-
Notifications
You must be signed in to change notification settings - Fork 0
/
pooltag.txt
4968 lines (4596 loc) · 248 KB
/
pooltag.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
//
// Copyright (C) Microsoft. All rights reserved.
//
rem
rem Pooltag.txt
rem
rem This file lists the tags used for pool allocations by kernel mode components
rem and drivers.
rem
rem The file has the following format:
rem <PoolTag> - <binary-name> - <Description>
rem
rem Pooltag.txt is installed with Debugging Tools for Windows (in %windbg%\triage)
rem and with the Windows DDK (in %winddk%\tools\other\platform\poolmon, where
rem platform is amd64, i386, or arm).
rem
@GMM - <unknown> - (Intel video driver) Memory manager
@KCH - <unknown> - (Intel video driver) Chipset specific service
@MP - <unknown> - (Intel video driver) Miniport related memory
@SB - <unknown> - (Intel video driver) Soft BIOS
_ATI - <unknown> - ATI video driver
_LCD - monitor.sys - Monitor PDO name buffer
8042 - i8042prt.sys - PS/2 keyboard and mouse
AdSv - vmsrvc.sys - Virtual Machines Additions Service
ARPC - atmarpc.sys - ATM ARP Client
ATMU - atmuni.sys - ATM UNI Call Manager
Atom - <unknown> - Atom Tables
Abos - <unknown> - Abiosdsk
AcdM - <unknown> - TDI AcdObjectInfoG
AcdN - <unknown> - TDI AcdObjectInfoG
AcpA - acpi.sys - ACPI arbiter data
AcpB - acpi.sys - ACPI buffer data
AcpD - acpi.sys - ACPI device data
AcpE - acpi.sys - ACPI embedded controller data
AcpF - acpi.sys - ACPI interface data
Acpg - acpi.sys - ACPI GPE data
Acpi - acpi.sys - ACPI generic data
AcpI - acpi.sys - ACPI irp data
AcpL - acpi.sys - ACPI lock data
AcpM - acpi.sys - ACPI miscellaneous data
AcpO - acpi.sys - ACPI object data
AcpP - acpi.sys - ACPI power data
AcpR - acpi.sys - ACPI resource data
AcpS - acpi.sys - ACPI string data
Acpt - acpi.sys - ACPI table data
AcpT - acpi.sys - ACPI thermal data
AcpX - acpi.sys - ACPI translation data
Adap - <unknown> - Adapter objects
Adbe - <unknown> - Adobe's font driver
ADPT - acpipagr.sys - Processor Aggregator Driver
AECi - <unknown> - filter object interface for MS acoustic echo canceller
Afd? - afd.sys - AFD objects
AfdA - afd.sys - Afd EA buffer
AfdB - afd.sys - Afd data buffer
AfdC - afd.sys - Afd connection structure
aFDC - afd.sys - Afd WSK client context
aFDT - afd.sys - Afd TL provider context
AfdD - afd.sys - Afd debug data
AfdE - afd.sys - Afd endpoint structure
AfdF - afd.sys - Afd TransmitFile info
AfdG - afd.sys - Afd group table
AfdI - afd.sys - Afd TDI data
AfdL - afd.sys - Afd local address buffer
AfdP - afd.sys - Afd poll info
AfdQ - afd.sys - Afd work queue item
AfdR - afd.sys - Afd remote address buffer
AfdS - afd.sys - Afd security info
AfdT - afd.sys - Afd transport info
AfdW - afd.sys - Afd work item
AfdX - afd.sys - Afd context buffer
Afda - afd.sys - Afd APC buffer (NT 3.51 only)
Afdc - afd.sys - Afd connect data buffer
Afdd - afd.sys - Afd disconnect data buffer
Afdf - afd.sys - Afd TransmitFile debug data
Afdh - afd.sys - Afd address list change buffer
Afdi - afd.sys - Afd "set inline mode" buffer
Afdl - afd.sys - Afd lookaside lists buffer
Afdp - afd.sys - Afd transport IRP buffer
Afdq - afd.sys - Afd routing query buffer
Afdr - afd.sys - Afd ERESOURCE buffer
Afdt - afd.sys - Afd transport address buffer
Ahca - ahcache.sys - Appcompat kernel cache pool tag
AleD - tcpip.sys - ALE remote endpoint
Ala4 - tcpip.sys - ALE remote endpoint IPv4 address
Ala6 - tcpip.sys - ALE remote endpoint IPv6 address
Alei - tcpip.sys - ALE arrival/nexthop interface cache
AleU - tcpip.sys - ALE pend context
AleE - tcpip.sys - ALE endpoint context
AlLl - tcpip.sys - ALE remote endpoint LRU
AlCi - tcpip.sys - ALE credential info
AlSP - tcpip.sys - ALE secure socket policy
AlPU - tcpip.sys - ALE secure socket policy update
AlPi - tcpip.sys - ALE peer info
AlP4 - tcpip.sys - ALE peer IPv4 address
AlP6 - tcpip.sys - ALE peer IPv6 address
AlPT - tcpip.sys - ALE peer target
Alep - tcpip.sys - ALE process info
AleS - tcpip.sys - ALE token info
AleP - tcpip.sys - ALE process image path
AleK - tcpip.sys - ALE audit
AleA - tcpip.sys - ALE connection abort context
AlDN - tcpip.sys - ALE endpoint delete notify
AleW - tcpip.sys - ALE enum filter array
AleN - tcpip.sys - ALE notify context
AlSs - tcpip.sys - ALE socket security context
AlPF - tcpip.sys - ALE policy filters
AleL - tcpip.sys - ALE LRU
AleI - tcpip.sys - ALE token ID
AlP5 - tcpip.sys - ALE 5-tuple state
AlE5 - tcpip.sys - ALE 5-tuple temp entry
Aric - tcpip.sys - ALE route inspection context
Adnc - tcpip.sys - ALE endpoint deactivation notification context
Acrc - tcpip.sys - ALE connect request inspection context
Acrl - tcpip.sys - ALE connect redirect layer data
Abrc - tcpip.sys - ALE bind request inspection context
Abrl - tcpip.sys - ALE bind redirect layer data
AlSm - tcpip.sys - ALE Secondary App Meta Data
Afp - <unknown> - SFM File server
AlCI - nt!alpc - ALPC communication info
AlEv - nt!alpc - ALPC eventlog queue
AlIn - nt!alpc - ALPC Internal allocation
AlHa - nt!alpc - ALPC port handle table
AlMs - nt!alpc - ALPC message
ALPC - nt!alpc - ALPC port objects
AlRe - nt!alpc - ALPC section region
AlRr - nt!Alpc - ALPC resource reserves
AlSc - nt!alpc - ALPC section
AlSe - nt!alpc - ALPC client security
AlVi - nt!alpc - ALPC view
ATmp - AppTag mount point
ATon - AppTag object name
ATub - AppTag user buffer
ATgb - AppTag guid buffer
ATac - AppTag ATR command buffer
ATdi - AppTag cliendata index buffer
ATdt - AppTag cliendata temp buffer
ATFb - AppTag file id buffer
Aml* - <unknown> - ACPI AMLI Pooltags
APIC - pnpapic.sys - I/O APIC Driver
ArbA - nt!arb - ARBITER_ALLOCATION_STATE_TAG
ArbL - nt!arb - ARBITER_ORDERING_LIST_TAG
ArbM - nt!arb - ARBITER_MISC_TAG
ArbR - nt!arb - ARBITER_RANGE_LIST_TAG
Arp? - <unknown> - ATM ARP server objects, atmarps.sys
ArpA - <unknown> - AtmArpS address
ArpB - <unknown> - AtmArpS buffer space
ArpI - <unknown> - AtmArpS Interface structure
ArpK - <unknown> - AtmArpS ARP block
ArpM - <unknown> - AtmArpS MARS structure
ArpR - <unknown> - AtmArpS NDIS request
ArpS - <unknown> - AtmArpS SAP structure
Asy1 - <unknown> - ndis / ASYNC_IOCTX_TAG
Asy2 - <unknown> - ndis / ASYNC_INFO_TAG
Asy3 - <unknown> - ndis / ASYNC_ADAPTER_TAG
Asy4 - <unknown> - ndis / ASYNC_FRAME_TAG
AtC - <unknown> - IDE disk configuration
AtD - <unknown> - atdisk.c
ATIX - <unknown> - WDM mini drivers for ATI tuner, xbar, etc.
