ParC - <unknown> - Parallel class driver
ParL - <unknown> - Parallel link driver
ParP - <unknown> - Parallel port driver
ParV - <unknown> - ParVdm driver for vdm<->parallel port communciation
PciB - pci.sys - PnP pci bus enumerator
PcCi - <unknown> - WDM audio port class adapter device object stuff
PcCr - <unknown> - WDM audio stuff
PcDi - <unknown> - WDM audio stuff
PcDm - <unknown> - DirectMusic MXF objects (WDM audio)
PcFM - <unknown> - WDM audio FM synthesizer
PcFp - <unknown> - WDM audio stuff
PcIc - <unknown> - WDM audio stuff
PcIl - <unknown> - WDM audio stuff
PcNw - <unknown> - WDM audio stuff
PcPc - <unknown> - WDM audio stuff
PcPr - <unknown> - WDM audio stuff
PcSX - <unknown> - WDM audio stuff
PcSl - <unknown> - WDM audio stuff
PcSt - <unknown> - WDM audio stuff
PcSx - <unknown> - WDM audio stuff
PcUs - <unknown> - WDM audio stuff
Pcmc - pcmcia.sys - Pcmcia bus enumerator, general structures
Pcic - <unknown> - Pcmcia bus enumerator, PCIC/Cardbus controller specific structures
Pcdb - <unknown> - Pcmcia bus enumerator, Databook controller specific structures
Pf?? - nt!pf - Pf Allocations
PfAL - nt!pf - Pf Application launch event data
PfAS - nt!pf - Pf Prefetch support array
PfDq - nt!pf - Pf Directory query buffers
PfED - nt!pf - Pf Generic event data
PfEL - nt!pf - Pf Event logging buffers
PfET - nt!pf - Pf Entry info tables
PfFH - nt!pf - Pf RpContext FileKeyHash buckets
PfFK - nt!pf - Pf RpContext FileKeyHashEntry
PfLB - nt!pf - Pf Log buffers
PfMP - nt!pf - Pf Prefetch metadata buffers
PfNL - nt!pf - Pf Name logging buffers
PfOB - nt!pf - Pf Oplock buffers
PfPB - nt!pf - Pf Pfn query buffers
PfRL - nt!pf - Pf Prefetch read list
PfRQ - nt!pf - Pf Prefetch request buffers
PfSA - nt!pf - Pf Prefetch support array
PfTD - nt!pf - Pf Trace Dump
PfTt - nt!pf - Pf Translation tables
PfVA - nt!pf - Pf VA prefetching buffers
PfVH - nt!pf - Pf Prefetch volume handles
Pgm? - <unknown> - Pgm (Pragmatic General Multicast) protocol: RMCast.sys
Plcp - <unknown> - Cache aware pushlock list (array of puchlock addresses)
Plcl - <unknown> - Cache aware pushlock entry. One per processor
PmpA - portmap.sys - Portmap address list
PmpC - portmap.sys - Portmap device context
PmpM - portmap.sys - Portmap mapping
PmpR - portmap.sys - Portmap RPCB
PNCH - <unknown> - Power Notify Channel
PNCL - <unknown> - Power Notify channel list
PNDP - <unknown> - Power Abort Dpc Routine
PNI - <unknown> - Power Notify Instance
Pool - <unknown> - Pool tables, etc.
PooL - <unknown> - Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures
Port - <unknown> - Port objects
PoSL - <unknown> - Power shutdown event list
PPMd - <unknown> - Processor Drivers (Processor Power Management).
PPMi - nt!po - Kernel Processor Power Management Idle States.
PPMp - nt!po - Kernel Processor Power Management Perf States.
PPMw - nt!po - Kernel Processor Power Management WMI interface.
Prof - <unknown> - Profile objects
POWI - nt!po - Power Work Item (executive worker thread work item entry)
PSwt - nt!po - Power switch structure
PSTA - nt!po - Po registered system state
PDss - nt!po - Po device system state
PpTg - mpsdrv.sys - MPSDRV PPTP GRE analyzer
PpTt - mpsdrv.sys - MPSDRV PPTP TCP analyzer
Prcr - processr.sys - Processr driver allocations
Proc - nt!ps - Process objects
Ps - nt!ps - general ps allocations
Psap - nt!ps - Block used to hold a user mode APC while its queued to a thread
PsAp - nt!ps - Process APC queued by user mode process
PsCa - nt!ps - APC queued at thread create time.
PsCr - nt!ps - Working set change record (temporary allocation)
PsEx - nt!ps - Process exit APC
PsFn - nt!ps - Captured image file name buffer (temporary allocation)
PsHl - nt!ps - Captured list of handles to inherit in child process (temporary allocation)
PsIm - nt!ps - Thread impersonation (PS_IMPERSONATE_INFORMATION, pre-Vista)
PsJa - nt!ps - Job access control state
Psjb - nt!ps - Job set array (temporary allocation)
PsLd - nt!ps - Process LDT information blocks
PsPb - nt!ps - Captured process parameter block (temporary allocation)
PsQb - nt!ps - Process quota block
PsRl - nt!ps - Captured memory reserve list (temporary allocation)
PsSb - nt!ps - Initial process parameter block (temporary allocation)
PsSd - nt!ps - Augmented thread security descriptor (temporary allocation)
PsTf - nt!ps - Job object token filter
Pstb - nt!ps - Process tables via EX handle.c
Psta - nt!ps - Power management system state
PsTp - nt!ps - Thread termination port block
PsWs - nt!ps - Process working set watch array
PSE3 - pse36.sys - Physical Size Extension driver
Pnp0 - nt!pnp - PNPMGR rebalance resource request table
Pnp1 - nt!pnp - PNPMGR IRP completion context
Pnp2 - nt!pnp - PNPMGR device action request
Pnp3 - nt!pnp - PNPMGR dock serial numbers
Pnp4 - nt!pnp - PNPMGR dock state
Pnp5 - nt!pnp - PNPMGR assign resources context
Pnp6 - nt!pnp - PNPMGR resource request
Pnp7 - nt!pnp - PNPMGR deferred notify entry
Pnp8 - nt!pnp - PNPMGR async target device change notify
Pnp9 - nt!pnp - PNPMGR HW profile notify
PnpA - nt!pnp - PNPMGR HW profile event
PnpB - nt!pnp - PNPMGR setup notify
PnpC - nt!pnp - PNPMGR target device notify
PnpD - nt!pnp - PNPMGR device class notify
PnpE - nt!pnp - PNPMGR veto name
PnpF - nt!pnp - PNPMGR eject data
PnpG - nt!pnp - PNPMGR generic
PnpH - nt!pnp - PNPMGR service name
PnpI - nt!pnp - PNPMGR instance path
PnPb - nt!pnp - PnP BIOS resource manipulation
PpEB - nt!pnp - PNP_POOL_EVENT_BUFFER
PpEE - nt!pnp - PNP_DEVICE_EVENT_ENTRY_TAG
PpEL - nt!pnp - PNP_DEVICE_EVENT_LIST_TAG
PpLg - nt!pnp - PnP last good.
