-
Notifications
You must be signed in to change notification settings - Fork 12
/
Copy pathpfn.py
7776 lines (7265 loc) · 450 KB
/
pfn.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
# Creator: Aviel Zohar ([email protected])
import sys
import time
import struct
import threading, functools
import urllib.request, urllib.parse, urllib.error
from typing import Callable, List, Generator, Iterable
from volatility3.plugins.windows import pslist
from volatility3.plugins.windows import info
from volatility3.plugins.windows import vadinfo
from volatility3.framework.configuration import requirements
from volatility3.framework import renderers, interfaces, objects, exceptions, symbols, constants
import tkinter as tk
from tkinter import N, E, W, S, END, YES, BOTH, PanedWindow, Tk, VERTICAL, LEFT, Menu, StringVar, RIGHT, SOLID
import tkinter.messagebox as messagebox
import tkinter.colorchooser
from tkinter.ttk import Frame, Treeview, Scrollbar, Combobox
import tkinter.font
import os, re
import time
import io
import logging
vollog = logging.getLogger(__name__)
try:
import csv
has_csv = True
except ImportError:
has_csv = False
try:
from ttkthemes import ThemedStyle
has_themes = True
except ImportError:
has_themes = False
app = None
TreeTable_CULUMNS = {} # an TreeTable global to store all the user preference for the header selected.
file_path = ''
ABS_X = 60
ABS_Y = 60
file_slice = 8 if sys.platform == 'win32' else 5
right_click_event = '<Button-2>' if sys.platform == 'darwin' else '<Button-3>'
PAGES_LIST = {0: 'Zeroed',
1: 'Free',
2: 'Standby',
3: 'Modified',
4: 'ModifiedNoWrite',
5: 'Bad',
6: 'Active',
7: 'Transition'}
POOL_TAGS = {
"AzWp": " HDAudio.sys - HD Audio Class Driver (AzWaveport, HdaWaveRTminiport)\r\n",
"SCLb": " <unknown> - Smart card driver library\r\n",
"Wmit": " <unknown> - Wmi Trace\r\n",
"Wmis": " <unknown> - Wmi SysId allocations\r\n",
"Wmiq": " <unknown> - Wmi NBQ Blocks\r\n",
"smWd": " nt!store or rdyboost.sys - ReadyBoost store contents rundown work item\r\n",
"PsJa": " nt!ps - Job access control state\r\n",
"Gtvp": " win32k!PFFOBJ::bAddPvtData - GDITAG_PFF_DATA\r\n",
"FMts": " fltmgr.sys - Tree Stack\r\n",
"FMtr": " fltmgr.sys - Temporary Registry information\r\n",
"Dfsm": " win32k.sys - GDITAG_ENG_EVENT\r\n",
"FMtp": " fltmgr.sys - Non Paged TxVol context structures\r\n",
"IpAT": " ipsec.sys - AH headers in transport mode\r\n",
"IpAU": " ipsec.sys - AH headers in tunnel mode\r\n",
"AzWd": " HDAudio.sys - HD Audio Class Driver (AzWidget)\r\n",
"HpMM": " pnpmem.sys - HotPlug Memory Driver\r\n",
"W32l": " win32k!W32PIDLOCK::vInit - GDITAG_W32PIDLOCK\r\n",
"Qp??": " <unknown> - Generic Packet Classifier (MSGPC)\r\n",
"Wmim": " <unknown> - Wmi KM to UM Notification Buffers\r\n",
"IpAX": " ipsec.sys - key acquire contexts\r\n",
"FMtb": " fltmgr.sys - TXN_PARAMETER_BLOCK structure\r\n",
"Ppcs": " pacer.sys - PACER Pipe Counter Sets\r\n",
"Ppcr": " nt!pnp - plug-and-play critical allocations\r\n",
"Usai": " win32k!zzzAttachThreadInput - USERTAG_ATTACHINFO\r\n",
"SmMt": " mrxsmb10.sys - SMB1 mailslot buffer (special build only)\r\n",
"SmMs": " mrxsmb.sys - SMB miscellaneous\r\n",
"WmiR": " <unknown> - Wmi Registration info blocks\r\n",
"PXg": " ndproxy.sys - PX_CMAF_TAG\r\n",
"RaUE": " storport.sys - RaidUnitAllocateResources\r\n",
"Usac": " win32k!_CreateAcceleratorTable - USERTAG_ACCEL\r\n",
"Gpft": " win32k!pAllocateAndInitializePFT - GDITAG_PFT\r\n",
"Gful": " win32k.sys - GDITAG_FULLSCREEN\r\n",
"SrWI": " sr.sys - Work queue item\r\n",
"WmiG": " <unknown> - Allocation of WMIGUID\r\n",
"SmVr": " mrxsmb10.sys - SMB1 VNetroot (special build only)\r\n",
"DCdm": " win32kbase!DirectComposition::CRemotingRenderTargetMarshaler::_allocate - DCOMPOSITIONTAG_REMOTINGRENDERTARGETMARSHALER\r\n",
"WmiD": " <unknown> - Wmi Registration DataSouce\r\n",
"WmiC": " <unknown> - Wmi Create Pump Thread Work Item\r\n",
"DCdj": " win32kbase!DirectComposition::CSharedWriteDcompTargetMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITEDCOMPTARGETMARSHALER\r\n",
"SmMa": " mrxsmb10.sys - SMB1 mid atlas (special build only)\r\n",
"Ppcd": " nt!pnp - PnP critical device database\r\n",
"DCdg": " win32kbase!DirectComposition::CSharedWriteDesktopTargetMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITEDESKTOPTARGETMARSHALER\r\n",
"Gpff": " win32k.sys - GDITAG_PFF\r\n",
"SmMm": " mrxsmb.sys - SMB mm allocated structures.\r\n",
"MupI": " mup.sys - Windows Server 2003 and prior versions: DFS Irp Context allocation\r\n",
"DCdc": " win32kbase!DirectComposition::CDwmChannel::_allocate - DCOMPOSITIONTAG_DWMCHANNEL\r\n",
"DCdb": " win32kbase!DirectComposition::CDCompDynamicArrayBase::_allocate - DCOMPOSITIONTAG_DYNAMICARRAYBASE\r\n",
"Obeb": " nt!ob - object tables extra bit tables via EX handle.c\r\n",
"UlVH": " http.sys - Virtual Host\r\n",
"Dfs ": " <unknown> - Distributed File System\r\n",
"DpPl": " FsDepends.sys - FsDepends Parent Link Block\r\n",