Atk - <unknown> - Appletalk transport
AtmA - <unknown> - Atoms
AtmT - <unknown> - Atom tables
AtvE - cea_km.lib - Event broker aggregation library.
AuxL - <unknown> - EXIFS Auxlist
AzAp - HDAudio.sys - HD Audio Class Driver (Datastore: audio path)
AzAd - HDAudio.sys - HD Audio Class Driver (AzPcAudDev)
AzCd - HDAudio.sys - HD Audio Class Driver (CodecVendor)
AzCE - HDAudio.sys - HD Audio Class Driver (CEAAudioRender)
AzCm - HDAudio.sys - HD Audio Class Driver (AzCommon)
AzFg - HDAudio.sys - HD Audio Class Driver (Audio Function Group)
Azfg - HDAudio.sys - HD Audio Class Driver (datastore: function group)
AzJd - HDAudio.sys - HD Audio Class Driver (JackDetector)
AzMa - HDAudio.sys - HD Audio Class Driver (Main)
AzMi - HDAudio.sys - HD Audio Class Driver (micin, MixedCapture)
AzMu - HDAudio.sys - HD Audio Class Driver (MuxedCapture)
AzMx - HDAudio.sys - HD Audio Class Driver (AzMixerport)
AzLd - HDAudio.sys - HD Audio Class Driver (Datastore: logical device)
AzLi - HDAudio.sys - HD Audio Class Driver (CDIn,AUXIn, linein)
AzLg - HDAudio.sys - HD Audio Class Driver (debug)
AzLs - HDAudio.sys - HD Audio Class Driver (DLTest)
AzPd - HDAudio.sys - HD Audio Class Driver (AzDma)
AzPx - HDAudio.sys - HD Audio Class Driver (AzPower)
AzRr - HDAudio.sys - HD Audio Class Driver (RedirectedRender)
AzRR - HDAudio.sys - HD Audio Class Driver (SpdifEmbeddedRender, SpdifOut, Headphone, HBDAout)
AzSd - HDAudio.sys - HD Audio Class Driver (subdevicegraph)
AzSi - HDAudio.sys - HD Audio Class Driver (SpdifIn)
AzSt - HDAudio.sys - HD Audio Class Driver (AzWaveCyclicStream, HdaWaveRTstream)
AzTs - HDAudio.sys - HD Audio Class Driver (TestSet1000, TestSet1001)
AzUT - HDAudio.sys - HD Audio Class Driver (TestSet0004)
AzWd - HDAudio.sys - HD Audio Class Driver (AzWidget)
AzWp - HDAudio.sys - HD Audio Class Driver (AzWaveport, HdaWaveRTminiport)
Bat? - <unknown> - Battery Class drivers
BatC - <unknown> - Composite battery driver
BatM - <unknown> - Control method battery driver
BatS - <unknown> - Smart battery driver
Batt - <unknown> - Battery class driver
BCSP - bthbcsp.sys - Bluetooth BCSP minidriver
BCDK - nt!init - Kernel boot configuration data.
BDD - BasicDisplay.sys - Microsoft Basic Display Driver
BIG - nt!mm - Large session pool allocations (ntos\ex\pool.c)
BlCc - blkcache.sys - Block Cache Driver
Bmfd - <unknown> - Font related stuff
BT3C - bt3c.sys - Bluetooth 3COM minidriver
BT8x - <unknown> - WDM mini drivers for Brooktree 848,829, etc.
BTHP - bthport.sys - Bluetooth port driver (generic)
BthS - bthport.sys - Bluetooth port driver (security)
BTME - bthenum.sys - Bluetooth enumerator
BTMO - bthmodem.sys - Bluetooth modem
BTPT - <unknown> - Bluetooth transport protocol library
BTSR - bthser.sys - Bluetooth serial minidriver
BTUR - bthuart.sys - Bluetooth UART minidriver
WPAD - BasicRender.sys - Basic Render Adapter
WPDV - BasicRender.sys - Basic Render DX Device
WPCT - BasicRender.sys - Basic Render DX Context
WPAL - BasicRender.sys - Basic Render Allocation
WPAO - BasicRender.sys - Basic Render Opened Allocation
WPRC - BasicRender.sys - Basic Render Rectangles (for Present)
Bu* - <unknown> - burneng.sys from adaptec
BvHI - netiobvt.sys - BVT HT Items
BvHT - netiobvt.sys - BVT HT Tables
Call - nt!ex - kernel callback object signature
call - <unknown> - debugging call tables
CBRe - <unknown> - CallbackRegistration
CBSI - cbsi.sys - Common Block Store
Cc - nt!cc - Cache Manager allocations (catch-all)
CcAs - nt!cc - Cache Manager Async cached read structure
CcBc - nt!cc - Cache Manager Bcb from pool
CcBm - nt!cc - Cache Manager Bitmap
CcBn - nt!cc - Cache Manager Bcb trim notification entry
CcBr - nt!cc - Cache Manager Bitmap range
CcBz - nt!cc - Cache Manager Bcb Zone
CcDw - nt!cc - Cache Manager Deferred Write
CcEC - nt!cc - Cache Manager External Cache tracking structure
CcEv - nt!cc - Cache Manager Event
CcFn - nt!cc - Cache Manager File name for popups
CCFF - CCFFilter.sys - Cluster Client Failover Filter
Ccfx - nt!cc - Cache Manager Registry value full info structure
CcMb - nt!cc - Cache Manager Mbcb
CcNu - nt!cc - Cache Manager NUMA structures
CcOb - nt!cc - Cache Manager Overlap Bcb
CcPB - nt!ccpf - Prefetcher trace buffer
CcPC - nt!ccpf - Prefetcher context
CcPD - nt!ccpf - Prefetcher trace dump
CcPF - nt!ccpf - Prefetcher file name
CcPI - nt!ccpf - Prefetcher intermediate table
CcPL - nt!ccpf - Prefetcher read list
CcPM - nt!ccpf - Prefetcher metadata
CcPS - nt!ccpf - Prefetcher scenario
CcPT - nt!ccpf - Prefetcher trace
CcPV - nt!ccpf - Prefetcher queried volumes
CcPW - nt!ccpf - Prefetcher workers
CcPa - nt!ccpf - Prefetcher async context
CcPc - nt!cc - Cache Manager Private Cache Map
CcPf - nt!ccpf - Prefetcher
CcPh - nt!ccpf - Prefetcher header preallocation
CcPn - nt!ccpf - Prefetcher name info
CcPp - nt!ccpf - Prefetcher instructions
CcPq - nt!ccpf - Prefetcher query buffer
CcPr - nt!ccpf - Cache Manager Partition structures
CcPs - nt!ccpf - Prefetcher section table
CcPv - nt!ccpf - Prefetcher volume info
CcPw - nt!ccpf - Prefetcher enable worker
CcSc - nt!cc - Cache Manager Shared Cache Map
CcTe - nt!cc - Cache Manager Telemetry allocation
CcVa - nt!cc - Cache Manager Initial array of Vacbs
CcVl - nt!cc - Cache Manager Vacb Level structures (large streams)
