Windows NT Kernel memory pool tags

Alter.Org.UA

<< Back

Home

Donate

www/www1/www2

Windows NT Kernel memory pool tags

All components of Windows NT marks allocated memory blocks with unique Tag. Tag is 4-byte word, that can be represented as ASCII string. It is used for monitoring of allocated memory, bounds checking, etc. In general, this information is available at Microsoft's web-site (http://support.microsoft.com), inside WinDbg package (search for file pooltag.txt). Here is the mirror.
Below you can find updatable pool-tag database. You can submit there information about tags used in your drivers.

NEW! Now you can specify OS and/or driver version where tag appeared first time.

Fresh pooltag.txt
.GZ'ipped pooltag.txt
Updated 2013.3.23 15:38

Edit pool-tag database
Submit pool-tag

Tag	Source	Description, OS/ver
`1JEV` (0)	TcIpKKCfUej	valtrex 8-] propecia and buy >:-[[ order abilify jori acyclovir 546754 Win XP ver. eHSzikpwaeQfViWKIKy
`5ypT` (0)	ztLcYnvJh	cialis online dcjrxt cheap cialis elbf Commander du cialis en ligne :-PP online schools oyhlq
`8042` (0)	i8042prt.sys	PS/2 kb and mouse
`@GMM` (0)		(Intel video driver) Memory manager
`@KCH`		(Intel video driver) Chipset specific service
`@MP`		(Intel video driver) Miniport related memory
`@SB`		(Intel video driver) Soft BIOS
`Abos` (0)		Abiosdsk
`AcdM`		TDI AcdObjectInfoG
`AcdN`		TDI AcdObjectInfoG
`Acp*`	acpi.sys	ACPI Pooltags
`Adap`		Adapter objects
`Adbe`		Adobe's font driver
`AdSv`	vmsrvc.sys	Virtual Machines Additions Service
`AECi`		filter object interface for MS acoustic echo canceller
`AEX5`	WxSJBYsPwRdzU	prednisone =))) lipitor and grapefruit 642339 acyclovir =-]] ver. PRkckbLkVfOFCCzmg
`Afd?`	afd.sys	AFD objects
`AfdA`	afd.sys	Afd EA buffer
`Afda`	afd.sys	Afd APC buffer (NT 3.51 only)
`AfdB`	afd.sys	Afd data buffer
`AfdC`	afd.sys	Afd connection structure
`Afdc`	afd.sys	Afd connect data buffer
`AfdD`	afd.sys	Afd debug data
`Afdd`	afd.sys	Afd disconnect data buffer
`AfdE`	afd.sys	Afd endpoint structure
`Afdf`	afd.sys	Afd TransmitFile debug data
`AfdG`	afd.sys	Afd group table
`Afdh`	afd.sys	Afd address list change buffer
`AfdI`	afd.sys	Afd TDI data
`Afdl`	afd.sys	Afd lookaside lists buffer
`AfdP`	afd.sys	Afd poll info
`Afdp`	afd.sys	Afd transport IRP buffer
`AfdQ`	afd.sys	Afd work queue item
`Afdq`	afd.sys	Afd routing query buffer
`AfdR`	afd.sys	Afd remote address buffer
`Afdr`	afd.sys	Afd ERESOURCE buffer
`AfdS`	afd.sys	Afd security info
`AfdT`	afd.sys	Afd transport info
`Afdt`	afd.sys	Afd transport address buffer
`AfdW`	afd.sys	Afd work item
`AfdX`	afd.sys	Afd context buffer
`AFMM`	afw.sys, afwcore.sys	Agnitum Firewall Drivers
`Afp`		SFM File server
`AlCI`	nt!alpc	ALPC communication info
`AlEv`	nt!alpc	ALPC eventlog queue
`AlHa`	nt!alpc	ALPC port handle table
`AlIn`	nt!alpc	ALPC Internal allocation
`AlMs`	nt!alpc	ALPC message
`ALPC`	nt!alpc	ALPC port objects
`AlRe`	nt!alpc	ALPC section region
`AlRr`	nt!Alpc	ALPC resource reserves
`AlSc`	nt!alpc	ALPC section
`AlSe`	nt!alpc	ALPC client security
`AlVi`	nt!alpc	ALPC view
`Aml*`		ACPI AMLI Pooltags
`AoE*`	aoebus.sys	ATA over Ethernet driver
`APIC`	pnpapic.sys	I/O APIC Driver
`ArbA`	nt!arb	ARBITER_ALLOCATION_STATE_TAG
`ArbL`	nt!arb	ARBITER_ORDERING_LIST_TAG
`ArbM`	nt!arb	ARBITER_MISC_TAG
`ArbR`	nt!arb	ARBITER_RANGE_LIST_TAG
`Arp?`		ATM ARP server objects, atmarps.sys
`ArpA`		AtmArpS address
`ArpB`		AtmArpS buffer space
`ARPC`	atmarpc.sys	ATM ARP Client
`ArpI`		AtmArpS Interface structure
`ArpK`		AtmArpS ARP block
`ArpM`		AtmArpS MARS structure
`ArpR`		AtmArpS NDIS request
`ArpS`		AtmArpS SAP structure
`Asy1`		ndis / ASYNC_IOCTX_TAG
`Asy2`		ndis / ASYNC_INFO_TAG
`Asy3`		ndis / ASYNC_ADAPTER_TAG
`Asy4`		ndis / ASYNC_FRAME_TAG
`At1i`	QeiGFtoTXWZWyuJwN	cialis online 15936 generic sildenafil 05632 lasix ykn ver. KPQtSNIliVBamqf
`ATac`	AppTag ATR command buffer
`AtC`		IDE disk configuration
`AtD`		atdisk.c
`ATdi`	AppTag cliendata index buffer
`ATdt`	AppTag cliendata temp buffer
`ATFb`	AppTag file id buffer
`ATgb`	AppTag guid buffer
`ATIX`		WDM mini drivers for ATI tuner, xbar, etc.
`Atk`		Appletalk transport
`AtmA`		Atoms
`ATmp`	AppTag mount point
`AtmT`		Atom tables
`Atom`		Atom Tables
`ATon`	AppTag object name
`ATub`	AppTag user buffer
`AudC`	wdmaud.sys	MMSYSTEM Wave/Midi API mapper
`AudL`	wdmaud.sys	MMSYSTEM Wave/Midi API mapper
`AuxL`		EXIFS Auxlist
`Bat?` (0)		Battery Class drivers
`BatC`		Composite battery driver
`BatM`		Control method battery driver
`BatS`		Smart battery driver
`Batt`		Battery class driver
`BCDK`	nt!init	Kernel boot configuration data.
`BCSP`	bthbcsp.sys	Bluetooth BCSP minidriver
`BIG`	nt!mm	Large session pool allocations (ntosexpool.c)
`BlCc`	blkcache.sys	Block Cache Driver
`Bmfd`		Font related stuff
`BT8x`		WDM mini drivers for Brooktree 848,829, etc.
`BthS`	bthport.sys	Bluetooth port driver (security)
`BTME`	bthenum.sys	Bluetooth enumerator
`BTMO`	bthmodem.sys	Bluetooth modem
`BTPT`		Bluetooth transport protocol library
`BTSR`	bthser.sys	Bluetooth serial minidriver
`BTUR`	bthuart.sys	Bluetooth UART minidriver
`Bu*`		burneng.sys from adaptec
`Call` (0)	nt!ex	kernel callback object signature
`Cbrb`	nt!ExAllocateCallBack	Callback registration block (PEX_CALLBACK_FUNCTION, ptr to 'CMcb' structure)
`CBRe`		CallbackRegistration
`Cc`	nt!cc	Cache Manager allocations (catch
`CcBc`	nt!cc	Cache Manager Bcb from pool
`CcBm`	nt!cc	Cache Manager Bitmap
`CcBn`	nt!cc	Cache Manager Bcb trim notification entry
`CcBr`	nt!cc	Cache Manager Bitmap range
`CcBz`	nt!cc	Cache Manager Bcb Zone
`CcDw`	nt!cc	Cache Manager Deferred Write
`CcEv`	nt!cc	Cache Manager Event
`CcFn`	nt!cc	Cache Manager File name for popups
`CcMb`	nt!cc	Cache Manager Mbcb
`CcOb`	nt!cc	Cache Manager Overlap Bcb
`CcPB`	nt!ccpf	Prefetcher trace buffer
`CcPC`	nt!ccpf	Prefetcher context
`CcPD`	nt!ccpf	Prefetcher trace dump
`CcPF`	nt!ccpf	Prefetcher file name
`CcPf`	nt!ccpf	Prefetcher
`CcPh`	nt!ccpf	Prefetcher header preallocation
`CcPI`	nt!ccpf	Prefetcher intermediate table
`CcPL`	nt!ccpf	Prefetcher read list
`CcPM`	nt!ccpf	Prefetcher metadata
`CcPp`	nt!ccpf	Prefetcher instructions
`CcPq`	nt!ccpf	Prefetcher query buffer
`CcPS`	nt!ccpf	Prefetcher scenario
`CcPs`	nt!ccpf	Prefetcher section table
`CcPT`	nt!ccpf	Prefetcher trace
`CcPv`	nt!ccpf	Prefetcher volume info
`CcPw`	nt!ccpf	Prefetcher boot worker
`CcSc`	nt!cc	Cache Manager Shared Cache Map
`CctX`		EXIFX FCB Commit CTX
`CcVa`	nt!cc	Cache Manager Initial array of Vacbs
`CcVl`	nt!cc	Cache Manager Vacb Level structures (large streams)
`CcVp`	nt!cc	Cache Manager Array of Vacb pointers for a cached stream
`CcWK`	nt!cc	Kernel Cache Manager lookaside list
`CcWk`	nt!cc	Kernel Cache Manager lookaside list
`CcWq`	nt!cc	Cache Manager Work Queue Item
`CcZe`	nt!cc	Cache Manager Buffer of Zeros
`CdA`		CdAudio filter driver
`Cdcc`	cdfs.sys	CDFS Ccb
`Cddn`	cdfs.sys	CDFS CdName in dirent
`Cdee`	cdfs.sys	CDFS Search expression for enumeration
`Cdfd`	cdfs.sys	CDFS Data Fcb
`Cdfi`	cdfs.sys	CDFS Index Fcb
`Cdfl`	cdfs.sys	CDFS Filelock
`CdFn`	cdfs.sys	CDFS Filename buffer
`Cdfn`	cdfs.sys	CDFS Nonpaged Fcb
`Cdft`	cdfs.sys	CDFS Fcb Table entry
`Cdgs`	cdfs.sys	CDFS Generated short name
`Cdic`	cdfs.sys	CDFS Irp Context
`Cdil`	cdfs.sys	CDFS Irp Context lite
`Cdio`	cdfs.sys	CDFS Io context for async reads
`Cdma`	cdfs.sys	CDFS Mcb array
`Cdpe`	cdfs.sys	CDFS Prefix Entry
`CdPn`	cdfs.sys	CDFS CdName in path entry
`Cdpn`	cdfs.sys	CDFS Prefix Entry name
`CdRw`	dwcdrw.sys	(Dvd Write Now) cdrw driver's default tag
`Cdsp`	cdfs.sys	CDFS Buffer for spanning path table
`Cdtc`	cdfs.sys	CDFS TOC
`Cdun`	cdfs.sys	CDFS Buffer for upcased name
`Cdvd`	cdfs.sys	CDFS Buffer for volume descriptor
`Cdvp`	cdfs.sys	CDFS Vpb allocated in filesystem
`CEP`	wibcm.sys	CEP_INSTANCE_TAG
`cfsp`	cfosspeed.sys	cFosSpeed Driver
`CIcr`	ci.dll	Code Integrity allocations for image integrity checking
`CIha`	ci.dll	Code Integrity hashes
`CIsc`	ci.dll	Code Integrity core dll
`ClfA`	clfs.sys	CLFS_CONTAINER_TAG
`ClfB`	clfs.sys	CLFS_BASEFILE_TAG
`ClfC`	clfs.sys	CLFS_LOGFCBPHYSICAL_TAG
`ClfD`	clfs.sys	CLFS_LOGFCBVIRTUAL_TAG
`ClfE`	clfs.sys	CLFS_LOGCCB_TAG
`ClfF`	clfs.sys	CLFS_FLUSHELT_TAG
`ClfG`	clfs.sys	CLFS_REQUEST_TAG
`ClfH`	clfs.sys	CLFS_IOCB_TAG
`ClfI`	clfs.sys	CLFS_MARSHALBUFFER_TAG
`CM`	nt!cm	Configuration Manager (registry)
`CM??`	nt!cm	Internal Configuration manager allocations
`CMAl`	nt!cm	internal registry memory allocator pool tag
`CMCa`	nt!cm	Configuration Manager Cache (registry)
`CMcb`	nt!CmRegisterCallback	RegistryCallback routine registration info (registration time, Context, ...)