PpUB - nt!pnp - PNP_USER_BLOCK_TAG
PpWI - nt!pnp - PNP_DEVICE_WORK_ITEM_TAG
Ppcd - nt!pnp - PnP critical device database
Ppcr - nt!pnp - plug-and-play critical allocations
Ppdd - nt!pnp - new Plug-And-Play driver entries and IRPs
Ppde - nt!pnp - routines to perform device removal
Ppei - nt!pnp - Eisa related code
Ppen - nt!pnp - routines to perform device enumeration
Ppin - nt!pnp - plug-and-play initialization
Ppio - nt!pnp - plug-and-play IO system APIs
PPMi - nt!po - Processor Power Manager Idle States
PPMp - nt!po - Processor Power Manager Perf States
PPMw - nt!po - Processor Power Manager WMI Interface
Ppre - nt!pnp - resource allocation and translation
Pprl - nt!pnp - routines to manipulate relations list
Ppsu - nt!pnp - plug-and-play subroutines for the I/O system
PPTP - <unknown> - PPTP_MEMORYPOOL_TAG
PPT0 - <unknown> - PPTP_TDIADDR_TAG
PPT1 - <unknown> - PPTP_TDICONN_TAG
PPT2 - <unknown> - PPTP_CONNINFO_TAG
PPT3 - <unknown> - PPTP_ADDRINFO_TAG
PPT4 - <unknown> - PPTP_TIMEOUT_TAG
PPT5 - <unknown> - PPTP_TIMER_TAG
PPT6 - <unknown> - PPTP_TDICOTS_TAG
PPT7 - <unknown> - PPTP_WRKQUEUE_TAG
PPT8 - <unknown> - PPTP_SEND_CTRLDATA_TAG
PPT9 - <unknown> - PPTP_SEND_ACKDATA_TAG
PPTa - <unknown> - PPTP_SEND_DGRAMDESC_TAG
PPTb - <unknown> - PPTP_TDICLTS_TAG
PPTc - <unknown> - PPTP_RECV_CTRLDESC_TAG
PPTd - <unknown> - PPTP_RECV_CTRLDATA_TAG
PPTe - <unknown> - PPTP_RECV_DGRAMDESC_TAG
PPTf - <unknown> - PPTP_RECV_DGRAMDATA_TAG
PPTg - <unknown> - PPTP_RECVDESC_TAG
PPTh - <unknown> - PPTP_ENGINE_TAG
PPTi - <unknown> - PPTP_RECVDATA_TAG
PRF? - nt!wdi - Performance Allocations
PRFd - nt!wdi - Performance Diagnostics Structures
PSC? - <unknown> - Packet Scheduler (PSCHED) Tags
PSC0 - <unknown> - NDIS Request
PSC1 - <unknown> - GPC Client Vc
PSC2 - <unknown> - WanLink
PSC3 - <unknown> - Miscellaneous allocations
PSC4 - <unknown> - WMI
PSCa - <unknown> - Adapter
PSCb - <unknown> - CallParameters
PSCc - <unknown> - PipeContext
PSCd - <unknown> - FlowContext
PSCe - <unknown> - ClassMapContext
PSCf - <unknown> - Adapter Profile
PSCg - <unknown> - Component
PX1 - <unknown> - ndis ProviderEventLookaside
p2?? - perm2dll.dll - Permedia2 display driver
p2d3 - perm2dll.dll - Permedia2 display driver - d3d.c
p2d6 - perm2dll.dll - Permedia2 display driver - d3ddx6.c
p2de - perm2dll.dll - Permedia2 display driver - debug.c
p2ds - perm2dll.dll - Permedia2 display driver - d3dstate.c
p2dt - perm2dll.dll - Permedia2 display driver - d3dtxman.c
p2su - perm2dll.dll - Permedia2 display driver - ddsurf.c
p2en - perm2dll.dll - Permedia2 display driver - enable.c
p2fi - perm2dll.dll - Permedia2 display driver - fillpath.c
p2he - perm2dll.dll - Permedia2 display driver - heap.c
p2hw - perm2dll.dll - Permedia2 display driver - hwinit.c
p2cx - perm2dll.dll - Permedia2 display driver - p2ctxt.c
p2pa - perm2dll.dll - Permedia2 display driver - palette.c
p2pe - perm2dll.dll - Permedia2 display driver - permedia.c
p2tx - perm2dll.dll - Permedia2 display driver - textout.c
P3D? - perm3dd.dll - Permedia3 display driver - DirectDraw/3D
P3G? - perm3dd.dll - Permedia3 display driver
PSHD - pshed.dll - PSHED
PSPi - pshed.dll - PSHED Plug-in
Qnam - <unknown> - EXIFS Query Name
Qp?? - <unknown> - Generic Packet Classifier (MSGPC)
Qppn - <unknown> - Queued Notifications
Qppi - <unknown> - Pending Irp structures
Qpci - <unknown> - CfInfo
Qpct - <unknown> - Client blocks
Qppa - <unknown> - Pattern blocks
Qphf - <unknown> - HandleFactory
Qpph - <unknown> - PathHash
Qprz - <unknown> - Rhizome
Qppd - <unknown> - GenPatternDb
Qpfd - <unknown> - FragmentDb
Qpcf - <unknown> - ClassificationFamily
Qpcd - <unknown> - CfInfoData
Qpcb - <unknown> - ClassificationBlock
Qppt - <unknown> - Protocol
Qpdg - <unknown> - Debug
QuU2 - mpsdrv.sys - MPSDRV upcall response
RB?? - <unknown> - RedBook Filter Driver, static allocations
RBEv - <unknown> - RedBook - Thread Events
RBRl - <unknown> - RedBook - Remove lock
RBRg - <unknown> - RedBook - driverExtension->RegistryPath
RBSe - <unknown> - RedBook - Serialization tracking for checked builds
RBWa - <unknown> - RedBook - Wait block for system thread
rb?? - <unknown> - RedBook Filter Driver, dynamic allocations
rbBu - <unknown> - RedBook - Buffer for read/stream
rbIr - <unknown> - RedBook - Irp for read/stream
rbIp - <unknown> - RedBook - Irp pointer block
rbMd - <unknown> - RedBook - Mdl for read/stream
rbMp - <unknown> - RedBook - Mdl pointer block
rbRc - <unknown> - RedBook - Read completion context
rbRx - <unknown> - RedBook - Read Xtra info
rbSc - <unknown> - RedBook - Stream completion context
rbSx - <unknown> - RedBook - Stream Xtra info
rbTo - <unknown> - RedBook - Cached table of contents
Rcp? - sacdrv.sys - SAC Driver (Headless)
RcpA - sacdrv.sys - Internal memory mgr alloc block
RcpI - sacdrv.sys - Internal memory mgr initial heap block
RcpS - sacdrv.sys - Security related block
RDPD - rdpdr.sys - Device list object
ReEv - <unknown> - Resource Event
ReSe - <unknown> - Resource Semaphore
ReTa - <unknown> - Resource Extended Table
RefT - <unknown> - Bluetooth reference tracking
Rf?? - <unknown> - Bluetooth RFCOMM TDI driver
RfAD - rfcomm.sys - RFCOMM Address
RfBB - rfcomm.sys - RFCOMM BRB
RfBT - rfcomm.sys - RFCOMM (bthport)
