windowswideopen.com

@GMM - <unknown> - (Intel video driver) Memory manager
@KCH - <unknown> - (Intel video driver) Chipset specific service
@MP - <unknown> - (Intel video driver) Miniport related memory
@SB - <unknown> - (Intel video driver) Soft BIOS

_ATI - <unknown> - ATI video driver

_LCD - monitor.sys - Monitor PDO name buffer

8042 - i8042prt.sys - PS/2 kb and mouse

AdSv - vmsrvc.sys - Virtual Machines Additions Service
ARPC - atmarpc.sys - ATM ARP Client
ATMU - atmuni.sys - ATM UNI Call Manager
Atom - <unknown> - Atom Tables
Abos - <unknown> - Abiosdsk
AcdM - <unknown> - TDI AcdObjectInfoG
AcdN - <unknown> - TDI AcdObjectInfoG
Acp* - acpi.sys - ACPI Pooltags
ACPI - acpi.sys - ACPI
Adap - <unknown> - Adapter objects
Adbe - <unknown> - Adobe’s font driver
AECi - <unknown> - filter object interface for MS acoustic echo canceller
Afd? - afd.sys - AFD objects
AfdA - afd.sys - Afd EA buffer
AfdB - afd.sys - Afd data buffer
AfdC - afd.sys - Afd connection structure
AfdD - afd.sys - Afd debug data
AfdE - afd.sys - Afd endpoint structure
AfdF - afd.sys - Afd TransmitFile info
AfdG - afd.sys - Afd group table
AfdI - afd.sys - Afd TDI data
AfdL - afd.sys - Afd local address buffer
AfdP - afd.sys - Afd poll info
AfdQ - afd.sys - Afd work queue item
AfdR - afd.sys - Afd remote address buffer
AfdS - afd.sys - Afd security info
AfdT - afd.sys - Afd transport info
AfdW - afd.sys - Afd work item
AfdX - afd.sys - Afd context buffer
Afda - afd.sys - Afd APC buffer (NT 3.51 only)
Afdc - afd.sys - Afd connect data buffer
Afdd - afd.sys - Afd disconnect data buffer
Afdf - afd.sys - Afd TransmitFile debug data
Afdh - afd.sys - Afd address list change buffer
Afdi - afd.sys - Afd “set inline mode” buffer
Afdl - afd.sys - Afd lookaside lists buffer
Afdp - afd.sys - Afd transport IRP buffer
Afdq - afd.sys - Afd routing query buffer
Afdr - afd.sys - Afd ERESOURCE buffer
Afdt - afd.sys - Afd transport address buffer
Afp - <unknown> - SFM File server
AlCI - nt!alpc - ALPC communication info
AlEv - nt!alpc - ALPC eventlog queue
AlIn - nt!alpc - ALPC Internal allocation
AlHa - nt!alpc - ALPC port handle table
AlMs - nt!alpc - ALPC message
ALPC - nt!alpc - ALPC port objects
AlRe - nt!alpc - ALPC section region
AlRr - nt!Alpc - ALPC resource reserves
AlSc - nt!alpc - ALPC section
AlSe - nt!alpc - ALPC client security
AlVi - nt!alpc - ALPC view
ATmp - AppTag mount point
ATon - AppTag object name
ATub - AppTag user buffer
ATgb - AppTag guid buffer
ATac - AppTag ATR command buffer
ATdi - AppTag cliendata index buffer
ATdt - AppTag cliendata temp buffer
ATFb - AppTag file id buffer

Aml* - <unknown> - ACPI AMLI Pooltags
APIC - pnpapic.sys - I/O APIC Driver
ArbA - nt!arb - ARBITER_ALLOCATION_STATE_TAG
ArbL - nt!arb - ARBITER_ORDERING_LIST_TAG
ArbM - nt!arb - ARBITER_MISC_TAG
ArbR - nt!arb - ARBITER_RANGE_LIST_TAG
Arp? - <unknown> - ATM ARP server objects, atmarps.sys
ArpA - <unknown> - AtmArpS address
ArpB - <unknown> - AtmArpS buffer space
ArpI - <unknown> - AtmArpS Interface structure
ArpK - <unknown> - AtmArpS ARP block
ArpM - <unknown> - AtmArpS MARS structure
ArpR - <unknown> - AtmArpS NDIS request
ArpS - <unknown> - AtmArpS SAP structure
Asy1 - <unknown> - ndis / ASYNC_IOCTX_TAG
Asy2 - <unknown> - ndis / ASYNC_INFO_TAG
Asy3 - <unknown> - ndis / ASYNC_ADAPTER_TAG
Asy4 - <unknown> - ndis / ASYNC_FRAME_TAG
AtC - <unknown> - IDE disk configuration
AtD - <unknown> - atdisk.c
ATIX - <unknown> - WDM mini drivers for ATI tuner, xbar, etc.
Atk - <unknown> - Appletalk transport
AtmA - <unknown> - Atoms
AtmT - <unknown> - Atom tables
AuxL - <unknown> - EXIFS Auxlist

Bat? - <unknown> - Battery Class drivers
BatC - <unknown> - Composite battery driver
BatM - <unknown> - Control method battery driver
BatS - <unknown> - Smart battery driver
Batt - <unknown> - Battery class driver
BCSP - bthbcsp.sys - Bluetooth BCSP minidriver
BCDK - nt!init - Kernel boot configuration data.
BIG - nt!mm - Large session pool allocations (ntos\ex\pool.c)
BlCc - blkcache.sys - Block Cache Driver
Bmfd - <unknown> - Font related stuff
BT3C - bt3c.sys - Bluetooth 3COM minidriver
BT8x - <unknown> - WDM mini drivers for Brooktree 848,829, etc.
BTHP - bthport.sys - Bluetooth port driver (generic)
BthS - bthport.sys - Bluetooth port driver (security)
BTME - bthenum.sys - Bluetooth enumerator
BTMO - bthmodem.sys - Bluetooth modem
BTPT - <unknown> - Bluetooth transport protocol library
BTSR - bthser.sys - Bluetooth serial minidriver
BTUR - bthuart.sys - Bluetooth UART minidriver
Bu* - <unknown> - burneng.sys from adaptec

Call - nt!ex - kernel callback object signature
call - <unknown> - debugging call tables
CBRe - <unknown> - CallbackRegistration
Cc - nt!cc - Cache Manager allocations (catch-all)
CcBc - nt!cc - Cache Manager Bcb from pool
CcBm - nt!cc - Cache Manager Bitmap
CcBn - nt!cc - Cache Manager Bcb trim notification entry
CcBr - nt!cc - Cache Manager Bitmap range
CcBz - nt!cc - Cache Manager Bcb Zone
CcDw - nt!cc - Cache Manager Deferred Write
CcEv - nt!cc - Cache Manager Event
CcFn - nt!cc - Cache Manager File name for popups
CcMb - nt!cc - Cache Manager Mbcb
CcOb - nt!cc - Cache Manager Overlap Bcb
CcPB - nt!ccpf - Prefetcher trace buffer
CcPC - nt!ccpf - Prefetcher context
CcPD - nt!ccpf - Prefetcher trace dump
CcPF - nt!ccpf - Prefetcher file name
CcPI - nt!ccpf - Prefetcher intermediate table
CcPL - nt!ccpf - Prefetcher read list
CcPM - nt!ccpf - Prefetcher metadata
CcPS - nt!ccpf - Prefetcher scenario
CcPT - nt!ccpf - Prefetcher trace
CcPc - nt!cc - Cache Manager Private Cache Map
CcPf - nt!ccpf - Prefetcher
CcPh - nt!ccpf - Prefetcher header preallocation
CcPp - nt!ccpf - Prefetcher instructions
CcPq - nt!ccpf - Prefetcher query buffer
CcPs - nt!ccpf - Prefetcher section table
CcPv - nt!ccpf - Prefetcher volume info
CcPw - nt!ccpf - Prefetcher boot worker
CcSc - nt!cc - Cache Manager Shared Cache Map
CcVa - nt!cc - Cache Manager Initial array of Vacbs
CcVl - nt!cc - Cache Manager Vacb Level structures (large streams)
CcVp - nt!cc - Cache Manager Array of Vacb pointers for a cached stream
CctX - <unknown> - EXIFX FCB Commit CTX
CcWq - nt!cc - Cache Manager Work Queue Item
CcWK - nt!cc - Kernel Cache Manager lookaside list
CcWk - nt!cc - Kernel Cache Manager lookaside list
CcZe - nt!cc - Cache Manager Buffer of Zeros
CdA - <unknown> - CdAudio filter driver
Cdcc - cdfs.sys - CDFS Ccb
Cddn - cdfs.sys - CDFS CdName in dirent
Cdee - cdfs.sys - CDFS Search expression for enumeration
Cdfd - cdfs.sys - CDFS Data Fcb
Cdfi - cdfs.sys - CDFS Index Fcb
Cdfl - cdfs.sys - CDFS Filelock
CdFn - cdfs.sys - CDFS Filename buffer
Cdfn - cdfs.sys - CDFS Nonpaged Fcb
Cdfs - cdfs.sys - CDFS General Allocation
Cdft - cdfs.sys - CDFS Fcb Table entry
Cdgs - cdfs.sys - CDFS Generated short name
Cdic - cdfs.sys - CDFS Irp Context
Cdil - cdfs.sys - CDFS Irp Context lite
Cdio - cdfs.sys - CDFS Io context for async reads
Cdma - cdfs.sys - CDFS Mcb array
Cdpe - cdfs.sys - CDFS Prefix Entry
CdPn - cdfs.sys - CDFS CdName in path entry
Cdpn - cdfs.sys - CDFS Prefix Entry name
Cdsp - cdfs.sys - CDFS Buffer for spanning path table
Cdtc - cdfs.sys - CDFS TOC
Cdun - cdfs.sys - CDFS Buffer for upcased name
Cdvd - cdfs.sys - CDFS Buffer for volume descriptor
Cdvp - cdfs.sys - CDFS Vpb allocated in filesystem
CIcr - ci.dll - Code Integrity allocations for image integrity checking
CIsc - ci.dll - Code Integrity core dll
CIha - ci.dll - Code Integrity hashes
ClfA - clfs.sys - CLFS_CONTAINER_TAG
ClfB - clfs.sys - CLFS_BASEFILE_TAG
ClfC - clfs.sys - CLFS_LOGFCBPHYSICAL_TAG
ClfD - clfs.sys - CLFS_LOGFCBVIRTUAL_TAG
ClfE - clfs.sys - CLFS_LOGCCB_TAG
ClfF - clfs.sys - CLFS_FLUSHELT_TAG
ClfG - clfs.sys - CLFS_REQUEST_TAG
ClfH - clfs.sys - CLFS_IOCB_TAG
ClfI - clfs.sys - CLFS_MARSHALBUFFER_TAG
Clfs - clfs.sys - CLFS_TAG
CM - nt!cm - Configuration Manager (registry)
CmcD - hal.dll - HAL CMC Driver Log
CmcK - hal.dll - HAL CMC Kernel Log
CmcT - hal.dll - HAL CMC temporary Log
CMCa - nt!cm - Configuration Manager Cache (registry)
CMDc - nt!cm - Configuration Manager Cache (registry)
CMkb - nt!cm - registry key control blocks
CMpb - nt!cm - registry post blocks
CMnb - nt!cm - registry notify blocks
CMpe - nt!cm - registry post events
CMpa - nt!cm - registry post apcs
CMsb - nt!cm - registry stash buffer
CmVn - nt!cm - captured value name
CMVw - nt!cm - registry mapped view of file
CMVa - nt!cm - value cache value tag
CMVI - nt!cm - value index cache tag
CMSc - nt!cm - security cache pooltag
CMSb - nt!cm - internal stash buffer pool tag
CMNb - nt!cm - notification block pool tag
CMIn - nt!cm - index hint pool tag
CM?? - nt!cm - Internal Configuration manager allocations
CMDa - nt!cm - value data cache pool tag
CMAl - nt!cm -internal registry memory allocator pool tag
Cngb - ksecdd.sys - CNG kmode crypto pool tag
COMX - serial.sys - serial driver allocations
Cont - <unknown> - Contiguous physical memory allocations for device drivers
CopW - <unknown> - EXIFS CopyOnWrite
Covr - nt!cov - Code Coverage pool tag
CpeD - hal.dll - HAL CPE Driver Log
CpeK - hal.dll - HAL CMC Kernel Log
CpeT - hal.dll - HAL CPE temporary Log
CPnp - classpnp.sys - ClassPnP transfer packets
Crsp - ksecdd.sys - CredSSP kernel mode client allocations
CrtH - <unknown> - EXIFS Create Header
Cryp - ksecdd.sys - Crypto allocations
CSdk - <unknown> - Cluster Disk Filter driver
CSnt - <unknown> - Cluster Network driver
CTE - <unknown> - Common transport environment (ntos\inc\cxport.h, used by tdi)
Cvli - <unknown> - EXIFS Cached Volume Info