"DErz": " devolume.sys - Drive extender write super blocks request: DEVolume!DEDiskSet::WriteSuperBlocksRequest\r\n",
"DEry": " devolume.sys - Drive extender start or create request: DEVolume!DiskSetVolume::StartOrCreateRequest\r\n",
"DErx": " devolume.sys - Drive extender shutdown system request: DEVolume!DiskSetVolume::ShutdownRequest\r\n",
"DErw": " devolume.sys - Drive extender read write target: DEVolume!ReadWriteTarget\r\n",
"DErv": " devolume.sys - Drive extender repair volume request: DEVolume!DiskSetVolume::RepairVolumeDamageRequest\r\n",
"DEru": " devolume.sys - Drive extender shutdown request: DEVolume!DEDiskSet::ShutdownRequest\r\n",
"DErt": " devolume.sys - Drive extender start request: DEVolume!DEDiskSet::StartRequest\r\n",
"DErs": " devolume.sys - Drive extender delete or shutdown request: DEVolume!DiskSetVolume::DeleteOrShutdownRequest\r\n",
"DErr": " devolume.sys - Drive extender read request: DEVolume!ReadRequest\r\n",
"DErp": " devolume.sys - Drive extender replicator: DEVolume!Replicator\r\n",
"DEro": " devolume.sys - Drive extender become out of date request: DEVolume!VolumeChunk::BecomeOutOfDateRequest\r\n",
"DErn": " devolume.sys - Drive extender new epoch request: DEVolume!DEDiskSet::NewEpochRequest\r\n",
"DErm": " devolume.sys - Drive extender range lock manager: DEVolume!RangeLockManager\r\n",
"DErl": " devolume.sys - Drive extender long and notify request: DEVolume!DiskSetVolume::LogAndNotifyRequest\r\n",
"DCav": " win32kbase!DirectComposition::CSharedWriteAnimationTriggerMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITEANIMATIONTRIGGERMARSHALER\r\n",
"DErh": " devolume.sys - Drive extender replicate chunk: DEVolume!ReplicateChunk\r\n",
"DErg": " devolume.sys - Drive extender registry: DEVolume!DERegistry\r\n",
"DEre": " devolume.sys - Drive extender decommit all request: DEVolume!DiskSetVolume::DecommitAllRequest\r\n",
"Cdma": " cdfs.sys - CDFS Mcb array\r\n",
"DErc": " devolume.sys - Drive extender commit request: DEVolume!VolumeChunk::CommitRequest\r\n",
"Ddk ": " <unknown> - Default for driver allocated memory (user's of ntddk.h)\r\n",
"DEra": " devolume.sys - Drive extender disk event request\r\n",
"DCza": " win32kbase!DirectComposition::CSharedClientProjectedShadowCasterMarshaler::_allocate - DCOMPOSITIONTAG_CLIENTPROJECTEDSHADOWCASTERMARSHALER\r\n",
"DCzc": " win32kbase!DirectComposition::CProjectedShadowCasterMarshaler::_allocate - DCOMPOSITIONTAG_PROJECTEDSHADOWCASTERMARSHALER\r\n",
"DCzb": " win32kbase!DirectComposition::CSharedHostProjectedShadowCasterMarshaler::_allocate - DCOMPOSITIONTAG_HOSTPROJECTEDSHADOWCASTERMARSHALER\r\n",
"Fl6D": " tcpip.sys - FL6t DataLink Addresses\r\n",
"FMtn": " fltmgr.sys - Temporary file names\r\n",
"smEd": " nt!store - ReadyBoost virtual store manager key descriptor allocation for logging\r\n",
"UHCD": " <unknown> - Universal Host Controller (USB - Intel Controller)\r\n",
"DCzr": " win32kbase!DirectComposition::CProjectedShadowReceiverMarshaler::_allocate - DCOMPOSITIONTAG_PROJECTEDSHADOWRECEIVERMARSHALER\r\n",
"DCdi": " win32kbase!DirectComposition::CSharedReadDcompTargetMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDREADDCOMPTARGETMARSHALER\r\n",
"Usdm": " win32k!CreateDCompositionHwndTargetInfo - USERTAG_DCOMPHWNDTARGETINFO\r\n",
"Umen": " win32kbase!HMAllocObject - USERTAG_MENU\r\n",
"FIvp": " fileinfo.sys - FileInfo FS-filter Volume Properties\r\n",
"Via4": " dxgmms2.sys - GPU scheduler context state\r\n",
"Via5": " dxgmms2.sys - GPU scheduler queue packet\r\n",
"Via6": " dxgmms2.sys - GPU scheduler DMA packet\r\n",
"Via7": " dxgmms2.sys - GPU scheduler VSync cookie\r\n",
"ScVk": " <unknown> - read buffer for DVD keys\r\n",
"Via1": " dxgmms2.sys - GPU scheduler node state\r\n",
"Via2": " dxgmms2.sys - GPU scheduler process state\r\n",
"Via3": " dxgmms2.sys - GPU scheduler device state\r\n",
"ObSq": " nt!ob - object security descriptors (query)\r\n",
"ViSh": " dxgkrnl.sys - Video scheduler\r\n",
"VMhd": " vmbushid.sys - Virtual Machine Input VSC Driver\r\n",
"Via8": " dxgmms2.sys - GPU scheduler GPU sync object\r\n",
"Via9": " dxgmms2.sys - GPU scheduler present info\r\n",
"FIvn": " fileinfo.sys - FileInfo FS-filter Volume Name\r\n",
"Dmga": " <unknown> - mga (matrox) video driver\r\n",
"Giog": " win32k.sys - GDITAG_COMPOSEDGAMMA\r\n",
"Gbaf": " win32k.sys - GDITAG_BRUSH_FREELIST\r\n",
"Wmij": " <unknown> - Wmi GuidMaps\r\n",
"NbL0": " netbt.sys - NetBT lower connection\r\n",
"VsSw": " vmswitch.sys - Virtual Machine Network Switch Driver\r\n",
"Wmii": " <unknown> - Wmi InstId chunks\r\n",
"NbL1": " netbt.sys - NetBT lower connection\r\n",
"MmBk": " nt!mm - Mm banked sections\r\n",
"CcAs": " nt!cc - Cache Manager Async cached read structure\r\n",
"DCjc": " win32kbase!DirectComposition::CColorBrushMarshaler::_allocate - DCOMPOSITIONTAG_COLORBRUSHMARSHALER\r\n",
"Viad": " dxgmms2.sys - GPU scheduler hardware queue\r\n",
"Viae": " dxgmms2.sys - GPU scheduler monitored fence\r\n",
"Viaf": " dxgmms2.sys - GPU scheduler sync point\r\n",