RfCB - rfcomm.sys - RCOMMM
RfCH - rfcomm.sys - RFCOMM channel
RfCN - rfcomm.sys - RFCOMM connect
RfDA - rfcomm.sys - RFCOMM data
RfFR - rfcomm.sys - RFCOMM frame
RfRX - rfcomm.sys - RFCOMM receive
RfPP - rfcomm.sys - RFCOMM pnp
RfWR - rfcomm.sys - RFCOMM worker
RKRW - mpsdrv.sys - MPSDRV work item
RTLF - mpsdrv.sys - MPSDRV filter
RpcL - msrpc.sys - debugging log data - present on checked builds only
RpcM - msrpc.sys - all msrpc.sys allocations not covered elsewhere
Rpcr - msrpc.sys - not currently used
RRle - <unknown> - RTL_RANGE_LIST_ENTRY_TAG
RRlm - <unknown> - RTL_RANGE_LIST_MISC_TAG
RtPi - <unknown> - Temp allocation for product type key
Rpcl - msrpc.sys - MSRpc memory logging - checked build only
Rpcm - msrpc.sys - MSRpc memory allocations
Rpcr - msrpc.sys - MSRpc resources
Rpcs - msrpc.sys - Memory shared b/n MSRpc and caller
RPrt - rstorprt.sys - Remote Storage Port Driver
Rqrv - <unknown> - Registry query buffer
RS?? - <unknown> - Remote Storage
RSFS - <unknown> - Recall Queue
RSFN - <unknown> - File Name
RSSE - <unknown> - Security info
RSWQ - <unknown> - Work Queue
RSQI - <unknown> - Queue info
RSLT - <unknown> - Long term data
RSIO - <unknown> - Ioctl Queue
RSFO - <unknown> - File Obj queue
RSVO - <unknown> - Validate Queue
RSER - <unknown> - Error log data
RtlT - nt!rtl - Temporary RTL allocation
RWan - rawwan.sys - Raw WAN driver
R300 - <unknown> - ATI video driver
RX00 - <unknown> - ATI video driver
Rx?? - <unknown> - Rdr2 rdbss.sys stuff
RxSc - <unknown> - SrvCall
RxNr - <unknown> - NetRoot
RxVn - <unknown> - VNetRoot
RxFc - <unknown> - FCB
RxSo - <unknown> - SrvOpen
RxFx - <unknown> - Fobx
RxNf - <unknown> - nonpaged FCB
RxWq - <unknown> - work queue
RxBm - <unknown> - buffering manager
RxMs - <unknown> - misc.
RxIr - <unknown> - RxContext (IrpContext)
RxMx - <unknown> - minirdr dispatch table
RxNc - <unknown> - NameCache (not currently used)
RxCt - <unknown> - connection engine transport
RxCa - <unknown> - connection engine address
RxCc - <unknown> - connection engine connection
RxCv - <unknown> - connection engine VC
RxCd - <unknown> - connection engine TDI
RxSp - <unknown> - srvcall calldown params (special build only)
RxVp - <unknown> - vnetroot calldown params (special build only)
RxTm - <unknown> - timer context (special build only)
RxDc - <unknown> - querydirectory pattern (special build only)
RxCx - <unknown> - connection engine misc. (special build only)
S3 - <unknown> - S3 video driver
SBad - <unknown> - bad block simulator - simbad.c
sbp2 - <unknown> - Sbp2 1394 storage port driver
SC?? - <unknown> - Smart card driver tags
SCLb - <unknown> - Smart card driver library
SCB8 - <unknown> - Bull CP8 Transac serial reader
SCB3 - <unknown> - Bull SmarTlp PnP
SCS4 - <unknown> - SCM Microsystems pcmcia reader
SCl0 - <unknown> - Litronic 220
Sc?? - <unknown> - Mass storage driver tags
ScB? - classpnp.sys - ClassPnP misc allocations
ScC? - classpnp.sys - ClassPnP misc allocations
ScC? - <unknown> - CdRom
ScCE - <unknown> - device control synch event
ScCG - <unknown> - disk geometry buffer
ScCH - <unknown> - hitachi error buffer
ScCI - <unknown> - sense info buffers
ScCS - <unknown> - srb allocation
ScCM - <unknown> - mode data buffer
ScCP - <unknown> - read capacity buffer
ScCp - <unknown> - play active checks
ScCQ - <unknown> - read sub q buffer
ScCR - <unknown> - raw mode read buffer
ScCT - <unknown> - read toc buffer
ScCt - <unknown> - toshiba error buffer
ScCU - <unknown> - update capacity path
ScCV - <unknown> - volume control buffer
ScCv - <unknown> - volume control buffer
ScD? - <unknown> - Disk
ScD - <unknown> - generic tag
ScDa - <unknown> - SMART
ScDA - <unknown> - Info Exceptions
ScDC - <unknown> - disable cache paths
ScDb - classpnp.sys - ClassPnP debug globals buffer
ScDc - <unknown> - disk allocated completion c
ScDG - <unknown> - disk geometry buffer
ScDg - <unknown> - update disk geometry paths
ScDI - <unknown> - sense info buffers
ScDp - <unknown> - pnp ids
ScDM - <unknown> - mode data buffer
ScDM - <unknown> - mbr checksum code
ScDN - <unknown> - disk name code
ScDP - <unknown> - read capacity buffer
ScDp - <unknown> - disk partition lists
ScDS - <unknown> - srb allocation
ScDs - <unknown> - start device paths
ScDU - <unknown> - update capacity path
ScDW - <unknown> - work-item context
ScMC - <unknown> - medium changer allocations
ScIO - classpnp.sys - ClassPnP device control
ScL? - classpnp.sys - Classpnp
ScLA - classpnp.sys - allocation to check for autorun disable
ScLF - classpnp.sys - File Object Extension
ScLc - classpnp.sys - Cache filters
ScLf - classpnp.sys - Fault prediction
ScLm - classpnp.sys - Mount
ScLM - classpnp.sys - Media Change Detection
ScLq - classpnp.sys - Release queue
ScLw - classpnp.sys - WMI
ScLW - classpnp.sys - Power
ScNo - classpnp.sys - ClassPnP notification
ScP? - <unknown> - Scsiport
ScPa - <unknown> - Hold registry data
ScPA - <unknown> - Access Ranges
ScPb - <unknown> - Get Bus Dat Holder
ScPB - <unknown> - Queuetag BitMap
ScPc - <unknown> - Fake common buffer
ScPC - <unknown> - reset bus code
ScPd - <unknown> - Pnp id strings
ScPD - <unknown> - SRB_DATA allocations
ScPE - <unknown> - Scatter gather lists