D2d - <unknown> - Device Object to DosName rtns (ntos\rtl\dev2dos.c)
D3Dd - <unknown> - DX D3D driver (embedded in a display driver like s3mvirge.dll)
D851 - <unknown> - 8514a video driver
Dacl - <unknown> - Temp allocations for object DACLs
Dati - <unknown> - ati video driver
DbCb - nt!dbg - Debug Print Callbacks
DbLo - <unknown> - Debug logging
dcam - <unknown> - WDM mini driver for IEEE 1394 digital camera
Dcdd - cdd.dll - Canonical display driver
Dcl - <unknown> - cirrus video driver
Ddk - <unknown> - Default for driver allocated memory (user’s of ntddk.h)
Devi - <unknown> - Device objects

Dh 0 - <unknown> - DirectDraw/3D default object
Dh 1 - <unknown> - DirectDraw/3D DirectDraw object
Dh 2 - <unknown> - DirectDraw/3D Surface object
Dh 3 - <unknown> - DirectDraw/3D Direct3D context object
Dh 4 - <unknown> - DirectDraw/3D VideoPort object
Dh 5 - <unknown> - DirectDraw/3D MotionComp object

Dfb - <unknown> - framebuf video driver
DfC? - dfsc.sys - DFS Client allocations
DfCa - dfsc.sys - DFS Client PERUSERTABLE
DfCb - dfsc.sys - DFS Client REFCONTEXT
DfCc - dfsc.sys - DFS Client CONNECTION
DfCd - dfsc.sys - DFS Client CURRENTDC
DfCe - dfsc.sys - DFS Client CSCEA
DfCf - dfsc.sys - DFS Client FILENAME
DfCg - dfsc.sys - DFS Client PREFIXCACHE
DfCh - dfsc.sys - DFS Client HASH
DfCi - dfsc.sys - DFS Client INPUTBUFFER
DfCj - dfsc.sys - DFS Client REFERRALNAME
DfCj - dfsc.sys - DFS Client REWRITTENNAME
DfCl - dfsc.sys - DFS Client DCLIST
DfCm - dfsc.sys - DFS Client CMCONTEXT
DfCn - dfsc.sys - DFS Client DOMAINNAME
DfCp - dfsc.sys - DFS Client PATH
DfCq - dfsc.sys - DFS Client REGSTRING
DfCr - dfsc.sys - DFS Client REFERRAL
DfCs - dfsc.sys - DFS Client SHARENAME
DfCt - dfsc.sys - DFS Client TREECONNECT
DfCu - dfsc.sys - DFS Client USETABLE
DfCv - dfsc.sys - DFS Client SERVERNAME
DfCw - dfsc.sys - DFS Client TARGETINFO
DfCx - dfsc.sys - DFS Client CREDENTIALS
DfCy - dfsc.sys - DFS Client REMOTEENTRY
DfCz - dfsc.sys - DFS Client DOMAINREFERRAL
Dfs - <unknown> - Distributed File System
dfsr - <unknown> - RDBSS IRP allocation
Dfsm - <unknown> - Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdi\gre
dFVE - dumpfve.sys - Full Volume Encryption crash dump filter (Bitlocker Drive Encryption)
Dire - <unknown> - Directory objects
Dlck - <unknown> - deadlock verifier (part of driver verifier) structures
Dlmp - <unknown> - Video utility library for Vista display drivers
Dmga - <unknown> - mga (matrox) video driver
DmH? - <unknown> - DirectMusic hardware synthesizer
DmpS - dumpsvc.sys - Crashdump Service Driver
DmS? - <unknown> - DirectMusic kernel software synthesizer
Dndt - <unknown> - Device node
Dnod - <unknown> - Device node structure
DOPE - <unknown> - Device Object Power Extension (po component)
DPrf - <unknown> - Disk performance filter driver
DPwr - nt!pnp - PnP power management
Dprt - dxgkrnl.sys - Video port for Vista display drivers
Dps5 - <unknown> - NT5 PostScript printer driver
Dpsh - <unknown> - Postcript driver heap memory
Dpsi - <unknown> - psidisp video driver
Dpsm - <unknown> - Postcript driver memory
Dqv - <unknown> - qv (qvision) video driver
DrDr - rdpdr.sys - Global object
DrEx - rdpdr.sys - Exchange object
DrIC - rdpdr.sys - I/O context object
Driv - <unknown> - Driver objects
Drsd - <unknown> - Rasdd Printer Driver Pool Tag.
Dtga - <unknown> - tga video driver
Dump - <unknown> - Bugcheck dump allocations
Dun5 - <unknown> - NT5 Universal printer driver
DUQD - mpsdrv.sys - MPSDRV upcall user request
DV?? - <unknown> - RDR2 DAV MiniRedir Tags
DVCx - <unknown> - AsyncEngineContext, DAV MiniRedir
DVEx - <unknown> - Exchange, DAV MiniRedir
DVFi - <unknown> - FileInfo, DAV MiniRedir
DVFn - <unknown> - FileName, DAV MiniRedir
DVRw - <unknown> - ReadWrite, DAV MiniRedir
DVSc - <unknown> - SrvCall, DAV MiniRedir
DVSh - <unknown> - SharedHeap, DAV MiniRedir

Dvga - <unknown> - vga 16 color video driver
Dvg2 - <unknown> - vga 256 color video driver
Dvg6 - <unknown> - vga 64K color video driver
Dvgr - <unknown> - vga for risc video driver
DW32 - <unknown> - W32 video driver
Dwd - <unknown> - wd90c24a video driver
Dwp9 - <unknown> - weitekp9 video driver
Dxga - <unknown> - XGA video driver

DxgK - dxgkrnl.sys - Vista display driver support

Efsm - <unknown> - EFS driver
Efsc - <unknown> - EFS driver

Efst - <unknown> - EXIFS FS Statistics

Envr - <unknown> - Environment strings
Err - <unknown> - Error strings

EtwA - nt!etw - Etw APC
EtwG - nt!etw - Etw Guid
EtwD - nt!etw - Etw DataBlock
EtwS - nt!etw - Etw DataSource
EtwR - nt!etw - Etw Registration
EtwC - nt!etw - Etw Realtime Consumer
EtwB - nt!etw - Etw Buffer
EtwP - nt!etw - Etw Pool
EtwQ - nt!etw - Etw Queue
Etwq - nt!etw - Etw ReplyQueue
Etwr - nt!etw - Etw ReplyQueue Entry
EtwL - nt!etw - ETW_LOGGER_CONTEXT
Etwp - nt!etw - ETW per-processor block

Evel - <unknown> - EFS file system filter driver lookaside list
Even - <unknown> - Event objects
Evid - <unknown> - Rtl Event ID’s
ExWl - <unknown> - Executive worker list entry

Fat - fastfat.sys - Fat File System allocations
FatB - fastfat.sys - Fat allocation bitmaps
FatC - fastfat.sys - Fat Ccbs
FatD - fastfat.sys - Fat pool dirents
FatE - fastfat.sys - Fat EResources
FatF - fastfat.sys - Fat Fcbs
FatI - fastfat.sys - Fat IrpContexts
FatL - fastfat.sys - Fat FAT entry lookup buffer on verify
FatN - fastfat.sys - Fat Nonpaged Fcbs
FatO - fastfat.sys - Fat I/O buffer
FatP - fastfat.sys - Fat output for query retrieval pointers (caller frees)
FatQ - fastfat.sys - Fat buffered user buffer
FatR - fastfat.sys - Fat repinned Bcb
FatS - fastfat.sys - Fat stashed Bpb
FatT - fastfat.sys - Fat directory allocation bitmaps
FatV - fastfat.sys - Fat Vcb stat bucket
Fatv - fastfat.sys - Fat events
FatW - fastfat.sys - Fat FAT windowing structure
FatX - fastfat.sys - Fat IO contexts
Fatb - fastfat.sys - Fat Bcb arrays
Fatd - fastfat.sys - Fat EA data
Fate - fastfat.sys - Fat EA set headers
Fatf - fastfat.sys - Fat deferred flush contexts
Fati - fastfat.sys - Fat IO run descriptor
Fatn - fastfat.sys - Fat filename buffer
Fatr - fastfat.sys - Fat verification-time rootdir snapshot
Fats - fastfat.sys - Fat verification-time boot sector
Fatv - fastfat.sys - Fat backpocket Vpb
Fatx - fastfat.sys - Fat delayed close contexts

Fcbl - <unknown> - EXIFS FCBlock
fboX - <unknown> - EXIFS FOBXVF List

File - <unknown> - File objects
FIcn - fileinfo.sys - FileInfo FS-filter Create Retry Path
FIcp - fileinfo.sys - FileInfo FS-filter Extra Create Parameter
FIcs - fileinfo.sys - FileInfo FS-filter Stream Context
FIcv - fileinfo.sys - FileInfo FS-filter Volume Context
FIOc - fileinfo.sys - FileInfo FS-filter Prefetch Open Context
FIou - fileinfo.sys - FileInfo FS-filter User Open Context
FIof - fileinfo.sys - FileInfo FS-filter File Object Context
FIPc - fileinfo.sys - FileInfo FS-filter Prefetch Context
FIvn - fileinfo.sys - FileInfo FS-filter Volume Name
FIvp - fileinfo.sys - FileInfo FS-filter Volume Properties

Flop - <unknown> - floppy driver

Flst - <unknown> - EXIFS Freelist

FLex - <unknown> - exclusive file lock
FLfl - <unknown> - exported (non-private) file lock
FLli - <unknown> - per-file lock information
FLln - <unknown> - shared lock tree node
FLsh - <unknown> - shared file lock
FLwl - <unknown> - waiting lock

FM?? - fltmgr.sys - Unrecognized FltMgr tag (update pooltag.w)
FMac - fltmgr.sys - ASCII String buffers
FMas - fltmgr.sys - ASYNC_IO_COMPLETION_CONTEXT structure
FMcb - fltmgr.sys - FLT_CCB structure
FMcr - fltmgr.sys - Context registration structures
FMct - fltmgr.sys - TRACK_COMPLETION_NODES structure
FMdl - fltmgr.sys - Array of DEVICE_OBJECT pointers
FMea - fltmgr.sys - EA buffer for create
FMfc - fltmgr.sys - FLTMGR_FILE_OBJECT_CONTEXT structure
FMfi - fltmgr.sys - Fast IO dispatch table
FMfk - fltmgr.sys - Byte Range Lock structure
FMfl - fltmgr.sys - FLT_FILTER structure
FMfn - fltmgr.sys - NAME_CACHE_NODE structure
FMfr - fltmgr.sys - FLT_FRAME structure
FMfz - fltmgr.sys - FILE_LIST_CTRL structure
FMib - fltmgr.sys - Irp SYSTEM buffers
FMic - fltmgr.sys - IRP_CTRL structure
FMin - fltmgr.sys - FLT_INSTANCE name
FMil - fltmgr.sys - IRP_CTRL completion node stack
FMis - fltmgr.sys - FLT_INSTANCE structure
FMla - fltmgr.sys - Per-processor IRPCTRL lookaside lists
FMnc - fltmgr.sys - NAME_CACHE_CREATE_CTRL structure
FMng - fltmgr.sys - NAME_GENERATION_CONTEXT structure
FMol - fltmgr.sys - OPLOCK_CONTEXT structure
FMos - fltmgr.sys - Operation status ctrl structure
FMpl - fltmgr.sys - Cache aware pushLock
FMpr - fltmgr.sys - FLT_PRCB structure
FMrl - fltmgr.sys - FLT_OBJECT rundown logs
FMrp - fltmgr.sys - Reparse point data buffer
FMrr - fltmgr.sys - Per-processor Cache-aware rundown ref structure
FMsd - fltmgr.sys - Security descriptors
FMsl - fltmgr.sys - STREAM_LIST_CTRL structure
FMtn - fltmgr.sys - Temporary file names
FMtr - fltmgr.sys - Temporary Registry information
FMts - fltmgr.sys - Tree Stack
FMus - fltmgr.sys - Unicode string
FMvf - fltmgr.sys - FLT_VERIFIER_EXTENSION structure
FMvj - fltmgr.sys - FLT_VERIFIER_OBJECT structure
FMvo - fltmgr.sys - FLT_VOLUME structure
FMwi - fltmgr.sys - Work item structures
FMcn - fltmgr.sys - Non paged context extension structures.
FMtp - fltmgr.sys - Non Paged tx vol context structures.
FMlp - fltmgr.sys - Paged stream list control entry structures.