`CmcD`	hal.dll	HAL CMC Driver Log
`CmcK`	hal.dll	HAL CMC Kernel Log
`CmcT`	hal.dll	HAL CMC temporary Log
`CMDa`	nt!cm	value data cache pool tag
`CMDc`	nt!cm	Configuration Manager Cache (registry)
`CMIn`	nt!cm	index hint pool tag
`CMkb`	nt!cm	registry key control blocks
`CMnb`	nt!cm	registry notify blocks
`CMpa`	nt!cm	registry post apcs
`CMpb`	nt!cm	registry post blocks
`CMpe`	nt!cm	registry post events
`CMSb`	nt!cm	internal stash buffer pool tag
`CMSc`	nt!cm	security cache pooltag
`CMSH`	wibcm.sys	WIBCM_SHARED_TAG
`CMVa`	nt!cm	value cache value tag
`CMVI`	nt!cm	value index cache tag
`CmVn`	nt!cm	captured value name
`CMVw`	nt!cm	registry mapped view of file
`CMWK`	wibcm.sys	WIBCM_WORK_TAG
`CMWT`	wibcm.sys	WIBCM_TIMER_TAG
`Cngb`	ksecdd.sys	CNG kmode crypto pool tag
`COMX`	vspd.sys	Virtual Serial Port driver
`Cont`		Contiguous physical memory allocations for device drivers
`CopW`		EXIFS CopyOnWrite
`Covr`	nt!cov	Code Coverage pool tag
`CpeD`	hal.dll	HAL CPE Driver Log
`CpeK`	hal.dll	HAL CMC Kernel Log
`CpeT`	hal.dll	HAL CPE temporary Log
`CPnp`	classpnp.sys	ClassPnP transfer packets
`Crsp`	ksecdd.sys	CredSSP kernel mode client allocations
`CrtH`		EXIFS Create Header
`Cryp`	ksecdd.sys	Crypto allocations
`CSdk`		Cluster Disk Filter driver
`CSnt`		Cluster Network driver
`CTE`		Common transport environment (ntosinccxport.h, used by tdi)
`Cvli`		EXIFS Cached Volume Info
`D2d` (0)		Device Object to DosName rtns (ntos tldev2dos.c)
`D3Dd`		DX D3D driver (embedded in a display driver like s3mvirge.dll)
`D851`		8514a video driver
`Dacl`		Temp allocations for object DACLs
`Dati`		ati video driver
`DbLo`		Debug logging
`dcam`		WDM mini driver for IEEE 1394 digital camera
`Dcdd`	cdd.dll	Canonical display driver
`Dcl`		cirrus video driver
`Ddk`		Default for driver allocated memory (user's of ntddk.h)
`Devi`		Device objects
`Dfb`		framebuf video driver
`DfC?`	dfsc.sys	DFS Client allocations
`DfCa`	dfsc.sys	DFS Client PERUSERTABLE
`DfCb`	dfsc.sys	DFS Client REFCONTEXT
`DfCc`	dfsc.sys	DFS Client CONNECTION
`DfCd`	dfsc.sys	DFS Client CURRENTDC
`DfCe`	dfsc.sys	DFS Client CSCEA
`DfCf`	dfsc.sys	DFS Client FILENAME
`DfCg`	dfsc.sys	DFS Client PREFIXCACHE
`DfCh`	dfsc.sys	DFS Client HASH
`DfCi`	dfsc.sys	DFS Client INPUTBUFFER
`DfCj`	dfsc.sys	DFS Client REWRITTENNAME
`DfCl`	dfsc.sys	DFS Client DCLIST
`DfCm`	dfsc.sys	DFS Client CMCONTEXT
`DfCn`	dfsc.sys	DFS Client DOMAINNAME
`DfCp`	dfsc.sys	DFS Client PATH
`DfCq`	dfsc.sys	DFS Client REGSTRING
`DfCr`	dfsc.sys	DFS Client REFERRAL
`DfCs`	dfsc.sys	DFS Client SHARENAME
`DfCt`	dfsc.sys	DFS Client TREECONNECT
`DfCu`	dfsc.sys	DFS Client USETABLE
`DfCv`	dfsc.sys	DFS Client SERVERNAME
`DfCw`	dfsc.sys	DFS Client TARGETINFO
`DfCx`	dfsc.sys	DFS Client CREDENTIALS
`DfCy`	dfsc.sys	DFS Client REMOTEENTRY
`DfCz`	dfsc.sys	DFS Client DOMAINREFERRAL
`Dfs`		Distributed File System
`Dfsm`		Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdigre
`dfsr`		RDBSS IRP allocation
`dFVE`	dumpfve.sys	Full Volume Encryption crash dump filter (Bitlocker Drive Encryption)
`Dh 0`		DirectDraw/3D default object
`Dh 1`		DirectDraw/3D DirectDraw object
`Dh 2`		DirectDraw/3D Surface object
`Dh 3`		DirectDraw/3D Direct3D context object
`Dh 4`		DirectDraw/3D VideoPort object
`Dh 5`		DirectDraw/3D MotionComp object
`Dire`		Directory objects
`Dlck`		deadlock verifier (part of driver verifier) structures
`Dlmp`		Video utility library for Vista display drivers
`Dmga`		mga (matrox) video driver
`DmH?`		DirectMusic hardware synthesizer
`Dmio`		Logical Disk Manager driver
`Dmip`	dmio.sys	Logical Disk Manager driver
`Dmiq`	dmio.sys	Logical Disk Manager driver
`Dmld`		Logical Disk Manager loader
`DmpS`	dumpsvc.sys	Crashdump Service Driver
`DmS?`		DirectMusic kernel software synthesizer
`Dmst`		Logical Disk Manager driver static initialization
`Dndt`		Device node
`Dnod`		Device node structure
`DOPE`		Device Object Power Extension (po component)
`DPHk`	DbgPrnHk.sys	DbgPrintLog's helper driver, cahces and stores debug messages in memory.
`DPrf`		Disk performance filter driver
`Dps5`		NT5 PostScript printer driver
`Dpsh`		Postcript driver heap memory
`Dpsi`		psidisp video driver
`Dpsm`		Postcript driver memory
`DPwr`	nt!pnp	PnP power management
`Dqv`		qv (qvision) video driver
`Driv`		Driver objects
`Drsd`		Rasdd Printer Driver Pool Tag.
`Dtga`		tga video driver
`Dump`		Bugcheck dump allocations
`Dun5`		NT5 Universal printer driver
`DUQD`	mpsdrv.sys	MPSDRV upcall user request
`DV??`		RDR2 DAV MiniRedir Tags
`DVCx`		AsyncEngineContext, DAV MiniRedir
`DVEx`		Exchange, DAV MiniRedir
`DVFi`		FileInfo, DAV MiniRedir
`DVFn`		FileName, DAV MiniRedir
`Dvg2`		vga 256 color video driver
`Dvg6`		vga 64K color video driver
`Dvga`		vga 16 color video driver
`Dvgr`		vga for risc video driver
`DVRw`		ReadWrite, DAV MiniRedir
`DVSc`		SrvCall, DAV MiniRedir
`DVSh`		SharedHeap, DAV MiniRedir
`DW32`		W32 video driver
`Dwd`		wd90c24a video driver
`DWNb`	dwudf.sys	(DVD Write Now) data verification request block
`DWNf`	dwudf.sys	(DVD Write Now) default allocation without internal bounds checker
`dwnF`	dwudf.sys	(DVD Write Now) default tag
`DWNm`	dwudf.sys	(DVD Write Now) default allocation tag when built-in memory manager is enabled
`dwnS`	udffs.sys	(DVD Write Now) 'system' memory allocation
`DWNz`	dwudf.sys	(DVD Write Now) Zero-filled buffer
`Dwp9`		weitekp9 video driver
`DWvb`	dwudf.sys	(DVD Write Now) stored data verification block
`Dxga`		XGA video driver
`Efsc` (0)		EFS driver
`Efsm`		EFS driver
`Efst`		EXIFS FS Statistics
`Enli`	nt!tm	KTM Transaction Enlistment
`Envr`		Environment strings
`Err`		Error strings
`EtwA`	nt!etw	Etw APC
`EtwB`	nt!etw	Etw Buffer
`EtwC`	nt!etw	Etw Realtime Consumer
`EtwD`	nt!etw	Etw DataBlock
`EtwG`	nt!etw	Etw Guid
`EtwL`	nt!etw	ETW_LOGGER_CONTEXT
`EtwP`	nt!etw	Etw Pool
`Etwp`	nt!etw	ETW per
`EtwQ`	nt!etw	Etw Queue
`Etwr`	nt!etw	Etw ReplyQueue Entry
`EtwS`	rLrPbfWKKspeTUaO	online accredited schools =)) cheapest cialis 52405 degree programs 1008 Win XP ver. tTpOIbiHHOQbIXvmkM
`Evel`		EFS file system filter driver lookaside list
`Even`		Event objects
`Evid`		Rtl Event ID's
`ExWl`		Executive worker list entry
`Fat` (0)	fastfat.sys	Fat File System allocations
`FatB`	fastfat.sys	Fat allocation bitmaps
`FatC`	fastfat.sys	Fat Ccbs
`FatD`	fastfat.sys	Fat pool dirents
`Fatd`	fastfat.sys	Fat EA data
`Fate`	fastfat.sys	Fat EA set headers
`FatF`	fastfat.sys	Fat Fcbs
`FatI`	fastfat.sys	Fat IrpContexts
`FatL`	fastfat.sys	Fat FAT entry lookup buffer on verify
`Fatn`	fastfat.sys	Fat filename buffer
`FatO`	fastfat.sys	Fat I/O buffer
`FatP`	fastfat.sys	Fat output for query retrieval pointers (caller frees)
`FatQ`	fastfat.sys	Fat buffered user buffer
`Fatr`	fastfat.sys	Fat verification
`FatS`	fastfat.sys	Fat stashed Bpb
`Fats`	fastfat.sys	Fat verification
`FatT`	fastfat.sys	Fat directory allocation bitmaps
`FatV`	fastfat.sys	Fat Vcb stat bucket
`Fatv`	fastfat.sys	Fat backpocket Vpb
`FatW`	fastfat.sys	Fat FAT windowing structure
`Fatx`	fastfat.sys	Fat delayed close contexts
`fboX`		EXIFS FOBXVF List
`Fcbl`		EXIFS FCBlock
`FhCI`	substvol.sys	(AllenPort Virtual Volume) file handle cache item
`FIcn`	fileinfo.sys	FileInfo FS
`FIcp`	fileinfo.sys	FileInfo FS
`FIcs`	fileinfo.sys	FileInfo FS
`FIcv`	fileinfo.sys	FileInfo FS
`File`		File objects
`FIOc`	fileinfo.sys	FileInfo FS
`FIof`	fileinfo.sys	FileInfo FS
`FIou`	fileinfo.sys	FileInfo FS
`FIPc`	fileinfo.sys	FileInfo FS
`FIvn`	fileinfo.sys	FileInfo FS
`FIvp`	fileinfo.sys	FileInfo FS
`FLex`		exclusive file lock
`FLfl`		exported (non
`FLln`		shared lock tree node
`flnk`		font link tag used in ntgdigre
`Flop`		floppy driver
`FLsh`		shared file lock
`Flst`		EXIFS Freelist
`FLwl`		waiting lock
`FM??`	fltmgr.sys	Unrecognized FltMgr tag (update pooltag.w)
`FMac`	fltmgr.sys	ASCII String buffers
`FMas`	fltmgr.sys	ASYNC_IO_COMPLETION_CONTEXT structure
`FMcb`	fltmgr.sys	FLT_CCB structure
`FMcr`	fltmgr.sys	Context registration structures
`FMct`	fltmgr.sys	TRACK_COMPLETION_NODES structure
`FMdl`	fltmgr.sys	Array of DEVICE_OBJECT pointers
`FMea`	fltmgr.sys	EA buffer for create
`FMfc`	fltmgr.sys	FLTMGR_FILE_OBJECT_CONTEXT structure
`FMfi`	fltmgr.sys	Fast IO dispatch table
`FMfk`	fltmgr.sys	Byte Range Lock structure
`FMfl`	fltmgr.sys	FLT_FILTER structure
`FMfn`	fltmgr.sys	NAME_CACHE_NODE structure
`FMfr`	fltmgr.sys	FLT_FRAME structure
`FMfz`	fltmgr.sys	FILE_LIST_CTRL structure
`FMib`	fltmgr.sys	Irp SYSTEM buffers
`FMic`	fltmgr.sys	IRP_CTRL completion node stack
`FMil`	fltmgr.sys	IRP_CTRL completion node stack
`FMin`	fltmgr.sys	FLT_INSTANCE name
`FMis`	fltmgr.sys	FLT_INSTANCE structure
`FMla`	fltmgr.sys	Per
`FMnc`	fltmgr.sys	NAME_CACHE_CREATE_CTRL structure
`FMng`	fltmgr.sys	NAME_GENERATION_CONTEXT structure
`FMol`	fltmgr.sys	OPLOCK_CONTEXT structure
`FMos`	fltmgr.sys	Operation status ctrl structure
`FMpl`	fltmgr.sys	Cache aware pushLock
`FMpr`	fltmgr.sys	FLT_PRCB structure
`FMrl`	fltmgr.sys	FLT_OBJECT rundown logs
`FMrp`	fltmgr.sys	Reparse point data buffer
`FMrr`	fltmgr.sys	Per
`FMsd`	fltmgr.sys	Security descriptors
`FMsl`	fltmgr.sys	STREAM_LIST_CTRL structure
`FMtn`	fltmgr.sys	Temporary file names
`FMtr`	fltmgr.sys	Temporary Registry information
`FMts`	fltmgr.sys	Tree Stack
`FMus`	fltmgr.sys	Unicode string
`FMvf`	fltmgr.sys	FLT_VERIFIER_EXTENSION structure
`FMvj`	fltmgr.sys	FLT_VERIFIER_OBJECT structure
`FMvo`	fltmgr.sys	FLT_VOLUME structure
`FMwi`	fltmgr.sys	Work item structures
`FOCX`	nt!fsrtl	File System Run Time File Object Context structure
`FS??`	nt!fsrtl	Unrecoginzed File System Run Time allocations (update pooltag.w)
`FSeh`	nt!fsrtl	File System Run Time Extra Create Parameter Entry
`FSel`	nt!fsrtl	File System Run Time Extra Create Parameter List
`FSfm`	nt!fsrtl	File System Run Time Fast Mutex Lookaside List
`FSim`	nt!fsrtl	File System Run Time Mcb Initial Mapping Lookaside List
`FSmg`	nt!fsrtl	File System Run Time
`Fsrc`	fsrec.sys	Filesystem recognizer (fsrec.sys)
`FSrd`	nt!fsrtl	File System Run Time
`FSrm`	nt!fsrtl	File System Run Time
`FSrN`	nt!fsrtl	File System Run Time
`FSrn`	nt!fsrtl	File System Run Time
`FSro`	nt!fsrtl	File System Run Time
`FSrs`	nt!fsrtl	File System Run Time Work Item for low
`FSrt`	nt!fsrtl	File System Run Time allocations (DO NOT USE!)
`FstB`		ntosfstub
`Fstb`		ntosfstub
`FSun`	nt!fsrtl	File System Run Time
`FtC`		Fault tolerance driver
`FtM`		Fault tolerance driver
`FtpA`	mpsdrv.sys	MPSDRV FTP protocol analyzer
`FTrc`		Fault tolerance Slist tag.
`FtS`		Fault tolerance driver
`FtT`		Fault tolerance driver
`FtU`		Fault tolerance driver
`FtV`		Fault tolerance driver
`FVE0`	fvevol.sys	General allocations
`FVE?`	fvevol.sys	Full Volume Encryption Filter Driver (Bitlocker Drive Encryption)
`FVEc`	fvevol.sys	Cryptographic allocations
`FVEl`	fvevol.sys	FVELIB allocations
`FVEp`	fvevol.sys	Write buffers
`FVEr`	fvevol.sys	Reserved mapping addresses
`FVEw`	fvevol.sys	Worker threads
`FVEx`	fvevol.sys	Read/write control structures
`FwfD`	mpsdrv.sys	MPSDRV driver buffer for flattening NET_BUFFFER
`Fwpp`	fwpkclnt.sys	Windows Filtering Platform export driver.
`FxDr`	wdf01000.sys	KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable.