ScPG - <unknown> - Global memory
ScPh - <unknown> - HwDevice Ext
ScPi - <unknown> - Sense Info
ScPI - <unknown> - Init data chain
ScPl - <unknown> - remove lock tracking
ScPL - <unknown> - scatter gather lists
ScPm - <unknown> - address mapping lists
ScPM - <unknown> - scatter gather lists
ScPp - <unknown> - device & adapter enable
ScpP - <unknown> - scsi PortConfig copies
ScPq - <unknown> - inquiry data
ScPQ - <unknown> - request sense
ScPr - <unknown> - resource list copy
ScPS - <unknown> - registry allocations
ScPt - <unknown> - legacy request rerouting
ScPT - <unknown> - interface mapping
ScPu - <unknown> - device relation structs
ScPv - <unknown> - KEVENT
ScPV - <unknown> - Device map allocations
ScPw - <unknown> - Wmi Events
ScPW - <unknown> - Wmi Requests
ScPx - <unknown> - Report Luns
ScPY - <unknown> - Report Targets
ScPZ - <unknown> - Device name buffer
ScR? - <unknown> - Partition Manager
ScRi - <unknown> - IOCTL buffer
ScRp - <unknown> - Partition entry
ScRr - <unknown> - Remove lock
ScRt - <unknown> - Table entry
ScRv - <unknown> - Dependant volume relations lists
ScRV - <unknown> - Volume entry
ScRw - <unknown> - Power mgmt private work item
ScsC - <unknown> - non-pnp SCSI CdRom
ScsD - <unknown> - non-pnp SCSI Disk
ScsH - <unknown> - non-pnp SCSI from class.h (class2)
ScsI - <unknown> - non-pnp SCSI port internal
ScsL - <unknown> - non-pnp SCSI class.c driver allocations
ScsP - <unknown> - non-pnp SCSI port.c
Scs$ - <unknown> - Tag for pnp class driver's SRB lookaside list
ScUn - <unknown> - Default Tag for pnp class driver allocations
ScV? - <unknown> - Dvd functionality in cdrom.sys
ScVk - <unknown> - read buffer for DVD keys
ScVK - <unknown> - write buffer for DVD keys
ScVS - <unknown> - buffer for reads of DVD on-disk structures
SdCc - <unknown> - ObsSecurityDescriptorCache / SECURITY_DESCRIPTOR_CACHE_ENTRIES
Sdba - <unknown> - Application compatibility Sdb* allocations
Sdp? - <unknown> - Bluetooth SDP functionality in BTHPORT.sys
SdpC - bthport.sys - Bluetooth SDP client connection
SdpD - bthport.sys - Bluetooth SDP database
SdpI - bthport.sys - Bluetooth port driver (SDP)
Se - nt!se - General security allocations
SeAc - nt!se - Security ACL
SeAi - nt!se - Security Audit Work Item
SeAp - nt!se - Security Audit Parameter Record
SeCL - nt!se - Security CONTEXT_TAG
SeDb - nt!se - Temp directory query buffer to delete logon session symbolic links.
SeFS - nt!se - SEP_FILE_SYSTEM_NOTIFY_CONTEXT
SeHa - nt!se - Temp directory query buffer to delete logon session symbolic links.
SeLs - nt!se - Security Logon Session
SeLu - nt!se - Security LUID and Attributes array
SeLS - nt!se - Security Logon Session tracking array
SeLw - nt!se - Security LSA Work Item
SeOn - nt!se - Security Captured Object Name information
SeOt - nt!se - Captured object type array. Used by access check code
SePa - nt!se - Process audit image names and captured polity structures
SePh - nt!se - Dummy image page hash structure. Used when CI is disabled.
SePr - nt!se - Security Privilege Set
SeSa - nt!se - Security SID and Attributes
SeSc - nt!se - Captured Security Descriptor
SeSd - nt!se - Security Descriptor
SeSi - nt!se - Security SID
SeTa - nt!se - Security Temporary Array
SeTd - nt!se - Security Token dynamic part
SeTI - ksecdd.sys - Security TargetInfo
SeTn - nt!se - Security Captured Type Name information
SeUs - nt!se - Security Captured Unicode string
Sect - <unknown> - Section objects
Sema - <unknown> - Semaphore objects
Senm - <unknown> - Serenum (RS-232 serial bus enumerator)
SimB - <unknown> - Simbad (bad sector simulation driver) allocations
SIfs - <unknown> - Default tag for user's of ntsrv.h
sidg - <unknown> - GDI spooler events
Sis - <unknown> - Single Instance Store (dd\sis\filter)
SisB - <unknown> - SIS per file object break event
SisC - <unknown> - SIS common store file object
SisF - <unknown> - SIS per file object
SisL - <unknown> - SIS per link object
SisS - <unknown> - SIS SCB
Setp - <unknown> - SETUPDD SpMemAlloc calls
SRdm - scsirdma.sys - Infiniband SRP driver
SV?? - <unknown> - Synthetic Video Driver
SVLb - <unknown> - Generic Synthetic Video Driver Kernel-Mode Library
SVXD - synvidxd.dll - WDDM Synthetic Video Display Driver
SVXM - synvidxm.sys - WDDM Synthetic Video Miniport Driver
SVid - synthvid.sys - LDDM Synthetic Video Miniport Driver
SW?? - <unknown> - Software Bus Enumerator
SWbi - <unknown> - bus ID
SWbr - <unknown> - bus reference
SWda - <unknown> - POOLTAG_DEVICE_ASSOCIATION
SWdn - <unknown> - device name
SWdr - <unknown> - device reference
SWdr - <unknown> - POOLTAG_DEVICE_DRIVER_REGISTRY
SWfd - <unknown> - POOLTAG_DEVICE_FDOEXTENSION
SWid - <unknown> - device ID
SWii - <unknown> - instance ID
SWip - <unknown> - POOLTAG_DEVICE_INTERFACEPATH
SWki - <unknown> - key information
SWpd - <unknown> - POOLTAG_DEVICE_PDOEXTENSION
SWre - <unknown> - relations
SWrp - <unknown> - reparse string
SWrs - <unknown> - reference string
Sm?? - <unknown> - rdr2 smb mini
SmCe - <unknown> - smbmini connection engine
SmMm - <unknown> - smbmini managed datastructures
SmAd - <unknown> - session setup/admin exchange
SmRw - <unknown> - read/write path
SmTr - <unknown> - transact exchange
SmMs - <unknown> - misc.