Fsrc - fsrec.sys - Filesystem recognizer (fsrec.sys)

Fstb - <unknown> - ntos\fstub
FstB - <unknown> - ntos\fstub

FsVg - fsvga.sys - International VGA support

flnk - <unknown> - font link tag used in ntgdi\gre

FS?? - nt!fsrtl - Unrecoginzed File System Run Time allocations (update pooltag.w)
FSeh - nt!fsrtl - File System Run Time Extra Create Parameter Entry
FSel - nt!fsrtl - File System Run Time Extra Create Parameter List
FSfm - nt!fsrtl - File System Run Time Fast Mutex Lookaside List
FSim - nt!fsrtl - File System Run Time Mcb Initial Mapping Lookaside List
FSrt - nt!fsrtl - File System Run Time allocations (DO NOT USE!)
FSmg - nt!fsrtl - File System Run Time
FSrd - nt!fsrtl - File System Run Time
FSrm - nt!fsrtl - File System Run Time
FSrn - nt!fsrtl - File System Run Time
FSrN - nt!fsrtl - File System Run Time
FSro - nt!fsrtl - File System Run Time
FSrs - nt!fsrtl - File System Run Time Work Item for low-stack posting
FSun - nt!fsrtl - File System Run Time
FOCX - nt!fsrtl - File System Run Time File Object Context structure

FTrc - <unknown> - Fault tolerance Slist tag.
FtC - <unknown> - Fault tolerance driver
FtM - <unknown> - Fault tolerance driver
FtS - <unknown> - Fault tolerance driver
FtT - <unknown> - Fault tolerance driver
FtU - <unknown> - Fault tolerance driver
FtV - <unknown> - Fault tolerance driver
<unknown>

FtpA - mpsdrv.sys - MPSDRV FTP protocol analyzer
FwfD - mpsdrv.sys - MPSDRV driver buffer for flattening NET_BUFFFER

FVE? - fvevol.sys - Full Volume Encryption Filter Driver (Bitlocker Drive Encryption)
FVE0 - fvevol.sys - General allocations
FVEc - fvevol.sys - Cryptographic allocations
FVEl - fvevol.sys - FVELIB allocations
FVEp - fvevol.sys - Write buffers
FVEr - fvevol.sys - Reserved mapping addresses
FVEv - fvevol.sys - Conversion allocations
FVEw - fvevol.sys - Worker threads
FVEx - fvevol.sys - Read/write control structures

FxDr - wdf01000.sys - KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable.
FxLg - wdf01000.sys - KMDF IFR log tag
FxL? - wdfldr.sys - KMDF Loader Pool allocation

Fwpp - fwpkclnt.sys - Windows Filtering Platform export driver.

G??? - <unknown> - Gdi Objects
G - <unknown> - Gdi Generic allocations
Gcac - <unknown> - Gdi glyph cache
Gcap - <unknown> - Gdi capture buffer
Gcsl - <unknown> - Gdi string resource script names
Gdbr - <unknown> - Gdi driver brush realization
Gdd - <unknown> - Gdi ddraw PKEY_VALUE_FULL_INFORMATION
Gdda - <unknown> - Gdi ddraw attach list
GddD - <unknown> - Gdi ddraw dummy page
Gdde - <unknown> - Gdi ddraw event
Gddf - <unknown> - Gdi ddraw driver heaps
Gddp - <unknown> - Gdi ddraw driver caps
Gddv - <unknown> - Gdi ddraw driver video memory list
Gdwd - win32k.sys - Gdi watchdog support objects
Gdxd - <unknown> - Gdi ddraw VPE directdraw object
Gdxs - <unknown> - Gdi ddraw VPE surface, videoport, capture object
Gdxx - <unknown> - Gdi ddraw VPE DXAPI object
Gdev - <unknown> - Gdi GDITAG_DEVMODE
GDev - <unknown> - Gdi pdev
Gdrs - <unknown> - Gdi GDITAG_DRVSUP
Gebr - <unknown> - Gdi ENGBRUSH
gEdg - <unknown> - Gdi gradient fill triangle
Gffv - <unknown> - Gdi FONTFILEVIEW
gFil - <unknown> - Gdi FILEVIEW
GFil - <unknown> - Gdi engine descriptor list
Gfsb - <unknown> - Gdi font sustitution list
Gfsm - <unknown> - Gdi Fast mutex
Ggdv - <unknown> - Gdi GDITAG_GDEVICE
Gglb - <unknown> - Gdi temp buffer
Ggls - <unknown> - Gdi glyphset
Ggb - <unknown> - Gdi glyph bits
Ggbl - <unknown> - Gdi look aside buffers
Ghmg - <unknown> - Gdi handle manager objects
Gini - <unknown> - Gdi fast mutex
Gh?? - win32k.sys - Gdi Handle manager specific object types: defined in w32\ntgdi\inc\ntgdistr.h
Gla? - win32k.sys - Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdi\inc\ntgdistr.h
Gldv - <unknown> - Gdi Ldev
Glnk - <unknown> - Gdi PFELINK
Gmap - <unknown> - Gdi font map signature table
Gpff - <unknown> - Gdi physical font file
Gpft - <unknown> - Gdi font table
Gsem - <unknown> - Gdi Semaphores
Gsp - <unknown> - Gdi sprite
Gspr - <unknown> - Gdi sprite grow range
Gtmp - <unknown> - Gdi temporary allocations
Gtmw - <unknown> - Gdi TMW_INTERNAL
Gxlt - <unknown> - Gdi Xlate

Gfcb - <unknown> - EXIFS Grow FCB

Hal - hal.dll - Hardware Abstraction Layer
HalV - ntoskrnl.exe - Driver Verifier DMA checking
Hpfs - <unknown> - Pinball (aka Hpfs) allocations
HisC - <unknown> - histogram filter driver
Hist - <unknown> - histogram filter driver
HidP - <unknown> - HID Parser
HidC - <unknown> - HID Class
HdCl - <unknown> - HID Client Sample Driver
HpMM - pnpmem.sys - HotPlug Memory Driver

HCID - bthport.sys - Bluetooth port driver HCI debug
HCIT - bthport.sys - Bluetooth port driver (HCI)

HcRs - hcaport.sys - HCAPORT_TAG_RESOURCE_LIST
HcEv - hcaport.sys - HCAPORT_TAG_EVENT
HcdI - hcaport.sys - HCAPORT_TAG_HWID
HcEn - hcaport.sys - HCAPORT_TAG_ENUM
HcMc - hcaport.sys - HCAPORT_TAG_MISC
HcDr - hcaport.sys - HCAPORT_TAG_DEVICE_RELATIONS
HcBm - hcaport.sys - HCAPORT_TAG_BITMAP
HcOb - hcaport.sys - HCAPORT_TAG_OBJECT
HcCq - hcaport.sys - HCAPORT_TAG_CQUEUE
HcPr - hcaport.sys - HCAPORT_TAG_PROTD
HPmi - hcaport.sys - HCAPORT_TAG_PMI_EXTENSION
HcMa - hcaport.sys - HCAPORT_TAG_MAD
HcMp - hcaport.sys - HCAPORT_TAG_MINIPORT
HcCm - hcaport.sys - HCAPORT_TAG_CM
HcUc - hcaport.sys - HCAPORT_TAG_UCONTEXT
HcMr - hcaport.sys - HCAPORT_TAG_REMOVE_LOCK
Hmgo - hcaport.sys - HCAPORT_TAG_WQ_MG_INFO
Hioc - hcaport.sys - HCAPORT_TAG_IOC_SERVICE_TABLE

hSVD - mrxdav.sys - Shared Heap Tag

HT01 - <unknown> - GDI Halftone AddCachedDCI() for CurCDCIData
HT02 - <unknown> - GDI Halftone GetCachedDCI() for Threshold
HT03 - <unknown> - GDI Halftone FindCachedSMP() for CurCSMPData
HT04 - <unknown> - GDI Halftone FindCachedSMP() for CurCSMPBmp
HT05 - <unknown> - GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI
HT06 - <unknown> - GDI Halftone pDCIAdjClr() for DEVCLRADJ
HT07 - <unknown> - GDI Halftone ComputeRGB555LUT() for RGBLUT
HT08 - <unknown> - GDI Halftone ColorTriadSrcToDev() for RGB-XYZ
HT09 - <unknown> - GDI Halftone ColorTriadSrcToDev() for CRTX-FD6XYZ Cache
HT10 - <unknown> - GDI Halftone CreateDyesColorMappingTable() for DevPrims
HT11 - <unknown> - GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable
HT12 - <unknown> - GDI Halftone ThresholdsFromYData() for pYData
HT13 - <unknown> - GDI Halftone ComputeHTCellRegress() for pThresholds
HT14 - <unknown> - GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine
HT15 - <unknown> - GDI Halftone CalculateStretch() for PrimColorInfo

Hvlm - nt!Hvl - Temporary MDL for the Hvl component.
HvlP - nt!Hvl - Hypercall marshalling pages for the Hvl component.