CcVp - nt!cc - Cache Manager Array of Vacb pointers for a cached stream
CctX - <unknown> - EXIFX FCB Commit CTX
CcWq - nt!cc - Cache Manager Work Queue Item
CcWK - nt!cc - Kernel Cache Manager lookaside list
CcWk - nt!cc - Kernel Cache Manager lookaside list
CcWR - nt!cc - Cache Manager Registry watch structure
CcZe - nt!cc - Cache Manager Buffer of Zeros
CDmp - crashdmp.sys - Crashdump driver
CdA - <unknown> - CdAudio filter driver
Cdcc - cdfs.sys - CDFS Ccb
Cddn - cdfs.sys - CDFS CdName in dirent
Cdee - cdfs.sys - CDFS Search expression for enumeration
Cdfd - cdfs.sys - CDFS Data Fcb
Cdfi - cdfs.sys - CDFS Index Fcb
Cdfl - cdfs.sys - CDFS Filelock
CdFn - cdfs.sys - CDFS Filename buffer
Cdfn - cdfs.sys - CDFS Nonpaged Fcb
Cdfs - cdfs.sys - CDFS General Allocation
Cdft - cdfs.sys - CDFS Fcb Table entry
Cdgs - cdfs.sys - CDFS Generated short name
Cdic - cdfs.sys - CDFS Irp Context
Cdil - cdfs.sys - CDFS Irp Context lite
Cdio - cdfs.sys - CDFS Io context for async reads
Cdma - cdfs.sys - CDFS Mcb array
Cdpe - cdfs.sys - CDFS Prefix Entry
CdPn - cdfs.sys - CDFS CdName in path entry
Cdpn - cdfs.sys - CDFS Prefix Entry name
Cdsp - cdfs.sys - CDFS Buffer for spanning path table
Cdtc - cdfs.sys - CDFS TOC
Cdun - cdfs.sys - CDFS Buffer for upcased name
Cdvd - cdfs.sys - CDFS Buffer for volume descriptor
Cdvp - cdfs.sys - CDFS Vpb allocated in filesystem
CIcr - ci.dll - Code Integrity allocations for image integrity checking
CIsc - ci.dll - Code Integrity core dll
CIha - ci.dll - Code Integrity hashes
CKRT - <multiple> - Cluster Kernel RTL library
CLb* - clusbflt.sys - Cluster block storage target driver
CLB* - clusbflt.sys - Cluster block storage target driver
CLd* - clusdflt.sys - Cluster disk filter driver
ClfA - clfs.sys - CLFS Log container lookaside list
ClfB - clfs.sys - CLFS Log base file lookaside list
ClfC - clfs.sys - CLFS Log physical FCB lookaside list
ClfD - clfs.sys - CLFS Log virtual FCB lookaside list
ClfE - clfs.sys - CLFS Log CCB lookaside list
ClfF - clfs.sys - CLFS Log flush element lookaside list
ClfG - clfs.sys - CLFS Log I/O Request lookaside list
ClfH - clfs.sys - CLFS Log I/O control block lookaside list
ClfI - clfs.sys - CLFS Log marshal buffer lookaside list
ClfJ - clfs.sys - CLFS Log MDL reference
ClfK - clfs.sys - CLFS Log read completion element
ClfL - clfs.sys - CLFS Log base file image (obsolete)
ClfN - clfs.sys - CLFS Log base file lock
ClfO - clfs.sys - CLFS Log zero page
ClfP - clfs.sys - CLFS Log request state
ClfS - clfs.sys - CLFS Log base file snapshot
Clfs - clfs.sys - CLFS General buffer, or owner page lookaside list
ClNt - netft.sys - NetFt
ClNw - netft.sys - NetFt work items
CM - nt!cm - Configuration Manager (registry)
CmcD - hal.dll - HAL CMC Driver Log
CmcK - hal.dll - HAL CMC Kernel Log
CmcT - hal.dll - HAL CMC temporary Log
CMCa - nt!cm - Configuration Manager Cache (registry)
CMDc - nt!cm - Configuration Manager Cache (registry)
CMkb - nt!cm - registry key control blocks
CMpb - nt!cm - registry post blocks
CMnb - nt!cm - registry notify blocks
CMpe - nt!cm - registry post events
CMpa - nt!cm - registry post apcs
CMsb - nt!cm - registry stash buffer
CmVn - nt!cm - captured value name
CMVw - nt!cm - registry mapped view of file
CMVa - nt!cm - value cache value tag
CMVI - nt!cm - value index cache tag
CMSc - nt!cm - security cache pooltag
CMSb - nt!cm - internal stash buffer pool tag
CMNb - nt!cm - Configuration Manager Name Tag
CMIn - nt!cm - Configuration Manager Index Hint Tag
CMDa - nt!cm - value data cache pool tag
CMAl - nt!cm - internal registry memory allocator pool tag
CMA1 - nt!cm - Configuration Manager Audit Tag 1
CMA2 - nt!cm - Configuration Manager Audit Tag 2
CMA3 - nt!cm - Configuration Manager Audit Tag 3
CMA4 - nt!cm - Configuration Manager Audit Tag 4
CMIx - nt!cm - Configuration Manager Intent Lock Tag
CMUw - nt!cm - Configuration Manager Unit of Work Tag
CMTr - nt!cm - Configuration Manager Transaction Tag
CMRm - nt!cm - Configuration Manager Resource Manager Tag
CM?? - nt!cm - Internal Configuration manager allocations
Cngb - ksecdd.sys - CNG kmode crypto pool tag
COMX - serial.sys - serial driver allocations
Cont - <unknown> - Contiguous physical memory allocations for device drivers
CopW - <unknown> - EXIFS CopyOnWrite
Covr - nt!cov - Code Coverage pool tag
CpeD - hal.dll - HAL CPE Driver Log
CpeK - hal.dll - HAL CMC Kernel Log
CpeT - hal.dll - HAL CPE temporary Log
CPnp - classpnp.sys - ClassPnP transfer packets
Crsp - ksecdd.sys - CredSSP kernel mode client allocations
CrtH - <unknown> - EXIFS Create Header
Cryp - ksecdd.sys - Crypto allocations
CSdk - <unknown> - Cluster Disk Filter driver
CSnt - <unknown> - Cluster Network driver
CTE - <unknown> - Common transport environment (ntos\inc\cxport.h, used by tdi)
Cvli - <unknown> - EXIFS Cached Volume Info
D2d - <unknown> - Device Object to DosName rtns (ntos\rtl\dev2dos.c)
D3Dd - <unknown> - DX D3D driver (embedded in a display driver like s3mvirge.dll)
D851 - <unknown> - 8514a video driver
Dacl - <unknown> - Temp allocations for object DACLs
DamK - dam.sys - Desktop Activity Moderator
Dati - <unknown> - ati video driver
DbCb - nt!dbg - Debug Print Callbacks
DbLo - <unknown> - Debug logging
dcam - <unknown> - WDM mini driver for IEEE 1394 digital camera