SmTp - <unknown> - server transport tag
SmRb - <unknown> - remote boot
SmFc - <unknown> - fsctl structures (special build only)
SmDc - <unknown> - dir query buffer (special build only)
SmPi - <unknown> - pipeinfo buffer (special build only)
SmDO - <unknown> - deferred open context (special build only)
SmQP - <unknown> - params for directory query transact (special build only)
SmRx - <unknown> - minirdr generated RxContext (special build only)
SmVr - <unknown> - VNetroot (special build only)
SmSr - <unknown> - Server (special build only)
SmSe - <unknown> - Session (special build only)
SmNr - <unknown> - NetRoot (special build only)
SmMa - <unknown> - mid atlas (special build only)
SmMt - <unknown> - mailslot buffer (special build only)
SmVc - <unknown> - smbmini connectionengine VC (special build only)
SmEc - <unknown> - echo buffer (special build only)
SmKs - <unknown> - Kerberos blob (special build only)
SPX - <unknown> - Nwlnkspx transport
SQOS - <unknown> - Security quality of service in IO
Sr?? - sr.sys - System Restore file system filter driver
SrCo - sr.sys - SR's control object
SrSC - sr.sys - Stream contexts
SrDB - sr.sys - Debug information for lookup blob
SrDL - sr.sys - Device list
SrFE - sr.sys - File information buffer
SrFN - sr.sys - File name
SrHB - sr.sys - Hash bucket
SrHH - sr.sys - Hash header
SrHK - sr.sys - Hash key
SrLB - sr.sys - Log buffer
SrLC - sr.sys - Logging context
SrLE - sr.sys - Log entry
SrLT - sr.sys - Lookup blob
SrMP - sr.sys - Mount point information
SrOI - sr.sys - Overwrite information
SrPC - sr.sys - Persistant configuration information
SrRB - sr.sys - Rename buffer
SrRG - sr.sys - Logger context
SrRH - sr.sys - Reparse data size
SrRR - sr.sys - Registry information
SrSD - sr.sys - Security data information
SrST - sr.sys - Stream data information
SrTI - sr.sys - Directory delete information
SrWI - sr.sys - Work queue item
SslC - ksecdd.sys - SSL kernel mode client allocations
ST* - <unknown> - New MMC compliant storage drivers
Stac - <unknown> - Stack Trace Database - i386 checked and built with NTNOFPO=1 only
Strg - <unknown> - Dynamic Translated strings
Strm - <unknown> - Streams and streams transports allocations
SwMi - <unknown> - SWMidi KS filter (WDM Audio)
Symb - <unknown> - Symbolic link objects
Symt - <unknown> - Symbolic link target strings
SYPK - syspart.lib - Kernel mode system partition detection allocations
SYSA - <unknown> - Sysaudio (wdm audio)
TAPI - <unknown> - ntos\ndis\ndistapi
TC?? - TCP - TCP/IP network protocol
TCh? - <unknown> - TCP/IP header pools
TCPC - <unknown> - TCP connection pool
TCPT - <unknown> - TCB pool
TCPY - <unknown> - SYN-TCB pool
TCPr - <unknown> - TCP request pool
TDIc - <unknown> - TDI resource
TDId - <unknown> - TDI resource
TDIe - <unknown> - TDI resource
TDIf - <unknown> - TDI resource
TDIg - <unknown> - TDI resource
TDIk - <unknown> - TDI resource
TDIu - <unknown> - TDI resource
TDIv - <unknown> - TDI resource
thdd - <unknown> - DirectDraw/3D handle manager table
Thre - nt!ps - Thread objects
Time - nt!ke - Timer objects
TmDn - nt!tm - Tm Dynamic Name
TmEn - nt!tm - Tm KENLISTMENT object
TmLo - nt!tm - Tm Log Entries
TmNo - nt!tm - Tm Notification
TmPa - nt!tm - Tm Propagate Argument
TmPb - nt!tm - Tm Propagation Buffer
TmPe - nt!tm - Tm Enlistment Pointers
TmPi - nt!tm - Tm Protocol Information
TmPo - nt!tm - Tm Propagation Output
TmPp - nt!tm - Tm Protocol Pointers
TmPr - nt!tm - Tm Protocol
TmPx - nt!tm - Tm Protocol Array
TmRi - nt!tm - Tm Recovery Information
TmRm - nt!tm - Tm KRESOURCEMANAGER object
TmRq - nt!tm - Tm Propagation Request
TmTm - nt!tm - Tm KTRANSACTIONMANAGER object
TmTx - nt!tm - Tm KTRANSACTION object
TOBJ - rdpdr.sys - Topology object
Toke - nt!se - Token objects
TpWc - nt!ex - Threadpool minipacket context
TpWo - nt!ex - Threadpool worker factory objects
Tran - <unknown> - EXIFS Translate
TSBV - <unknown> - WDM mini driver for Toshiba 750 capture
TSdd - rdpdd.sys - RDPDD - Hydra Display Driver
TSch - rdpwd.sys - RDPWD - Hydra char conversion
TSic - termdd.sys - Terminal Services - ICA_POOL_TAG
TSlc - rdpwd.sys - RDPWD - Hydra Licensing
TSmc - <unknown> - PDMCS - Hydra MCS Protocol Driver
Tspk - ksecdd.sys - TS Package kernel mode client allocations
TSq - <unknown> - Terminal Services - Queue - TSQ_TAG
TSrp - termdd.sys - Terminal Services - RP_ALLOC_TAG
TSwd - rdpwd.sys - RDPWD - Hydra Winstation Driver
TTFC - <unknown> - Font file cache
Ttfd - <unknown> - TrueType Font driver
Thrm - <unknown> - Thermal zone structure
Tun4 - <unknown> - Tunnel cache allocation for long file name
TunL - <unknown> - Tunnel cache lookaside-allocated elements
TunP - <unknown> - Tunnel cache oddsized pool-allocated elements
TunK - <unknown> - Tunnel cache temporary key value
Txcl - ntfs.sys - TXF_CLR_RESERVATION_CHUNK
Txdl - ntfs.sys - TXF_DELETED_LINK
Txdr - ntfs.sys - TXF_DEFAULT_READER_SECTION
Txfc - ntfs.sys - TXF_FCB
Txfe - ntfs.sys - TXF_FCB_EXTENSION
Txfi - ntfs.sys - TXF_FCB_INFO
Txfl - ntfs.sys - TXF_FCB_CLEANUP
Txfo - ntfs.sys - TXF_FO
Txfq - ntfs.sys - Txf quota block
Txgd - ntfs.sys - TxfData global structure
Txis - ntfs.sys - TXF_ISO_SNAPSHOT
Txlf - ntfs.sys - TXF_FCB (large)
Txls - ntfs.sys - TXF_CANCEL_LSN
Txre - ntfs.sys - TXF_TOPS_RANGE_ENTRY
Txsc - ntfs.sys - TXF_SCB
Txsp - ntfs.sys - TXF_SAVEPOINT
Txsp - ntfs.sys - TXF_SCB_PTR
Txtc - ntfs.sys - TXF_TRANS_CANCEL_LIST
Txtr - ntfs.sys - TXF_TRANS (Txf transaction context)
Txvc - ntfs.sys - TXF_VCB
Txvd - ntfs.sys - TXF_VSCB_TO_DEREF
Txvf - ntfs.sys - TXF_VSCB_FILE_SIZES
Txvl - ntfs.sys - TXF_VSCB
Type - <unknown> - Type objects
UCAM - <unknown> - USB digital camera library
UDFV - <unknown> - Udfs volume descriptor sequence descriptor buffer
Udf1 - <unknown> - Udfs file set descriptor buffer
Udf2 - <unknown> - Udfs volmume recognition sequence descriptor buffer
Udf2 - <unknown> - Udfs volume descriptor sequence descriptor buffer
UdfC - <unknown> - Udfs CRC table
UdfD - <unknown> - Udfs FID buffer for view spanning
UdfF - <unknown> - Udfs nonpaged Fcb errata
UdfI - <unknown> - Udfs IO context
UdfL - <unknown> - Udfs IRP context lite (delayed close)
UdfS - <unknown> - Udfs short file name
UdfT - <unknown> - Udfs generic table entry
Udfb - <unknown> - Udfs IO buffer
Udfc - <unknown> - Udfs IRP context
Udfd - <unknown> - Udfs file Fcb
Udfe - <unknown> - Udfs enumeration match expression
Udff - <unknown> - Udfs normalized full filename
Udfi - <unknown> - Udfs directory Fcb
Udfl - <unknown> - Udfs Lcb
Udfp - <unknown> - Udfs Pcb
Udfs - <unknown> - Udfs Sparing Mcb
Udft - <unknown> - Udfs CDROM TOC
Udfv - <unknown> - Udfs Vpb
Udfx - <unknown> - Udfs Ccb
Udp - <unknown> - Udp protocol (TCP/IP driver)
Ufsc - <unknown> - User FULLSCREEN
UHCD - <unknown> - Universal Host Controller (USB - Intel Controller)
UHUB - <unknown> - Universal Serial Bus Hub
Ul?? - http.sys - tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??";
Uc?? - http.sys - i.e., the case of the leading "Ul" or "Uc" has been reversed.