IBCM - wibcm.sys - CM_INSTANCE_TAG Windows Infiniband Communications Manager
CEP - wibcm.sys - CEP_INSTANCE_TAG
CMSH - wibcm.sys - WIBCM_SHARED_TAG
CMWK - wibcm.sys - WIBCM_WORK_TAG
CMWT - wibcm.sys - WIBCM_TIMER_TAG

IBm* - wibms.sys - Windows Infiniband Management Server pool tags

IbPm - wibpm.sys - WIBPM_TAG Windows Infiniband Performance Manager
IbPS - wibpm.sys - WIBPM_SENT_TAG
IbPI - wibpm.sys - WIBPM_ITEM_TAG
IbPA - wibpm.sys - WIBPM_SAMPLE_TAG

IbW0 - wibwmi.sys - WIBWMI0_TAG Windows Infiniband WMI Manager
IbW1 - wibwmi.sys - WIBWMI1_TAG
IbW2 - wibwmi.sys - WIBWMI2_TAG

IPX - <unknown> - Nwlnkipx transport
Icp - <unknown> - I/O completion packets queue on a completion ports
IcpP - <unknown> - NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers
IdeP - <unknown> - atapi IDE
IdeX - <unknown> - PCI IDE
idle - <unknown> - Power Manager idle handler
Ifs - <unknown> - Default file system allocations (user’s of ntifs.h)
Info - <unknown> - general system information allocations
Io - nt!io - general IO allocations
IoCc - nt!io - Io completion context
IoEa - nt!io - Io extended attributes
IoEr - nt!io - Io error log packets
IoFc - nt!io - Io name transmogrify operation
IoFs - nt!io - Io shutdown packet
IoFu - nt!pnp - Io file utils
IoKB - <unknown> - Registry basic key block (temp allocation)
IoNm - nt!io - Io parsing names
IoRb - nt!io - Io remote boot related
IoRN - nt!io - Registry key name (temp allocation)
IoSe - nt!io - Io security related
IoSh - nt!io - Io shutdown packet
IoSt - nt!io - Io Stream Identifier Context
IoTi - nt!io - Io timers
IoTt - nt!vf - I/O verifier IRP tracking table
Ioin - <unknown> - Io interrupts
IoOp - nt!io - I/O subsystem open packet
IoRi - nt!io - I/O SubSystem Driver Reinitialization Callback Packet
IoUs - nt!io - I/O SubSystem completion Context Allocation
Irp - <unknown> - Io, IRP packets
Irp+ - nt!vf - I/O verifier allocated IRP packets
IrpB - nt!vf - I/O verifier direct I/O double buffer allocation
Irpd - nt!vf - I/O verifier deferred completion context
Irps - nt!vf - I/O verifier per-IRP session tracking data
Irpt - nt!vf - I/O verifier per-IRP tracking data
IrpC - nt!vf - I/O verifier stack contexts
Irpl - nt!io - system large IRP lookaside list
Irps - nt!io - system small IRP lookaside list
Isap - <unknown> - Pnp Isa bus extender
II?? - <unknown> - IP in IP tunneling
IIrf - <unknown> - Free memory
IIdt - <unknown> - Data
IITn - <unknown> - Tunnel
IIhd - <unknown> - Header
IIpk - <unknown> - Packet
IIsc - <unknown> - Send Context
IIts - <unknown> - Transfer Context
IIwc - <unknown> - Work Context

Im* - <unknown> - Imapi.sys from adaptec

INTC - <unknown> - Intel video driver

IPm? - <unknown> - IP Multicasting
IPmg - <unknown> - Group
IPms - <unknown> - Source
IPmo - <unknown> - Outgoing Interface
IPmm - <unknown> - Message
IPmf - <unknown> - Free memory (only in checked builds)

Ip?? - ipsec.sys - IP Security
IpSI - ipsec.sys - initial allocations
IpAT - ipsec.sys - AH headers in transport mode
IpAU - ipsec.sys - AH headers in tunnel mode
IpET - ipsec.sys - ESP headers in transport mode
IpEU - ipsec.sys - ESP headers in tunnel mode
IpHT - ipsec.sys - HUGHES headers in transport mode
IpHU - ipsec.sys - HUGHES headers in tunnel mode
IpAX - ipsec.sys - Key acquire contexts
IpFI - ipsec.sys - Filter blocks
IpSA - ipsec.sys - Security Associations
IpKE - ipsec.sys - keys
IpTI - ipsec.sys - timers
IpSQ - ipsec.sys - stall queues
IpLA - ipsec.sys - lookaside lists
IpBP - ipsec.sys - buffer pools
IpSC - ipsec.sys - send complete context
IpEQ - ipsec.sys - event queue
IpHW - ipsec.sys - hardware accleration items
IpCO - ipsec.sys - IP compression

ItoM - tcpip.sys - IPsec task offload interface
ItoD - tcpip.sys - IPsec task offload delete SA
ItoS - tcpip.sys - IPsec task offload add SA
ItoC - tcpip.sys - IPsec task offload context
ItoO - tcpip.sys - IPsec task offload paramters

IpFl - mpsdrv.sys - MPSDRV IP Flow

IrD? - <unknown> - IrDA TDI and RAS drivers

IU?? - <unknown> - IIS Utility Driver
IUDl - <unknown> - Lookaside list allocations
IUcp - <unknown> - completion port minipackets

KAPC - nt!io - I/O SubSystem HardError APC
KbdC - <unknown> - Keyboard Class Driver
KCfe - <unknown> - Kernel COM factory entry
Ke - <unknown> - Kernel data structures
KeIC - <unknown> - Kernel Interrupt Object Chain
Key - <unknown> - Key objects
KMIX - <unknown> - Kmixer (wdm audio)
KNMI - <unknown> - Kernel NMI Callback object
KrbC - ksecdd.sys - Kerberos Client package
KSah - <unknown> - Ks auxiliary stream headers
KSAI - <unknown> - allocator instance
KSai - <unknown> - default allocator instance header
KSbi - <unknown> - event buffered item
KSCI - <unknown> - clock instance
KSce - <unknown> - create item entry
KSch - <unknown> - create handler entry
KSci - <unknown> - default clock instance header
KScp - <unknown> - object creation parameters auxiliary copy
KSda - <unknown> - default allocator
KSdc - <unknown> - default clock
KSdh - <unknown> - device header
Kse0 - ksecdd.sys - Security driver allocs for sec package 0
Kse1 - ksecdd.sys - Security driver allocs for sec package 1
Kse2 - ksecdd.sys - Security driver allocs for sec package 2
Kse3 - ksecdd.sys - Security driver allocs for sec package 3
Kse4 - ksecdd.sys - Security driver allocs for sec package 4
Kse5 - ksecdd.sys - Security driver allocs for sec package 5
Kse6 - ksecdd.sys - Security driver allocs for sec package 6
Kse7 - ksecdd.sys - Security driver allocs for sec package 7
Kse8 - ksecdd.sys - Security driver allocs for sec package 8
Kse9 - ksecdd.sys - Security driver allocs for sec package 9
Ksec - ksecdd.sys - Security device driver
KSed - <unknown> - event dpc item
KSee - <unknown> - event entry
KSed - <unknown> - oneshot event deletion dpc
KSep - <unknown> - irp system buffer event parameter
KseS - ksecdd.sys - Security driver allocs for LSA proper
KSew - <unknown> - oneshot event deletion workitem
KseZ - ksecdd.sys - Security driver allocs for default sec package
KSqr - <unknown> - QM quality report
KSer - <unknown> - QM error report
KSfd - <unknown> - filter cache data (MSKSSRV)
KsFI - <unknown> - filter instance
KSns - <unknown> - null security object
KSnv - <unknown> - registry name value
KSoh - <unknown> - object header
KSop - <unknown> - object creation parameters
KSpc - <unknown> - port driver instance FsContext
KSPI - <unknown> - pin instance
KSpp - <unknown> - irp system buffer property/method/event parameter
KSpt - <unknown> - pin type list (MSKSSRV)
KSqf - <unknown> - query information file buffer
KSsc - <unknown> - port driver stream FsContext
KSsf - <unknown> - set information file buffer
KSsh - <unknown> - stream headers
KSsi - <unknown> - software bus interface
KSsl - <unknown> - symbolic link buffer (MSKSSRV)
KSsp - <unknown> - serialized property set
KsoO - <unknown> - WDM audio stuff
L2CA - bthport.sys - Bluetooth port driver (L2CAP)
L2T0 - <unknown> - ndis\l2tp / MTAG_FREED
L2T1 - <unknown> - ndis\l2tp / MTAG_ADAPTERCB
L2T2 - <unknown> - ndis\l2tp / MTAG_TUNNELCB
L2T3 - <unknown> - ndis\l2tp / MTAG_VCCB
L2T4 - <unknown> - ndis\l2tp / MTAG_VCTABLE
L2T5 - <unknown> - ndis\l2tp / MTAG_WORKITEM
L2T6 - <unknown> - ndis\l2tp / MTAG_TIMERQ
L2T7 - <unknown> - ndis\l2tp / MTAG_TIMERQITEM
L2T8 - <unknown> - ndis\l2tp / MTAG_PACKETPOOL
L2T9 - <unknown> - ndis\l2tp / MTAG_FBUFPOOL
L2Ta - <unknown> - ndis\l2tp / MTAG_HBUFPOOL
L2Tb - <unknown> - ndis\l2tp / MTAG_TDIXRDG
L2Tc - <unknown> - ndis\l2tp / MTAG_TDIXSDG
L2Td - <unknown> - ndis\l2tp / MTAG_CTRLRECD
L2Te - <unknown> - ndis\l2tp / MTAG_CTRLSENT
L2Tf - <unknown> - ndis\l2tp / MTAG_PAYLRECD
L2Tg - <unknown> - ndis\l2tp / MTAG_PAYLSENT
L2Th - <unknown> - ndis\l2tp / MTAG_INCALL
L2Ti - <unknown> - ndis\l2tp / MTAG_UTIL
L2Tj - <unknown> - ndis\l2tp / MTAG_ROUTEQUERY
L2Tk - <unknown> - ndis\l2tp / MTAG_ROUTESET
L2Tl - <unknown> - ndis\l2tp / MTAG_L2TPPARAMS
L2Tm - <unknown> - ndis\l2tp / MTAG_TUNNELWORK
L2Tn - <unknown> - ndis\l2tp / MTAG_TDIXROUTE
LANE - atmlane.sys - LAN Emulation Client for ATM
LB?? - <unknown> - LM Datagram receiver allocations
LBan - <unknown> - Server announcement
LBvb - <unknown> - View buffer
LBma - <unknown> - Master announce context
LBxp - <unknown> - Transport
LBxn - <unknown> - TransportName
LBxm - <unknown> - Master name
LBtn - <unknown> - Transport name
LBea - <unknown> - Ea buffer
LBdi - <unknown> - POOL_DOMAIN_INFO
LBds - <unknown> - Send datagram context
LBci - <unknown> - Connection info
LBmh - <unknown> - Mailslot header
LBbl - <unknown> - Backup List
LBsl - <unknown> - Browser server list
LBbs - <unknown> - Browser server
LBgb - <unknown> - GetBackupList request
LBbr - <unknown> - GetBackupList response
LBmb - <unknown> - Mailslot Buffer
LBid - <unknown> - Illegal datagram context
LBbn - <unknown> - Name
LBnn - <unknown> - Name name
LBic - <unknown> - IRP context
LBwi - <unknown> - Work item
LBel - <unknown> - Election context
LBbb - <unknown> - Become backup context
LBbr - <unknown> - Become backup request
LBpn - <unknown> - Paged Name
LBpt - <unknown> - Paged transport
LBse - <unknown> - Browser security