"NbL3": " netbt.sys - NetBT lower connection\r\n",
"Viaa": " dxgmms2.sys - GPU scheduler history buffer\r\n",
"Viab": " dxgmms2.sys - GPU scheduler periodic frame notification state\r\n",
"Rqrv": " <unknown> - Registry query buffer\r\n",
"UlIC": " http.sys - Irp Context\r\n",
"Ucmp": " http.sys - Multipart String Buffer\r\n",
"Gdwd": " win32k.sys - GDITAG_WATCHDOG\r\n",
"WlDt": " writelog.sys - Writelog drain target\r\n",
"StEl": " storport.sys - PortpErrorInitRecords storport!_STORAGE_TRACE_CONTEXT_INTERNAL.ErrorLogRecords\r\n",
"RxNf": " rdbss.sys - RDBSS non paged FCB\r\n",
"SWre": " <unknown> - relations\r\n",
"FwfD": " mpsdrv.sys - MPSDRV driver buffer for flattening NET_BUFFFER\r\n",
"Txgd": " ntfs.sys - TxfData global structure\r\n",
"FCuu": " dxgkrnl!CEndpointResourceStateManager::PrepareIncrementalUpdateForUser - FLIPCONTENT_INCREMENTALRESOURCEUPDATEFORUSER\r\n",
"WPCT": " BasicRender.sys - Basic Render DX Context\r\n",
"AlHa": " nt!alpc - ALPC port handle table\r\n",
"Usal": " win32k!InitSwitchWndInfo - USERTAG_ALTTAB\r\n",
"Uspo": " win32k!QueuePowerRequest - USERTAG_POWER\r\n",
"FCub": " dxgkrnl!CEndpointResourceStateManager::PrepareIncrementalUpdateForStateManager - FLIPCONTENT_INCREMENTALRESOURCEUPDATEFORCONSUMER\r\n",
"DDsr": " win32kbase!DirectComposition::CDataSourceReaderMarshaler::_allocate - DCOMPOSITIONTAG_DATASOURCEREADERMARSHALER\r\n",
"Xtra": " <unknown> - EXIFS Extra Create\r\n",
"PmDD": " partmgr.sys - Partition Manager device descriptor\r\n",
"VmLb": " volmgrx.sys - Log blocks\r\n",
"D2d ": " <unknown> - Device Object to DosName rtns (ntos\\rtl\\dev2dos.c)\r\n",
"Qphf": " <unknown> - HandleFactory\r\n",
"RxMs": " rdbss.sys - RDBSS miscellaneous\r\n",
"VHDI": " vhdmp.sys - VHD IO Range pool\r\n",
"RxMx": " rdbss.sys - RDBSS mini-rdr\r\n",
"VHDA": " vhdmp.sys - VHD generic allocator pool\r\n",
"AtC ": " <unknown> - IDE disk configuration\r\n",
"RaAM": " storport.sys - RaidAllocateAddressMapping storport!_MAPPED_ADDRESS\r\n",
"VHDS": " vhdmp.sys - VHD symbolic link\r\n",
"Gubm": " win32k.sys - GDITAG_UMODE_BITMAP\r\n",
"NBF ": " <unknown> - general NBF allocations\r\n",
"SYPK": " syspart.lib - Kernel mode system partition detection allocations\r\n",
"FVE?": " fvevol.sys - Full Volume Encryption Filter Driver (Bitlocker Drive Encryption)\r\n",
"DCdo": " win32kbase!DirectComposition::CSharedWriteRemotingRenderTargetMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITEREMOTINGRENDERTARGETMARSHALER\r\n",
"VHDh": " vhdmp.sys - VHD header\r\n",
"VHDi": " vhdmp.sys - VHD IO Range\r\n",
"VHDn": " vhdmp.sys - VHD filename\r\n",
"SmTh": " mrxsmb.sys - SMB thunk\r\n",
"VHDl": " vhdmp.sys - VHD LUN\r\n",
"VHDm": " vhdmp.sys - VHD bitmap\r\n",
"VHDb": " vhdmp.sys - VHD Block Allocation Table\r\n",
"HcDr": " hcaport.sys - HCAPORT_TAG_DEVICE_RELATIONS\r\n",
"VHDa": " vhdmp.sys - VHD generic allocator\r\n",
"VHDf": " vhdmp.sys - VHD file entry\r\n",
"PNDP": " <unknown> - Power Abort Dpc Routine\r\n",
"Gmap": " win32k!InitializeFontSignatures - GDITAG_FONT_MAPPER\r\n",
"flnk": " <unknown> - font link tag used in ntgdi\\gre\r\n",
"call": " <unknown> - debugging call tables\r\n",
"NMhf": " netio.sys - Handle Factory pool\r\n",
"RxCv": " mrxsmb.sys - RXCE VcEndpoint\r\n",
"VHDr": " vhdmp.sys - VHD read buffer\r\n",
"VHDs": " vhdmp.sys - VHD sector map\r\n",
"VHDp": " vhdmp.sys - VHD filepath\r\n",
"Dnod": " <unknown> - Device node structure\r\n",
"Ukdp": " win32k!Win32UserInitialize - USERTAG_KERNELDISPLAYINFO\r\n",
"VHDw": " vhdmp.sys - VHD work item\r\n",
"VHDt": " vhdmp.sys - VHD tracking information\r\n",
"RxM1": " rdbss.sys - RDBSS VNetRoot name\r\n",
"fboX": " <unknown> - EXIFS FOBXVF List\r\n",
"RxM3": " rdbss.sys - RDBSS querypath name\r\n",
"RxM2": " rdbss.sys - RDBSS canonical name\r\n",
"RxM5": " rdbss.sys - RDBSS reparse buffer name\r\n",
"RxM4": " rdbss.sys - RDBSS treeconnect name\r\n",
"MmPh": " nt!mm - Physical memory nodes for querying memory ranges\r\n",
"PmRL": " partmgr.sys - Partition Manager remove lock\r\n",
"FSun": " nt!fsrtl - File System Run Time\r\n",
"MmPg": " nt!mm - Mm page table pages at init time\r\n",
"MmPd": " nt!mm - Mm page table commitment bitmaps\r\n",
"NBFu": " <unknown> - NBF UI frame\r\n",
"MmPb": " nt!mm - Paging file bitmaps\r\n",
"NBFs": " <unknown> - NBF provider stats\r\n",
"NBFp": " <unknown> - NBF packet\r\n",
"MmPa": " nt!mm - pagefile space deletion slist entries\r\n",
"NBFn": " <unknown> - NBF netbios name\r\n",
"CMpa": " nt!cm - registry post apcs\r\n",
"CMpb": " nt!cm - registry post blocks\r\n",
"CMpe": " nt!cm - registry post events\r\n",
"NBFi": " <unknown> - NBF tdi connection info\r\n",
"NBFf": " <unknown> - NBF address file object\r\n",
"NBFg": " <unknown> - NBF registry path name\r\n",
"NBFd": " <unknown> - NBF packet pool descriptor\r\n",
"NBFe": " <unknown> - NBF bind & export names\r\n",
"NBFb": " <unknown> - NBF receive buffer\r\n",
"NBFc": " <unknown> - NBF connection object\r\n",
"Cvli": " <unknown> - EXIFS Cached Volume Info\r\n",