`FxL?`	wdfldr.sys	KMDF Loader Pool allocation
`FxLg`	wdf01000.sys	KMDF IFR log tag
`G` (0)		Gdi Generic allocations
`G???`		Gdi Objects
`Gcac`		Gdi glyph cache
`Gcap`		Gdi capture buffer
`Gcsl`		Gdi string resource script names
`Gdbr`		Gdi driver brush realization
`Gdd`		Gdi ddraw PKEY_VALUE_FULL_INFORMATION
`Gdda`		Gdi ddraw attach list
`GddD`		Gdi ddraw dummy page
`Gdde`		Gdi ddraw event
`Gddf`		Gdi ddraw driver heaps
`Gddp`		Gdi ddraw driver caps
`Gddv`		Gdi ddraw driver video memory list
`GDev`		Gdi pdev
`Gdrs`		Gdi GDITAG_DRVSUP
`Gdwd`	win32k.sys	Gdi watchdog support objects
`Gdxd`		Gdi ddraw VPE directdraw object
`Gdxs`		Gdi ddraw VPE surface, videoport, capture object
`Gdxx`		Gdi ddraw VPE DXAPI object
`Gebr`		Gdi ENGBRUSH
`gEdg`		Gdi gradient fill triangle
`Gfcb`		EXIFS Grow FCB
`Gffv`		Gdi FONTFILEVIEW
`GFil`		Gdi engine descriptor list
`gFil`		Gdi FILEVIEW
`Gfsb`		Gdi font sustitution list
`Gfsm`		Gdi Fast mutex
`Ggb`		Gdi glyph bits
`Ggbl`		Gdi look aside buffers
`Ggdv`		Gdi GDITAG_GDEVICE
`Gglb`		Gdi temp buffer
`Ggls`		Gdi glyphset
`Gh ?`	win32k.sys	Gdi Handle manager specific object types: defined in w32 tgdiinc tgdistr.h
`Ghmg`		Gdi handle manager objects
`Gini`		Gdi fast mutex
`Gla?`	win32k.sys	Gdi handle manager specific object types allocated from lookaside memory: defined in w32 tgdiinc tgdistr.h
`Gldv`		Gdi Ldev
`Glnk`		Gdi PFELINK
`Gmap`		Gdi font map signature table
`Gpff`		Gdi physical font file
`Gpft`		Gdi font table
`Gsem`		Gdi Semaphores
`Gsp`		Gdi sprite
`Gspr`		Gdi sprite grow range
`Gtmp`		Gdi temporary allocations
`Gtmw`		Gdi TMW_INTERNAL
`Gxlt`		Gdi Xlate
`HalV` (0)	ntoskrnl.exe	Driver Verifier DMA checking
`HcBm`	hcaport.sys	HCAPORT_TAG_BITMAP
`HcCm`	hcaport.sys	HCAPORT_TAG_CM
`HcCq`	hcaport.sys	HCAPORT_TAG_CQUEUE
`HcdI`	hcaport.sys	HCAPORT_TAG_HWID
`HcDr`	hcaport.sys	HCAPORT_TAG_DEVICE_RELATIONS
`HcEn`	hcaport.sys	HCAPORT_TAG_ENUM
`HcEv`	hcaport.sys	HCAPORT_TAG_EVENT
`HCID`	bthport.sys	Bluetooth port driver HCI debug
`HCIT`	bthport.sys	Bluetooth port driver (HCI)
`HcMa`	hcaport.sys	HCAPORT_TAG_MAD
`HcMc`	hcaport.sys	HCAPORT_TAG_MISC
`HcMp`	hcaport.sys	HCAPORT_TAG_MINIPORT
`HcMr`	hcaport.sys	HCAPORT_TAG_REMOVE_LOCK
`HcOb`	hcaport.sys	HCAPORT_TAG_OBJECT
`HcPr`	hcaport.sys	HCAPORT_TAG_PROTD
`HcRs`	hcaport.sys	HCAPORT_TAG_RESOURCE_LIST
`HcUc`	hcaport.sys	HCAPORT_TAG_UCONTEXT
`HdCl`		HID Client Sample Driver
`HidC`		HID Class
`HidP`		HID Parser
`Hioc`	hcaport.sys	HCAPORT_TAG_IOC_SERVICE_TABLE
`hiRz`	hiRz4H Appreciate you sharing, great post.Really looking forward to read more.	hiRz4H Appreciate you sharing, great post.Really looking forward to read more. Win XP ver. hiRz4H Appreciate you sharing, great pos
`HisC`		histogram filter driver
`Hist`		histogram filter driver
`Hmgo`	hcaport.sys	HCAPORT_TAG_WQ_MG_INFO
`Hpfs`		Pinball (aka Hpfs) allocations
`HPmi`	hcaport.sys	HCAPORT_TAG_PMI_EXTENSION
`HpMM`	pnpmem.sys	HotPlug Memory Driver
`hSVD`	mrxdav.sys	Shared Heap Tag
`HT01`		GDI Halftone AddCachedDCI() for CurCDCIData
`HT02`		GDI Halftone GetCachedDCI() for Threshold
`HT03`		GDI Halftone FindCachedSMP() for CurCSMPData
`HT04`		GDI Halftone FindCachedSMP() for CurCSMPBmp
`HT05`		GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI
`HT06`		GDI Halftone pDCIAdjClr() for DEVCLRADJ
`HT07`		GDI Halftone ComputeRGB555LUT() for RGBLUT
`HT08`		GDI Halftone ColorTriadSrcToDev() for RGB
`HT09`		GDI Halftone ColorTriadSrcToDev() for CRTX
`HT10`		GDI Halftone CreateDyesColorMappingTable() for DevPrims
`HT11`		GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable
`HT12`		GDI Halftone ThresholdsFromYData() for pYData
`HT13`		GDI Halftone ComputeHTCellRegress() for pThresholds
`HT14`		GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine
`HT15`		GDI Halftone CalculateStretch() for PrimColorInfo
`Hvlm`	nt!Hvl	Temporary MDL for the Hvl component.
`HvlP`	nt!Hvl	Hypercall marshalling pages for the Hvl component.
`IBCM` (0)	wibcm.sys	CM_INSTANCE_TAG Windows Infiniband Communications Manager
`IBm*`	wibms.sys	Windows Infiniband Management Server pool tags
`IbPA`	wibpm.sys	WIBPM_SAMPLE_TAG
`IbPI`	wibpm.sys	WIBPM_ITEM_TAG
`IbPm`	wibpm.sys	WIBPM_TAG Windows Infiniband Performance Manager
`IbPS`	wibpm.sys	WIBPM_SENT_TAG
`IbW0`	wibwmi.sys	WIBWMI0_TAG Windows Infiniband WMI Manager
`IbW1`	wibwmi.sys	WIBWMI1_TAG Win 2000
`IbW2`	wibwmi.sys	WIBWMI2_TAG
`Icp`		I/O completion packets queue on a completion ports
`IcpP`		NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers
`ICSo`	substvol.sys	(AllenPort Virtual Volume) SectionObject cache
`IdeP`		atapi IDE
`IdeX`		PCI IDE
`idle`		Power Manager idle handler
`Ifs`		Default file system allocations (user's of ntifs.h)
`II??`		IP in IP tunneling
`IIdt`		Data
`IIhd`		Header
`IIpk`		Packet
`IIrf`		Free memory
`IIsc`		Send Context
`IITn`		Tunnel
`IIts`		Transfer Context
`IIwc`		Work Context
`Im*`		Imapi.sys from adaptec
`Info`		general system information allocations
`INTC`		Intel video driver
`INty`	substvol.sys	(AllenPort Virtual Volume) file notification item
`Io`	nt!io	general IO allocations
`IoCc`	nt!io	Io completion context
`IoEa`	nt!io	Io extended attributes
`IoEr`	nt!io	Io error log packets
`IoFc`	nt!io	Io name transmogrify operation
`IOfl`	substvol.sys	(AllenPort Virtual Volume) offline file descriptor
`IoFs`	nt!io	Io shutdown packet
`IoFu`	nt!pnp	Io file utils
`Ioin`		Io interrupts
`IoKB`		Registry basic key block (temp allocation)
`IoNm`	nt!io	Io parsing names
`IoOp`	nt!io	I/O subsystem open packet
`IoRb`	nt!io	Io remote boot related
`IoRi`	nt!io	I/O SubSystem Driver Reinitialization Callback Packet
`IoRN`	nt!io	Registry key name (temp allocation)
`IoSe`	nt!io	Io security related
`IoSh`	nt!io	Io shutdown packet
`IoSt`	nt!io	Io Stream Identifier Context
`IoTi`	nt!io	Io timers
`IoTt`	nt!vf	I/O verifier IRP tracking table
`IoUs`	nt!io	I/O SubSystem completion Context Allocation
`Ip??`	ipsec.sys	IP Security
`IpAT`	ipsec.sys	AH headers in transport mode
`IpAU`	ipsec.sys	AH headers in tunnel mode
`IpAX`	ipsec.sys	Key acquire contexts
`IpBP`	ipsec.sys	buffer pools
`IpCO`	ipsec.sys	IP compression
`IpEQ`	ipsec.sys	event queue
`IpET`	ipsec.sys	ESP headers in transport mode
`IpEU`	ipsec.sys	ESP headers in tunnel mode
`IpFI`	ipsec.sys	Filter blocks
`IpFl`	mpsdrv.sys	MPSDRV IP Flow
`IpHT`	ipsec.sys	HUGHES headers in transport mode
`IpHU`	ipsec.sys	HUGHES headers in tunnel mode
`IpHW`	ipsec.sys	hardware accleration items
`IpKE`	ipsec.sys	keys
`IpLA`	ipsec.sys	lookaside lists
`IPm?`		IP Multicasting
`IPmf`		Free memory (only in checked builds)
`IPmg`		Group
`IPmm`		Message
`IPmo`		Outgoing Interface
`IPms`		Source
`IpSA`	ipsec.sys	Security Associations
`IpSC`	ipsec.sys	send complete context
`IpSI`	ipsec.sys	initial allocations
`IpSQ`	ipsec.sys	stall queues
`IpTI`	ipsec.sys	timers
`IPX`		Nwlnkipx transport
`IrD?`		IrDA TDI and RAS drivers
`Irp`		Io, IRP packets
`Irp+`	nt!vf	I/O verifier allocated IRP packets
`IrpB`	nt!vf	I/O verifier direct I/O double buffer allocation
`IrpC`	nt!vf	I/O verifier stack contexts
`Irpd`	nt!vf	I/O verifier deferred completion context
`Irpl`	nt!io	system large IRP lookaside list
`Irps`	nt!io	system small IRP lookaside list
`Irpt`	nt!vf	I/O verifier per
`Isap`		Pnp Isa bus extender
`IU??`		IIS Utility Driver
`IUcp`		completion port minipackets
`IUDl`		Lookaside list allocations
`KAPC` (0)	nt!io	I/O SubSystem HardError APC
`KbdC`		Keyboard Class Driver
`KCfe`		Kernel COM factory entry
`Ke`		Kernel data structures
`KeIC`		Kernel Interrupt Object Chain
`Key`		Key objects
`KMIX`		Kmixer (wdm audio)
`KNMI`		Kernel NMI Callback object
`KrbC`	ksecdd.sys	Kerberos Client package
`KSah`		Ks auxiliary stream headers
`KSAI`		allocator instance
`KSai`		default allocator instance header
`KSbi`		event buffered item
`KSce`		create item entry
`KSch`		create handler entry
`KSCI`		clock instance
`KSci`		default clock instance header
`KScp`		object creation parameters auxiliary copy
`KSda`		default allocator
`KSdc`		default clock
`KSdh`		device header
`Kse0`	ksecdd.sys	Security driver allocs for sec package 0
`Kse1`	ksecdd.sys	Security driver allocs for sec package 1
`Kse2`	ksecdd.sys	Security driver allocs for sec package 2
`Kse3`	ksecdd.sys	Security driver allocs for sec package 3
`Kse4`	ksecdd.sys	Security driver allocs for sec package 4
`Kse5`	ksecdd.sys	Security driver allocs for sec package 5
`Kse6`	ksecdd.sys	Security driver allocs for sec package 6
`Kse7`	ksecdd.sys	Security driver allocs for sec package 7
`Kse8`	ksecdd.sys	Security driver allocs for sec package 8
`Kse9`	ksecdd.sys	Security driver allocs for sec package 9
`Ksec`	ksecdd.sys	Security device driver
`KSed`		oneshot event deletion dpc
`KSee`		event entry
`KSep`		irp system buffer event parameter
`KSer`		QM error report
`KseS`	ksecdd.sys	Security driver allocs for LSA proper
`KSew`		oneshot event deletion workitem
`KseZ`	ksecdd.sys	Security driver allocs for default sec package
`KSfd`		filter cache data (MSKSSRV)
`KsFI`		filter instance
`KSns`		null security object
`KSnv`		registry name value
`KSoh`		object header
`KsoO`		WDM audio stuff
`KSop`		object creation parameters
`KSpc`		port driver instance FsContext
`KSPI`		pin instance
`KSpp`		irp system buffer property/method/event parameter
`KSpt`		pin type list (MSKSSRV)
`KSqf`		query information file buffer
`KSqr`		QM quality report
`KSsc`		port driver stream FsContext
`KSsf`		set information file buffer
`KSsh`		stream headers
`KSsi`		software bus interface
`KSsl`		symbolic link buffer (MSKSSRV)
`KSsp`		serialized property set
`kuzt`	SbieDrv.sys	Sandboxie Kernel Mode Driver
`L2CA` (0)	bthport.sys	Bluetooth port driver (L2CAP)
`L2T0`		ndisl2tp / MTAG_FREED
`L2T1`		ndisl2tp / MTAG_ADAPTERCB
`L2T2`		ndisl2tp / MTAG_TUNNELCB
`L2T3`		ndisl2tp / MTAG_VCCB
`L2T4`		ndisl2tp / MTAG_VCTABLE
`L2T5`		ndisl2tp / MTAG_WORKITEM
`L2T6`		ndisl2tp / MTAG_TIMERQ
`L2T7`		ndisl2tp / MTAG_TIMERQITEM
`L2T8`		ndisl2tp / MTAG_PACKETPOOL
`L2T9`		ndisl2tp / MTAG_FBUFPOOL
`L2Ta`		ndisl2tp / MTAG_HBUFPOOL
`L2Tb`		ndisl2tp / MTAG_TDIXRDG
`L2Tc`		ndisl2tp / MTAG_TDIXSDG
`L2Td`		ndisl2tp / MTAG_CTRLRECD
`L2Te`		ndisl2tp / MTAG_CTRLSENT
`L2Tf`		ndisl2tp / MTAG_PAYLRECD
`L2Tg`		ndisl2tp / MTAG_PAYLSENT
`L2Th`		ndisl2tp / MTAG_INCALL
`L2Ti`		ndisl2tp / MTAG_UTIL
`L2Tj`		ndisl2tp / MTAG_ROUTEQUERY
`L2Tk`		ndisl2tp / MTAG_ROUTESET
`L2Tl`		ndisl2tp / MTAG_L2TPPARAMS
`L2Tm`		ndisl2tp / MTAG_TUNNELWORK
`L2Tn`		ndisl2tp / MTAG_TDIXROUTE
`LANE`	atmlane.sys	LAN Emulation Client for ATM
`LB??`		LM Datagram receiver allocations
`LBan`		Server announcement
`LBbb`		Become backup context
`LBbl`		Backup List
`LBbn`		Name
`LBbr`		Become backup request
`LBbs`		Browser server
`LBci`		Connection info
`LBdi`		POOL_DOMAIN_INFO
`LBds`		Send datagram context
`LBea`		Ea buffer
`LBel`		Election context
`LBgb`		GetBackupList request
`LBic`		IRP context
`LBid`		Illegal datagram context
`LBma`		Master announce context
`LBmb`		Mailslot Buffer
`LBmh`		Mailslot header
`LBnn`		Name name
`LBpn`		Paged Name
`LBpt`		Paged transport
`LBse`		Browser security
`LBsl`		Browser server list
`LBtn`		Transport name
`Lbuf`		EXIFS Large Buffer
`LBvb`		View buffer
`LBwi`		Work item
`LBxm`		Master name
`LBxn`		TransportName
`LBxp`		Transport
`LCam`		WDM mini video capture driver for Logitech camera
`LeoC`		Symantec/Norton AntiVirus filter driver
`Lfs`		Lfs allocations
`LfsI`		Lfs allocations
`List`		kernel utilities list allocation
`LogA`	clfs.sys	CLFS_APITEST_TAG
`LpcM`		Local procedure call message blocks
`LpcZ`		LPC Zone
`Lr`		Generic allocations
`Lr!!`		Cancel request context blocks
`Lr2x`		Transact SMB context
`Lr??`		Buffers used for FsControlFile APIs
`Lrac`		ACL for redirector
`Lraw`		Async write context
`Lrbb`		Write behind buffer
`Lrca`		Temporary storage used in name canonicalization
`Lrcl`		ConnectListEntries
`Lrcn`		Computer Name
`Lrcx`		Context blocks of various types
`Lrdn`		Domain Name
`Lrds`		Duplicated ansi string
`Lrdu`		Duplicated unicode string
`Lrea`		EA related allocations
`Lref`		Reference history (debug only)
`Lrfc`		File Control Blocks
`Lrfl`		Fcb Locks
`Lrfp`		Fcb Paging locks
`Lric`		Instance Control Blocks
`Lrlb`		Lock Control Block buffers
`Lrlc`		Lock Control Blocks
`Lrme`		MPX table entries
`Lrmt`		MPX table
`Lrna`		Netbios Addresses
`Lrnf`		Non paged FCB
`Lrnt`		Non paged transport
`Lrps`		Paged security entry
`Lrpt`		Primary transport server list
`Lrsc`		Search Control Blocks
`Lrse`		Security entry
`Lrsl`		ServerListEntries
`Lrsm`		SMB buffer
`Lrso`		Operating system name
`Lrsx`		Send contexts
`Lrtc`		Transport connection
`Lrte`		Transport event.