Lbuf - <unknown> - EXIFS Large Buffer

LeoC - <unknown> - Symantec/Norton AntiVirus filter driver
List - <unknown> - kernel utilities list allocation
LCam - <unknown> - WDM mini video capture driver for Logitech camera
Lfs - <unknown> - Lfs allocations
LfsI - <unknown> - Lfs allocations
LogA - clfs.sys - CLFS_APITEST_TAG
LpcZ - <unknown> - LPC Zone
LpcM - <unknown> - Local procedure call message blocks
Lr?? - <unknown> - LM redirector allocations
Lr - <unknown> - Generic allocations
Lrcx - <unknown> - Context blocks of various types
Lrcl - <unknown> - ConnectListEntries
Lrsl - <unknown> - ServerListEntries
Lrse - <unknown> - Security entry
Lrsc - <unknown> - Search Control Blocks
Lrea - <unknown> - EA related allocations
Lric - <unknown> - Instance Control Blocks
Lrfc - <unknown> - File Control Blocks
Lrfl - <unknown> - Fcb Locks
Lrfp - <unknown> - Fcb Paging locks
Lrcn - <unknown> - Computer Name
Lrdn - <unknown> - Domain Name
Lr?? - <unknown> - Buffers used for FsControlFile APIs
Lrlc - <unknown> - Lock Control Blocks
Lrlb - <unknown> - Lock Control Block buffers
Lrnf - <unknown> - Non paged FCB
Lrnt - <unknown> - Non paged transport
Lrps - <unknown> - Paged security entry
Lrte - <unknown> - Transport event.
Lrxx - <unknown> - Transceive context blocks
Lr!! - <unknown> - Cancel request context blocks
Lrmt - <unknown> - MPX table
Lrme - <unknown> - MPX table entries
Lrsx - <unknown> - Send contexts
Lraw - <unknown> - Async write context
Lrwb - <unknown> - Write behind buffer header
Lrbb - <unknown> - Write behind buffer
Lrwq - <unknown> - Work queue item
Lrac - <unknown> - ACL for redirector
Lrds - <unknown> - Security Descriptor for redirector
Lrsm - <unknown> - SMB buffer
Lrds - <unknown> - Duplicated ansi string
Lrdu - <unknown> - Duplicated unicode string
Lxpt - <unknown> - Transport
Lrtc - <unknown> - Transport connection
Lrna - <unknown> - Netbios Addresses
Lrca - <unknown> - Temporary storage used in name canonicalization
Lr2x - <unknown> - Transact SMB context
Lrpt - <unknown> - Primary transport server list
Lrso - <unknown> - Operating system name
Lref - <unknown> - Reference history (debug only)
LS?? - <unknown> - LM server allocations
LSac - <unknown> - BlockTypeAdminCheck
LSas - <unknown> - BlockTypeAdapterStatus
LSbf - <unknown> - buffer descriptor
LScd - <unknown> - comm device
LScn - <unknown> - connection
LSdb - <unknown> - data buffer
LSdc - <unknown> - BlockTypeDirCache
LSdi - <unknown> - BlockTypeDirectoryInfo
LSep - <unknown> - endpoint
LSfn - <unknown> - BlockTypeFSName
LSlf - <unknown> - LFCB
LSlr - <unknown> - BlockTypeLargeReadX
LSmf - <unknown> - MFCB
LSmi - <unknown> - BlockTypeMisc
LSnh - <unknown> - nonpaged block header
LSni - <unknown> - BlockTypeNameInfo
LSop - <unknown> - oplock break wait
LSpc - <unknown> - paged connection
LSpm - <unknown> - paged MFCB
LSpr - <unknown> - paged RFCB
LSrf - <unknown> - RFCB
LSsc - <unknown> - search(core)
LSsd - <unknown> - BlockTypeShareSecurityDescriptor
LSsf - <unknown> - BlockTypeDfs
LSsh - <unknown> - share
LSsp - <unknown> - search(core complete)
LSsr - <unknown> - search
LSss - <unknown> - session
LStb - <unknown> - table
LStc - <unknown> - tree connect
LSti - <unknown> - timer
LStr - <unknown> - transaction
LSvi - <unknown> - BlockTypeVolumeInformation
LSwi - <unknown> - initial work context
LSwn - <unknown> - normal work context
LSwq - <unknown> - BlockTypeWorkQueue
LSwr - <unknown> - raw work context
LSws - <unknown> - BlockTypeWorkContextSpecial
LSnd - <unknown> - WDM mini sound driver for Logitech video camera
Luaf - luafv.sys - LUA File Virtualization
LXMK - <unknown> - kernel mixer line driver (KMXL - looks like they got their tag backwards)

MXF - <unknown> - DirectMusic (MIDI Transform Filter)

MapP - <unknown> - PNP map
Mapr - <unknown> - arc firmware registry routines

McaC - hal.dll - HAL MCA corrected Log
McaD - hal.dll - HAL MCA Driver Log
McaK - hal.dll - HAL MCA Kernel Log
McaP - hal.dll - HAL MCA Log from previous boot
McaT - hal.dll - HAL MCA temporary Log

MCAM - <unknown> - WDM mini driver for Intel USB camera
MCDx - <unknown> - OpenGL MCD server (mcdsrv32.dll) allocations
MCDd - <unknown> - OpenGL MCD driver (embedded in a display driver like s3mvirge.dll)
Mdl - <unknown> - Io, Mdls
MdlP - <unknown> - MDL per processor lookaside list pointers
MePr - <unknown> - In-memory print buffer
mkup - mpsdrv.sys - MPSDRV upcall request
Mm - nt!mm - general Mm Allocations
MmAc - nt!mm - Mm access log buffers
MmBk - nt!mm - Mm banked sections
MmCa - nt!mm - Mm control areas for mapped files
MmCd - nt!mm - Mm fork clone descriptors
MmCh - nt!mm - Mm fork clone headers
MmCi - nt!mm - Mm control areas for images
MmCl - nt!mm - Mm fork clone prototype PTEs
MmCm - nt!mm - Calls made to MmAllocateContiguousMemory
MmCr - nt!mm - Mm fork clone roots
MmCt - nt!mm - Mm debug tracing
MmDb - nt!mm - NtMapViewOfSection service
MmDT - nt!mm - Mm debug
MmEx - nt!mm - Mm events
MmHi - nt!mm - Mm image entry - allocated per session
MmHn - nt!mm - Mm sessionwide address name string entry
MmHv - nt!mm - Mm sessionwide address entry
MmIn - nt!mm - Mm inpaged io structures
MmLd - nt!mm - Mm load module database
MmPd - nt!mm - Mm page table commitment bitmaps
MmPg - nt!mm - Mm page table pages at init time
MmRp - nt!mm - Mm repurpose logging
MmRw - nt!mm - Mm read write virtual memory buffers
MmSb - nt!mm - Mm subsections
MmSe - nt!mm - Mm secured VAD allocation
MmSg - nt!mm - Mm segments
MmSt - nt!mm - Mm section object prototype ptes
MmSy - nt!mm - Mm PTE and IO tracking logs
Mmdl - nt!mm - Mm Mdls for flushes
Mmpp - nt!mm - Mm prototype PTEs for pool
Mmpr - nt!mm - Mm physical VAD roots
MmVd - nt!mm - Mm virtual address descriptors for mapped views
MmVs - nt!mm - Mm virtual address descriptors short form (private views)
Mmxx - nt!mm - Mm temporary allocations
MmCx - nt!mm - info for dynamic section extension
MmDm - nt!mm - deferred MmUnlock entries
MmHt - nt!mm - session space PTE data
MmLn - nt!mm - temporary name buffer for driver loads
MmMl - nt!mm - physical memory range information
MmPa - nt!mm - pagefile space deletion slist entries
MmRl - nt!mm - temporary readlists for file prefetch
MmSP - nt!mm - SLIST entries for system PTE NB queues
MmSi - nt!mm - Control area security image stubs
MmSc - nt!mm - subsections used to map data files
MmSd - nt!mm - extended subsections used to map data files
MmSm - nt!mm - segments used to map data files
MmWe - nt!mm - Work entries for writing out modified filesystem pages.
MmWw - nt!mm - Write watch VAD info
Mmpv - nt!mm - Physical view VAD info
Mmww - nt!mm - Write watch bitmap VAD info

Mn01 - monitor.sys - ACPI method evaluation output buffer
Mn02 - monitor.sys - Unused
Mn03 - monitor.sys - Raw E-EDID v.1.x byte stream including base block + extension blocks (if any)
Mn04 - monitor.sys - Cached monitor ID WMI data block
Mn05 - monitor.sys - Cached monitor basic display parameters WMI data block
Mn06 - monitor.sys - Cached monitor analog video input parameters WMI data block
Mn07 - monitor.sys - Cached monitor digitial video input parameters WMI data block
Mn08 - monitor.sys - Cached monitor color characteristics WMI data block
Mn09 - monitor.sys - Cached supported monitor source modes WMI data block
Mn0A - monitor.sys - Registry subkey info buffer
Mn0B - monitor.sys - Registry value buffer
Mn0C - monitor.sys - Cached supported monitor frequency ranges WMI data block (overrides from registry)
Mn0D - monitor.sys - Cached supported monitor frequency ranges WMI data block (from E-EDID v.1.x base block)
Mn0E - monitor.sys - Buffer for E-EDID v.1.x base block, if any, populated by miniport
Mn0F - monitor.sys - Buffer for E-EDID v.1.x extension block(s), if any, populated by miniport

MNFf - msnfsflt.sys - NFS FS Filter, filename buffer
MNFi - msnfsflt.sys - NFS FS Filter, instance name buffer
MNFr - msnfsflt.sys - NFS FS Filter, registry access buffer
MNFs - msnfsflt.sys - NFS FS Filter, general string buffer
MNFv - msnfsflt.sys - NFS FS Filter, volume name buffer
MNFC - msnfsflt.sys - NFS FS Filter, callback context
MNFF - msnfsflt.sys - NFS FS Filter, file context
MNFI - msnfsflt.sys - NFS FS Filter, instance context
MNFS - msnfsflt.sys - NFS FS Filter, stream context
MNFT - msnfsflt.sys - NFS FS Filter, thread array

MQAA - mqac.sys - MSMQ driver, AVL allocations
MQAB - mqac.sys - MSMQ driver, CCursor allocations
MQAC - mqac.sys - MSMQ driver, generic allocations
MQAD - mqac.sys - MSMQ driver, CDistribution allocations
MQAG - mqac.sys - MSMQ driver, CGroup allocations
MQAH - mqac.sys - MSMQ driver, Heap allocations
MQAP - mqac.sys - MSMQ driver, CPacket allocations
MQAQ - mqac.sys - MSMQ driver, CQueue allocations
MQAT - mqac.sys - MSMQ driver, CTransaction allocations

MRXx - <unknown> - Client side caching for SMB

Msdv - <unknown> - WDM mini driver for IEEE 1394 DV Camera and VCR
MST? - <unknown> - MSTEE (mstee.sys)
MSTa - <unknown> - associated stream header
MSTc - <unknown> - filer connection
MSTd - <unknown> - data format
MSTf - <unknown> - filter instance
MSTp - <unknown> - pin instance
MSTs - <unknown> - stream header

MuoC - <unknown> - MOUSE_POOL_TAG Mouse Class Driver
MsFc - <unknown> - Mailslot CCB, Client control block. Each client with an opened mailslot has one of these
MsFC - <unknown> - Mailslot root CCB, A client control block for the top level mailslot directory
MsFd - <unknown> - Mailslot data entry write buffer, This is writes buffered inside mailslots
MsFD - <unknown> - Mailslot root DCB and its name buffer
MsFf - <unknown> - Mailslot FCB, File control block, Service side block for each created mailslot.
MsFg - <unknown> - Mailslot global resource
MsFn - <unknown> - Mailslot temporary name buffer
MsFN - <unknown> - Mailslot FCB name buffer, name for each created mailslot
MsFr - <unknown> - Mailslot read buffer, buffer created for pended reads issued.
MsFt - <unknown> - Mailslot query template, used for directory queries.
MsFw - <unknown> - Mailslot work context block, blocks create when we need to timeout reads.

MsvC - ksecdd.sys - Msv/Ntlm client package
Mup - mup.sys - Multiple UNC provider allocations, generic
MupI - mup.sys - Windows Server 2003 and prior versions: DFS Irp Context allocation
MuDn - mup.sys - Device name
MuFc - mup.sys - File Context
MuFn - mup.sys - File name rewrite
MuIc - mup.sys - IRP Context
MuMc - mup.sys - Master context
MuQc - mup.sys - Query context
MuSi - mup.sys - Surrogate info
MuSf - mup.sys - Surrogate file info
MuSr - mup.sys - Surrogate IRP info
MuPe - mup.sys - Known prefix entry
MuPi - mup.sys - Provider info
MuUn - mup.sys - UNC provider

Muta - <unknown> - Mutant objects
NBF - <unknown> - general NBF allocations
NBFa - <unknown> - NBF address object
NBFb - <unknown> - NBF receive buffer
NBFc - <unknown> - NBF connection object
NBFd - <unknown> - NBF packet pool descriptor
NBFe - <unknown> - NBF bind & export names
NBFf - <unknown> - NBF address file object
NBFg - <unknown> - NBF registry path name
NBFi - <unknown> - NBF tdi connection info
NBFk - <unknown> - NBF loopback buffer
NBFl - <unknown> - NBF link object
NBFn - <unknown> - NBF netbios name
NBFo - <unknown> - NBF config data
NBFp - <unknown> - NBF packet
NBFq - <unknown> - NBF query buffer
NBFr - <unknown> - NBF request
NBFs - <unknown> - NBF provider stats
NBFt - <unknown> - NBF connection table
NBFu - <unknown> - NBF UI frame
NBFw - <unknown> - NBF work item
NBI - <unknown> - NwlnkNb transport
NBS - <unknown> - general NetBIOS allocations
NBSa - <unknown> - address block
NBSc - <unknown> - connection block
NBSe - <unknown> - EA buffer
NBSf - <unknown> - FCB
NBSl - <unknown> - LANA block
NBSn - <unknown> - copy of user NCB
NBSr - <unknown> - registry allocations
NBSx - <unknown> - XNS NETONE address (connect block)
NBSy - <unknown> - NetBIOS address (connect block)
NBSz - <unknown> - NetBIOS address (listen block)
NBqh - <unknown> - Non-blocking queue entries used to carry the real data in the queue.