"NBFa": " <unknown> - NBF address object\r\n",
"WmiL": " <unknown> - WmiLIb\r\n",
"Adbe": " win32k.sys - GDITAG_ATM_FONT\r\n",
"FVEx": " fvevol.sys - Read/write control structures\r\n",
"FVEw": " fvevol.sys - Worker threads\r\n",
"FVEv": " fvevol.sys - Conversion allocations\r\n",
"FVEr": " fvevol.sys - Reserved mapping addresses\r\n",
"FVEp": " fvevol.sys - Write buffers\r\n",
"PsCr": " nt!ps - Working set change record (temporary allocation)\r\n",
"FVEl": " fvevol.sys - FVELIB allocations\r\n",
"VHD?": " vhdmp.sys - VHD allocation\r\n",
"V2??": " vhdmp.sys - VHD2 pool allocation\r\n",
"FVEc": " fvevol.sys - Cryptographic allocations\r\n",
"LS09": " srvnet.sys - SRVNET LookasideList level 9 allocation 128K Bytes\r\n",
"LS08": " srvnet.sys - SRVNET LookasideList level 8 allocation 64K Bytes\r\n",
"IPmf": " <unknown> - Free memory (only in checked builds)\r\n",
"IPmg": " <unknown> - Group\r\n",
"LS03": " srvnet.sys - SRVNET LookasideList level 3 allocation 2K Bytes\r\n",
"LS02": " srvnet.sys - SRVNET LookasideList level 2 allocation 1K Bytes\r\n",
"LS01": " srvnet.sys - SRVNET LookasideList level 1 allocation 512 Bytes\r\n",
"LS00": " srvnet.sys - SRVNET LookasideList level 0 allocation 256 Bytes\r\n",
"LS07": " srvnet.sys - SRVNET LookasideList level 7 allocation 32K Bytes\r\n",
"LS06": " srvnet.sys - SRVNET LookasideList level 6 allocation 16K Bytes\r\n",
"LS05": " srvnet.sys - SRVNET LookasideList level 5 allocation 8K Bytes\r\n",
"IPmo": " <unknown> - Outgoing Interface\r\n",
"IPms": " <unknown> - Source\r\n",
"DCpc": " win32kbase!DirectComposition::CPrimitveColorMarshaler::_allocate - DCOMPOSITIONTAG_PRIMITIVECOLORMARSHALER\r\n",
"p2hw": " perm2dll.dll - Permedia2 display driver - hwinit.c\r\n",
"smEK": " nt!store - ReadyBoost encryption key\r\n",
"Vi22": " dxgmms2.sys - Video memory manager DMA buffer\r\n",
"TWTa": " tcpip.sys - Echo Request Timer Table\r\n",
"UsI3": " win32k!NSInstrumentation::CBackTraceStoreEx::Create - USERTAG_BACKTRACE_STORE\r\n",
"IoDn": " nt!io - Io device name info\r\n",
"RxCd": " mrxsmb.sys - RXCE TDI\r\n",
"Gh?8": " win32k.sys - GDITAG_HMGR_PAL_TYPE\r\n",
"Gh?9": " win32k.sys - GDITAG_HMGR_ICMLCS_TYPE\r\n",
"Gh?:": " win32k.sys - GDITAG_HMGR_LFONT_TYPE\r\n",
"Gh?;": " win32k.sys - GDITAG_HMGR_RFONT_TYPE\r\n",
"I4ba": " tcpip.sys - IPv4 Local Broadcast Addresses\r\n",
"RxCc": " mrxsmb.sys - RXCE connection\r\n",
"Gh?6": " win32k.sys - GDITAG_HMGR_CLIENTOBJ_TYPE\r\n",
"Gh?7": " win32k.sys - GDITAG_HMGR_PATH_TYPE\r\n",
"RSFS": " <unknown> - Recall Queue\r\n",
"Gh?1": " win32k.sys - GDITAG_HMGR_DC_TYPE\r\n",
"I4bf": " tcpip.sys - IPv4 Generic Buffers (Source Address List allocations)\r\n",
"RSFO": " <unknown> - File Obj queue\r\n",
"RSFN": " <unknown> - File Name\r\n",
"UsI0": " win32k!NSInstrumentation::CBackTraceStorageUnit::Create - USERTAG_BACKTRACE_STORAGE_UNIT\r\n",
"Atom": " <unknown> - Atom Tables\r\n",
"TmRm": " nt!tm - Tm KRESOURCEMANAGER object\r\n",
"I6rd": " tcpip.sys - IPv6 Receive Datagrams Arguments\r\n",
"ppPT": " pvhdparser.sys - Proxy Virtual Machine Storage VHD Parser Driver (parser)\r\n",
"SmDg": " mrxsmb.sys - SMB datagram endpoint\r\n",
"DEfg": " devolume.sys - Drive extender filter: DEVolume!DEFilter\r\n",
"MSfa": " refs.sys - Minstore filtered AVL\r\n",
"Lr!!": " <unknown> - Cancel request context blocks\r\n",
"Gh?L": " win32k.sys - GDITAG_HMGR_DRVOBJ_TYPE\r\n",
"SDe ": " smbdirect.sys - SMB Direct large receive buffers\r\n",
"Gh?E": " win32k.sys - GDITAG_HMGR_META_TYPE\r\n",
"SmDc": " mrxsmb10.sys - SMB1 dir query buffer (special build only)\r\n",
"Gh?@": " win32k.sys - GDITAG_HMGR_BRUSH_TYPE\r\n",
"Gh?A": " win32k.sys - GDITAG_HMGR_UMPD_TYPE\r\n",
"TuSB": " tunnel.sys - Tunnel stack block\r\n",
"IPm?": " <unknown> - IP Multicasting\r\n",
"PsCa": " nt!ps - APC queued at thread create time.\r\n",
"Ushr": " win32k!AllocateAndLinkHidPageOnlyRequest - USERTAG_HIDPAGEREQUEST\r\n",
"Pcdb": " <unknown> - Pcmcia bus enumerator, Databook controller specific structures\r\n",
"PSE3": " pse36.sys - Physical Size Extension driver\r\n",
"LSep": " srv.sys - SMB1 endpoint\r\n",
"PnPb": " nt!pnp - PnP BIOS resource manipulation\r\n",
"Nbtw": " netbt.sys - NetBT device linkage names\r\n",
"WfpM": " netio.sys - WFP filter match buffers\r\n",
"WfpL": " netio.sys - WFP fast cache\r\n",
"TmRq": " nt!tm - Tm Propagation Request\r\n",
"Idqf": " tcpip.sys - IPsec DoS Protection QoS flow\r\n",
"NDdp": " ndis.sys - NDIS_TAG_DBG_P\r\n",
"Txvc": " ntfs.sys - TXF_VCB\r\n",
"WfpE": " netio.sys - WFP extension\r\n",
"VHur": " vmusbhub.sys - Virtual Machine USB Hub Driver (URB)\r\n",
"Txvf": " ntfs.sys - TXF_VSCB_FILE_SIZES\r\n",
"FMea": " fltmgr.sys - EA buffer for create\r\n",
"Txvd": " ntfs.sys - TXF_VSCB_TO_DEREF\r\n",
"LSlr": " srv.sys - SMB1 BlockTypeLargeReadX\r\n",
"TunP": " <unknown> - Tunnel cache oddsized pool-allocated elements\r\n",
"LpcZ": " <unknown> - LPC Zone\r\n",
"RS??": " <unknown> - Remote Storage\r\n",