Ucac - http.sys - Auth Cache Pool
UcCO - http.sys - Client Connection
Ucmp - http.sys - Multipart String Buffer
Ucre - http.sys - Receive Response
Ucrp - http.sys - Response App Buffer
Ucrq - http.sys - Request Pool
UcSc - http.sys - Common Server Information
UcSN - http.sys - Server name
UcSP - http.sys - Process Server Information
UcSp - http.sys - Sspi Pool
UcST - http.sys - Server info table
Uctd - http.sys - Response Tdi Buffer
Ucte - http.sys - Entity Pool
Ucto - http.sys - Tdi Objects Pool
UlAB - http.sys - Auxiliary Buffer
UlAO - http.sys - App Pool Object
UlAP - http.sys - App Pool Process
UlBL - http.sys - Binary Log File Entry
UlBO - http.sys - Outstanding i/o
UlCC - http.sys - Control Channel
UlCE - http.sys - Config Group Tree Entry
UlCH - http.sys - Config Group Tree Header
UlCI - http.sys - Config Group URL Info
UlCJ - http.sys - Config Group Object Pool
UlCK - http.sys - Chunk Tracker
UlCL - http.sys - Config Group LogDir
UlCl - http.sys - Connection RefTraceLog
UlCO - http.sys - Connection
UlCT - http.sys - Config Group Timestamp
UlCY - http.sys - Connection Count Entry
UlDB - http.sys - Debug
UlDC - http.sys - Data Chunks array
UlDO - http.sys - Disconnect Object
UlDR - http.sys - Deferred Remove Item
UlDT - http.sys - Debug Thread Pool
UlEP - http.sys - Endpoint
UlFA - http.sys - Force Abort Work Item
UlFC - http.sys - File Cache Entry
Ulfc - http.sys - Uri Filter Context
UlFD - http.sys - Noncached File Data
UlFP - http.sys - Filter Process
UlFR - http.sys - Dummy Filter Receive Buffer
UlFT - http.sys - Filter Channel
UlFU - http.sys - Full Tracker
UlFW - http.sys - Filter Write Tracker
UlHC - http.sys - Http Connection
UlHc - http.sys - Http Connection RefTraceLog
UlHL - http.sys - Internal Request RefTraceLog
UlHR - http.sys - Internal Request
UlHT - http.sys - Hash Table
UlHV - http.sys - Header Value
UlIC - http.sys - Irp Context
UlID - http.sys - Conn ID Table
UlIR - http.sys - Internal Response
UlLD - http.sys - Log Field
UlLF - http.sys - Log File Entry
UlLG - http.sys - Log Generic
UlLH - http.sys - Log File Handle
UlLL - http.sys - Log File Buffer
UlLS - http.sys - Ansi Log Data Buffer
UlLT - http.sys - Binary Log Data Buffer
UlNO - http.sys - NSGO Pool
UlNP - http.sys - Non-Paged Data
UlOE - http.sys - Endpoint OwnerRefTraceLog PoolTag
UlOR - http.sys - Owner RefTrace Signature
UlOT - http.sys - Opaque ID Table
UlPB - http.sys - APool Proc Binding
UlPL - http.sys - Pipeline
UlQF - http.sys - TCI Filter
UlQG - http.sys - TCI Generic
UlQI - http.sys - TCI Interface
UlQL - http.sys - TCI Flow
UlQT - http.sys - TCI Tracker
UlQW - http.sys - TCI WMI
UlRB - http.sys - Receive Buffer
UlRD - http.sys - Registry Data
UlRE - http.sys - Request Body Buffer
UlRP - http.sys - Request Buffer
UlRR - http.sys - Request Buffer References
UlRS - http.sys - Non-Paged Resource
UlRT - http.sys - RefTraceLog PoolTag
UlSC - http.sys - SSL Cert Data
UlSD - http.sys - Security Data
UlSl - http.sys - StringLog Buffer PoolTag
UlSL - http.sys - StringLog PoolTag
UlSO - http.sys - Site Counter Entry
UlSS - http.sys - Simple Status Item
UlTA - http.sys - Address Pool
UlTD - http.sys - UL_TRANSPORT_ADDRESS
UlTT - http.sys - Thread Tracker
UlUB - http.sys - URL Buffer
UlUC - http.sys - Uri Cache Entry
UlUH - http.sys - HTTP Unknown Header
UlUL - http.sys - URL
UlUM - http.sys - URL Map
UlVH - http.sys - Virtual Host
UlWC - http.sys - Work Context
UlWI - http.sys - Work Item
UndP - <unknown> - EXIFS Underlying Path
Urdr - win32k!SetRedirectionBitmap - REDIRECT
Usac - win32k!_CreateAcceleratorTable - ACCEL
Usai - win32k!zzzAttachThreadInput - ATTACHINFO
Usal - win32k!InitSwitchWndInfo - ALTTAB
USBB - bthusb.sys - Bluetooth USB minidriver
USBD - <unknown> - Universal Serial Bus Class Driver
Usbg - win32k!xxxLogClipData - DEBUG
Uscb - win32k!_ConvertMemHandle - CLIPBOARD
Uscc - win32k!AllocCallbackMessage - CALLBACK
Usci - win32k!InitSystemThread - CLIENTTHREADINFO
Uscl - win32k!ClassAlloc - CLASS
Uscm - win32k!InitScancodeMap - SCANCODEMAP
Uscp - win32k!CreateDIBPalette - CLIPBOARDPALETTE
Uscr - win32k!NtUserSetSysColors - COLORS
Usct - win32k!CkptRestore - CHECKPT
Uscu - win32k!_CreateEmptyCursorObject - CURSOR
Uscv - win32k!NtUserSetSysColors - COLORVALUES
Usd1 - win32k!FreeListAdd - DDE1
Usd2 - win32k!_DdeSetQualityOfService - DDE2
Usd4 - win32k!AddPublicObject - DDE4
Usd5 - win32k!xxxCsEvent - DDE5
Usd6 - win32k!xxxCsEvent - DDE6
Usd7 - win32k!xxxCsEvent - DDE7
Usd8 - win32k!xxxMessageEvent - DDE8
Usd9 - win32k!xxxCsDdeInitialize - DDE9
UsdA - win32k!NewConversation - DDEa
UsdB - win32k!Createpxs - DDEb
UsdD - win32k!NtUserfnDDEINIT - DDEd
UsdE - win32k!xxxClientCopyDDEIn1 - DDE
Usdc - win32k!CreateCacheDC - DCE