NCSt - <unknown> - EXIFS NC

ND - ndis.sys - general NDIS allocations
NDDl - ndis.sys - NDIS_TAG_DBG_LOG
NDMb - ndis.sys - NDIS_TAG_MAC_BLOCK
NDPX - ndis.sys - NDIS Proxy allocations
NDPa - ndis.sys - Apple Talk
NDPb - ndis.sys - NBF
NDPi - ndis.sys - NWLNKIPX
NDPn - ndis.sys - NWLNKNB
NDPp - ndis.sys - Packet Scheduler.
NDPs - ndis.sys - NWLNKSPX
NDPt - ndis.sys - TCPIP
NDPw - ndis.sys - WAN_PACKET_TAG
NDam - ndis.sys - NdisAllocateMemory
NDan - ndis.sys - adapter name
NDco - ndis.sys - NDIS_TAG_CO
NDd - ndis.sys - NDIS_TAG_DBG
NDdb - ndis.sys - DMA block
NDdl - ndis.sys - NDIS_TAG_DBG_L
NDdp - ndis.sys - NDIS_TAG_DBG_P
NDds - ndis.sys - NDIS_TAG_DBG_S
NDdt - ndis.sys - NDIS_TAG_DFRD_TMR
NDfa - ndis.sys - NDIS_TAG_FILTER_ADDR
NDlb - ndis.sys - lookahead buffer
NDlp - ndis.sys - NDIS_TAG_LOOP_PKT
NDmb - ndis.sys - MAC block
NDmr - ndis.sys - map register entry array
NDoa - ndis.sys - NDIS_TAG_OID_ARRAY
NDob - ndis.sys - open block
NDpb - ndis.sys - protocol block
NDpf - ndis.sys - NDIS_TAG_FILTER
NDpk - ndis.sys - NDIS_TAG_PKT_PATTERN
NDpp - ndis.sys - packet pool
NDrl - ndis.sys - resource list
NDrp - ndis.sys - NDIS_TAG_REGISTRY_PATH
NDrq - ndis.sys - NDIS_TAG_Q_REQ
NDsi - ndis.sys - EISA slot information
NDsm - ndis.sys - Cached shared memory descriptor
NDst - ndis.sys - NDIS_TAG_STRING
NDw0 - ndis.sys - NDIS_TAG_WMI_REG_INFO
NDw1 - ndis.sys - NDIS_TAG_WMI_GUID_TO_OID
NDw2 - ndis.sys - NDIS_TAG_WMI_OID_SUPPORTED_LIST
NDw3 - ndis.sys - NDIS_TAG_WMI_EVENT_ITEM
NDwi - ndis.sys - NDIS_TAG_WORK_ITEM

Nb?? - <unknown> - NetBT allocations
Nf?? - nfssvr.sys - NFS (Network File System) allocations
NfR? - nfsrdr.sys - NFS (Network File System) client re-director
Nls - <unknown> - Nls strings
NlsK - nt!ex - Nls data
Nmdd - <unknown> - NetMeeting display driver miniport 1 MB block
None - <unknown> - call to ExAllocatePool

Npf* - npfs.sys - Npfs Allocations
NpFc - npfs.sys - CCB, client control block
NpFC - npfs.sys - ROOT_DCB CCB
NpFD - npfs.sys - DCB, directory block
NpFg - npfs.sys - Global storage
NpFi - npfs.sys - NPFS client info buffer.
NpFn - npfs.sys - Name block
NpFq - npfs.sys - Query template buffer used for directory query
NpFr - npfs.sys - DATA_ENTRY records (read/write buffers)
NpFs - npfs.sys - Client security context
NpFw - npfs.sys - Write block
NpFW - npfs.sys - Write block

NS?? - <unknown> - Netware server allocations

Ntf? - ntfs.sys - NTFS Specific allocation tags
Ntf0 - ntfs.sys - general pool allocation
Ntf9 - ntfs.sys - Large Temporary Buffer
NtfC - ntfs.sys - CCB
Ntfc - ntfs.sys - CCB_DATA
NtfD - ntfs.sys - DEALLOCATED_RECORDS
NtfE - ntfs.sys - INDEX_CONTEXT
NtfF - ntfs.sys - FCB_INDEX
Ntff - ntfs.sys - FCB_DATA
NtfI - ntfs.sys - NTFS_IO_CONTEXT
Ntfi - ntfs.sys - IRP_CONTEXT
NtfK - ntfs.sys - KEVENT
Ntfk - ntfs.sys - FILE_LOCK
Ntfl - ntfs.sys - LCB
NtfM - ntfs.sys - NTFS_MCB_ENTRY
Ntfm - ntfs.sys - NTFS_MCB_ARRAY
NtfN - ntfs.sys - NUKEM
Ntfn - ntfs.sys - SCB_NONPAGED
Ntfo - ntfs.sys - SCB_INDEX normalized named buffer
NtfQ - ntfs.sys - QUOTA_CONTROL_BLOCK
Ntfq - ntfs.sys - General Allocation with Quota
NtfR - ntfs.sys - READ_AHEAD_THREAD
Ntfr - ntfs.sys - ERESOURCE
NtfS - ntfs.sys - SCB_INDEX
Ntfs - ntfs.sys - SCB_DATA
NtfT - ntfs.sys - SCB_SNAPSHOT
Ntft - ntfs.sys - SCB (Prerestart)
NtfV - ntfs.sys - VPB
Ntfv - ntfs.sys - COMPRESSION_SYNC
Ntfw - ntfs.sys - Workspace
Ntfx - ntfs.sys - General Allocation
NtF? - ntfs.sys - NTFS tags based on source module
NtFa - ntfs.sys - AllocSup.c
NtFA - ntfs.sys - AttrSup.c
NtFB - ntfs.sys - BitmpSup.c
NtFC - ntfs.sys - Create.c
NtFD - ntfs.sys - DevioSup.c
NtFd - ntfs.sys - DirCtrl.c
NtFE - ntfs.sys - Ea.c
NtFF - ntfs.sys - FileInfo.c
NtFf - ntfs.sys - FsCtrl.c
NtFH - ntfs.sys - SelfHeal.c
NtFI - ntfs.sys - IndexSup.c
NtFL - ntfs.sys - LogSup.c
NtFM - ntfs.sys - McbSup.c
NtFN - ntfs.sys - NtfsData.c
NtFO - ntfs.sys - ObjIdSup.c
NtFQ - ntfs.sys - QuotaSup.c
NtFR - ntfs.sys - RestrSup.c
NtFS - ntfs.sys - SecurSup.c
NtFs - ntfs.sys - StrucSup.c
NtFU - ntfs.sys - usnsup.c
NtFV - ntfs.sys - VerfySup.c
NtFv - ntfs.sys - ViewSup.c
NtFW - ntfs.sys - Write.c

NV - <unknown> - nVidia video driver
NvLA - <nvlddmkm.sys> - nVidia video driver
NvLa - <nvlddmkm.sys> - nVidia video driver
NvLC - <nvlddmkm.sys> - nVidia video driver
NvLc - <nvlddmkm.sys> - nVidia video driver
NvLD - <nvlddmkm.sys> - nVidia video driver
NvLd - <nvlddmkm.sys> - nVidia video driver
NvLE - <nvlddmkm.sys> - nVidia video driver
NvLH - <nvlddmkm.sys> - nVidia video driver
NvLm - <nvlddmkm.sys> - nVidia video driver
NvLP - <nvlddmkm.sys> - nVidia video driver
NvLp - <nvlddmkm.sys> - nVidia video driver
NvLR - <nvlddmkm.sys> - nVidia video driver
NvLr - <nvlddmkm.sys> - nVidia video driver
NvLS - <nvlddmkm.sys> - nVidia video driver
NvLs - <nvlddmkm.sys> - nVidia video driver
NvLT - <nvlddmkm.sys> - nVidia video driver

Nwcs - <unknown> - Client Services for NetWare
NwFw - <unknown> - ntos\tdi\fwd

ObSq - nt!ob - object security descriptors (query)
ObCi - nt!ob - captured information for ObCreateObject
ObCI - nt!ob - object creation lookaside list
ObDi - nt!ob - object directory
ObHd - nt!ob - object handle count data base
ObNm - nt!ob - object names
ObNM - nt!ob - name buffer per processor lookaside pointers
ObRt - nt!ob - object reference stack tracing
ObZn - nt!ob - object zone
ObjT - nt!ob - object type objects
Obtb - nt!ob - object tables via EX handle.c
ObTR - nt!ob - object table ERESOURCEs
Obeb - nt!ob - object tables extra bit tables via EX handle.c
ObDm - nt!ob - object device map
ObSc - nt!ob - Object security descriptor cache block
ObSt - nt!ob - Object Manager temporary storage

OHCI - <unknown> - Open Host Controller Interface for USB
ohci - <unknown> - 1394 OHCI host controller driver

Ovfl - <unknown> - The internal pool tag table has overflowed - usually this is a result of nontagged allocations being made

OvfL - <unknown> - EXIFS FCBOVF List

PaeD - <unknown> - PAE top level directory allocation blocks

ParC - <unknown> - Parallel class driver
ParL - <unknown> - Parallel link driver
ParP - <unknown> - Parallel port driver
ParV - <unknown> - ParVdm driver for vdm<->parallel port communciation

PciB - pci.sys - PnP pci bus enumerator

PcCi - <unknown> - WDM audio port class adapter device object stuff
PcCr - <unknown> - WDM audio stuff
PcDi - <unknown> - WDM audio stuff
PcDm - <unknown> - DirectMusic MXF objects (WDM audio)
PcFM - <unknown> - WDM audio FM synthesizer
PcFp - <unknown> - WDM audio stuff
PcIc - <unknown> - WDM audio stuff
PcIl - <unknown> - WDM audio stuff
PcNw - <unknown> - WDM audio stuff
PcPc - <unknown> - WDM audio stuff
PcPr - <unknown> - WDM audio stuff
PcSX - <unknown> - WDM audio stuff
PcSl - <unknown> - WDM audio stuff
PcSt - <unknown> - WDM audio stuff
PcSx - <unknown> - WDM audio stuff
PcUs - <unknown> - WDM audio stuff

Pcmc - pcmcia.sys - Pcmcia bus enumerator, general structures
Pcic - <unknown> - Pcmcia bus enumerator, PCIC/Cardbus controller specific structures
Pcdb - <unknown> - Pcmcia bus enumerator, Databook controller specific structures

Pf?? - nt!pf - Pf Allocations
PfAL - nt!pf - Pf Application launch event data
PfAS - nt!pf - Pf Prefetch support array
PfDq - nt!pf - Pf Directory query buffers
PfED - nt!pf - Pf Generic event data
PfEL - nt!pf - Pf Event logging buffers
PfET - nt!pf - Pf Entry info tables
PfFH - nt!pf - Pf RpContext FileKeyHash buckets
PfFK - nt!pf - Pf RpContext FileKeyHashEntry
PfLB - nt!pf - Pf Log buffers
PfMP - nt!pf - Pf Prefetch metadata buffers
PfNL - nt!pf - Pf Name logging buffers
PfOB - nt!pf - Pf Oplock buffers
PfPB - nt!pf - Pf Pfn query buffers
PfRL - nt!pf - Pf Prefetch read list
PfRQ - nt!pf - Pf Prefetch request buffers
PfSA - nt!pf - Pf Prefetch support array
PfTD - nt!pf - Pf Trace Dump
PfTt - nt!pf - Pf Translation tables
PfVA - nt!pf - Pf VA prefetching buffers
PfVH - nt!pf - Pf Prefetch volume handles

Pgm? - <unknown> - Pgm (Pragmatic General Multicast) protocol: RMCast.sys

Plcp - <unknown> - Cache aware pushlock list (array of puchlock addresses)
Plcl - <unknown> - Cache aware pushlock entry. One per processor

PmpA - portmap.sys - Portmap address list
PmpC - portmap.sys - Portmap device context
PmpM - portmap.sys - Portmap mapping
PmpR - portmap.sys - Portmap RPCB

PNCH - <unknown> - Power Notify Channel
PNCL - <unknown> - Power Notify channel list
PNDP - <unknown> - Power Abort Dpc Routine
PNI - <unknown> - Power Notify Instance

Pool - <unknown> - Pool tables, etc.
PooL - <unknown> - Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures
Port - <unknown> - Port objects

PoSL - <unknown> - Power shutdown event list

PPMd - <unknown> - Processor Drivers (Processor Power Management).
PPMi - nt!po - Kernel Processor Power Management Idle States.
PPMp - nt!po - Kernel Processor Power Management Perf States.
PPMw - nt!po - Kernel Processor Power Management WMI interface.