"DEqm": " devolume.sys - Drive extender queued message: DEVolume!QueuedMessage\r\n",
"WfpS": " netio.sys - WFP startup\r\n",
"WfpR": " netio.sys - WFP RPC\r\n",
"SeFS": " nt!se - Security File System Notify Context\r\n",
"HidC": " hidclass.sys - HID Class driver\r\n",
"DErd": " devolume.sys - Drive extender decommit request: DEVolume!VolumeChunk::DecommitRequest\r\n",
"PFXM": " nt!PoFx - Runtime Power Management Framework\r\n",
"NtF?": " ntfs.sys - Unknown NTFS source module\r\n",
"DCpf": " win32kbase!DirectComposition::CSharedWritePrimitiveColorMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITEPRIMITIVECOLORMARSHALER\r\n",
"DErb": " devolume.sys - Drive extender become dirty request: DEVolume!VolumeChunk::BecomeDirtyRequest\r\n",
"HidP": " hidparse.sys - HID Parser\r\n",
"Wl2l": " wfplwfs.sys - WFP L2 LWF context\r\n",
"Tdx ": " tdx.sys - TDX Generic Buffers (Address, Entity information, Interface change allocations)\r\n",
"Ppre": " nt!pnp - resource allocation and translation\r\n",
"smFp": " nt!store - ReadyBoost virtual forward progress entry\r\n",
"NtFR": " ntfs.sys - RestrSup.c\r\n",
"Pprl": " nt!pnp - routines to manipulate relations list\r\n",
"DEcl": " devolume.sys - Drive extender delayed cleaner: DEVolume!DelayedCleaner\r\n",
"Uspy": " win32k!CreateProp - USERTAG_PROPLIST\r\n",
"DCxp": " win32kbase!DirectComposition::CCrossChannelParentVisualMarshaler::_allocate - DCOMPOSITIONTAG_CROSSCHANNELPARENTVISUALMARSHALER\r\n",
"TdxP": " tdx.sys - TDX Transport Layer Providers\r\n",
"FbCx": " tcpip.sys - Inet feature fallback contexts\r\n",
"TdxR": " tdx.sys - TDX Received Data\r\n",
"Uspp": " win32k!AllocateAndLinkHidTLCInfo - USERTAG_PNP\r\n",
"Uspq": " win32k!CreatePointerDeviceInfo - USERTAG_PARALLELPROP\r\n",
"Uspr": " win32k!GetPrivateProfileStruct - USERTAG_PROFILE\r\n",
"Usps": " win32k!InitPlaySound - USERTAG_PLAYSOUND\r\n",
"Uspt": " win32k!AllocThreadPointerData - USERTAG_POINTERTHREADDATA\r\n",
"Uspv": " win32k!ContactVisualization - USERTAG_POINTERVISUALIZATION\r\n",
"Uspw": " win32k!CDynamicArray::Add - USERTAG_DYNAMICARRAY\r\n",
"Grgb": " win32k.sys - GDITAG_PALETTE_RGB_XLATE\r\n",
"Wl2g": " wfplwfs.sys - WFP L2 generic block\r\n",
"ScsP": " <unknown> - non-pnp SCSI port.c\r\n",
"Setp": " <unknown> - SETUPDD SpMemAlloc calls\r\n",
"TdxA": " tdx.sys - TDX Transport Addresses\r\n",
"TdxB": " tdx.sys - TDX Transport Layer Buffers\r\n",
"FSrn": " nt!fsrtl - File System Run Time\r\n",
"DEct": " devolume.sys - Drive extender chunk table\r\n",
"TdxM": " tdx.sys - TDX Message Indication Buffers\r\n",
"RpcM": " msrpc.sys - all msrpc.sys allocations not covered elsewhere\r\n",
"Dcdd": " cdd.dll - Canonical display driver\r\n",
"Grgn": " win32k.sys - GDITAG_REGION\r\n",
"MmWe": " nt!mm - Work entries for writing out modified filesystem pages.\r\n",
"Uspf": " win32k!CommitHoldingFrame - USERTAG_POINTERINPUTFRAME\r\n",
"Uspg": " win32k!GeneratePointerMessage - USERTAG_POINTERINPUTMSG\r\n",
"LBea": " <unknown> - Ea buffer\r\n",
"MSpa": " refs.sys - Minstore hash table entries (incl. and primarily SmsPage)\r\n",
"ScB?": " classpnp.sys - ClassPnP misc allocations\r\n",
"ST* ": " <unknown> - New MMC compliant storage drivers\r\n",
"Rpcs": " msrpc.sys - Memory shared b/n MSRpc and caller\r\n",
"Rpcr": " msrpc.sys - MSRpc resources\r\n",
"Wl2c": " wfplwfs.sys - WFP L2 classify cache\r\n",
"PSwt": " nt!po - Power switch structure\r\n",
"VsRD": " vmswitch.sys - Virtual Machine Network Switch Driver (RNDIS device)\r\n",
"LBel": " <unknown> - Election context\r\n",
"Dfb ": " <unknown> - framebuf video driver\r\n",
"UlQT": " http.sys - TCI Tracker\r\n",
"Txrm": " ntfs.sys - TXF_RMCB\r\n",
"Tdxc": " tdx.sys - TDX Control Channels\r\n",
"Gh?4": " win32k.sys - GDITAG_HMGR_RGN_TYPE\r\n",
"PfVA": " nt!pf - Pf VA prefetching buffers\r\n",
"Rpcm": " msrpc.sys - MSRpc memory allocations\r\n",
"Rpcl": " msrpc.sys - MSRpc memory logging - checked build only\r\n",
"Uskf": " win32k!LoadKeyboardLayoutFile - USERTAG_KBDFILE\r\n",
"sidg": " <unknown> - GDI spooler events\r\n",
"AdSv": " vmsrvc.sys - Virtual Machines Additions Service\r\n",
"CctX": " <unknown> - EXIFX FCB Commit CTX\r\n",
"UlQW": " http.sys - TCI WMI\r\n",
"VHif": " vmusbhub.sys - Virtual Machine USB Hub Driver (interface)\r\n",
"ScDS": " <unknown> - srb allocation\r\n",
"ScDP": " <unknown> - read capacity buffer\r\n",
"SmXc": " mrxsmb.sys - SMB exchange\r\n",
"StDa": " netio.sys - WFP stream inspection data\r\n",
"ScDW": " <unknown> - work-item context\r\n",
"ScDU": " <unknown> - update capacity path\r\n",
"ScDI": " <unknown> - sense info buffers\r\n",
"ScDN": " <unknown> - disk name code\r\n",
"ScDM": " <unknown> - mbr checksum code\r\n",
"ScDC": " <unknown> - disable cache paths\r\n",
"ScDA": " <unknown> - Info Exceptions\r\n",
"Type": " <unknown> - Type objects\r\n",
"ScDG": " <unknown> - disk geometry buffer\r\n",
"Flng": " tcpip.sys - Framing Layer Generic Buffers (Tunnel/Port change notifications, ACLs)\r\n",