Usdi - win32k!CreateMonitor - DISPLAYINFO
UsDI - win32k!CreateDeviceInfo - DEVICEINFO
Usds - win32k!xxxDragObject - DRAGDROP
Usdv - win32k!NtUserfnINDEVICECHANGE - DEVICECHANGE
User - win32k!InitCreateUserCrit - ERESOURCE
Usev - win32k!xxxPollAndWaitForSingleObject - EVENT
Usgh - win32k!NtUserUserHandleGrantAccess - GRANTEDHANDLES
Usgl - win32k!CreateShadowTL - GLOBALTHREADLOCK
Usgt - win32k!AddGhost - GHOST
Usha - win32k!AllocateHidData - HIDDATA
UshD - Win32k!AllocateHidDesc - HIDDESC
Ushk - win32k!_RegisterHotKey - HOTKEY
Usih - win32k!SetImeHotKey - IMEHOTKEY
Usim - win32k!CreateInputContext - IME
Usjb - win32k!CreateW32Job - W32JOB
Usjx - win32k!JobCalloutAddProcess - W32JOBEXTRA
Uskb - win32k!xxxLoadKeyboardLayoutEx - KBDLAYOUT
Uske - win32k!GetKbdExId - KBDEXID
Uskf - win32k!LoadKeyboardLayoutFile - KBDFILE
Usks - win32k!PostUpdateKeyStateEvent - KBDSTATE
Uskt - win32k!ReadLayoutFile - KBDTABLE
Usla - win32k!InitLockRecordLookaside - LOOKASIDE
Usld - win32k!GrowLogIfNecessary - LOGDESKTOP
Uslr - win32k!InitLockRecordLookaside - LOCKRECORD
Usmi - win32k!MirrorRegion - MIRROR
Usml - win32k!MsgLookupTableAlloc - MESSAGE FILTER TABLE
Usmr - win32k!SnapshotMonitorRects - MONITORRECTS
Usms - win32k!xxxMoveSize - MOVESIZE
Usmt - win32k!xxxMNAllocMenuState - MENUSTATE
Usno - win32k!zzz - NONE - don't use
Usny - win32k!CreateNotify - NOTIFY
Uspi - win32k!MapDesktop - PROCESSINFO
Uspm - win32k!MNAllocPopup - POPUPMENU
Uspn - win32k!CreateProfileUserName - PROFILEUSERNAME
Uspo - win32k!QueuePowerRequest - POWER
Uspp - win32k!AllocateAndLinkHidTLCInfo - PNP
Uspr - win32k!GetPrivateProfileStruct - PROFILE
Usqm - win32k!InitQEntryLookaside - QMSG
Usqu - win32k!InitQEntryLookaside - Q
Usrt - win32k!xxxDrawMenuItemText - RTL
Ussa - win32k!xxxBroadcastMessage - SMS_ASYNC
Ussb - win32k!CreateSpb - SPB
Ussd - win32k!xxxAddShadow - SHADOW
Ussc - win32k!xxxInterSendMsgEx - SMS_CAPTURE
Usse - win32k!SetDisconnectDesktopSecurity - SECURITY
Ussi - win32k!NtUserSendInput - SENDINPUT
Ussm - win32k!InitSMSLookaside - SMS
Usss - win32k!xxxBroadcastMessage - SMS_STRING
Usst - win32k!xxxSBTrackInit - SCROLLTRACK
Ussw - win32k!_BeginDeferWindowPos - SWP
Ussy - win32k!xxxDesktopThread - SYSTEM
Ustd - win32k!TrackAddDesktop - TRACKDESKTOP
Usti - win32k!AllocateW32Thread - THREADINFO
Ustk - win32k!HeavyAllocPool - STACK
Ustm - win32k!InternalSetTimer - TIMER
Usto - win32k!xxxConnectService - TOKEN
Usts - win32k!_Win32CreateSection - SECTION
Ustx - win32k!NtUserDrawCaptionTemp - TEXT
Usty - win32k!NtUserResolveDesktopForWOW - TEXT2
Usub - win32k!NtUserToUnicodeEx - UNICODEBUFFER
Usvi - win32k!ResizeVisExcludeMemory - VISRGN
Usvl - win32k!VWPLAdd - VWPL
Uswd - win32k!xxxCreateWindowEx - WINDOW
Uswe - win32k!_SetWinEventHook - WINEVENT
Uswl - win32k!BuildHwndList - WINDOWLIST
Uswo - win32k!zzzInitTask - WOWTDB
Uswp - win32k!xxxRegisterUserHungAppHandlers - WOWPROCESSINFO
Uswt - win32k!xxxUserNotifyProcessCreate - WOWTHREADINFO
Vad - nt!mm - Mm virtual address descriptors
VadF - nt!mm - VADs created by a FreeVM splitting
Vadl - nt!mm - Mm virtual address descriptors (long)
VadS - nt!mm - Mm virtual address descriptors (short)
VBus - vmbus.sys - Virtual Machine Bus Driver
VcCh - rdpdr.sys - Dynamic Virtual channel object
VcFl - rdpdr.sys - Dynamic Virtual file object
VcMn - rdpdr.sys - Dynamic Virtual manager object
VcSn - rdpdr.sys - Dynamic Virtual session object
VDM - nt!vdm - ntos\vdm
VdPN - dxgkrnl.sys - Video display mode management
VfIT - nt!Vf - Verifier Import Address Table information
VidL - videoprt.sys - VideoPort Allocation List (FDO_EXTENSION)
VidR - videoprt.sys - VideoPort Allocation on behalf of Miniport
ViMm - dxgkrnl.sys - Video memory manager
virt - vmm.sys - Virtual Machine Manager (VPC/VS)
ViSh - dxgkrnl.sys - Video scheduler
VM?? - volmgr.sys - Volume Manager
VM - volmgr.sys - General allocations
Vm?? - volmgrx.sys - Volume Manager Extension
Vm - volmgrx.sys - General allocations
VmBl - volmgrx.sys - Raw configuration blocks
VmBu - volmgrx.sys - I/O buffers
VmCc - volmgrx.sys - Configuration copies
VmCo - volmgrx.sys - Configurations
VmCp - volmgrx.sys - Copies
VmCr - volmgrx.sys - Completion routine contexts
VmDc - volmgrx.sys - Device changes
VmDd - volmgrx.sys - Disk devices
VmDh - volmgrx.sys - Disk headers
VmLa - volmgrx.sys - Drive layouts
VmLb - volmgrx.sys - Log blocks
VmLc - volmgrx.sys - Log copies
VmLo - volmgrx.sys - Logs
VmLr - volmgrx.sys - Log raw content
VmMm - volmgrx.sys - Mirror emergency mappings
VmNe - volmgrx.sys - Notification entries
VmOb - volmgrx.sys - I/O objects
VmP0 - volmgrx.sys - Packets
VmP1 - volmgrx.sys - Small packets
VmP2 - volmgrx.sys - Large packets
VmP3 - volmgrx.sys - Huge packets
VmPa - volmgrx.sys - Packs