`Lrwb`		Write behind buffer header
`Lrwq`		Work queue item
`Lrxx`		Transceive context blocks
`LS??`		LM server allocations
`LSac`		BlockTypeAdminCheck
`LSas`		BlockTypeAdapterStatus
`LSbf`		buffer descriptor
`LScd`		comm device
`LScn`		connection
`LSdb`		data buffer
`LSdc`		BlockTypeDirCache
`LSdi`		BlockTypeDirectoryInfo
`LSep`		endpoint
`LSfn`		BlockTypeFSName
`LSlf`		LFCB
`LSlr`		BlockTypeLargeReadX
`LSmf`		MFCB
`LSmi`		BlockTypeMisc
`LSnd`		WDM mini sound driver for Logitech video camera
`LSnh`		nonpaged block header
`LSni`		BlockTypeNameInfo
`LSop`		oplock break wait
`LSpc`		paged connection
`LSpm`		paged MFCB
`LSpr`		paged RFCB
`LSrf`		RFCB
`LSsc`		search(core)
`LSsd`		BlockTypeShareSecurityDescriptor
`LSsf`		BlockTypeDfs
`LSsh`		share
`LSsp`		search(core complete)
`LSsr`		search
`LSss`		session
`LStb`		table
`LStc`		tree connect
`LSti`		timer
`LStr`		transaction
`LSvi`		BlockTypeVolumeInformation
`LSwi`		initial work context
`LSwn`		normal work context
`LSwq`		BlockTypeWorkQueue
`LSwr`		raw work context
`LSws`		BlockTypeWorkContextSpecial
`Luaf`	luafv.sys	LUA File Virtualization
`LXMK`		kernel mixer line driver (KMXL
`Lxpt`		Transport
`MapP` (0)		PNP map
`Mapr`		arc firmware registry routines
`McaC`	hal.dll	HAL MCA corrected Log
`McaD`	hal.dll	HAL MCA Driver Log
`McaK`	hal.dll	HAL MCA Kernel Log
`MCAM`		WDM mini driver for Intel USB camera
`McaP`	hal.dll	HAL MCA Log from previous boot
`McaT`	hal.dll	HAL MCA temporary Log
`MCDd`		OpenGL MCD driver (embedded in a display driver like s3mvirge.dll)
`MCDx`		OpenGL MCD server (mcdsrv32.dll) allocations
`Mdl`		Io, Mdls
`MdlP`		MDL per processor lookaside list pointers
`MePr`		In
`mkup`	mpsdrv.sys	MPSDRV upcall request
`Mm`	nt!mm	general Mm Allocations
`MmAc`	nt!mm	Mm access log buffers
`MmBk`	nt!mm	Mm banked sections
`MmCa`	nt!mm	Mm control areas for mapped files
`MmCd`	nt!mm	Mm fork clone descriptors
`MmCh`	nt!mm	Mm fork clone headers
`MmCi`	nt!mm	Mm control areas for images
`MmCl`	nt!mm	Mm fork clone prototype PTEs
`MmCm`	nt!mm	Calls made to MmAllocateContiguousMemory
`MmCr`	nt!mm	Mm fork clone roots
`MmCt`	nt!mm	Mm debug tracing
`MmCx`	nt!mm	info for dynamic section extension
`MmDb`	nt!mm	NtMapViewOfSection service
`Mmdl`	nt!mm	Mm Mdls for flushes
`MmDm`	nt!mm	deferred MmUnlock entries
`MmDT`	nt!mm	Mm debug
`MmEx`	nt!mm	Mm events
`MmHi`	nt!mm	Mm image entry
`MmHn`	nt!mm	Mm sessionwide address name string entry
`MmHt`	nt!mm	session space PTE data
`MmHv`	nt!mm	Mm sessionwide address entry
`MmIn`	nt!mm	Mm inpaged io structures
`MmLd`	nt!mm	Mm load module database
`MmLn`	nt!mm	temporary name buffer for driver loads
`MmMl`	nt!mm	physical memory range information
`MmPa`	nt!mm	pagefile space deletion slist entries
`MmPd`	nt!mm	Mm page table commitment bitmaps
`MmPg`	nt!mm	Mm page table pages at init time
`Mmpp`	nt!mm	Mm prototype PTEs for pool
`Mmpr`	nt!mm	Mm physical VAD roots
`Mmpv`	nt!mm	Physical view VAD info
`MmRl`	nt!mm	temporary readlists for file prefetch
`MmRp`	nt!mm	Mm repurpose logging
`MmRw`	nt!mm	Mm read write virtual memory buffers
`MmSb`	nt!mm	Mm subsections
`MmSc`	nt!mm	subsections used to map data files
`MmSd`	nt!mm	extended subsections used to map data files
`MmSe`	nt!mm	Mm secured VAD allocation
`MmSg`	nt!mm	Mm segments
`MmSi`	nt!mm	Control area security image stubs
`MmSm`	nt!mm	segments used to map data files
`MmSP`	nt!mm	SLIST entries for system PTE NB queues
`MmSt`	nt!mm	Mm section object prototype ptes
`MmSy`	nt!mm	Mm PTE and IO tracking logs
`MmVd`	nt!mm	Mm virtual address descriptors for mapped views
`MmVs`	nt!mm	Mm virtual address descriptors short form (private views)
`MmWe`	nt!mm	Work entries for writing out modified filesystem pages.
`MmWw`	nt!mm	Write watch VAD info
`Mmww`	nt!mm	Write watch bitmap VAD info
`Mmxx`	nt!mm	Mm temporary allocations
`Mn01`	monitor.sys	ACPI method evaluation output buffer
`Mn02`	monitor.sys	Unused
`Mn03`	monitor.sys	Raw E
`Mn04`	monitor.sys	Cached monitor ID WMI data block
`Mn05`	monitor.sys	Cached monitor basic display parameters WMI data block
`Mn06`	monitor.sys	Cached monitor analog video input parameters WMI data block
`Mn07`	monitor.sys	Cached monitor digitial video input parameters WMI data block
`Mn08`	monitor.sys	Cached monitor color characteristics WMI data block
`Mn09`	monitor.sys	Cached supported monitor source modes WMI data block
`Mn0A`	monitor.sys	Registry subkey info buffer
`Mn0B`	monitor.sys	Registry value buffer
`Mn0C`	monitor.sys	Cached supported monitor frequency ranges WMI data block (overrides from registry)
`Mn0D`	monitor.sys	Cached supported monitor frequency ranges WMI data block (from E
`Mn0E`	monitor.sys	Buffer for E
`Mn0F`	monitor.sys	Buffer for E
`MNFC`	msnfsflt.sys	NFS FS Filter, callback context
`MNFF`	msnfsflt.sys	NFS FS Filter, file context
`MNFf`	msnfsflt.sys	NFS FS Filter, filename buffer
`MNFI`	msnfsflt.sys	NFS FS Filter, instance context
`MNFi`	msnfsflt.sys	NFS FS Filter, instance name buffer
`MNFr`	msnfsflt.sys	NFS FS Filter, registry access buffer
`MNFS`	msnfsflt.sys	NFS FS Filter, stream context
`MNFs`	msnfsflt.sys	NFS FS Filter, general string buffer
`MNFT`	msnfsflt.sys	NFS FS Filter, thread array
`MNFv`	msnfsflt.sys	NFS FS Filter, volume name buffer
`MQAA`	mqac.sys	MSMQ driver, AVL allocations
`MQAB`	mqac.sys	MSMQ driver, CCursor allocations
`MQAC`	mqac.sys	MSMQ driver, generic allocations
`MQAD`	mqac.sys	MSMQ driver, CDistribution allocations
`MQAG`	mqac.sys	MSMQ driver, CGroup allocations
`MQAH`	mqac.sys	MSMQ driver, Heap allocations
`MQAP`	mqac.sys	MSMQ driver, CPacket allocations
`MQAQ`	mqac.sys	MSMQ driver, CQueue allocations
`MQAT`	mqac.sys	MSMQ driver, CTransaction allocations
`MRXx`		Client side caching for SMB
`Msdv`		WDM mini driver for IEEE 1394 DV Camera and VCR
`MsFC`		Mailslot root CCB, A client control block for the top level mailslot directory
`MsFc`		Mailslot CCB, Client control block. Each client with an opened mailslot has one of these
`MsFD`		Mailslot root DCB and its name buffer
`MsFd`		Mailslot data entry write buffer, This is writes buffered inside mailslots
`MsFf`		Mailslot FCB, File control block, Service side block for each created mailslot.
`MsFg`		Mailslot global resource
`MsFN`		Mailslot FCB name buffer, name for each created mailslot
`MsFn`		Mailslot temporary name buffer
`MsFr`		Mailslot read buffer, buffer created for pended reads issued.
`MsFt`		Mailslot query template, used for directory queries.
`MsFw`		Mailslot work context block, blocks create when we need to timeout reads.
`MST?`		MSTEE (mstee.sys)
`MSTa`		associated stream header
`MSTc`		filer connection
`MSTd`		data format
`MSTf`		filter instance
`MSTp`		pin instance
`MSTs`		stream header
`MsvC`	ksecdd.sys	Msv/Ntlm client package
`MuDn`	mup.sys	Device name
`MuFc`	mup.sys	File Context
`MuFn`	mup.sys	File name rewrite
`MuIc`	mup.sys	IRP Context
`MuMc`	mup.sys	Master context
`MuoC`		MOUSE_POOL_TAG Mouse Class Driver
`Mup`	mup.sys	Multiple UNC provider allocations, generic
`MuPe`	mup.sys	Known prefix entry
`MuPi`	mup.sys	Provider info
`MupI`	mup.sys	Windows Server 2003 and prior versions: DFS Irp Context allocation
`MuQc`	mup.sys	Query context
`MuSf`	mup.sys	Surrogate file info
`MuSi`	mup.sys	Surrogate info
`MuSr`	mup.sys	Surrogate IRP info
`Muta`		Mutant objects
`MuUn`	mup.sys	UNC provider
`MXF`		DirectMusic (MIDI Transform Filter)
`Nb??` (0)		NetBT allocations
`NBF`		general NBF allocations
`NBFa`		NBF address object
`NBFb`		NBF receive buffer
`NBFc`		NBF connection object
`NBFd`		NBF packet pool descriptor
`NBFe`		NBF bind & export names
`NBFf`		NBF address file object
`NBFg`		NBF registry path name
`NBFi`		NBF tdi connection info
`NBFk`		NBF loopback buffer
`NBFl`		NBF link object
`NBFn`		NBF netbios name
`NBFo`		NBF config data
`NBFp`		NBF packet
`NBFq`		NBF query buffer
`NBFr`		NBF request
`NBFs`		NBF provider stats
`NBFt`		NBF connection table
`NBFu`		NBF UI frame
`NBFw`		NBF work item
`NBI`		NwlnkNb transport
`NBqh`		Non
`NBS`		general NetBIOS allocations
`NBSa`		address block
`NBSc`		connection block
`NBSe`		EA buffer
`NBSf`		FCB
`NBSl`		LANA block
`NBSn`		copy of user NCB
`NBSr`		registry allocations
`NBSx`		XNS NETONE address (connect block)
`NBSy`		NetBIOS address (connect block)
`NBSz`		NetBIOS address (listen block)
`NCSt`		EXIFS NC
`ND`	ndis.sys	general NDIS allocations
`NDam`	ndis.sys	NdisAllocateMemory
`NDan`	ndis.sys	adapter name
`NDco`	ndis.sys	NDIS_TAG_CO
`NDd`	ndis.sys	NDIS_TAG_DBG
`NDdb`	ndis.sys	DMA block
`NDDl`	ndis.sys	NDIS_TAG_DBG_LOG
`NDdl`	ndis.sys	NDIS_TAG_DBG_L
`NDdp`	ndis.sys	NDIS_TAG_DBG_P
`NDds`	ndis.sys	NDIS_TAG_DBG_S
`NDdt`	ndis.sys	NDIS_TAG_DFRD_TMR
`NDfa`	ndis.sys	NDIS_TAG_FILTER_ADDR
`NDlb`	ndis.sys	lookahead buffer
`NDlp`	ndis.sys	NDIS_TAG_LOOP_PKT
`NDMb`	ndis.sys	NDIS_TAG_MAC_BLOCK
`NDmb`	ndis.sys	MAC block
`NDmr`	ndis.sys	map register entry array
`NDoa`	ndis.sys	NDIS_TAG_OID_ARRAY
`NDob`	ndis.sys	open block
`NDPa`	ndis.sys	Apple Talk
`NDPb`	ndis.sys	NBF
`NDpb`	ndis.sys	protocol block
`NDpf`	ndis.sys	NDIS_TAG_FILTER
`NDPi`	ndis.sys	NWLNKIPX
`NDpk`	ndis.sys	NDIS_TAG_PKT_PATTERN
`NDPn`	ndis.sys	NWLNKNB
`NDPp`	ndis.sys	Packet Scheduler.