"SePh": " nt!se - Dummy image page hash structure, used when CI is disabled\r\n",
"UshP": " win32k!HidCreateDeviceInfo - USERTAG_HIDPREPARSED\r\n",
"PoSL": " <unknown> - Power shutdown event list\r\n",
"Gini": " <unknown> - Gdi fast mutex\r\n",
"ScDs": " <unknown> - start device paths\r\n",
"ScDp": " <unknown> - disk partition lists\r\n",
"VsOb": " vmswitch.sys - Virtual Machine Network Switch Driver (object allocation)\r\n",
"FLln": " <unknown> - shared lock tree node\r\n",
"ScPm": " <unknown> - address mapping lists\r\n",
"SrHK": " sr.sys - Hash key\r\n",
"SrHH": " sr.sys - Hash header\r\n",
"RRlm": " <unknown> - RTL_RANGE_LIST_MISC_TAG\r\n",
"ScDc": " <unknown> - disk allocated completion c\r\n",
"SePr": " nt!se - Security Privilege Set\r\n",
"ScDa": " <unknown> - SMART\r\n",
"ScDg": " <unknown> - update disk geometry paths\r\n",
"NwFw": " <unknown> - ntos\\tdi\\fwd\r\n",
"smPb": " rdyboost.sys - ReadyBoost persist log buffer\r\n",
"smPc": " rdyboost.sys - ReadyBoost persist log context\r\n",
"UsbS": " usbser.sys - USB Serial Driver\r\n",
"SCl0": " <unknown> - Litronic 220\r\n",
"FTrc": " <unknown> - Fault tolerance Slist tag.\r\n",
"smPi": " rdyboost.sys - ReadyBoot population ranges index\r\n",
"ScPi": " <unknown> - Sense Info\r\n",
"Ppdd": " nt!pnp - new Plug-And-Play driver entries and IRPs\r\n",
"Ppde": " nt!pnp - routines to perform device removal\r\n",
"smPr": " rdyboost.sys - ReadyBoot population ranges\r\n",
"FMwi": " fltmgr.sys - Work item structures\r\n",
"Qpct": " <unknown> - Client blocks\r\n",
"SeLu": " nt!se - Security LUID and Attributes array\r\n",
"NfR?": " nfsrdr.sys - NFS (Network File System) client re-director\r\n",
"UlQF": " http.sys - TCI Filter\r\n",
"ScVS": " <unknown> - buffer for reads of DVD on-disk structures\r\n",
"SmNr": " mrxsmb10.sys - SMB1 NetRoot (special build only)\r\n",
"UlQG": " http.sys - TCI Generic\r\n",
"Usbr": " win32k!NtUserShutdownBlockReasonCreate - USERTAG_BLOCKREASON\r\n",
"ScD?": " <unknown> - Disk\r\n",
"PfDq": " nt!pf - Pf Directory query buffers\r\n",
"Ifs ": " <unknown> - Default file system allocations (user's of ntifs.h)\r\n",
"DCgs": " win32kbase!DirectComposition::CColorGradientStopMarshaler::_allocate - DCOMPOSITIONTAG_COLORGRADIENTSTOPMARSHALER\r\n",
"RefD": " refs.sys - DEALLOCATED_RECORDS\r\n",
"VsCT": " vmswitch.sys - Virtual Machine Network Switch Driver (chimney TCP context)\r\n",
"VdPN": " dxgkrnl.sys - Video display mode management\r\n",
"DmpS": " dumpsvc.sys - Crashdump Service Driver\r\n",
"ScPc": " <unknown> - Fake common buffer\r\n",
"Fecf": " netio.sys - WFP filter engine callout context\r\n",
"Usbg": " win32k!xxxLogClipData - USERTAG_DEBUG\r\n",
"DCgi": " win32kbase!DirectComposition::CGenericInkMarshaler::_allocate - DCOMPOSITIONTAG_GENERICINKMARSHALER\r\n",
"Fecc": " netio.sys - WFP filter engine classify context\r\n",
"TcFC": " tcpip.sys - TCP Fastopen Cookies\r\n",
"PmPE": " partmgr.sys - Partition Manager partition entry\r\n",
"ScD ": " <unknown> - generic tag\r\n",
"SeLs": " nt!se - Security Logon Session\r\n",
"smBt": " nt!store or rdyboost.sys - ReadyBoost various B+Tree allocations\r\n",
"DCge": " win32kbase!DirectComposition::CGaussianBlurEffectMarshaler::_allocate - DCOMPOSITIONTAG_GAUSSIANBLUREFFECTMARSHALER\r\n",
"TCPC": " <unknown> - TCP connection pool\r\n",
"AzJd": " HDAudio.sys - HD Audio Class Driver (JackDetector)\r\n",
"NDoc": " ndis.sys - NDIS_TAG_OPEN_CONTEXT\r\n",
"NDob": " ndis.sys - open block\r\n",
"NDoa": " ndis.sys - NDIS_TAG_OID_ARRAY\r\n",
"NDof": " ndis.sys - NDIS_TAG_OFFLOAD\r\n",
"ScLA": " classpnp.sys - allocation to check for autorun disable\r\n",
"TcIn": " tcpip.sys - TCP Inputs\r\n",
"APIC": " pnpapic.sys - I/O APIC Driver\r\n",
"Gfnt": " win32k!RFONTOBJ::bRealizeFont - GDITAG_RFONT\r\n",
"MmWS": " nt!mm - Working set swap support\r\n",
"NDop": " ndis.sys - NDIS_TAG_PM_PROT_OFFLOAD\r\n",
"FOCX": " nt!fsrtl - File System Run Time File Object Context structure\r\n",
"LANE": " atmlane.sys - LAN Emulation Client for ATM\r\n",
"MmNo": " nt!mm - Inernal physical memory nodes\r\n",
"Usrt": " win32k!xxxDrawMenuItemText - USERTAG_RTL\r\n",
"Lric": " <unknown> - Instance Control Blocks\r\n",
"Qpcf": " <unknown> - ClassificationFamily\r\n",
"WlIb": " writelog.sys - Writelog I/O buffer\r\n",
"TCPr": " <unknown> - TCP request pool\r\n",
"Ioin": " <unknown> - Io interrupts\r\n",
"PcSx": " <unknown> - WDM audio stuff\r\n",
"EQPn": " tcpip.sys - EQoS policy net entry\r\n",
"TMce": " dxgkrnl!CCompositionFrame::TokenTableEntry::Allocate - TOKENMANAGER_TOKENTABLEENTRY\r\n",
"Wmiw": " <unknown> - Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL\r\n",
"MmCS": " nt!mm - Pagefile CRC verification buffer\r\n",
"UcSP": " http.sys - Process Server Information\r\n",
"InCS": " tcpip.sys - Inet Compartment Set\r\n",
"UcST": " http.sys - Server info table\r\n",
"DCvr": " win32kbase!DirectComposition::CVisualCaptureMarshaler::_allocate - DCOMPOSITIONTAG_VISUALCAPTUREMARSHALER\r\n",
"TTsp": " tcpip.sys - TCP TCB Sends\r\n",