Prof - <unknown> - Profile objects

POWI - nt!po - Power Work Item (executive worker thread work item entry)
PSwt - nt!po - Power switch structure
PSTA - nt!po - Po registered system state
PDss - nt!po - Po device system state

PpTg - mpsdrv.sys - MPSDRV PPTP GRE analyzer
PpTt - mpsdrv.sys - MPSDRV PPTP TCP analyzer

Prcr - processr.sys - Processr driver allocations

Proc - nt!ps - Process objects
Ps - nt!ps - general ps allocations
Psap - nt!ps - Block used to hold a user mode APC while its queued to a thread
PsAp - nt!ps - Process APC queued by user mode process
PsCa - nt!ps - APC queued at thread create time.
PsCr - nt!ps - Working set change record (temporary allocation)
PsEx - nt!ps - Process exit APC
PsFn - nt!ps - Captured image file name buffer (temporary allocation)
PsHl - nt!ps - Captured list of handles to inherit in child process (temporary allocation)
PsIm - nt!ps - Thread impersonation (PS_IMPERSONATE_INFORMATION, pre-Vista)
PsJa - nt!ps - Job access control state
Psjb - nt!ps - Job set array (temporary allocation)
PsLd - nt!ps - Process LDT information blocks
PsPb - nt!ps - Captured process parameter block (temporary allocation)
PsQb - nt!ps - Process quota block
PsRl - nt!ps - Captured memory reserve list (temporary allocation)
PsSb - nt!ps - Initial process parameter block (temporary allocation)
PsSd - nt!ps - Augmented thread security descriptor (temporary allocation)
PsTf - nt!ps - Job object token filter
Pstb - nt!ps - Process tables via EX handle.c
Psta - nt!ps - Power management system state
PsTp - nt!ps - Thread termination port block
PsWs - nt!ps - Process working set watch array

PSE3 - pse36.sys - Physical Size Extension driver

Pnp0 - nt!pnp - PNPMGR rebalance resource request table
Pnp1 - nt!pnp - PNPMGR IRP completion context
Pnp2 - nt!pnp - PNPMGR device action request
Pnp3 - nt!pnp - PNPMGR dock serial numbers
Pnp4 - nt!pnp - PNPMGR dock state
Pnp5 - nt!pnp - PNPMGR assign resources context
Pnp6 - nt!pnp - PNPMGR resource request
Pnp7 - nt!pnp - PNPMGR deferred notify entry
Pnp8 - nt!pnp - PNPMGR async target device change notify
Pnp9 - nt!pnp - PNPMGR HW profile notify
PnpA - nt!pnp - PNPMGR HW profile event
PnpB - nt!pnp - PNPMGR setup notify
PnpC - nt!pnp - PNPMGR target device notify
PnpD - nt!pnp - PNPMGR device class notify
PnpE - nt!pnp - PNPMGR veto name
PnpF - nt!pnp - PNPMGR eject data
PnpG - nt!pnp - PNPMGR generic
PnpH - nt!pnp - PNPMGR service name
PnpI - nt!pnp - PNPMGR instance path
PnPb - nt!pnp - PnP BIOS resource manipulation
PpEB - nt!pnp - PNP_POOL_EVENT_BUFFER
PpEE - nt!pnp - PNP_DEVICE_EVENT_ENTRY_TAG
PpEL - nt!pnp - PNP_DEVICE_EVENT_LIST_TAG
PpLg - nt!pnp - PnP last good.
PpUB - nt!pnp - PNP_USER_BLOCK_TAG
PpWI - nt!pnp - PNP_DEVICE_WORK_ITEM_TAG
Ppcd - nt!pnp - PnP critical device database
Ppcr - nt!pnp - plug-and-play critical allocations
Ppdd - nt!pnp - new Plug-And-Play driver entries and IRPs
Ppde - nt!pnp - routines to perform device removal
Ppei - nt!pnp - Eisa related code
Ppen - nt!pnp - routines to perform device enumeration
Ppin - nt!pnp - plug-and-play initialization
Ppio - nt!pnp - plug-and-play IO system APIs

PPMi - nt!po - Processor Power Manager Idle States
PPMp - nt!po - Processor Power Manager Perf States
PPMw - nt!po - Processor Power Manager WMI Interface

Ppre - nt!pnp - resource allocation and translation
Pprl - nt!pnp - routines to manipulate relations list
Ppsu - nt!pnp - plug-and-play subroutines for the I/O system

PPTP - <unknown> - PPTP_MEMORYPOOL_TAG
PPT0 - <unknown> - PPTP_TDIADDR_TAG
PPT1 - <unknown> - PPTP_TDICONN_TAG
PPT2 - <unknown> - PPTP_CONNINFO_TAG
PPT3 - <unknown> - PPTP_ADDRINFO_TAG
PPT4 - <unknown> - PPTP_TIMEOUT_TAG
PPT5 - <unknown> - PPTP_TIMER_TAG
PPT6 - <unknown> - PPTP_TDICOTS_TAG
PPT7 - <unknown> - PPTP_WRKQUEUE_TAG
PPT8 - <unknown> - PPTP_SEND_CTRLDATA_TAG
PPT9 - <unknown> - PPTP_SEND_ACKDATA_TAG
PPTa - <unknown> - PPTP_SEND_DGRAMDESC_TAG
PPTb - <unknown> - PPTP_TDICLTS_TAG
PPTc - <unknown> - PPTP_RECV_CTRLDESC_TAG
PPTd - <unknown> - PPTP_RECV_CTRLDATA_TAG
PPTe - <unknown> - PPTP_RECV_DGRAMDESC_TAG
PPTf - <unknown> - PPTP_RECV_DGRAMDATA_TAG
PPTg - <unknown> - PPTP_RECVDESC_TAG
PPTh - <unknown> - PPTP_ENGINE_TAG
PPTi - <unknown> - PPTP_RECVDATA_TAG

PRF? - nt!wdi - Performance Allocations
PRFd - nt!wdi - Performance Diagnostics Structures

PSC? - <unknown> - Packet Scheduler (PSCHED) Tags

PSC0 - <unknown> - NDIS Request
PSC1 - <unknown> - GPC Client Vc
PSC2 - <unknown> - WanLink
PSC3 - <unknown> - Miscellaneous allocations
PSC4 - <unknown> - WMI
PSCa - <unknown> - Adapter
PSCb - <unknown> - CallParameters
PSCc - <unknown> - PipeContext
PSCd - <unknown> - FlowContext
PSCe - <unknown> - ClassMapContext
PSCf - <unknown> - Adapter Profile
PSCg - <unknown> - Component

PX1 - <unknown> - ndis ProviderEventLookaside

p2?? - perm2dll.dll - Permedia2 display driver
p2d3 - perm2dll.dll - Permedia2 display driver - d3d.c
p2d6 - perm2dll.dll - Permedia2 display driver - d3ddx6.c
p2de - perm2dll.dll - Permedia2 display driver - debug.c
p2ds - perm2dll.dll - Permedia2 display driver - d3dstate.c
p2dt - perm2dll.dll - Permedia2 display driver - d3dtxman.c
p2su - perm2dll.dll - Permedia2 display driver - ddsurf.c
p2en - perm2dll.dll - Permedia2 display driver - enable.c
p2fi - perm2dll.dll - Permedia2 display driver - fillpath.c
p2he - perm2dll.dll - Permedia2 display driver - heap.c
p2hw - perm2dll.dll - Permedia2 display driver - hwinit.c
p2cx - perm2dll.dll - Permedia2 display driver - p2ctxt.c
p2pa - perm2dll.dll - Permedia2 display driver - palette.c
p2pe - perm2dll.dll - Permedia2 display driver - permedia.c
p2tx - perm2dll.dll - Permedia2 display driver - textout.c

P3D? - perm3dd.dll - Permedia3 display driver - DirectDraw/3D
P3G? - perm3dd.dll - Permedia3 display driver

PSHD - pshed.dll - PSHED
PSPi - pshed.dll - PSHED Plug-in

Qnam - <unknown> - EXIFS Query Name

Qp?? - <unknown> - Generic Packet Classifier (MSGPC)
Qppn - <unknown> - Queued Notifications
Qppi - <unknown> - Pending Irp structures
Qpci - <unknown> - CfInfo
Qpct - <unknown> - Client blocks
Qppa - <unknown> - Pattern blocks
Qphf - <unknown> - HandleFactory
Qpph - <unknown> - PathHash
Qprz - <unknown> - Rhizome
Qppd - <unknown> - GenPatternDb
Qpfd - <unknown> - FragmentDb
Qpcf - <unknown> - ClassificationFamily
Qpcd - <unknown> - CfInfoData
Qpcb - <unknown> - ClassificationBlock
Qppt - <unknown> - Protocol
Qpdg - <unknown> - Debug

QuU2 - mpsdrv.sys - MPSDRV upcall response

RB?? - <unknown> - RedBook Filter Driver, static allocations
RBEv - <unknown> - RedBook - Thread Events
RBRl - <unknown> - RedBook - Remove lock
RBRg - <unknown> - RedBook - driverExtension->RegistryPath
RBSe - <unknown> - RedBook - Serialization tracking for checked builds
RBWa - <unknown> - RedBook - Wait block for system thread

rb?? - <unknown> - RedBook Filter Driver, dynamic allocations
rbBu - <unknown> - RedBook - Buffer for read/stream
rbIr - <unknown> - RedBook - Irp for read/stream
rbIp - <unknown> - RedBook - Irp pointer block
rbMd - <unknown> - RedBook - Mdl for read/stream
rbMp - <unknown> - RedBook - Mdl pointer block
rbRc - <unknown> - RedBook - Read completion context
rbRx - <unknown> - RedBook - Read Xtra info
rbSc - <unknown> - RedBook - Stream completion context
rbSx - <unknown> - RedBook - Stream Xtra info
rbTo - <unknown> - RedBook - Cached table of contents

Rcp? - sacdrv.sys - SAC Driver (Headless)
RcpA - sacdrv.sys - Internal memory mgr alloc block
RcpI - sacdrv.sys - Internal memory mgr initial heap block
RcpS - sacdrv.sys - Security related block

RDPD - rdpdr.sys - Device list object

ReEv - <unknown> - Resource Event
ReSe - <unknown> - Resource Semaphore
ReTa - <unknown> - Resource Extended Table

RefT - <unknown> - Bluetooth reference tracking
Rf?? - <unknown> - Bluetooth RFCOMM TDI driver
RfAD - rfcomm.sys - RFCOMM Address
RfBB - rfcomm.sys - RFCOMM BRB
RfBT - rfcomm.sys - RFCOMM (bthport)
RfCB - rfcomm.sys - RCOMMM
RfCH - rfcomm.sys - RFCOMM channel
RfCN - rfcomm.sys - RFCOMM connect
RfDA - rfcomm.sys - RFCOMM data
RfFR - rfcomm.sys - RFCOMM frame
RfRX - rfcomm.sys - RFCOMM receive
RfPP - rfcomm.sys - RFCOMM pnp
RfWR - rfcomm.sys - RFCOMM worker