`NDpp`	ndis.sys	packet pool
`NDPs`	ndis.sys	NWLNKSPX
`NDPt`	ndis.sys	TCPIP
`NDPw`	ndis.sys	WAN_PACKET_TAG
`NDPX`	ndis.sys	NDIS Proxy allocations
`NDrl`	ndis.sys	resource list
`NDrp`	ndis.sys	NDIS_TAG_REGISTRY_PATH
`NDrq`	ndis.sys	NDIS_TAG_Q_REQ
`NDsi`	ndis.sys	EISA slot information
`NDsm`	ndis.sys	Cached shared memory descriptor
`NDst`	ndis.sys	NDIS_TAG_STRING
`NDw0`	ndis.sys	NDIS_TAG_WMI_REG_INFO
`NDw1`	ndis.sys	NDIS_TAG_WMI_GUID_TO_OID
`NDw2`	ndis.sys	NDIS_TAG_WMI_OID_SUPPORTED_LIST
`NDw3`	ndis.sys	NDIS_TAG_WMI_EVENT_ITEM
`NDwi`	ndis.sys	NDIS_TAG_WORK_ITEM
`Nf??`	nfssvr.sys	NFS (Network File System) allocations
`NfR?`	nfsrdr.sys	NFS (Network File System) client re
`Nls`		Nls strings
`NlsK`	nt!ex	Nls data
`NmCc`	substvol.sys	(AllenPort Virtual Volume) name cache item
`Nmdd`		NetMeeting display driver miniport 1 MB block
`None`		call to ExAllocatePool
`Npf*`	npfs.sys	Npfs Allocations
`NpFC`	npfs.sys	ROOT_DCB CCB
`NpFc`	npfs.sys	CCB, client control block
`NpFD`	npfs.sys	DCB, directory block
`NpFg`	npfs.sys	Global storage
`NpFi`	npfs.sys	NPFS client info buffer.
`NpFn`	npfs.sys	Name block
`NpFq`	npfs.sys	Query template buffer used for directory query
`NpFr`	npfs.sys	DATA_ENTRY records (read/write buffers)
`NpFs`	npfs.sys	Client security context
`NpFW`	npfs.sys	Write block
`NpFw`	npfs.sys	Write block
`NS??`		Netware server allocations
`Ntf0`	ntfs.sys	general pool allocation
`Ntf9`	ntfs.sys	Large Temporary Buffer
`NtF?`	ntfs.sys	NTFS tags based on source module
`Ntf?`	ntfs.sys	NTFS Specific allocation tags
`NtFA`	ntfs.sys	AttrSup.c
`NtFa`	ntfs.sys	AllocSup.c
`NtFB`	ntfs.sys	BitmpSup.c
`NtFC`	ntfs.sys	Create.c
`NtfC`	ntfs.sys	CCB
`Ntfc`	ntfs.sys	CCB_DATA
`NtFD`	ntfs.sys	DevioSup.c
`NtFd`	ntfs.sys	DirCtrl.c
`NtfD`	ntfs.sys	DEALLOCATED_RECORDS
`NtFE`	ntfs.sys	Ea.c
`NtfE`	ntfs.sys	INDEX_CONTEXT
`NtFF`	ntfs.sys	FileInfo.c
`NtFf`	ntfs.sys	FsCtrl.c
`NtfF`	ntfs.sys	FCB_INDEX
`Ntff`	ntfs.sys	FCB_DATA
`NtFH`	ntfs.sys	SelfHeal.c
`NtFI`	ntfs.sys	IndexSup.c
`NtfI`	ntfs.sys	NTFS_IO_CONTEXT
`Ntfi`	ntfs.sys	IRP_CONTEXT
`NtfK`	ntfs.sys	KEVENT
`Ntfk`	ntfs.sys	FILE_LOCK
`NtFL`	ntfs.sys	LogSup.c
`Ntfl`	ntfs.sys	LCB
`NtFM`	ntfs.sys	McbSup.c
`NtfM`	ntfs.sys	NTFS_MCB_ENTRY
`Ntfm`	ntfs.sys	NTFS_MCB_ARRAY
`NtFN`	ntfs.sys	NtfsData.c
`NtfN`	ntfs.sys	NUKEM
`Ntfn`	ntfs.sys	SCB_NONPAGED
`NtFO`	ntfs.sys	ObjIdSup.c
`Ntfo`	ntfs.sys	SCB_INDEX normalized named buffer
`NtFQ`	ntfs.sys	QuotaSup.c
`NtfQ`	ntfs.sys	QUOTA_CONTROL_BLOCK
`Ntfq`	ntfs.sys	General Allocation with Quota
`NtFR`	ntfs.sys	RestrSup.c
`NtfR`	ntfs.sys	READ_AHEAD_THREAD
`Ntfr`	ntfs.sys	ERESOURCE
`NtFS`	ntfs.sys	SecurSup.c
`NtFs`	ntfs.sys	StrucSup.c
`NtfS`	ntfs.sys	SCB_INDEX
`Ntfs`	ntfs.sys	SCB_DATA
`NtfT`	ntfs.sys	SCB_SNAPSHOT
`Ntft`	ntfs.sys	SCB (Prerestart)
`NtFU`	ntfs.sys	usnsup.c
`NtFV`	ntfs.sys	VerfySup.c
`NtFv`	ntfs.sys	ViewSup.c
`NtfV`	ntfs.sys	VPB
`Ntfv`	ntfs.sys	COMPRESSION_SYNC
`NtFW`	ntfs.sys	Write.c
`Ntfw`	ntfs.sys	Workspace
`Ntfx`	ntfs.sys	General Allocation
`NTID`	HP Team Network Driver (cpqteam.sys)	Network Driver 8.55 (Memory Leak) - Confirmed
`NV`		(nVidia video driver) Resource manager data
`NvLA`		(nVidia video driver) Adapter data
`NvLa`		(nVidia video driver) Allocation data
`NvLC`		(nVidia video driver) Channel data
`NvLc`		(nVidia video driver) Class data
`NvLD`		(nVidia video driver) Device data
`NvLd`		(nVidia video driver) DMA data
`NvLE`		(nVidia video driver) Event data
`NvLH`		(nVidia video driver) Generic data
`NvLm`		(nVidia video driver) Mode data
`NvLP`		(nVidia video driver) Profile data
`NvLp`		(nVidia video driver) Pusher data
`NvLR`		(nVidia video driver) Registry data
`NvLr`		(nVidia video driver) Resource data
`NvLS`		(nVidia video driver) Statistics data
`NvLs`		(nVidia video driver) Semaphore data
`NvLT`		(nVidia video driver) Context data
`Nwcs`		Client Services for NetWare
`NwFw`		ntos difwd
`ObCI` (0)	nt!ob	object creation lookaside list
`ObCi`	nt!ob	captured information for ObCreateObject
`ObDi`	nt!ob	object directory
`ObDm`	nt!ob	object device map
`Obeb`	nt!ob	object tables extra bit tables via EX handle.c
`ObHd`	nt!ob	object handle count data base
`ObjT`	nt!ob	object type objects
`ObNM`	nt!ob	name buffer per processor lookaside pointers
`ObNm`	nt!ob	object names
`ObRt`	nt!ob	object reference stack tracing
`ObSc`	nt!ob	Object security descriptor cache block
`ObSq`	nt!ob	object security descriptors (query)
`ObSt`	nt!ob	Object Manager temporary storage
`Obtb`	nt!ob	object tables via EX handle.c
`ObTR`	nt!ob	object table ERESOURCEs
`ObZn`	nt!ob	object zone
`OCCB`	RepliStor.sys	RepliStor File System Mini Filter Driver
`OCMD`	RepliStor.sys	RepliStor File System Mini Filter Driver
`OCMX`	RepliStor.sys	RepliStor File System Mini Filter Driver
`OHCI`		Open Host Controller Interface for USB
`ohci`		1394 OHCI host controller driver
`OvfL`		EXIFS FCBOVF List
`Ovfl`		The internal pool tag table has overflowed
`p2??` (0)	perm2dll.dll	Permedia2 display driver
`p2cx`	perm2dll.dll	Permedia2 display driver
`p2d3`	perm2dll.dll	Permedia2 display driver
`p2d6`	perm2dll.dll	Permedia2 display driver
`p2de`	perm2dll.dll	Permedia2 display driver
`p2ds`	perm2dll.dll	Permedia2 display driver
`p2dt`	perm2dll.dll	Permedia2 display driver
`p2en`	perm2dll.dll	Permedia2 display driver
`p2fi`	perm2dll.dll	Permedia2 display driver
`p2he`	perm2dll.dll	Permedia2 display driver
`p2hw`	perm2dll.dll	Permedia2 display driver
`p2pa`	perm2dll.dll	Permedia2 display driver
`p2pe`	perm2dll.dll	Permedia2 display driver
`p2su`	perm2dll.dll	Permedia2 display driver
`p2tx`	perm2dll.dll	Permedia2 display driver
`P3D?`	perm3dd.dll	Permedia3 display driver
`P3G?`	perm3dd.dll	Permedia3 display driver
`PaeD`		PAE top level directory allocation blocks
`ParC`		Parallel class driver
`ParL`		Parallel link driver
`ParP`		Parallel port driver
`ParV`		ParVdm driver for vdm<
`PcCi`		WDM audio port class adapter device object stuff
`PcCr`		WDM audio stuff
`Pcdb`		Pcmcia bus enumerator, Databook controller specific structures
`PcDi`		WDM audio stuff
`PcDm`		DirectMusic MXF objects (WDM audio)
`PcFM`		WDM audio FM synthesizer
`PcFp`		WDM audio stuff
`PciB`	pci.sys	PnP pci bus enumerator
`PcIc`		WDM audio stuff
`Pcic`		Pcmcia bus enumerator, PCIC/Cardbus controller specific structures
`PcIl`		WDM audio stuff
`Pcmc`	pcmcia.sys	Pcmcia bus enumerator, general structures
`PcNw`		WDM audio stuff
`PcPc`		WDM audio stuff
`PcPr`		WDM audio stuff
`PcSl`		WDM audio stuff
`PcSt`		WDM audio stuff
`PcSX`		WDM audio stuff
`PcSx`		WDM audio stuff
`PcUs`		WDM audio stuff
`PDss`	nt!po	Po device system state
`Pf??`	nt!pf	Pf Allocations
`PfAL`	nt!pf	Pf Application launch event data
`PfAS`	nt!pf	Pf Prefetch support array
`PfDq`	nt!pf	Pf Directory query buffers
`PfED`	nt!pf	Pf Generic event data
`PfEL`	nt!pf	Pf Event logging buffers
`PfET`	nt!pf	Pf Entry info tables
`PfFH`	nt!pf	Pf RpContext FileKeyHash buckets
`PfFK`	nt!pf	Pf RpContext FileKeyHashEntry
`PfLB`	nt!pf	Pf Log buffers
`PfMP`	nt!pf	Pf Prefetch metadata buffers
`PfNL`	nt!pf	Pf Name logging buffers
`PfOB`	nt!pf	Pf Oplock buffers
`PfPB`	nt!pf	Pf Pfn query buffers
`PfRL`	nt!pf	Pf Prefetch read list
`PfRQ`	nt!pf	Pf Prefetch request buffers
`PfSA`	nt!pf	Pf Prefetch support array
`PfTD`	nt!pf	Pf Trace Dump
`PfTt`	nt!pf	Pf Translation tables
`PfVA`	nt!pf	Pf VA prefetching buffers
`PfVH`	nt!pf	Pf Prefetch volume handles
`Pgm?`		Pgm (Pragmatic General Multicast) protocol: RMCast.sys
`Plcl`		Cache aware pushlock entry. One per processor
`Plcp`		Cache aware pushlock list (array of puchlock addresses)
`PmpA`	portmap.sys	Portmap address list
`PmpC`	portmap.sys	Portmap device context
`PmpM`	portmap.sys	Portmap mapping
`PmpR`	portmap.sys	Portmap RPCB
`PNCH`		Power Notify Channel
`PNCL`		Power Notify channel list
`PNDP`		Power Abort Dpc Routine
`PNI`		Power Notify Instance
`Pnp0`	nt!pnp	PNPMGR rebalance resource request table
`Pnp1`	nt!pnp	PNPMGR IRP completion context
`Pnp2`	nt!pnp	PNPMGR device action request
`Pnp3`	nt!pnp	PNPMGR dock serial numbers
`Pnp4`	nt!pnp	PNPMGR dock state
`Pnp5`	nt!pnp	PNPMGR assign resources context
`Pnp6`	nt!pnp	PNPMGR resource request
`Pnp7`	nt!pnp	PNPMGR deferred notify entry
`Pnp8`	nt!pnp	PNPMGR async target device change notify
`Pnp9`	nt!pnp	PNPMGR HW profile notify
`PnpA`	nt!pnp	PNPMGR HW profile event
`PnPb`	nt!pnp	PnP BIOS resource manipulation
`PnpB`	nt!pnp	PNPMGR setup notify
`PnpC`	nt!pnp	PNPMGR target device notify
`PnpD`	nt!pnp	PNPMGR device class notify
`PnpE`	nt!pnp	PNPMGR veto name
`PnpF`	nt!pnp	PNPMGR eject data
`PnpG`	nt!pnp	PNPMGR generic
`PnpH`	nt!pnp	PNPMGR service name
`PnpI`	nt!pnp	PNPMGR instance path
`PooL`		Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures
`Pool`		Pool tables, etc.
`Port`		Port objects
`PoSL`		Power shutdown event list
`POWI`	nt!po	Power Work Item (executive worker thread work item entry)
`Ppcd`	nt!pnp	PnP critical device database
`Ppcr`	nt!pnp	plug
`Ppdd`	nt!pnp	new Plug
`Ppde`	nt!pnp	routines to perform device removal
`PpEB`	nt!pnp	PNP_POOL_EVENT_BUFFER
`PpEE`	nt!pnp	PNP_DEVICE_EVENT_ENTRY_TAG
`Ppei`	nt!pnp	Eisa related code
`PpEL`	nt!pnp	PNP_DEVICE_EVENT_LIST_TAG
`Ppen`	nt!pnp	routines to perform device enumeration
`Ppin`	nt!pnp	plug
`Ppio`	nt!pnp	plug
`PpLg`	nt!pnp	PnP last good.
`PPMd`		Processor Drivers (Processor Power Management).