DcbA - msdcb.sys - DCB application priority
DcbC - msdcb.sys - DCB NMR provider context
DcbD - msdcb.sys - DCB NDIS_QOS_CONFIGURATION
DcbG - msdcb.sys - DCB string data
DcbI - msdcb.sys - DCB interface context
DcbL - msdcb.sys - DCB LLDP buffer
DcbP - msdcb.sys - DCB NDIS port information
DcbR - msdcb.sys - DCB store change record
DcbS - msdcb.sys - DCB security object
DcbU - msdcb.sys - DCB UQOS_POLICY_DESCRIPTOR
DcbX - msdcb.sys - DCB general
Dcdd - cdd.dll - Canonical display driver
Dcl - <unknown> - cirrus video driver
Ddk - <unknown> - Default for driver allocated memory (user's of ntddk.h)
Devi - <unknown> - Device objects
DEag - devolume.sys - Drive extender disk set array: DEVolume!DEDiskSet *
DEbo - devolume.sys - Drive extender bus opener context: DEVolume!DEBusOpenerContext
DEbe - devolume.sys - Drive extender extends buffer
DEbg - devolume.sys - Drive extender bus opener context global: DEVolume!DEBusOpenerContextGlobal
DEbm - devolume.sys - Drive extender bitmap
DEbu - devolume.sys - Drive extender generic buffer
DEcl - devolume.sys - Drive extender delayed cleaner: DEVolume!DelayedCleaner
DEct - devolume.sys - Drive extender chunk table
DEda - devolume.sys - Drive extender disk array: DEVolume!DEDisk *
DEdb - devolume.sys - Drive extender disk directory information
DEdc - devolume.sys - Drive extender disk chunk: DEVolume!DiskChunk
DEdg - devolume.sys - Drive extender disk globals: DEVolume!DEDiskGlobals
DEdi - devolume.sys - Drive extender disk: DEVolume!DEDisk
DEdm - devolume.sys - Drive extender disk mini chunk: DEVolume!DiskMiniChunk
DEdn - devolume.sys - Drive extender disk identification info: DEVolume!DiskIdentificationInfo
DEdr - devolume.sys - Drive extender device relations
DEds - devolume.sys - Drive extender disk set: DEVolume!DEDiskSet
DEdt - devolume.sys - Drive extender disk message: DEVolume!DE_DISK_MESSAGE
DEdu - devolume.sys - Drive extender disk set message: DEVolume!DE_DISK_SET_MESSAGE
DEdv - devolume.sys - Drive extender driver object: DEVolume!DEDriver
DEea - devolume.sys - Drive extender expanding array: DEVolume!ExpandingAutoPointerArray<T>
DEec - devolume.sys - Drive extender ECC Page: DEVolume!DeEccPage
DEfg - devolume.sys - Drive extender filter: DEVolume!DEFilter
DEga - devolume.sys - Drive extender guild array
DEic - devolume.sys - Drive extender filter instance context
DEip - devolume.sys - Drive extender IRP based logical to physical request: DEVolume!IrpBasedLogicalToPhysicalRequest
DEir - devolume.sys - Drive extender IRP based read request: DEVolume!IrpBasedReadRequest
DEiw - devolume.sys - Drive extender IRP based write request: DEVolume!IrpBasedWriteRequest
DEla - devolume.sys - Drive extender log mini chunk array
DElb - devolume.sys - Drive extender log buffer
DEli - devolume.sys - Drive extender disk set id record: DEVolume!DiskSetIdentificationRecord
DElm - devolume.sys - Drive extender log manager: DEVolume!LogManager
DElp - devolume.sys - Drive extender logical to physical request: DEVolume!LogicalToPhysicalRequest
DElr - devolume.sys - Drive extender log reader: DEVolume!LogReader
DElv - devolume.sys - Drive extender disk set volume id record: DEVolume!VolumeIdentificationRecord
DElw - devolume.sys - Drive extender log writer buffer: DEVolume!LogWriterBuffer
DEmc - devolume.sys - Drive extender volume chunk init mapping manager: DEVolume!VolumeChunkInitializationMappingManager
DEml - devolume.sys - Drive extender log mapping manager: DEVolume!LogMappingManager
DEms - devolume.sys - Drive extender superblock mapping manager: DEVolume!SuperBlockMappingManager
DEmv - devolume.sys - Drive extender volume mapping manager: DEVolume!VolumeMappingManager
DEog - devolume.sys - Drive extender old GUID array
DEpe - devolume.sys - Drive extender pingable event: DEVolume!PingableEvent
DEpg - devolume.sys - Drive extender pingable object globals: DEVolume!PingableObjectGlobals
DEpm - devolume.sys - Drive extender physical map: DEVolume!PhysicalMap
DEqm - devolume.sys - Drive extender queued message: DEVolume!QueuedMessage
DEra - devolume.sys - Drive extender disk event request
DErb - devolume.sys - Drive extender become dirty request: DEVolume!VolumeChunk::BecomeDirtyRequest
DErc - devolume.sys - Drive extender commit request: DEVolume!VolumeChunk::CommitRequest
DErd - devolume.sys - Drive extender decommit request: DEVolume!VolumeChunk::DecommitRequest
DEre - devolume.sys - Drive extender decommit all request: DEVolume!DiskSetVolume::DecommitAllRequest
DErg - devolume.sys - Drive extender registry: DEVolume!DERegistry
DErh - devolume.sys - Drive extender replicate chunk: DEVolume!ReplicateChunk
DErl - devolume.sys - Drive extender long and notify request: DEVolume!DiskSetVolume::LogAndNotifyRequest
DErm - devolume.sys - Drive extender range lock manager: DEVolume!RangeLockManager
DErn - devolume.sys - Drive extender new epoch request: DEVolume!DEDiskSet::NewEpochRequest
DEro - devolume.sys - Drive extender become out of date request: DEVolume!VolumeChunk::BecomeOutOfDateRequest
DErp - devolume.sys - Drive extender replicator: DEVolume!Replicator
DErr - devolume.sys - Drive extender read request: DEVolume!ReadRequest
DErs - devolume.sys - Drive extender delete or shutdown request: DEVolume!DiskSetVolume::DeleteOrShutdownRequest