"Psjb": " nt!ps - Job set array (temporary allocation)\r\n",
"Gwnd": " win32k.sys - GDITAG_WNDOBJ\r\n",
"PsTp": " nt!ps - Thread termination port block\r\n",
"Strm": " <unknown> - Streams and streams transports allocations\r\n",
"PcCr": " <unknown> - WDM audio stuff\r\n",
"Ggdv": " win32k.sys - GDITAG_GDEVICE\r\n",
"Strg": " <unknown> - Dynamic Translated strings\r\n",
"UcSN": " http.sys - Server name\r\n",
"LLDP": " mslldp.sys - LLDP protocol driver allocations\r\n",
"MmCr": " nt!mm - Mm fork clone roots\r\n",
"MmCp": " nt!mm - Colored page counts for physical memory allocations\r\n",
"UdpA": " tcpip.sys - UDP Endpoints\r\n",
"MmCt": " nt!mm - Mm debug tracing\r\n",
"VWFF": " vwififlt.sys - Virtual Wi-Fi Filter Driver (object allocation)\r\n",
"VsRm": " vmswitch.sys - Virtual Machine Network Switch Driver (routing)\r\n",
"MmCx": " nt!mm - info for dynamic section extension\r\n",
"VWFB": " vwifibus.sys - Virtual Wi-Fi Bus Driver\r\n",
"idle": " <unknown> - Power Manager idle handler\r\n",
"VsSW": " vmswitch.sys - Virtual Machine Network Switch Driver (WDF)\r\n",
"VraP": " <unknown> - parallel class driver\r\n",
"MmCd": " nt!mm - Mm fork clone descriptors\r\n",
"Via0": " dxgmms2.sys - GPU scheduler adapter state\r\n",
"MmCi": " nt!mm - Mm control areas for images\r\n",
"MmCh": " nt!mm - Mm fork clone headers\r\n",
"MmCm": " nt!mm - Calls made to MmAllocateContiguousMemory\r\n",
"InCo": " tcpip.sys - Inet Compartment\r\n",
"DChx": " win32kbase!DirectComposition::CHolographicViewer::_allocate - DCOMPOSITIONTAG_HOLOGRAPHICVIEWERMARSHALER\r\n",
"LSpm": " srv.sys - SMB1 paged MFCB\r\n",
"I4s6": " tcpip.sys - IPsec SADB v6\r\n",
"Gapl": " win32k.sys - GDITAG_APAL_TABLE\r\n",
"Ubws": " win32kmin!xxxMinSendPointerMessageWorker - USERTAG_BASE_WINDOW_SENTLIST\r\n",
"MuSi": " mup.sys - Surrogate info\r\n",
"LSpc": " srv.sys - SMB1 paged connection\r\n",
"CrtH": " <unknown> - EXIFS Create Header\r\n",
"Uspx": " win32k!GetCustomFlickPath - USERTAG_PTRCFG\r\n",
"TcHT": " tcpip.sys - TCP Hash Tables\r\n",
"LSdc": " srv.sys - SMB1 BlockTypeDirCache\r\n",
"LSdb": " srv.sys - SMB1 data buffer\r\n",
"UlLL": " http.sys - Log File Buffer\r\n",
"Gxlt": " win32k.sys - GDITAG_PXLATE\r\n",
"Ntfs": " ntfs.sys - SCB_DATA\r\n",
"KSsl": " <unknown> - symbolic link buffer (MSKSSRV)\r\n",
"LSdi": " srv.sys - SMB1 BlockTypeDirectoryInfo\r\n",
"RxVn": " rdbss.sys - RDBSS VNetRoot\r\n",
"RBEv": " <unknown> - RedBook - Thread Events\r\n",
"UlDC": " http.sys - Data Chunks array\r\n",
"Lfs ": " <unknown> - Lfs allocations\r\n",
"RSWQ": " <unknown> - Work Queue\r\n",
"Isap": " <unknown> - Pnp Isa bus extender\r\n",
"WanB": " <unknown> - ProtocolCB/LinkCB\r\n",
"WanC": " <unknown> - DataDesc\r\n",
"WanA": " <unknown> - BundleCB\r\n",
"WanG": " <unknown> - MiniportCB\r\n",
"WanD": " <unknown> - WanRequest\r\n",
"WanE": " <unknown> - LoopbackDesc\r\n",
"WanJ": " <unknown> - LineUpInfo\r\n",
"WanK": " <unknown> - Unicode String Buffer\r\n",
"WanH": " <unknown> - OpenCB\r\n",
"WanI": " <unknown> - IoPacket\r\n",
"WanN": " <unknown> - NdisPacketPool Desc\r\n",
"WanL": " <unknown> - Protocol Table\r\n",
"MuSf": " mup.sys - Surrogate file info\r\n",
"ClNw": " netft.sys - NetFt work items\r\n",
"RxBm": " rdbss.sys - RDBSS buffering manager\r\n",
"LfsI": " <unknown> - Lfs allocations\r\n",
"ClNt": " netft.sys - NetFt\r\n",
"WanV": " <unknown> - RC4 Encryption Context\r\n",
"WanW": " <unknown> - SHA Encryption\r\n",
"WanT": " <unknown> - Transform Driver\r\n",
"WanZ": " <unknown> - Protocol Specific Info\r\n",
"WanX": " <unknown> - Send Compression Context\r\n",
"WanY": " <unknown> - Recv Compression Context\r\n",
"UdCo": " tcpip.sys - UDP Compartment\r\n",
"I4sa": " tcpip.sys - IPsec SADB v4\r\n",
"Ntfu": " ntfs.sys - NTFS_MARK_UNUSED_CONTEXT\r\n",
"CdFn": " cdfs.sys - CDFS Filename buffer\r\n",
"Umit": " win32kfull!SetLPITEMInfoNoRedraw - USERTAG_MENUITEM\r\n",
"Icse": " tcpip.sys - IPsec NS connection state\r\n",
"PcUs": " <unknown> - WDM audio stuff\r\n",
"NBI ": " <unknown> - NwlnkNb transport\r\n",
"RfRX": " rfcomm.sys - RFCOMM receive\r\n",
"Vbxp": " vmbus.sys - Virtual Machine Bus Driver (cross partition)\r\n",
"RLin": " <unknown> - FsLib Range lock entry\r\n",
"DEbo": " devolume.sys - Drive extender bus opener context: DEVolume!DEBusOpenerContext\r\n",
"DEbm": " devolume.sys - Drive extender bitmap\r\n",
"DEbg": " devolume.sys - Drive extender bus opener context global: DEVolume!DEBusOpenerContextGlobal\r\n",
"DEbe": " devolume.sys - Drive extender extends buffer\r\n",
"Usqu": " win32k!InitQEntryLookaside - USERTAG_Q\r\n",
"ScCa": " cdrom.sys - Media change detection\r\n",
"Usqm": " win32k!InitQEntryLookaside - USERTAG_QMSG\r\n",
"Usql": " win32k!EnsureQMsgLog - USERTAG_QMSGLOG\r\n",
"DEbu": " devolume.sys - Drive extender generic buffer\r\n",
"ScLm": " classpnp.sys - Mount\r\n",
"SDd ": " smbdirect.sys - SMB Direct connect event contexts\r\n",
"NDxc": " ndis.sys - NDIS_TAG_POOL_XLATE\r\n",