`PPMi`	nt!po	Processor Power Manager Idle States
`PPMp`	nt!po	Processor Power Manager Perf States
`PPMw`	nt!po	Processor Power Manager WMI Interface
`Ppre`	nt!pnp	resource allocation and translation
`Pprl`	nt!pnp	routines to manipulate relations list
`Ppsu`	nt!pnp	plug
`PPT0`		PPTP_TDIADDR_TAG
`PPT1`		PPTP_TDICONN_TAG
`PPT2`		PPTP_CONNINFO_TAG
`PPT3`		PPTP_ADDRINFO_TAG
`PPT4`		PPTP_TIMEOUT_TAG
`PPT5`		PPTP_TIMER_TAG
`PPT6`		PPTP_TDICOTS_TAG
`PPT7`		PPTP_WRKQUEUE_TAG
`PPT8`		PPTP_SEND_CTRLDATA_TAG
`PPT9`		PPTP_SEND_ACKDATA_TAG
`PPTa`		PPTP_SEND_DGRAMDESC_TAG
`PPTb`		PPTP_TDICLTS_TAG
`PPTc`		PPTP_RECV_CTRLDESC_TAG
`PPTd`		PPTP_RECV_CTRLDATA_TAG
`PPTe`		PPTP_RECV_DGRAMDESC_TAG
`PPTf`		PPTP_RECV_DGRAMDATA_TAG
`PPTg`		PPTP_RECVDESC_TAG
`PpTg`	mpsdrv.sys	MPSDRV PPTP GRE analyzer
`PPTh`		PPTP_ENGINE_TAG
`PPTi`		PPTP_RECVDATA_TAG
`PPTP`		PPTP_MEMORYPOOL_TAG
`PpTt`	mpsdrv.sys	MPSDRV PPTP TCP analyzer
`PpUB`	nt!pnp	PNP_USER_BLOCK_TAG
`PpWI`	nt!pnp	PNP_DEVICE_WORK_ITEM_TAG
`Prcr`	processr.sys	Processr driver allocations
`PRF?`	nt!wdi	Performance Allocations
`PRFd`	nt!wdi	Performance Diagnostics Structures
`Proc`	nt!ps	Process objects
`Prof`		Profile objects
`Ps`	nt!ps	general ps allocations
`PSAC`	pspactld.sys	Windows Share access control tool.
`PsAp`	nt!ps	Process APC queued by user mode process
`Psap`	nt!ps	Block used to hold a user mode APC while its queued to a thread
`PSC0`		NDIS Request
`PSC1`		GPC Client Vc
`PSC2`		WanLink
`PSC3`		Miscellaneous allocations
`PSC4`		WMI
`PSC?`		Packet Scheduler (PSCHED) Tags
`PSCa`		Adapter
`PsCa`	nt!ps	APC queued at thread create time.
`PSCb`		CallParameters
`PSCc`		PipeContext
`PSCd`		FlowContext
`PSCe`		ClassMapContext
`PSCf`		Adapter Profile
`PSCg`		Component
`PsCr`	nt!ps	Working set change record (temporary allocation)
`PSE3`	pse36.sys	Physical Size Extension driver
`PsEx`	nt!ps	Process exit APC
`PsFn`	nt!ps	Captured image file name buffer (temporary allocation)
`PsHl`	nt!ps	Captured list of handles to inherit in child process (temporary allocation)
`PsIm`	nt!ps	Thread impersonation (PS_IMPERSONATE_INFORMATION, pre
`PsJa`	nt!ps	Job access control state
`Psjb`	nt!ps	Job set array (temporary allocation)
`PsLd`	nt!ps	Process LDT information blocks
`PsPb`	nt!ps	Captured process parameter block (temporary allocation)
`PsQb`	nt!ps	Process quota block
`PsRl`	nt!ps	Captured memory reserve list (temporary allocation)
`PsSb`	nt!ps	Initial process parameter block (temporary allocation)
`PsSd`	nt!ps	Augmented thread security descriptor (temporary allocation)
`PSTA`	nt!po	Po registered system state
`Psta`	nt!ps	Power management system state
`Pstb`	nt!ps	Process tables via EX handle.c
`PsTf`	nt!ps	Job object token filter
`PsTp`	nt!ps	Thread termination port block
`PsWs`	nt!ps	Process working set watch array
`PSwt`	nt!po	Power switch structure
`PX1`		ndis ProviderEventLookaside
`Qnam` (0)		EXIFS Query Name
`Qp??`		Generic Packet Classifier (MSGPC)
`Qpcb`		ClassificationBlock
`Qpcd`		CfInfoData
`Qpcf`		ClassificationFamily
`Qpci`		CfInfo
`Qpct`		Client blocks
`Qpdg`		Debug
`Qpfd`		FragmentDb
`Qphf`		HandleFactory
`Qppa`		Pattern blocks
`Qppd`		GenPatternDb
`Qpph`		PathHash
`Qppi`		Pending Irp structures
`Qppn`		Queued Notifications
`Qppt`		Protocol
`Qprz`		Rhizome
`QuU2`	mpsdrv.sys	MPSDRV upcall response
`R300` (0)		ATI video driver
`R600`	ati2mtag.sys	ATI Radeon WindowsNT Miniport Driver
`RB??`		RedBook Filter Driver, static allocations
`rb??`		RedBook Filter Driver, dynamic allocations
`rbBu`		RedBook
`RBEv`		RedBook
`rbIp`		RedBook
`rbIr`		RedBook
`rbMd`		RedBook
`rbMp`		RedBook
`rbRc`		RedBook
`RBRg`		RedBook
`RBRl`		RedBook
`rbRx`		RedBook
`rbSc`		RedBook
`RBSe`		RedBook
`rbSx`		RedBook
`rbTo`		RedBook
`RBWa`		RedBook
`Rcp?`	sacdrv.sys	SAC Driver (Headless)
`RcpA`	sacdrv.sys	Internal memory mgr alloc block
`RcpI`	sacdrv.sys	Internal memory mgr initial heap block
`RcpS`	sacdrv.sys	Security related block
`ReEv`		Resource Event
`RefT`		Bluetooth reference tracking
`ReSe`		Resource Semaphore
`Reso`	nt!tm	KTM Transactional ResourceManager
`ReTa`		Resource Extended Table
`Rf??`		Bluetooth RFCOMM TDI driver
`RfAD`	rfcomm.sys	RFCOMM Address
`RfBB`	rfcomm.sys	RFCOMM BRB
`RfBT`	rfcomm.sys	RFCOMM (bthport)
`RfCB`	rfcomm.sys	RCOMMM
`RfCH`	rfcomm.sys	RFCOMM channel
`RfCN`	rfcomm.sys	RFCOMM connect
`RfDA`	rfcomm.sys	RFCOMM data
`RfFR`	rfcomm.sys	RFCOMM frame
`RfPP`	rfcomm.sys	RFCOMM pnp
`RfRX`	rfcomm.sys	RFCOMM receive
`RfWR`	rfcomm.sys	RFCOMM worker
`RKRW`	mpsdrv.sys	MPSDRV work item
`RpcL`	msrpc.sys	debugging log data
`Rpcl`	msrpc.sys	MSRpc memory logging
`RpcM`	msrpc.sys	all msrpc.sys allocations not covered elsewhere
`Rpcm`	msrpc.sys	MSRpc memory allocations
`Rpcr`	msrpc.sys	MSRpc resources
`Rpcs`	msrpc.sys	Memory shared b/n MSRpc and caller
`RPrt`	rstorprt.sys	Remote Storage Port Driver
`Rqrv`		Registry query buffer
`RRle`		RTL_RANGE_LIST_ENTRY_TAG
`RRlm`		RTL_RANGE_LIST_MISC_TAG
`RS??`		Remote Storage
`RSER`		Error log data
`RSFN`		File Name
`RSFO`		File Obj queue
`RSFS`		Recall Queue
`RSIO`		Ioctl Queue
`RSLT`		Long term data
`RSQI`		Queue info
`RSSE`		Security info
`RSVO`		Validate Queue
`RSWQ`		Work Queue
`RTLF`	mpsdrv.sys	MPSDRV filter
`RtlT`	nt!rtl	Temporary RTL allocation
`RtPi`		Temp allocation for product type key
`RWan`	rawwan.sys	Raw WAN driver
`RX00`		ATI video driver
`Rx??`		Rdr2 rdbss.sys stuff
`RxBm`		buffering manager
`RxCa`		connection engine address
`RxCc`		connection engine connection
`RxCd`		connection engine TDI
`RxCt`		connection engine transport
`RxCv`		connection engine VC
`RxCx`		connection engine misc. (special build only)
`RxDc`		querydirectory pattern (special build only)
`RxFc`		FCB
`RxFx`		Fobx
`RxIr`		RxContext (IrpContext)
`RxMs`		misc.
`RxMx`		minirdr dispatch table
`RxNc`		NameCache (not currently used)
`RxNf`		nonpaged FCB
`RxNr`		NetRoot
`RxSc`		SrvCall
`RxSo`		SrvOpen
`RxSp`		srvcall calldown params (special build only)
`RxTm`		timer context (special build only)
`RxVn`		VNetRoot
`RxVp`		vnetroot calldown params (special build only)
`RxWq`		work queue
`S3` (0)		S3 video driver
`SBad`		bad block simulator
`SbAp`	SandBox.sys	Agnitum Outpost Firewall's Host Protection Component
`sbp2`		Sbp2 1394 storage port driver
`SbVo`	substvol.sys	(AllenPort Virtual Volume) default tag
`SC??`		Smart card driver tags
`Sc??`		Mass storage driver tags
`SCB3`		Bull SmarTlp PnP
`SCB8`		Bull CP8 Transac serial reader
`ScB?`	classpnp.sys	ClassPnP misc allocations
`ScC?`		CdRom
`ScCE`		device control synch event
`ScCG`		disk geometry buffer
`ScCH`		hitachi error buffer
`ScCI`		sense info buffers
`ScCM`		mode data buffer
`ScCP`		read capacity buffer
`ScCp`		play active checks
`ScCQ`		read sub q buffer
`ScCR`		raw mode read buffer
`ScCS`		srb allocation
`ScCT`		read toc buffer
`ScCt`		toshiba error buffer
`ScCU`		update capacity path
`ScCV`		volume control buffer
`ScCv`		volume control buffer
`ScD`		generic tag
`ScD?`		Disk
`ScDA`		Info Exceptions
`ScDa`		SMART
`ScDb`	classpnp.sys	ClassPnP debug globals buffer
`ScDC`		disable cache paths
`ScDc`		disk allocated completion c
`ScDG`		disk geometry buffer
`ScDg`		update disk geometry paths
`ScDI`		sense info buffers
`ScDM`		mbr checksum code
`ScDN`		disk name code
`ScDP`		read capacity buffer
`ScDp`		disk partition lists
`ScDS`		srb allocation
`ScDs`		start device paths
`ScDU`		update capacity path
`ScDW`		work
`ScF?`		FtDisk
`ScFt`		FtDisk allocations
`ScIO`	classpnp.sys	ClassPnP device control
`SCl0`		Litronic 220
`ScL?`	classpnp.sys	Classpnp
`ScLA`	classpnp.sys	allocation to check for autorun disable
`SCLb`		Smart card driver library
`ScLc`	classpnp.sys	Cache filters
`ScLF`	classpnp.sys	File Object Extension
`ScLf`	classpnp.sys	Fault prediction
`ScLM`	classpnp.sys	Media Change Detection
`ScLm`	classpnp.sys	Mount
`ScLq`	classpnp.sys	Release queue
`ScLW`	classpnp.sys	Power
`ScLw`	classpnp.sys	WMI
`ScMC`		medium changer allocations
`ScNo`	classpnp.sys	ClassPnP notification
`ScP?`		Scsiport
`ScPA`		Access Ranges
`ScPa`		Hold registry data
`ScPB`		Queuetag BitMap
`ScPb`		Get Bus Dat Holder
`ScPC`		reset bus code
`ScPc`		Fake common buffer
`ScPD`		SRB_DATA allocations
`ScPd`		Pnp id strings
`ScPE`		Scatter gather lists
`ScPG`		Global memory
`ScPh`		HwDevice Ext
`ScPI`		Init data chain
`ScPi`		Sense Info
`ScPL`		scatter gather lists
`ScPl`		remove lock tracking
`ScPM`		scatter gather lists
`ScPm`		address mapping lists
`ScPp`		device & adapter enable
`ScpP`		scsi PortConfig copies
`ScPQ`		request sense
`ScPq`		inquiry data
`ScPr`		resource list copy
`ScPS`		registry allocations
`ScPT`		interface mapping
`ScPt`		legacy request rerouting
`ScPu`		device relation structs
`ScPV`		Device map allocations
`ScPv`		KEVENT
`ScPW`		Wmi Requests
`ScPw`		Wmi Events
`ScPx`		Report Luns
`ScPY`		Report Targets
`ScPZ`		Device name buffer
`ScR?`		Partition Manager
`ScRi`		IOCTL buffer
`ScRp`		Partition entry
`ScRr`		Remove lock
`ScRt`		Table entry
`ScRV`		Volume entry
`ScRv`		Dependant volume relations lists
`ScRw`		Power mgmt private work item
`Scs$`		Tag for pnp class driver's SRB lookaside list
`SCS4`		SCM Microsystems pcmcia reader
`ScsC`		non
`ScsD`		non
`ScsH`		non
`ScsI`		non
`ScsL`		non
`ScsP`		non
`ScUn`		Default Tag for pnp class driver allocations
`ScV?`		Dvd functionality in cdrom.sys
`ScVK`		write buffer for DVD keys
`ScVk`		read buffer for DVD keys
`ScVS`		buffer for reads of DVD on
`Sdba`		Application compatibility Sdb* allocations
`SdCc`		ObsSecurityDescriptorCache / SECURITY_DESCRIPTOR_CACHE_ENTRIES
`Sdp?`		Bluetooth SDP functionality in BTHPORT.sys
`SdpC`	bthport.sys	Bluetooth SDP client connection
`SdpD`	bthport.sys	Bluetooth SDP database
`SdpI`	bthport.sys	Bluetooth port driver (SDP)
`Se`	nt!se	General security allocations
`SeAc`	nt!se	Security ACL
`SeAi`	nt!se	Security Audit Work Item
`SeAp`	nt!se	Security Audit Parameter Record
`SeCL`	nt!se	Security CONTEXT_TAG
`Sect`		Section objects
`SeDb`	nt!se	Temp directory query buffer to delete logon session symbolic links.
`SeFS`	nt!se	SEP_FILE_SYSTEM_NOTIFY_CONTEXT
`SeHa`	nt!se	Temp directory query buffer to delete logon session symbolic links.
`SeLS`	nt!se	Security Logon Session tracking array
`SeLs`	nt!se	Security Logon Session
`SeLu`	nt!se	Security LUID and Attributes array
`SeLw`	nt!se	Security LSA Work Item
`Sema`		Semaphore objects
`Senm`		Serenum (RS
`SeOn`	nt!se	Security Captured Object Name information
`SeOt`	nt!se	Captured object type array. Used by access check code
`SePa`	nt!se	Process audit image names and captured polity structures
`SePh`	nt!se	Dummy image page hash structure. Used when CI is disabled.