RKRW - mpsdrv.sys - MPSDRV work item
RTLF - mpsdrv.sys - MPSDRV filter

RpcL - msrpc.sys - debugging log data - present on checked builds only
RpcM - msrpc.sys - all msrpc.sys allocations not covered elsewhere
Rpcr - msrpc.sys - not currently used

RRle - <unknown> - RTL_RANGE_LIST_ENTRY_TAG
RRlm - <unknown> - RTL_RANGE_LIST_MISC_TAG

RtPi - <unknown> - Temp allocation for product type key

Rpcl - msrpc.sys - MSRpc memory logging - checked build only
Rpcm - msrpc.sys - MSRpc memory allocations
Rpcr - msrpc.sys - MSRpc resources
Rpcs - msrpc.sys - Memory shared b/n MSRpc and caller

RPrt - rstorprt.sys - Remote Storage Port Driver

Rqrv - <unknown> - Registry query buffer
RS?? - <unknown> - Remote Storage
RSFS - <unknown> - Recall Queue
RSFN - <unknown> - File Name
RSSE - <unknown> - Security info
RSWQ - <unknown> - Work Queue
RSQI - <unknown> - Queue info
RSLT - <unknown> - Long term data
RSIO - <unknown> - Ioctl Queue
RSFO - <unknown> - File Obj queue
RSVO - <unknown> - Validate Queue
RSER - <unknown> - Error log data

RtlT - nt!rtl - Temporary RTL allocation

RWan - rawwan.sys - Raw WAN driver

R300 - <unknown> - ATI video driver
RX00 - <unknown> - ATI video driver

Rx?? - <unknown> - Rdr2 rdbss.sys stuff
RxSc - <unknown> - SrvCall
RxNr - <unknown> - NetRoot
RxVn - <unknown> - VNetRoot
RxFc - <unknown> - FCB
RxSo - <unknown> - SrvOpen
RxFx - <unknown> - Fobx
RxNf - <unknown> - nonpaged FCB
RxWq - <unknown> - work queue
RxBm - <unknown> - buffering manager
RxMs - <unknown> - misc.
RxIr - <unknown> - RxContext (IrpContext)
RxMx - <unknown> - minirdr dispatch table
RxNc - <unknown> - NameCache (not currently used)

RxCt - <unknown> - connection engine transport
RxCa - <unknown> - connection engine address
RxCc - <unknown> - connection engine connection
RxCv - <unknown> - connection engine VC
RxCd - <unknown> - connection engine TDI

RxSp - <unknown> - srvcall calldown params (special build only)
RxVp - <unknown> - vnetroot calldown params (special build only)
RxTm - <unknown> - timer context (special build only)
RxDc - <unknown> - querydirectory pattern (special build only)
RxCx - <unknown> - connection engine misc. (special build only)

S3 - <unknown> - S3 video driver
SBad - <unknown> - bad block simulator - simbad.c

sbp2 - <unknown> - Sbp2 1394 storage port driver

SC?? - <unknown> - Smart card driver tags
SCLb - <unknown> - Smart card driver library
SCB8 - <unknown> - Bull CP8 Transac serial reader
SCB3 - <unknown> - Bull SmarTlp PnP
SCS4 - <unknown> - SCM Microsystems pcmcia reader
SCl0 - <unknown> - Litronic 220

Sc?? - <unknown> - Mass storage driver tags

ScB? - classpnp.sys - ClassPnP misc allocations
ScC? - classpnp.sys - ClassPnP misc allocations

ScC? - <unknown> - CdRom
ScCE - <unknown> - device control synch event
ScCG - <unknown> - disk geometry buffer
ScCH - <unknown> - hitachi error buffer
ScCI - <unknown> - sense info buffers
ScCS - <unknown> - srb allocation
ScCM - <unknown> - mode data buffer
ScCP - <unknown> - read capacity buffer
ScCp - <unknown> - play active checks
ScCQ - <unknown> - read sub q buffer
ScCR - <unknown> - raw mode read buffer
ScCT - <unknown> - read toc buffer
ScCt - <unknown> - toshiba error buffer
ScCU - <unknown> - update capacity path
ScCV - <unknown> - volume control buffer
ScCv - <unknown> - volume control buffer

ScD? - <unknown> - Disk
ScD - <unknown> - generic tag
ScDa - <unknown> - SMART
ScDA - <unknown> - Info Exceptions
ScDC - <unknown> - disable cache paths
ScDb - classpnp.sys - ClassPnP debug globals buffer
ScDc - <unknown> - disk allocated completion c
ScDG - <unknown> - disk geometry buffer
ScDg - <unknown> - update disk geometry paths
ScDI - <unknown> - sense info buffers
ScDp - <unknown> - pnp ids
ScDM - <unknown> - mode data buffer
ScDM - <unknown> - mbr checksum code
ScDN - <unknown> - disk name code
ScDP - <unknown> - read capacity buffer
ScDp - <unknown> - disk partition lists
ScDS - <unknown> - srb allocation
ScDs - <unknown> - start device paths
ScDU - <unknown> - update capacity path
ScDW - <unknown> - work-item context
ScMC - <unknown> - medium changer allocations

ScIO - classpnp.sys - ClassPnP device control
ScL? - classpnp.sys - Classpnp
ScLA - classpnp.sys - allocation to check for autorun disable
ScLF - classpnp.sys - File Object Extension
ScLc - classpnp.sys - Cache filters
ScLf - classpnp.sys - Fault prediction
ScLm - classpnp.sys - Mount
ScLM - classpnp.sys - Media Change Detection
ScLq - classpnp.sys - Release queue
ScLw - classpnp.sys - WMI
ScLW - classpnp.sys - Power

ScNo - classpnp.sys - ClassPnP notification

ScP? - <unknown> - Scsiport
ScPa - <unknown> - Hold registry data
ScPA - <unknown> - Access Ranges
ScPb - <unknown> - Get Bus Dat Holder
ScPB - <unknown> - Queuetag BitMap
ScPc - <unknown> - Fake common buffer
ScPC - <unknown> - reset bus code
ScPd - <unknown> - Pnp id strings
ScPD - <unknown> - SRB_DATA allocations
ScPE - <unknown> - Scatter gather lists
ScPG - <unknown> - Global memory
ScPh - <unknown> - HwDevice Ext
ScPi - <unknown> - Sense Info
ScPI - <unknown> - Init data chain
ScPl - <unknown> - remove lock tracking
ScPL - <unknown> - scatter gather lists
ScPm - <unknown> - address mapping lists
ScPM - <unknown> - scatter gather lists
ScPp - <unknown> - device & adapter enable
ScpP - <unknown> - scsi PortConfig copies
ScPq - <unknown> - inquiry data
ScPQ - <unknown> - request sense
ScPr - <unknown> - resource list copy
ScPS - <unknown> - registry allocations
ScPt - <unknown> - legacy request rerouting
ScPT - <unknown> - interface mapping
ScPu - <unknown> - device relation structs
ScPv - <unknown> - KEVENT
ScPV - <unknown> - Device map allocations
ScPw - <unknown> - Wmi Events
ScPW - <unknown> - Wmi Requests
ScPx - <unknown> - Report Luns
ScPY - <unknown> - Report Targets
ScPZ - <unknown> - Device name buffer

ScR? - <unknown> - Partition Manager
ScRi - <unknown> - IOCTL buffer
ScRp - <unknown> - Partition entry
ScRr - <unknown> - Remove lock
ScRt - <unknown> - Table entry
ScRv - <unknown> - Dependant volume relations lists
ScRV - <unknown> - Volume entry
ScRw - <unknown> - Power mgmt private work item

ScsC - <unknown> - non-pnp SCSI CdRom
ScsD - <unknown> - non-pnp SCSI Disk
ScsH - <unknown> - non-pnp SCSI from class.h (class2)
ScsI - <unknown> - non-pnp SCSI port internal
ScsL - <unknown> - non-pnp SCSI class.c driver allocations
ScsP - <unknown> - non-pnp SCSI port.c
Scs$ - <unknown> - Tag for pnp class driver’s SRB lookaside list

ScUn - <unknown> - Default Tag for pnp class driver allocations

ScV? - <unknown> - Dvd functionality in cdrom.sys
ScVk - <unknown> - read buffer for DVD keys
ScVK - <unknown> - write buffer for DVD keys
ScVS - <unknown> - buffer for reads of DVD on-disk structures

SdCc - <unknown> - ObsSecurityDescriptorCache / SECURITY_DESCRIPTOR_CACHE_ENTRIES

Sdba - <unknown> - Application compatibility Sdb* allocations

Sdp? - <unknown> - Bluetooth SDP functionality in BTHPORT.sys
SdpC - bthport.sys - Bluetooth SDP client connection
SdpD - bthport.sys - Bluetooth SDP database
SdpI - bthport.sys - Bluetooth port driver (SDP)

Se - nt!se - General security allocations
SeAc - nt!se - Security ACL
SeAi - nt!se - Security Audit Work Item
SeAp - nt!se - Security Audit Parameter Record
SeCL - nt!se - Security CONTEXT_TAG
SeDb - nt!se - Temp directory query buffer to delete logon session symbolic links.
SeFS - nt!se - SEP_FILE_SYSTEM_NOTIFY_CONTEXT
SeHa - nt!se - Temp directory query buffer to delete logon session symbolic links.
SeLs - nt!se - Security Logon Session
SeLu - nt!se - Security LUID and Attributes array
SeLS - nt!se - Security Logon Session tracking array
SeLw - nt!se - Security LSA Work Item
SeOn - nt!se - Security Captured Object Name information
SeOt - nt!se - Captured object type array. Used by access check code
SePa - nt!se - Process audit image names and captured polity structures
SePh - nt!se - Dummy image page hash structure. Used when CI is disabled.
SePr - nt!se - Security Privilege Set
SeSa - nt!se - Security SID and Attributes
SeSc - nt!se - Captured Security Descriptor
SeSd - nt!se - Security Descriptor
SeSi - nt!se - Security SID
SeTa - nt!se - Security Temporary Array
SeTd - nt!se - Security Token dynamic part
SeTI - ksecdd.sys - Security TargetInfo
SeTn - nt!se - Security Captured Type Name information
SeUs - nt!se - Security Captured Unicode string

Sect - <unknown> - Section objects
Sema - <unknown> - Semaphore objects
Senm - <unknown> - Serenum (RS-232 serial bus enumerator)
SimB - <unknown> - Simbad (bad sector simulation driver) allocations
SIfs - <unknown> - Default tag for user’s of ntsrv.h
sidg - <unknown> - GDI spooler events
Sis - <unknown> - Single Instance Store (dd\sis\filter)
SisB - <unknown> - SIS per file object break event
SisC - <unknown> - SIS common store file object
SisF - <unknown> - SIS per file object
SisL - <unknown> - SIS per link object
SisS - <unknown> - SIS SCB
Setp - <unknown> - SETUPDD SpMemAlloc calls

SRdm - scsirdma.sys - Infiniband SRP driver

SV?? - <unknown> - Synthetic Video Driver
SVLb - <unknown> - Generic Synthetic Video Driver Kernel-Mode Library
SVXD - synvidxd.dll - WDDM Synthetic Video Display Driver
SVXM - synvidxm.sys - WDDM Synthetic Video Miniport Driver
SVid - synthvid.sys - LDDM Synthetic Video Miniport Driver

SW?? - <unknown> - Software Bus Enumerator
SWbi - <unknown> - bus ID
SWbr - <unknown> - bus reference
SWda - <unknown> - POOLTAG_DEVICE_ASSOCIATION
SWdn - <unknown> - device name
SWdr - <unknown> - device reference
SWdr - <unknown> - POOLTAG_DEVICE_DRIVER_REGISTRY
SWfd - <unknown> - POOLTAG_DEVICE_FDOEXTENSION
SWid - <unknown> - device ID
SWii - <unknown> - instance ID
SWip - <unknown> - POOLTAG_DEVICE_INTERFACEPATH
SWki - <unknown> - key information
SWpd - <unknown> - POOLTAG_DEVICE_PDOEXTENSION
SWre - <unknown> - relations
SWrp - <unknown> - reparse string
SWrs - <unknown> - reference string

Sm?? - <unknown>