DErt - devolume.sys - Drive extender start request: DEVolume!DEDiskSet::StartRequest
DEru - devolume.sys - Drive extender shutdown request: DEVolume!DEDiskSet::ShutdownRequest
DErv - devolume.sys - Drive extender repair volume request: DEVolume!DiskSetVolume::RepairVolumeDamageRequest
DErw - devolume.sys - Drive extender read write target: DEVolume!ReadWriteTarget
DErx - devolume.sys - Drive extender shutdown system request: DEVolume!DiskSetVolume::ShutdownRequest
DEry - devolume.sys - Drive extender start or create request: DEVolume!DiskSetVolume::StartOrCreateRequest
DErz - devolume.sys - Drive extender write super blocks request: DEVolume!DEDiskSet::WriteSuperBlocksRequest
DEsb - devolume.sys - Drive extender super block buffer
DEsd - devolume.sys - Drive extender disk set disk: DEVolume!DiskSetDisk
DEsg - devolume.sys - Drive extender disk set globals: DEVolume!DEDiskSetGlobals
DEsh - devolume.sys - Drive extender space holder operation: DEVolume!SpaceHolderOperation
DEte - devolume.sys - Drive extender data error message: DEVolume!DE_DATA_ERROR_MESSAGE
DEtr - devolume.sys - Drive extender trace message
DEtn - devolume.sys - Drive extender range lock test node
DEtx - devolume.sys - Drive extender range lock test
DEts - devolume.sys - Drive extender splay tree test
DEtw - devolume.sys - Drive extender trim worker pauser: DEVolume!AutoPauseTrimWorker
DEub - devolume.sys - Drive extender unaligned EccPage temp buffer: DEVolume!DeEccPage
DEus - devolume.sys - Drive extender unicode string
DEva - devolume.sys - Drive extender volume chunk array: DEVolume!AutoVolumeChunkPtr *
DEvc - devolume.sys - Drive extender volume chunk: DEVolume!VolumeChunk
DEvg - devolume.sys - Drive extender volume globals: DEVolume!DEVolumeGlobals
DEvh - devolume.sys - Drive extender volume device globals: DEVolume!DEVolumeDeviceGlobals
DEvm - devolume.sys - Drive extender volume message: DEVolume!DE_VOLUME_MESSAGE
DEvo - devolume.sys - Drive extender volume message: DEVolume!DEVolume
DEvs - devolume.sys - Drive extender disk set volume: DEVolume!DiskSetVolume
DEwi - devolume.sys - Drive extender work item: DEVolume!AutoWorkItem
DEze - devolume.sys - Drive extender cluster of zeros
Dh 0 - <unknown> - DirectDraw/3D default object
Dh 1 - <unknown> - DirectDraw/3D DirectDraw object
Dh 2 - <unknown> - DirectDraw/3D Surface object
Dh 3 - <unknown> - DirectDraw/3D Direct3D context object
Dh 4 - <unknown> - DirectDraw/3D VideoPort object
Dh 5 - <unknown> - DirectDraw/3D MotionComp object
Dfb - <unknown> - framebuf video driver
DfC? - dfsc.sys - DFS Client allocations
DfCa - dfsc.sys - DFS Client PERUSERTABLE
DfCb - dfsc.sys - DFS Client REFCONTEXT
DfCc - dfsc.sys - DFS Client CONNECTION
DfCd - dfsc.sys - DFS Client CURRENTDC
DfCe - dfsc.sys - DFS Client CSCEA
DfCf - dfsc.sys - DFS Client FILENAME
DfCg - dfsc.sys - DFS Client PREFIXCACHE
DfCh - dfsc.sys - DFS Client HASH
DfCi - dfsc.sys - DFS Client INPUTBUFFER
DfCj - dfsc.sys - DFS Client REFERRALNAME
DfCj - dfsc.sys - DFS Client REWRITTENNAME
DfCl - dfsc.sys - DFS Client DCLIST
DfCm - dfsc.sys - DFS Client CMCONTEXT
DfCn - dfsc.sys - DFS Client DOMAINNAME
DfCp - dfsc.sys - DFS Client PATH
DfCq - dfsc.sys - DFS Client REGSTRING
DfCr - dfsc.sys - DFS Client REFERRAL
DfCs - dfsc.sys - DFS Client SHARENAME
DfCt - dfsc.sys - DFS Client TREECONNECT
DfCu - dfsc.sys - DFS Client USETABLE
DfCv - dfsc.sys - DFS Client SERVERNAME
DfCw - dfsc.sys - DFS Client TARGETINFO
DfCx - dfsc.sys - DFS Client CREDENTIALS
DfCy - dfsc.sys - DFS Client REMOTEENTRY
DfCz - dfsc.sys - DFS Client DOMAINREFERRAL
Dfs - <unknown> - Distributed File System
dfsr - <unknown> - RDBSS IRP allocation
Dfsm - <unknown> - Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdi\gre
dFVE - dumpfve.sys - Full Volume Encryption crash dump filter (Bitlocker Drive Encryption)
Dict - storport.sys - StorCreateDictionary storport!_STOR_DICTIONARY.Entries
Dire - <unknown> - Directory objects
Dlck - <unknown> - deadlock verifier (part of driver verifier) structures
Dlmp - <unknown> - Video utility library for Vista display drivers
Dmga - <unknown> - mga (matrox) video driver
DmH? - <unknown> - DirectMusic hardware synthesizer
DmpS - dumpsvc.sys - Crashdump Service Driver
DmS? - <unknown> - DirectMusic kernel software synthesizer
Dndt - <unknown> - Device node
Dnod - <unknown> - Device node structure
DNSk - netio.sys - DNS RPC Transactions
DOPE - <unknown> - Device Object Power Extension (po component)
DpDc - FsDepends.sys - FsDepends Dependency Context Block
DpDl - FsDepends.sys - FsDepends Dependency List Block
DpPl - FsDepends.sys - FsDepends Parent Link Block
DPrf - <unknown> - Disk performance filter driver
DPwr - nt!pnp - PnP power management
Dprt - dxgkrnl.sys - Video port for Vista display drivers
Dps5 - <unknown> - NT5 PostScript printer driver
Dpsh - <unknown> - Postcript driver heap memory
Dpsi - <unknown> - psidisp video driver
Dpsm - <unknown> - Postcript driver memory
Dqv - <unknown> - qv (qvision) video driver
DpVc - FsDepends.sys - FsDepends Volume Context Block
DrDr - rdpdr.sys - Global object
DrEx - rdpdr.sys - Exchange object
DrIC - rdpdr.sys - I/O context object
Driv - <unknown> - Driver objects
Drsd - <unknown> - Rasdd Printer Driver Pool Tag.