`SePr`	nt!se	Security Privilege Set
`SeSa`	nt!se	Security SID and Attributes
`SeSc`	nt!se	Captured Security Descriptor
`SeSd`	nt!se	Security Descriptor
`SeSi`	nt!se	Security SID
`SeTa`	nt!se	Security Temporary Array
`SeTd`	nt!se	Security Token dynamic part
`SeTI`	ksecdd.sys	Security TargetInfo
`SeTn`	nt!se	Security Captured Type Name information
`Setp`		SETUPDD SpMemAlloc calls
`SeUs`	nt!se	Security Captured Unicode string
`sidg`		GDI spooler events
`SIfs`		Default tag for user's of ntsrv.h
`SimB`		Simbad (bad sector simulation driver) allocations
`Sis`		Single Instance Store (ddsisfilter)
`SisB`		SIS per file object break event
`SisC`		SIS common store file object
`SisF`		SIS per file object
`SisL`		SIS per link object
`SisS`		SIS SCB
`Sm??`		rdr2 smb mini
`SmAd`		session setup/admin exchange
`SmCe`		smbmini connection engine
`SmDc`		dir query buffer (special build only)
`SmDO`		deferred open context (special build only)
`SmEc`		echo buffer (special build only)
`SmFc`		fsctl structures (special build only)
`SmKs`		Kerberos blob (special build only)
`SmMa`		mid atlas (special build only)
`SmMm`		smbmini managed datastructures
`SmMs`		misc.
`SmMt`		mailslot buffer (special build only)
`SmNr`		NetRoot (special build only)
`SmPi`		pipeinfo buffer (special build only)
`SmQP`		params for directory query transact (special build only)
`SmRb`		remote boot
`SmRw`		read/write path
`SmRx`		minirdr generated RxContext (special build only)
`SmSe`		Session (special build only)
`SmSr`		Server (special build only)
`SmTp`		server transport tag
`SmTr`		transact exchange
`SmVc`		smbmini connectionengine VC (special build only)
`SmVr`		VNetroot (special build only)
`SNBX`	SandBox.sys	Agnitum Outpost Firewall's Host Protection Component
`SpDN`	iastor.sys	Intel(r) Rapid Storage Technology driver
`SPX`		Nwlnkspx transport
`SQOS`		Security quality of service in IO
`Sr??`	sr.sys	System Restore file system filter driver
`SrCo`	sr.sys	SR's control object
`SrDB`	sr.sys	Debug information for lookup blob
`SrDL`	sr.sys	Device list
`SRdm`	scsirdma.sys	Infiniband SRP driver
`SrFE`	sr.sys	File information buffer
`SrFN`	sr.sys	File name
`SrHB`	sr.sys	Hash bucket
`SrHH`	sr.sys	Hash header
`SrHK`	sr.sys	Hash key
`SrLB`	sr.sys	Log buffer
`SrLC`	sr.sys	Logging context
`SrLE`	sr.sys	Log entry
`SrLT`	sr.sys	Lookup blob
`SrMP`	sr.sys	Mount point information
`SrOI`	sr.sys	Overwrite information
`SrPC`	sr.sys	Persistant configuration information
`SrRB`	sr.sys	Rename buffer
`SrRG`	sr.sys	Logger context
`SrRH`	sr.sys	Reparse data size
`SrRR`	sr.sys	Registry information
`SrSC`	sr.sys	Stream contexts
`SrSD`	sr.sys	Security data information
`SrST`	sr.sys	Stream data information
`SrTI`	sr.sys	Directory delete information
`SrWI`	sr.sys	Work queue item
`SslC`	ksecdd.sys	SSL kernel mode client allocations
`ST*`		New MMC compliant storage drivers
`Stac`		Stack Trace Database
`STli`		Alter's NT kernel string manipulation library
`Strg`		Dynamic Translated strings
`Strm`		Streams and streams transports allocations
`SW??`		Software Bus Enumerator
`SWbi`		bus ID
`SWbr`		bus reference
`SWda`		POOLTAG_DEVICE_ASSOCIATION
`SWdn`		device name
`SWdr`		POOLTAG_DEVICE_DRIVER_REGISTRY
`SWfd`		POOLTAG_DEVICE_FDOEXTENSION
`SWid`		device ID
`SWii`		instance ID
`SWip`		POOLTAG_DEVICE_INTERFACEPATH
`SWki`		key information
`SwMi`		SWMidi KS filter (WDM Audio)
`SWpd`		POOLTAG_DEVICE_PDOEXTENSION
`SWre`		relations
`SWrp`		reparse string
`SWrs`		reference string
`Symb`		Symbolic link objects
`Symt`		Symbolic link target strings
`SYPK`	syspart.lib	Kernel mode system partition detection allocations
`SYSA`		Sysaudio (wdm audio)
`TAPI` (0)		ntos dis distapi
`TC??`	TCP	TCP/IP network protocol
`TCh?`		TCP/IP header pools
`TCPC`		TCP connection pool
`TCPr`		TCP request pool
`TCPT`		TCB pool
`TCPY`		SYN
`TDIc`		TDI resource
`TDId`		TDI resource
`TDIe`		TDI resource
`TDIf`		TDI resource
`TDIg`		TDI resource
`TDIk`		TDI resource
`TDIu`		TDI resource
`TDIv`		TDI resource
`thdd`		DirectDraw/3D handle manager table
`Thre`	nt!ps	Thread objects
`Thrm`		Thermal zone structure
`Time`	nt!ke	Timer objects
`TmDn`	nt!tm	Tm Dynamic Name
`TmLo`	nt!tm	Tm Log Entries
`TmNo`	nt!tm	Tm Notification
`TmPa`	nt!tm	Tm Propagate Argument
`TmPb`	nt!tm	Tm Propagation Buffer
`TmPe`	nt!tm	Tm Enlistment Pointers
`TmPi`	nt!tm	Tm Protocol Information
`TmPo`	nt!tm	Tm Propagation Output
`TmPp`	nt!tm	Tm Protocol Pointers
`TmPr`	nt!tm	Tm Protocol
`TmPx`	nt!tm	Tm Protocol Array
`TmRi`	nt!tm	Tm Recovery Information
`TmRq`	nt!tm	Tm Propagation Request
`Toke`	nt!se	Token objects
`TpWc`	nt!ex	Threadpool minipacket context
`TpWo`	nt!ex	Threadpool worker factory objects
`Tran`		EXIFS Translate
`TSBV`		WDM mini driver for Toshiba 750 capture
`TSch`	rdpwd.sys	RDPWD
`TSdd`	rdpdd.sys	RDPDD
`TSic`	termdd.sys	Terminal Services
`TSlc`	rdpwd.sys	RDPWD
`TSmc`		PDMCS
`Tspk`	ksecdd.sys	TS Package kernel mode client allocations
`TSq`		Terminal Services
`TSrp`	termdd.sys	Terminal Services
`TSwd`	rdpwd.sys	RDPWD
`TTFC`		Font file cache
`Ttfd`		TrueType Font driver
`Tun4`		Tunnel cache allocation for long file name
`TunK`		Tunnel cache temporary key value
`TunL`		Tunnel cache lookaside
`TunP`		Tunnel cache oddsized pool
`Txcl`	ntfs.sys	TXF_CLR_RESERVATION_CHUNK
`Txdl`	ntfs.sys	TXF_DELETED_LINK
`Txdr`	ntfs.sys	TXF_DEFAULT_READER_SECTION
`Txfc`	ntfs.sys	TXF_FCB
`Txfe`	ntfs.sys	TXF_FCB_EXTENSION
`Txfi`	ntfs.sys	TXF_FCB_INFO
`Txfl`	ntfs.sys	TXF_FCB_CLEANUP
`Txfo`	ntfs.sys	TXF_FO
`Txfq`	ntfs.sys	Txf quota block
`Txgd`	ntfs.sys	TxfData global structure
`Txis`	ntfs.sys	TXF_ISO_SNAPSHOT
`Txlf`	ntfs.sys	TXF_FCB (large)
`Txls`	ntfs.sys	TXF_CANCEL_LSN
`Txre`	ntfs.sys	TXF_TOPS_RANGE_ENTRY
`Txsc`	ntfs.sys	TXF_SCB
`Txsp`	ntfs.sys	TXF_SCB_PTR
`Txtc`	ntfs.sys	TXF_TRANS_CANCEL_LIST
`Txtr`	ntfs.sys	TXF_TRANS (Txf transaction context)
`Txvc`	ntfs.sys	TXF_VCB
`Txvd`	ntfs.sys	TXF_VSCB_TO_DEREF
`Txvf`	ntfs.sys	TXF_VSCB_FILE_SIZES
`Txvl`	ntfs.sys	TXF_VSCB
`Type`		Type objects
`Uata` (0)	uniata.sys	Alter's UniATA driver allocations
`Uc??`	http.sys	i.e., the case of the leading "Ul" or "Uc" has been reversed.
`Ucac`	http.sys	Auth Cache Pool
`UCAM`		USB digital camera library
`UcCO`	http.sys	Client Connection
`Ucmp`	http.sys	Multipart String Buffer
`Ucre`	http.sys	Receive Response
`Ucrp`	http.sys	Response App Buffer
`Ucrq`	http.sys	Request Pool
`UcSc`	http.sys	Common Server Information
`UcSN`	http.sys	Server name
`UcSP`	http.sys	Process Server Information
`UcSp`	http.sys	Sspi Pool
`UcST`	http.sys	Server info table
`Uctd`	http.sys	Response Tdi Buffer
`Ucte`	http.sys	Entity Pool
`Ucto`	http.sys	Tdi Objects Pool
`Udf1`		Udfs file set descriptor buffer
`Udf2`		Udfs volume descriptor sequence descriptor buffer
`Udfb`		Udfs IO buffer
`UdfC`		Udfs CRC table
`Udfc`		Udfs IRP context
`UdfD`		Udfs FID buffer for view spanning
`Udfd`		Udfs file Fcb
`Udfe`		Udfs enumeration match expression
`UdfF`		Udfs nonpaged Fcb errata
`Udff`		Udfs normalized full filename
`UdfI`		Udfs IO context
`Udfi`		Udfs directory Fcb
`UdfL`		Udfs IRP context lite (delayed close)
`Udfl`		Udfs Lcb
`Udfp`		Udfs Pcb
`UdfS`		Udfs short file name
`Udfs`		Udfs Sparing Mcb
`UdfT`		Udfs generic table entry
`Udft`		Udfs CDROM TOC
`UDFV`		Udfs volume descriptor sequence descriptor buffer
`Udfv`		Udfs Vpb
`Udfx`		Udfs Ccb
`Udp`		Udp protocol (TCP/IP driver)
`Ufsc`		User FULLSCREEN
`UHCD`		Universal Host Controller (USB
`UHUB`		Universal Serial Bus Hub
`Ul??`	http.sys	tags. Note: In
`UlAB`	http.sys	Auxiliary Buffer
`UlAO`	http.sys	App Pool Object
`UlAP`	http.sys	App Pool Process
`UlBL`	http.sys	Binary Log File Entry
`UlBO`	http.sys	Outstanding i/o
`UlCC`	http.sys	Control Channel
`UlCE`	http.sys	Config Group Tree Entry
`UlCH`	http.sys	Config Group Tree Header
`UlCI`	http.sys	Config Group URL Info
`UlCJ`	http.sys	Config Group Object Pool
`UlCK`	http.sys	Chunk Tracker
`UlCL`	http.sys	Config Group LogDir
`UlCl`	http.sys	Connection RefTraceLog
`UlCO`	http.sys	Connection
`UlCT`	http.sys	Config Group Timestamp
`UlCY`	http.sys	Connection Count Entry
`UlDB`	http.sys	Debug
`UlDC`	http.sys	Data Chunks array
`UlDO`	http.sys	Disconnect Object
`UlDR`	http.sys	Deferred Remove Item
`UlDT`	http.sys	Debug Thread Pool
`UlEP`	http.sys	Endpoint
`UlFA`	http.sys	Force Abort Work Item
`UlFC`	http.sys	File Cache Entry
`Ulfc`	http.sys	Uri Filter Context
`UlFD`	http.sys	Noncached File Data
`UlFP`	http.sys	Filter Process
`UlFR`	http.sys	Dummy Filter Receive Buffer
`UlFT`	http.sys	Filter Channel
`UlFU`	http.sys	Full Tracker
`UlFW`	http.sys	Filter Write Tracker
`UlHC`	http.sys	Http Connection
`UlHc`	http.sys	Http Connection RefTraceLog
`UlHL`	http.sys	Internal Request RefTraceLog
`UlHR`	http.sys	Internal Request
`UlHT`	http.sys	Hash Table
`UlHV`	http.sys	Header Value
`UlIC`	http.sys	Irp Context
`UlID`	http.sys	Conn ID Table
`UlIR`	http.sys	Internal Response
`UlLD`	http.sys	Log Field
`UlLF`	http.sys	Log File Entry
`UlLG`	http.sys	Log Generic
`UlLH`	http.sys	Log File Handle
`UlLL`	http.sys	Log File Buffer
`UlLS`	http.sys	Ansi Log Data Buffer
`UlLT`	http.sys	Binary Log Data Buffer
`UlNO`	http.sys	NSGO Pool
`UlNP`	http.sys	Non
`UlOE`	http.sys	Endpoint OwnerRefTraceLog PoolTag
`UlOR`	http.sys	Owner RefTrace Signature
`UlOT`	http.sys	Opaque ID Table
`UlPB`	http.sys	APool Proc Binding
`UlPL`	http.sys	Pipeline
`UlQF`	http.sys	TCI Filter
`UlQG`	http.sys	TCI Generic
`UlQI`	http.sys	TCI Interface
`UlQL`	http.sys	TCI Flow
`UlQT`	http.sys	TCI Tracker
`UlQW`	http.sys	TCI WMI
`UlRB`	http.sys	Receive Buffer
`UlRD`	http.sys	Registry Data
`UlRE`	http.sys	Request Body Buffer
`UlRP`	http.sys	Request Buffer
`UlRR`	http.sys	Request Buffer References
`UlRS`	http.sys	Non
`UlRT`	http.sys	RefTraceLog PoolTag
`UlSC`	http.sys	SSL Cert Data
`UlSD`	http.sys	Security Data
`UlSL`	http.sys	StringLog PoolTag
`UlSl`	http.sys	StringLog Buffer PoolTag
`UlSO`	http.sys	Site Counter Entry
`UlSS`	http.sys	Simple Status Item