VmPd - volmgrx.sys - Physical disks
VmPs - volmgrx.sys - Arrays of packets
VmRb - volmgrx.sys - Raw record buffers
VmRc - volmgrx.sys - Raw configurations
VmRe - volmgrx.sys - Records
VmRi - volmgrx.sys - Record information
VmRm - volmgrx.sys - RAID-5 emergency mappings
VmRr - volmgrx.sys - Raw records
VmTa - volmgrx.sys - I/O tasks
VmTc - volmgrx.sys - Table of contents
VmTe - volmgrx.sys - Table of contents entries
VmTx - volmgrx.sys - Transactions
VmUe - volmgrx.sys - User entries
VmVd - volmgrx.sys - Volume devices
VmWi - volmgrx.sys - Work items
VoS? - volsnap.sys - VolSnap (Volume Snapshot Driver)
VoSa - volsnap.sys - Application information allocations
VoSb - volsnap.sys - Buffer allocations
VoSc - volsnap.sys - Snapshot context allocations
VoSd - volsnap.sys - Diff area volume allocations
VoSf - volsnap.sys - Diff area file allocations
VoSh - volsnap.sys - Bit history allocations
VoSi - volsnap.sys - Io status block allocations
VoSm - volsnap.sys - Bitmap allocations
VoSo - volsnap.sys - Old heap entry allocations
VoSp - volsnap.sys - Pnp id allocations
VoSr - volsnap.sys - Device relations allocations
VoSs - volsnap.sys - Short term allocations
VoSt - volsnap.sys - Temp table allocations
VoSw - volsnap.sys - Work queue allocations
VoSx - volsnap.sys - Dispatch context allocations
Vpb - <unknown> - Io, vpb's
Vprt - videoprt.sys - Video port for legacy (pre-Vista) display drivers
VraP - <unknown> - parallel class driver
Vtfd - <unknown> - Font file/context
vTDR - dxgkrnl.sys - Video timeout detection/recovery
Wait - <unknown> - NtWaitForMultipleObjects
Wan? - <unknown> - NdisWan Tags (PPP Framing module for Remote Access)
WanA - <unknown> - BundleCB
WanB - <unknown> - ProtocolCB/LinkCB
WanC - <unknown> - DataDesc
WanD - <unknown> - WanRequest
WanE - <unknown> - LoopbackDesc
WanG - <unknown> - MiniportCB
WanH - <unknown> - OpenCB
WanI - <unknown> - IoPacket
WanJ - <unknown> - LineUpInfo
WanK - <unknown> - Unicode String Buffer
WanL - <unknown> - Protocol Table
WanM - <unknown> - Connection Table
WanN - <unknown> - NdisPacketPool Desc
WanQ - <unknown> - DataBuffer
WanR - <unknown> - WanPacket
WanS - <unknown> - AfCB/SapCB/VcCB
WanT - <unknown> - Transform Driver
WanV - <unknown> - RC4 Encryption Context
WanW - <unknown> - SHA Encryption
WanX - <unknown> - Send Compression Context
WanY - <unknown> - Recv Compression Context
WanZ - <unknown> - Protocol Specific Info
Wdm - <unknown> - WDM
WDMA - <unknown> - WDM Audio
Wdog - watchdog.sys - Watchdog object/context allocation
werk - <unknown> - WER kernel mode reporting allocation
WimF - wimfsf.sys - WIM Boot Filter
Wmii - <unknown> - Wmi InstId chunks
Wmij - <unknown> - Wmi GuidMaps
Wmim - <unknown> - Wmi KM to UM Notification Buffers
Wmin - <unknown> - Wmi Notification Slot Chunks
Wmip - <unknown> - Wmi General purpose allocation
Wmiq - <unknown> - Wmi NBQ Blocks
Wmis - <unknown> - Wmi SysId allocations
Wmit - <unknown> - Wmi Trace
Wmiw - <unknown> - Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL
Wmiz - <unknown> - Wmi MCA Insertions debug code
WmiA - <unknown> - Wmi ACPI mapper
WmiC - <unknown> - Wmi Create Pump Thread Work Item
WmiD - <unknown> - Wmi Registration DataSouce
WmiG - <unknown> - Allocation of WMIGUID
WmiI - <unknown> - Wmi Instance Names
WmiL - <unknown> - WmiLIb
WmiN - <unknown> - Wmi Notification Notification Packet
WmiR - <unknown> - Wmi Registration info blocks
WmDS - <unknown> - Wmi DataSource chunks
WmGE - <unknown> - Wmi GuidEntry chunks
WmIS - <unknown> - Wmi InstanceSet chunks
WmMR - <unknown> - Wmi MofResouce chunks
WMca - <unknown> - WMI MCA Handling
WMsG - win32k.sys - Winlogon kernel mode IPC interface
Wrp? - <unknown> - WanArp Tags (ARP module for Remote Access)
Wrpa - <unknown> - WAN_ADAPTER_TAG
Wrpi - <unknown> - WAN_INTERFACE_TAG
Wrpr - <unknown> - WAN_REQUEST_TAG
Wrps - <unknown> - WAN_STRING_TAG
Wrpc - <unknown> - WAN_CONN_TAG
Wrpw - <unknown> - WAN_PACKET_TAG
Wrpf - <unknown> - FREE_TAG (checked builds only)
Wrpd - <unknown> - WAN_DATA_TAG
Wrph - <unknown> - WAN_HEADER_TAG
Wrpn - <unknown> - WAN_NOTIFICATION_TAG
WvCy - <unknown> - WDM Audio WaveCyc port
WvPc - <unknown> - WDM Audio WavePCI port
xCVD - mrxdav.sys - AsyncEngineContext Tag
XDR? - rpcxdr.sys - NFS (Network File System) XDR driver
xSMB - smbmrx.sys - IFSKIT sample SMB mini-redirector
XWan - <unknown> - ndis\usrwan allocations
Xtra - <unknown> - EXIFS Extra Create
ysd8 - win32k.sys - User DDE8
ysd9 - win32k.sys - User DDE9
ysda - win32k.sys - User DDEa
ysdb - win32k.sys - User DDEb
ysdc - win32k.sys - User DDEc
ysdd - win32k.sys - User DDEd
ZsaB - <unknown> - EXIFS ZeroBlock
Catergories
Recent Articles
Recent Comments
Recent Trackbacks
Calendar
Archive
Link
Search