Dtga - <unknown> - tga video driver
Dump - <unknown> - Bugcheck dump allocations
Dun5 - <unknown> - NT5 Universal printer driver
DUQD - mpsdrv.sys - MPSDRV upcall user request
DV?? - <unknown> - RDR2 DAV MiniRedir Tags
DVCx - <unknown> - AsyncEngineContext, DAV MiniRedir
DVEx - <unknown> - Exchange, DAV MiniRedir
DVFi - <unknown> - FileInfo, DAV MiniRedir
DVFn - <unknown> - FileName, DAV MiniRedir
DVRw - <unknown> - ReadWrite, DAV MiniRedir
DVSc - <unknown> - SrvCall, DAV MiniRedir
DVSh - <unknown> - SharedHeap, DAV MiniRedir
Dvga - <unknown> - vga 16 color video driver
Dvg2 - <unknown> - vga 256 color video driver
Dvg6 - <unknown> - vga 64K color video driver
Dvgr - <unknown> - vga for risc video driver
DW32 - <unknown> - W32 video driver
Dwd - <unknown> - wd90c24a video driver
Dwp9 - <unknown> - weitekp9 video driver
Dxga - <unknown> - XGA video driver
DxgK - dxgkrnl.sys - Vista display driver support
Efsm - <unknown> - EFS driver
Efsc - <unknown> - EFS driver
Efst - <unknown> - EXIFS FS Statistics
Envr - <unknown> - Environment strings
EQAn - tcpip.sys - EQoS application name
EQCc - tcpip.sys - EQoS counters
EQHb - tcpip.sys - EQoS HKE binding
EQHp - tcpip.sys - EQoS HKE parameters
EQOw - tcpip.sys - EQoS policy owner
EQPn - tcpip.sys - EQoS policy net entry
EQPp - tcpip.sys - EQoS policy profile entry
EQPs - tcpip.sys - EQoS policy scratch data
EQPt - tcpip.sys - EQoS policy table
EQQu - tcpip.sys - EQoS flow unit
EQSc - tcpip.sys - EQoS pacer client
EQSe - tcpip.sys - EQoS QIM endpoint
EQSp - tcpip.sys - EQoS generic policy data
EQSt - tcpip.sys - EQoS policy trim scratch
EQSx - tcpip.sys - EQoS security object
EQSy - tcpip.sys - EQoS proxy data
EQUn - tcpip.sys - EQoS uQoS NPI client data
EQUr - tcpip.sys - EQoS URL string
EQUp - tcpip.sys - EQoS URL policy section
EQUQ - tcpip.sys - UQoS generic allocation
Err - <unknown> - Error strings
Etwa - nt!etw - Etw server silo state
EtwA - nt!etw - Etw APC
Etwb - nt!etw - Etw provider tracking
EtwB - nt!etw - Etw Buffer
Etwc - nt!etw - Etw rundown reference counters
EtwC - nt!etw - Etw Realtime Consumer
Etwd - nt!etw - Etw Disallow List Entry
EtwD - nt!etw - Etw DataBlock
EtwF - nt!etw - Etw Filter
EtwG - nt!etw - Etw Guid
EtwH - nt!etw - Etw Private Handle Demuxing
Etwi - nt!etw - Etw IPT support
EtwK - nt!etw - Etw SoftRestart support
Etwl - nt!etw - Etw stack look-aside list entry
EtwL - nt!etw - Etw LoggerContext
Etwm - nt!etw - Etw BitMap
Etwo - nt!etw - Etw memory partition reference
EtwO - nt!etw - Etw memory partition MDL
Etwp - nt!etw - Etw TracingBlock
EtwP - nt!etw - Etw Pool
Etwq - nt!etw - Etw ReplyQueue
Etwr - nt!etw - Etw ReplyQueue entry
EtwR - nt!etw - Etw KM RegEntry
Etws - nt!etw - Etw stack cache
EtwS - nt!etw - Etw DataSource
Etwt - nt!etw - Etw temporary buffer
EtwT - nt!etw - Etw provider traits
EtwU - nt!etw - Etw Periodic Capture State
EtwV - nt!etw - Etw Coverage Sampling
EtwW - nt!etw - Etw WorkItem
Etwx - nt!etw - Etw LBR support
EtwX - nt!etw - Etw profiling support
EtwZ - nt!etw - Etw compression support
Evel - <unknown> - EFS file system filter driver lookaside list
Even - <unknown> - Event objects
Evid - <unknown> - Rtl Event ID's
ExWl - <unknown> - Executive worker list entry
Fat - fastfat.sys - Fat File System allocations
FatB - fastfat.sys - Fat allocation bitmaps
FatC - fastfat.sys - Fat Ccbs
FatD - fastfat.sys - Fat pool dirents
FatE - fastfat.sys - Fat EResources
FatF - fastfat.sys - Fat Fcbs
FatI - fastfat.sys - Fat IrpContexts
FatL - fastfat.sys - Fat FAT entry lookup buffer on verify
FatN - fastfat.sys - Fat Nonpaged Fcbs
FatO - fastfat.sys - Fat I/O buffer
FatP - fastfat.sys - Fat output for query retrieval pointers (caller frees)
FatQ - fastfat.sys - Fat buffered user buffer
FatR - fastfat.sys - Fat repinned Bcb
FatS - fastfat.sys - Fat stashed Bpb
FatT - fastfat.sys - Fat directory allocation bitmaps
FatV - fastfat.sys - Fat Vcb stat bucket
Fatv - fastfat.sys - Fat events
FatW - fastfat.sys - Fat FAT windowing structure
FatX - fastfat.sys - Fat IO contexts
Fatb - fastfat.sys - Fat Bcb arrays
Fatd - fastfat.sys - Fat EA data
Fate - fastfat.sys - Fat EA set headers
Fatf - fastfat.sys - Fat deferred flush contexts
Fati - fastfat.sys - Fat IO run descriptor
Fatn - fastfat.sys - Fat filename buffer
Fatr - fastfat.sys - Fat verification-time rootdir snapshot
Fats - fastfat.sys - Fat verification-time boot sector
Fatv - fastfat.sys - Fat backpocket Vpb
Fatx - fastfat.sys - Fat delayed close contexts
FbCx - tcpip.sys - Inet feature fallback contexts
REM FsLib allocations. FsLib is a static library linked in both NTFS and ReFS
FDEl - FsLib - FsLib DAX Extent Array
FDEd - FsLib - FsLib DAX Extent Descriptor
FDDb - FsLib - FsLib DAX DSM Buffer
FsIT - FsLib - FsLib IO Trace
FsLd - FsLib - FsLib Livedump
fboX - <unknown> - EXIFS FOBXVF List
Fcbl - <unknown> - EXIFS FCBlock
Fcon - nt!RtlpFc - Feature Configuration Management
Feiv - netio.sys - WFP filter engine incoming values
Fecc - netio.sys - WFP filter engine classify context
Fecf - netio.sys - WFP filter engine callout context
File - <unknown> - File objects
FIcn - fileinfo.sys - FileInfo FS-filter Create Retry Path
FIcp - fileinfo.sys - FileInfo FS-filter Extra Create Parameter
FIcs - fileinfo.sys - FileInfo FS-filter Stream Context
FIcv - fileinfo.sys - FileInfo FS-filter Volume Context
FIOc - fileinfo.sys - FileInfo FS-filter Prefetch Open Context
FIou - fileinfo.sys - FileInfo FS-filter User Open Context
FIof - fileinfo.sys - FileInfo FS-filter File Object Context
FIPc - fileinfo.sys - FileInfo FS-filter Prefetch Context
FIvn - fileinfo.sys - FileInfo FS-filter Volume Name
FIvp - fileinfo.sys - FileInfo FS-filter Volume Properties
FlmC - tcpip.sys - Framing Layer Client Contexts
FlmP - tcpip.sys - Framing Layer Provider Contexts
Flng - tcpip.sys - Framing Layer Generic Buffers (Tunnel/Port change notifications, ACLs)
FlpC - tcpip.sys - Framing Layer Client Contexts
FlpI - tcpip.sys - Framing Layer Interfaces
FlpL - tcpip.sys - Framing Layer Client Interface Contexts
FlpM - tcpip.sys - Framing Layer Multicast Groups
FlpS - tcpip.sys - Framing Layer Serialized Requests
Fl6D - tcpip.sys - FL6t DataLink Addresses
Fl4D - tcpip.sys - FL4t DataLink Addresses
FltD - tcpip.sys - FLt DataLink Addresses
FlSB - tcpip.sys - Framing Layer Stack Block
Flop - <unknown> - floppy driver
FLSk - nt!ps - Kernel TLS metadata
Flst - <unknown> - EXIFS Freelist
Fltt - nt!Vf - Log of Driver Verifier fault injection stack traces.