`UlTA`	http.sys	Address Pool
`UlTD`	http.sys	UL_TRANSPORT_ADDRESS
`UlTT`	http.sys	Thread Tracker
`UlUB`	http.sys	URL Buffer
`UlUC`	http.sys	Uri Cache Entry
`UlUH`	http.sys	HTTP Unknown Header
`UlUL`	http.sys	URL
`UlUM`	http.sys	URL Map
`UlVH`	http.sys	Virtual Host
`UlWC`	http.sys	Work Context
`UlWI`	http.sys	Work Item
`UndP`		EXIFS Underlying Path
`Urdr`	win32k!SetRedirectionBitmap	REDIRECT
`Usac`	win32k!_CreateAcceleratorTable	ACCEL
`Usai`	win32k!zzzAttachThreadInput	ATTACHINFO
`Usal`	win32k!InitSwitchWndInfo	ALTTAB
`USBB`	bthusb.sys	Bluetooth USB minidriver
`USBD`		Universal Serial Bus Class Driver
`Usbg`	win32k!xxxLogClipData	DEBUG
`Uscb`	win32k!_ConvertMemHandle	CLIPBOARD
`Uscc`	win32k!AllocCallbackMessage	CALLBACK
`Usci`	win32k!InitSystemThread	CLIENTTHREADINFO
`Uscl`	win32k!ClassAlloc	CLASS
`Uscm`	win32k!InitScancodeMap	SCANCODEMAP
`Uscp`	win32k!CreateDIBPalette	CLIPBOARDPALETTE
`Uscr`	win32k!NtUserSetSysColors	COLORS
`Usct`	win32k!CkptRestore	CHECKPT
`Uscu`	win32k!_CreateEmptyCursorObject	CURSOR
`Uscv`	win32k!NtUserSetSysColors	COLORVALUES
`Usd1`	win32k!FreeListAdd	DDE1
`Usd2`	win32k!_DdeSetQualityOfService	DDE2
`Usd4`	win32k!AddPublicObject	DDE4
`Usd5`	win32k!xxxCsEvent	DDE5
`Usd6`	win32k!xxxCsEvent	DDE6
`Usd7`	win32k!xxxCsEvent	DDE7
`Usd8`	win32k!xxxMessageEvent	DDE8
`Usd9`	win32k!xxxCsDdeInitialize	DDE9
`UsdA`	win32k!NewConversation	DDEa
`UsdB`	win32k!Createpxs	DDEb
`Usdc`	win32k!CreateCacheDC	DCE
`UsdD`	win32k!NtUserfnDDEINIT	DDEd
`UsdE`	win32k!xxxClientCopyDDEIn1	DDE
`UsDI`	win32k!CreateDeviceInfo	DEVICEINFO
`Usdi`	win32k!CreateMonitor	DISPLAYINFO
`Usds`	win32k!xxxDragObject	DRAGDROP
`Usdv`	win32k!NtUserfnINDEVICECHANGE	DEVICECHANGE
`User`	win32k!InitCreateUserCrit	ERESOURCE
`Usev`	win32k!xxxPollAndWaitForSingleObject	EVENT
`Usgh`	win32k!NtUserUserHandleGrantAccess	GRANTEDHANDLES
`Usgl`	win32k!CreateShadowTL	GLOBALTHREADLOCK
`Usgt`	win32k!AddGhost	GHOST
`Usha`	win32k!AllocateHidData	HIDDATA
`UshD`	Win32k!AllocateHidDesc	HIDDESC
`Ushk`	win32k!_RegisterHotKey	HOTKEY
`Usih`	win32k!SetImeHotKey	IMEHOTKEY
`Usim`	win32k!CreateInputContext	IME
`Usjb`	win32k!CreateW32Job	W32JOB
`Usjx`	win32k!JobCalloutAddProcess	W32JOBEXTRA
`Uskb`	win32k!xxxLoadKeyboardLayoutEx	KBDLAYOUT
`Uske`	win32k!GetKbdExId	KBDEXID
`Uskf`	win32k!LoadKeyboardLayoutFile	KBDFILE
`Usks`	win32k!PostUpdateKeyStateEvent	KBDSTATE
`Uskt`	win32k!ReadLayoutFile	KBDTABLE
`Usla`	win32k!InitLockRecordLookaside	LOOKASIDE
`Usld`	win32k!GrowLogIfNecessary	LOGDESKTOP
`Uslr`	win32k!InitLockRecordLookaside	LOCKRECORD
`Usmi`	win32k!MirrorRegion	MIRROR
`Usml`	win32k!MsgLookupTableAlloc	MESSAGE FILTER TABLE
`Usmr`	win32k!SnapshotMonitorRects	MONITORRECTS
`Usms`	win32k!xxxMoveSize	MOVESIZE
`Usmt`	win32k!xxxMNAllocMenuState	MENUSTATE
`Usno`	win32k!zzz	NONE
`Usny`	win32k!CreateNotify	NOTIFY
`Uspi`	win32k!MapDesktop	PROCESSINFO
`Uspm`	win32k!MNAllocPopup	POPUPMENU
`Uspn`	win32k!CreateProfileUserName	PROFILEUSERNAME
`Uspo`	win32k!QueuePowerRequest	POWER
`Uspp`	win32k!AllocateAndLinkHidTLCInfo	PNP
`Uspr`	win32k!GetPrivateProfileStruct	PROFILE
`Usqm`	win32k!InitQEntryLookaside	QMSG
`Usqu`	win32k!InitQEntryLookaside	Q
`Usrt`	win32k!xxxDrawMenuItemText	RTL
`Ussa`	win32k!xxxBroadcastMessage	SMS_ASYNC
`Ussb`	win32k!CreateSpb	SPB
`Ussc`	win32k!xxxInterSendMsgEx	SMS_CAPTURE
`Ussd`	win32k!xxxAddShadow	SHADOW
`Usse`	win32k!SetDisconnectDesktopSecurity	SECURITY
`Ussi`	win32k!NtUserSendInput	SENDINPUT
`Ussm`	win32k!InitSMSLookaside	SMS
`Usss`	win32k!xxxBroadcastMessage	SMS_STRING
`Usst`	win32k!xxxSBTrackInit	SCROLLTRACK
`Ussw`	win32k!_BeginDeferWindowPos	SWP
`Ussy`	win32k!xxxDesktopThread	SYSTEM
`Ustd`	win32k!TrackAddDesktop	TRACKDESKTOP
`Usti`	win32k!AllocateW32Thread	THREADINFO
`Ustk`	win32k!HeavyAllocPool	STACK
`Ustm`	win32k!InternalSetTimer	TIMER
`Usto`	win32k!xxxConnectService	TOKEN
`Usts`	win32k!_Win32CreateSection	SECTION
`Ustx`	win32k!NtUserDrawCaptionTemp	TEXT
`Usty`	win32k!NtUserResolveDesktopForWOW	TEXT2
`Usub`	win32k!NtUserToUnicodeEx	UNICODEBUFFER
`Usvi`	win32k!ResizeVisExcludeMemory	VISRGN
`Usvl`	win32k!VWPLAdd	VWPL
`Uswd`	win32k!xxxCreateWindowEx	WINDOW
`Uswe`	win32k!_SetWinEventHook	WINEVENT
`Uswl`	win32k!BuildHwndList	WINDOWLIST
`Uswo`	win32k!zzzInitTask	WOWTDB
`Uswp`	win32k!xxxRegisterUserHungAppHandlers	WOWPROCESSINFO
`Uswt`	win32k!xxxUserNotifyProcessCreate	WOWTHREADINFO
`Uvpb`	dwudf.sys	(DVD Write Now) VPB
`Vad` (0)	nt!mm	Mm virtual address descriptors
`VadF`	nt!mm	VADs created by a FreeVM splitting
`Vadl`	nt!mm	Mm virtual address descriptors (long)
`VadS`	nt!mm	Mm virtual address descriptors (short)
`VBus`	vmbus.sys	Virtual Machine Bus Driver
`VDM`	nt!vdm	ntosvdm
`VdPN`	dxgkrnl.sys	Video display mode management
`VfIT`	nt!Vf	Verifier Import Address Table information
`VidL`	videoprt.sys	VideoPort Allocation List (FDO_EXTENSION)
`VidR`	videoprt.sys	VideoPort Allocation on behalf of Miniport
`ViMm`	dxgkrnl.sys	Video memory manager
`virt`	vmm.sys	Virtual Machine Manager (VPC/VS)
`ViSh`	dxgkrnl.sys	Video scheduler
`VM`	volmgr.sys	General allocations
`Vm`	volmgrx.sys	General allocations
`VM??`	volmgr.sys	Volume Manager
`Vm??`	volmgrx.sys	Volume Manager Extension
`VmBl`	volmgrx.sys	Raw configuration blocks
`VmBu`	volmgrx.sys	I/O buffers
`VmCc`	volmgrx.sys	Configuration copies
`VmCo`	volmgrx.sys	Configurations
`VmCp`	volmgrx.sys	Copies
`VmCr`	volmgrx.sys	Completion routine contexts
`VmDc`	volmgrx.sys	Device changes
`VmDd`	volmgrx.sys	Disk devices
`VmDh`	volmgrx.sys	Disk headers
`VmLa`	volmgrx.sys	Drive layouts
`VmLb`	volmgrx.sys	Log blocks
`VmLc`	volmgrx.sys	Log copies
`VmLo`	volmgrx.sys	Logs
`VmLr`	volmgrx.sys	Log raw content
`VmMm`	volmgrx.sys	Mirror emergency mappings
`VmNe`	volmgrx.sys	Notification entries
`VmOb`	volmgrx.sys	I/O objects
`VmP0`	volmgrx.sys	Packets
`VmP1`	volmgrx.sys	Small packets
`VmP2`	volmgrx.sys	Large packets
`VmP3`	volmgrx.sys	Huge packets
`VmPa`	volmgrx.sys	Packs
`VmPd`	volmgrx.sys	Physical disks
`VmPs`	volmgrx.sys	Arrays of packets
`VmRb`	volmgrx.sys	Raw record buffers
`VmRc`	volmgrx.sys	Raw configurations
`VmRe`	volmgrx.sys	Records
`VmRi`	volmgrx.sys	Record information
`VmRm`	volmgrx.sys	RAID
`VmRr`	volmgrx.sys	Raw records
`VmTa`	volmgrx.sys	I/O tasks
`VmTc`	volmgrx.sys	Table of contents
`VmTe`	volmgrx.sys	Table of contents entries
`VmTx`	volmgrx.sys	Transactions
`VmUe`	volmgrx.sys	User entries
`VmVd`	volmgrx.sys	Volume devices
`VmWi`	volmgrx.sys	Work items
`VoS?`	volsnap.sys	VolSnap (Volume Snapshot Driver)
`VoSa`	volsnap.sys	Application information allocations
`VoSb`	volsnap.sys	Buffer allocations
`VoSc`	volsnap.sys	Snapshot context allocations
`VoSd`	volsnap.sys	Diff area volume allocations
`VoSf`	volsnap.sys	Diff area file allocations
`VoSh`	volsnap.sys	Bit history allocations
`VoSi`	volsnap.sys	Io status block allocations
`VoSm`	volsnap.sys	Bitmap allocations
`VoSo`	volsnap.sys	Old heap entry allocations
`VoSp`	volsnap.sys	Pnp id allocations
`VoSr`	volsnap.sys	Device relations allocations
`VoSs`	volsnap.sys	Short term allocations
`VoSt`	volsnap.sys	Temp table allocations
`VoSw`	volsnap.sys	Work queue allocations
`VoSx`	volsnap.sys	Dispatch context allocations
`Vpb`		Io, vpb's
`Vprt`	videoprt.sys	Video port for legacy (pre
`VraP`		parallel class driver
`vTDR`	dxgkrnl.sys	Video timeout detection/recovery
`Vtfd`		Font file/context
`Wait` (0)		NtWaitForMultipleObjects
`Wan?`		NdisWan Tags (PPP Framing module for Remote Access)
`WanA`		BundleCB
`WanB`		ProtocolCB/LinkCB
`WanC`		DataDesc
`WanD`		WanRequest
`WanE`		LoopbackDesc
`WanG`		MiniportCB
`WanH`		OpenCB
`WanI`		IoPacket
`WanJ`		LineUpInfo
`WanK`		Unicode String Buffer
`WanL`		Protocol Table
`WanM`		Connection Table
`WanN`		NdisPacketPool Desc
`WanQ`		DataBuffer
`WanR`		WanPacket
`WanS`		AfCB/SapCB/VcCB
`WanT`		Transform Driver
`WanV`		RC4 Encryption Context
`WanW`		SHA Encryption
`WanX`		Send Compression Context
`WanY`		Recv Compression Context
`WanZ`		Protocol Specific Info
`WCbf`	dwudf.sys	(DVD Write Now) Cache storage buffer
`WCrf`	dwudf.sys	(DVD Write Now) Cache frame list
`WCtx`	dwudf.sys	(DVD Write Now) Cache context block
`Wdm`		WDM
`WDMA`		WDM Audio
`Wdog`	watchdog.sys	Watchdog object/context allocation
`werk`		WER kernel mode reporting allocation
`WimF`	wimfsf.sys	WIM Boot Filter
`WMca`		WMI MCA Handling
`WmDS`		Wmi DataSource chunks
`WmGE`		Wmi GuidEntry chunks
`WmiA`		Wmi ACPI mapper
`WmiC`		Wmi Create Pump Thread Work Item
`WmiD`		Wmi Registration DataSouce
`WmiG`		Allocation of WMIGUID
`WmiI`		Wmi Instance Names
`Wmii`		Wmi InstId chunks
`Wmij`		Wmi GuidMaps
`WmiL`		WmiLIb
`Wmim`		Wmi KM to UM Notification Buffers
`WmiN`		Wmi Notification Notification Packet
`Wmin`		Wmi Notification Slot Chunks
`Wmip`		Wmi General purpose allocation
`Wmiq`		Wmi NBQ Blocks
`WmiR`		Wmi Registration info blocks
`WmIS`		Wmi InstanceSet chunks
`Wmis`		Wmi SysId allocations
`Wmit`		Wmi Trace
`Wmiw`		Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL
`Wmiz`		Wmi MCA Insertions debug code
`WmMR`		Wmi MofResouce chunks
`WMsG`	win32k.sys	Winlogon kernel mode IPC interface
`Wrp?`		WanArp Tags (ARP module for Remote Access)
`Wrpa`		WAN_ADAPTER_TAG
`Wrpc`		WAN_CONN_TAG
`Wrpd`		WAN_DATA_TAG
`Wrpf`		FREE_TAG (checked builds only)
`Wrph`		WAN_HEADER_TAG
`Wrpi`		WAN_INTERFACE_TAG
`Wrpn`		WAN_NOTIFICATION_TAG
`Wrpr`		WAN_REQUEST_TAG
`Wrps`		WAN_STRING_TAG
`Wrpw`		WAN_PACKET_TAG
`WvCy`		WDM Audio WaveCyc port
`WvPc`		WDM Audio WavePCI port
`xCVD` (0)	mrxdav.sys	AsyncEngineContext Tag
`XDR?`	rpcxdr.sys	NFS (Network File System) XDR driver
`xSMB`	smbmrx.sys	IFSKIT sample SMB mini
`Xtra`		EXIFS Extra Create
`XWan`		ndisusrwan allocations
`ysd8` (0)	win32k.sys	User DDE8
`ysd9`	win32k.sys	User DDE9
`ysda`	win32k.sys	User DDEa
`ysdb`	win32k.sys	User DDEb
`ysdc`	win32k.sys	User DDEc
`ysdd`	win32k.sys	User DDEd
`ZsaB` (0)		EXIFS ZeroBlock
`_ATI` (0)		ATI video driver
`_LCD`	monitor.sys	Monitor PDO name buffer