FLex - <unknown> - exclusive file lock
FLfl - <unknown> - exported (non-private) file lock
FLli - <unknown> - per-file lock information
FLln - <unknown> - shared lock tree node
FLsh - <unknown> - shared file lock
FLwl - <unknown> - waiting lock
FM?? - fltmgr.sys - Unrecognized FltMgr tag (update pooltag.w)
FMac - fltmgr.sys - ASCII String buffers
FMas - fltmgr.sys - ASYNC_IO_COMPLETION_CONTEXT structure
FMcb - fltmgr.sys - FLT_CCB structure
FMcn - fltmgr.sys - Non paged context extension structures
FMcp - fltmgr.sys - Client port wrapper structure
FMcr - fltmgr.sys - Context registration structures
FMct - fltmgr.sys - TRACK_COMPLETION_NODES structure
FMdh - fltmgr.sys - Paged ECP context for targeted create reparse
FMdl - fltmgr.sys - Array of DEVICE_OBJECT pointers
FMea - fltmgr.sys - EA buffer for create
FMfc - fltmgr.sys - FLTMGR_FILE_OBJECT_CONTEXT structure
FMfi - fltmgr.sys - Fast IO dispatch table
FMfk - fltmgr.sys - Byte Range Lock structure
FMfl - fltmgr.sys - FLT_FILTER structure
FMfn - fltmgr.sys - NAME_CACHE_NODE structure
FMfr - fltmgr.sys - FLT_FRAME structure
FMfz - fltmgr.sys - FILE_LIST_CTRL structure
FMib - fltmgr.sys - Irp SYSTEM buffers
FMic - fltmgr.sys - IRP_CTRL structure
FMil - fltmgr.sys - IRP_CTRL completion node stack
FMin - fltmgr.sys - FLT_INSTANCE name
FMis - fltmgr.sys - FLT_INSTANCE structure
FMla - fltmgr.sys - Per-processor IRPCTRL lookaside lists
FMlp - fltmgr.sys - Paged stream list control entry structures
FMnc - fltmgr.sys - NAME_CACHE_CREATE_CTRL structure
FMng - fltmgr.sys - NAME_GENERATION_CONTEXT structure
FMol - fltmgr.sys - OPLOCK_CONTEXT structure
FMor - fltmgr.sys - OpenReparse ECP structure
FMos - fltmgr.sys - Operation status ctrl structure
FMpl - fltmgr.sys - Cache aware pushLock
FMpr - fltmgr.sys - FLT_PRCB structure
FMQc - fltmgr.sys - QueryOnCreate ECP structure
FMrl - fltmgr.sys - FLT_OBJECT rundown logs
FMrp - fltmgr.sys - Reparse point data buffer
FMrr - fltmgr.sys - Per-processor Cache-aware rundown ref structure
FMrs - fltmgr.sys - Registry string
FMrw - fltmgr.sys - FLT_REGISTRY_WATCH_CONTEXT structure
FMsc - fltmgr.sys - SECTION_CONTEXT structure
FMsd - fltmgr.sys - Security descriptors
FMsl - fltmgr.sys - STREAM_LIST_CTRL structure
FMtb - fltmgr.sys - TXN_PARAMETER_BLOCK structure
FMtn - fltmgr.sys - Temporary file names
FMtp - fltmgr.sys - Non Paged TxVol context structures
FMtr - fltmgr.sys - Temporary Registry information
FMts - fltmgr.sys - Tree Stack
FMus - fltmgr.sys - Unicode string
FMvf - fltmgr.sys - FLT_VERIFIER_EXTENSION structure
FMvj - fltmgr.sys - FLT_VERIFIER_OBJECT structure
FMvl - fltmgr.sys - Array of FLT_VERIFIER_OBJECT structures
FMvo - fltmgr.sys - FLT_VOLUME structure
FMwi - fltmgr.sys - Work item structures
Fsb - netio.sys - Fixed-Size Block pool
Fsrc - fsrec.sys - Filesystem recognizer (fsrec.sys)
Fstb - <unknown> - ntos\fstub
FstB - <unknown> - ntos\fstub
FsVg - fsvga.sys - International VGA support
flnk - <unknown> - font link tag used in ntgdi\gre
FLpc - netio.sys - IPv6 Framing Layer Client context
fpct - wof.sys - Compressed file chunk table
fpcx - wof.sys - Compressed file IO context
fpdw - wof.sys - Compressed file decompression workspace
fpgn - wof.sys - Compressed file general
fppm - wof.sys - Compressed file IO parameters
fprd - wof.sys - Compressed file small read buffer
fpRD - wof.sys - Compressed file large read buffer
fpwi - wof.sys - Compressed file work item
fpxp - wof.sys - Compressed file xpress context
FS?? - nt!fsrtl - Unrecoginzed File System Run Time allocations (update pooltag.w)
FSeh - nt!fsrtl - File System Run Time Extra Create Parameter Entry
FSel - nt!fsrtl - File System Run Time Extra Create Parameter List
FSfm - nt!fsrtl - File System Run Time Fast Mutex Lookaside List
FSim - nt!fsrtl - File System Run Time Mcb allocations
FSrt - nt!fsrtl - File System Run Time allocations (DO NOT USE!)
FSmg - nt!fsrtl - File System Run Time
FSrd - nt!fsrtl - File System Run Time
FSrm - nt!fsrtl - File System Run Time
FSrn - nt!fsrtl - File System Run Time
FSrN - nt!fsrtl - File System Run Time
FSro - nt!fsrtl - File System Run Time
FSrs - nt!fsrtl - File System Run Time Work Item for low-stack posting
FSun - nt!fsrtl - File System Run Time
FOCX - nt!fsrtl - File System Run Time File Object Context structure
FsCo - fse.sys - FSE_CORE_CONTEXT_OBJECT_POOL_TAG
Fsbi - fse.sys - FSE_CORE_NBLCHAIN_INDICATION_CONTEXT_POOL_TAG
FsGo - fse.sys - FSE_CORE_NDIS_GENERIC_OBJECT_POOL_TAG
Fspe - fse.sys - FSE_CORE_NIC_PAIR_ENTRY_POOL_TAG
FsDC - fse.sys - FSE_DEVICE_CONTEXT_TAG
Fsed - fse.sys - FSE_DIAGNOSTICS_SCRATCH_TAG
FseB - fse.sys - FSE_EXPANDABLE_BUFFER_SIGNATURE
FsIP - fse.sys - FSE_IPS_CLIENT_TAG
FsIf - fse.sys - FSE_IPS_CLIENT_INTERFACE_TAG
Fsgo - fse.sys - FSE_NDIS_GENERIC_OBJECT_POOL_TAG
FsLS - fse.sys - FSE_NMR_CLIENT_POOLTAG
FseV - fse.sys - FSE_PARTITION_SIGNATURE
FseT - fse.sys - FSE_PATCH_SIGNATURE
FseC - fse.sys - FSE_PORT_CACHE_SIGNATURE
FsPp - fse.sys - FSE_PORT_POLICY_TAG
FseP - fse.sys - FSE_PORT_POOL_SIGNATURE
FseR - fse.sys - FSE_PORT_RESERVATION_SIGNATURE
FsGl - fse.sys - FSE_SERVER_TAG_GLOBAL
FsMt - fse.sys - FSE_SERVER_TAG_MESSAGE
FsMl - fse.sys - FSE_SERVER_TAG_MIDL
FsPd - fse.sys - FSE_SERVER_TAG_PARTITION
FsSt - fse.sys - FSE_SERVER_TAG_SOCKET
FsSc - fse.sys - FSE_SERVER_TAG_SOCKET_CONTEXT
FsWi - fse.sys - FSE_SERVER_TAG_WORKITEM
FseS - fse.sys - FSE_SHIMS_TAG
FseW - fse.sys - FSE_WORKSHEET_POOLTAG
FsTd - fse.sys - FSE_PT_TEST_DRIVER_TAG
FTrc - <unknown> - Fault tolerance Slist tag.
FtC - <unknown> - Fault tolerance driver
FtM - <unknown> - Fault tolerance driver
FtS - <unknown> - Fault tolerance driver
FtT - <unknown> - Fault tolerance driver
FtU - <unknown> - Fault tolerance driver
FtV - <unknown> - Fault tolerance driver
<unknown>
FtpA - mpsdrv.sys - MPSDRV FTP protocol analyzer
FwfD - mpsdrv.sys - MPSDRV driver buffer for flattening NET_BUFFFER
FwSD - tcpip.sys - WFP security descriptor
FVE? - fvevol.sys - Full Volume Encryption Filter Driver (Bitlocker Drive Encryption)
FVE0 - fvevol.sys - General allocations
FVEc - fvevol.sys - Cryptographic allocations
FVEl - fvevol.sys - FVELIB allocations
FVEp - fvevol.sys - Write buffers
FVEr - fvevol.sys - Reserved mapping addresses
FVEv - fvevol.sys - Conversion allocations
FVEw - fvevol.sys - Worker threads
FVEx - fvevol.sys - Read/write control structures
FxDr - wdf01000.sys - KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable.
FxLg - wdf01000.sys - KMDF IFR log tag
FxL? - wdfldr.sys - KMDF Loader Pool allocation
Fwpp - fwpkclnt.sys - Windows Filtering Platform export driver.
Fwpn - fwpkclnt.sys - WFP NBL info
Fwpi - fwpkclnt.sys - WFP injector info
Fwpx - fwpkclnt.sys - WFP NBL tagged context
Fwpd - fwpkclnt.sys - WFP delayed injection context
Fwpc - fwpkclnt.sys - WFP injection call context
G??? - <unknown> - Gdi Objects
G - <unknown> - Gdi Generic allocations
Gcac - <unknown> - Gdi glyph cache
Gcap - <unknown> - Gdi capture buffer
Gcsl - <unknown> - Gdi string resource script names
Gdbr - <unknown> - Gdi driver brush realization
Gdd - <unknown> - Gdi ddraw PKEY_VALUE_FULL_INFORMATION
Gdda - <unknown> - Gdi ddraw attach list
GddD - <unknown> - Gdi ddraw dummy page
Gdde - <unknown> - Gdi ddraw event
Gddf - <unknown> - Gdi ddraw driver heaps
Gddp - <unknown> - Gdi ddraw driver caps
Gddv - <unknown> - Gdi ddraw driver video memory list
Gdxd - <unknown> - Gdi ddraw VPE directdraw object
Gdxs - <unknown> - Gdi ddraw VPE surface, videoport, capture object
Gdxx - <unknown> - Gdi ddraw VPE DXAPI object
Gdev - <unknown> - Gdi GDITAG_DEVMODE
GDev - <unknown> - Gdi pdev
Gdrs - <unknown> - Gdi GDITAG_DRVSUP
Gebr - <unknown> - Gdi ENGBRUSH
gEdg - <unknown> - Gdi gradient fill triangle
Gffv - <unknown> - Gdi FONTFILEVIEW
gFil - <unknown> - Gdi FILEVIEW
GFil - <unknown> - Gdi engine descriptor list
Gfsb - <unknown> - Gdi font sustitution list
Gfsm - <unknown> - Gdi Fast mutex
Ggdv - <unknown> - Gdi GDITAG_GDEVICE
Gglb - <unknown> - Gdi temp buffer
Ggls - <unknown> - Gdi glyphset
Ggb - <unknown> - Gdi glyph bits
Ggbl - <unknown> - Gdi look aside buffers
Ghmg - <unknown> - Gdi handle manager objects
Gini - <unknown> - Gdi fast mutex
Gldv - <unknown> - Gdi Ldev
Glnk - <unknown> - Gdi PFELINK
Gmap - <unknown> - Gdi font map signature table
Gpff - <unknown> - Gdi physical font file
Gpft - <unknown> - Gdi font table
Gsem - <unknown> - Gdi Semaphores
Gsp - <unknown> - Gdi sprite
Gspr - <unknown> - Gdi sprite grow range
Gtmp - <unknown> - Gdi temporary allocations
Gtmw - <unknown> - Gdi TMW_INTERNAL
Gxlt - <unknown> - Gdi Xlate
Gfcb - <unknown> - EXIFS Grow FCB
Hal - hal.dll - Hardware Abstraction Layer
Hal2 - hal.dll - Hardware Abstraction Layer: Secondary Interrupts
HalA - hal.dll - Hardware Abstraction Layer: ACPI
Hala - hal.dll - Hardware Abstraction Layer: HSA
HalB - hal.dll - Hardware Abstraction Layer: MM Buffer
Halb - hal.dll - Hardware Abstraction Layer: MM Metadata
HalC - hal.dll - Hardware Abstraction Layer: Dynamic Partitioning
Halc - hal.dll - Hardware Abstraction Layer: Processors
HalD - hal.dll - Hardware Abstraction Layer: DMA
Hald - hal.dll - Hardware Abstraction Layer: Kernel Debug
HalE - hal.dll - Hardware Abstraction Layer: Errata Management
HalF - hal.dll - Hardware Abstraction Layer: Firmware
HalH - hal.dll - Hardware Abstraction Layer: Hypervisor
HalI - hal.dll - Hardware Abstraction Layer: IOMMU
Hali - hal.dll - Hardware Abstraction Layer: Interrupts
HalK - hal.dll - Hardware Abstraction Layer: KINTERUPT objects
HalM - hal.dll - Hardware Abstraction Layer: Memory Management
Halm - hal.dll - Hardware Abstraction Layer: Misc
HalP - hal.dll - Hardware Abstraction Layer: PCI
Halp - hal.dll - Hardware Abstraction Layer: PNP
Halo - hal.dll - Hardware Abstraction Layer: Power
HalV - ntoskrnl.exe - Driver Verifier DMA checking
HalW - hal.dll - Hardware Abstraction Layer: WHEA
Hpfs - <unknown> - Pinball (aka Hpfs) allocations
HisC - <unknown> - histogram filter driver
Hist - <unknown> - histogram filter driver
HidP - hidparse.sys - HID Parser
HidC - hidclass.sys - HID Class driver
HdCl - <unknown> - HID Client Sample Driver
HpMM - pnpmem.sys - HotPlug Memory Driver
HCID - bthport.sys - Bluetooth port driver HCI debug
HCIT - bthport.sys - Bluetooth port driver (HCI)
HcRs - hcaport.sys - HCAPORT_TAG_RESOURCE_LIST
HcEv - hcaport.sys - HCAPORT_TAG_EVENT
HcdI - hcaport.sys - HCAPORT_TAG_HWID
HcEn - hcaport.sys - HCAPORT_TAG_ENUM
HcMc - hcaport.sys - HCAPORT_TAG_MISC
HcDr - hcaport.sys - HCAPORT_TAG_DEVICE_RELATIONS
HcBm - hcaport.sys - HCAPORT_TAG_BITMAP
HcOb - hcaport.sys - HCAPORT_TAG_OBJECT
HcCq - hcaport.sys - HCAPORT_TAG_CQUEUE
HcPr - hcaport.sys - HCAPORT_TAG_PROTD
HPmi - hcaport.sys - HCAPORT_TAG_PMI_EXTENSION
HcMa - hcaport.sys - HCAPORT_TAG_MAD
HcMp - hcaport.sys - HCAPORT_TAG_MINIPORT
HcCm - hcaport.sys - HCAPORT_TAG_CM
HcUc - hcaport.sys - HCAPORT_TAG_UCONTEXT
HcMr - hcaport.sys - HCAPORT_TAG_REMOVE_LOCK