"ObCI": " nt!ob - object creation lookaside list\r\n",
"BTHP": " bthport.sys - Bluetooth port driver (generic)\r\n",
"Net ": " tcpip.sys - NetIO Generic Buffers (iBFT Table allocations)\r\n",
"Crsp": " ksecdd.sys - CredSSP kernel mode client allocations\r\n",
"Nmdd": " <unknown> - NetMeeting display driver miniport 1 MB block\r\n",
"UsDI": " win32k!CreateDeviceInfo - USERTAG_DEVICEINFO\r\n",
"NtFd": " ntfs.sys - DirCtrl.c\r\n",
"IPlc": " tcpip.sys - IP Locality\r\n",
"ScPM": " <unknown> - scatter gather lists\r\n",
"RBWa": " <unknown> - RedBook - Wait block for system thread\r\n",
"IPle": " tcpip.sys - IP Loopback execution context\r\n",
"IPlo": " tcpip.sys - IP Loopback buffers\r\n",
"IPlw": " tcpip.sys - IP Loopback worker\r\n",
"Pcic": " <unknown> - Pcmcia bus enumerator, PCIC/Cardbus controller specific structures\r\n",
"IbPm": " wibpm.sys - WIBPM_TAG Windows Infiniband Performance Manager\r\n",
"Gnls": " win32k.sys - GDITAG_NLS\r\n",
"IbPS": " wibpm.sys - WIBPM_SENT_TAG\r\n",
"RSER": " <unknown> - Error log data\r\n",
"UlFP": " http.sys - Filter Process\r\n",
"RaHI": " storport.sys - RaSaveDriverInitData storport!_HW_INITIALIZATION_DATA\r\n",
"DmS?": " <unknown> - DirectMusic kernel software synthesizer\r\n",
"UlFU": " http.sys - Full Tracker\r\n",
"rb??": " <unknown> - RedBook Filter Driver, dynamic allocations\r\n",
"IoEa": " nt!io - Io extended attributes\r\n",
"CMSb": " nt!cm - internal stash buffer pool tag\r\n",
"KSfd": " <unknown> - filter cache data (MSKSSRV)\r\n",
"VdMm": " Vid.sys - Virtual Machine Virtualization Infrastructure Driver (VSMM service)\r\n",
"Ldmp": " nt!io - Live Dump Buffers. Note, these buffers will not be present in the resulting live dump file.\r\n",
"IbPA": " wibpm.sys - WIBPM_SAMPLE_TAG\r\n",
"PciB": " pci.sys - PnP pci bus enumerator\r\n",
"MQAD": " mqac.sys - MSMQ driver, CDistribution allocations\r\n",
"UlFA": " http.sys - Force Abort Work Item\r\n",
"MuFn": " mup.sys - File name rewrite\r\n",
"IbPI": " wibpm.sys - WIBPM_ITEM_TAG\r\n",
"IoEr": " nt!io - Io error log packets\r\n",
"DCfe": " win32kbase!DirectComposition::CFilterEffectMarshaler::_allocate - DCOMPOSITIONTAG_FILTEREFFECTMARSHALER\r\n",
"Ppei": " nt!pnp - Eisa related code\r\n",
"DCff": " win32kbase!DirectComposition::CFilterEffectMarshaler::Initialize - DCOMPOSITIONTAG_FILTERINPUTFLAGS\r\n",
"PfET": " nt!pf - Pf Entry info tables\r\n",
"VsCs": " vmswitch.sys - Virtual Machine Network Switch Driver (configuration store)\r\n",
"DCfo": " win32kbase!DirectComposition::CSpatialVisualMarshaler::_allocate - DCOMPOSITIONTAG_SPATIALVISUALMARSHALER\r\n",
"DCfi": " win32kbase!DirectComposition::CFilterEffectMarshaler::Initialize - DCOMPOSITIONTAG_FILTERINPUTS\r\n",
"IpCO": " ipsec.sys - IP compression\r\n",
"DCfj": " win32kbase!DirectComposition::CFilterEffectMarshaler::Initialize - DCOMPOSITIONTAG_SUBRECTINPUTFLAGS\r\n",
"PfED": " nt!pf - Pf Generic event data\r\n",
"UlLD": " http.sys - Log Field\r\n",
"UscI": " win32k!CitStart - USERTAG_COMPAT_IMPACT\r\n",
"PfEL": " nt!pf - Pf Event logging buffers\r\n",
"Gxpd": " win32k!XUMPDOBJ::XUMPDOBJ - GDITAG_UMPDOBJ\r\n",
"DEpe": " devolume.sys - Drive extender pingable event: DEVolume!PingableEvent\r\n",
"Uscp": " win32k!CreateDIBPalette - USERTAG_CLIPBOARDPALETTE\r\n",
"DEpg": " devolume.sys - Drive extender pingable object globals: DEVolume!PingableObjectGlobals\r\n",
"Uscr": " win32k!NtUserSetSysColors - USERTAG_COLORS\r\n",
"VsCP": " vmswitch.sys - Virtual Machine Network Switch Driver (chimney NBL context)\r\n",
"CMIn": " nt!cm - Configuration Manager Index Hint Tag\r\n",
"RxNc": " rdbss.sys - RDBSS name cache\r\n",
"Uscv": " win32k!NtUserSetSysColors - USERTAG_COLORVALUES\r\n",
"DEpm": " devolume.sys - Drive extender physical map: DEVolume!PhysicalMap\r\n",
"AzUT": " HDAudio.sys - HD Audio Class Driver (TestSet0004)\r\n",
"Nrtw": " netio.sys - NRT worker\r\n",
"UlEP": " http.sys - Endpoint\r\n",
"Usca": " win32k!NtUserSetCalibrationData - USERTAG_CALIBRATIONDATA\r\n",
"Gadd": " win32k.sys - GDITAG_DC_FONT\r\n",
"Uscc": " win32k!AllocCallbackMessage - USERTAG_CALLBACK\r\n",
"CMIx": " nt!cm - Configuration Manager Intent Lock Tag\r\n",
"Usce": " win32k!RetrieveLinkCollection - USERTAG_COLLINK\r\n",
"Uscd": " win32k!GetCPD - USERTAG_CPD\r\n",
"Gh??": " win32k.sys - GDITAG_HMGR_SPRITE_TYPE\r\n",
"PmRP": " partmgr.sys - Partition Manager registry path\r\n",
"ScWs": " classpnp.sys - Working set\r\n",
"Uscl": " win32k!ClassAlloc - USERTAG_CLASS\r\n",
"Redf": " refs.sys - REFS_DISK_FLUSH_CONTEXT allocations\r\n",
"Info": " <unknown> - general system information allocations\r\n",
"UlHV": " http.sys - Header Value\r\n",
"VsC6": " vmswitch.sys - Virtual Machine Network Switch Driver (chimney path6 context)\r\n",
"FMdl": " fltmgr.sys - Array of DEVICE_OBJECT pointers\r\n",
"UlHR": " http.sys - Internal Request\r\n",
"Mmdl": " nt!mm - Mm Mdls for flushes\r\n",
"FMdh": " fltmgr.sys - Paged ECP context for targeted create reparse\r\n",
"Gtvt": " win32k!bTriangleMesh - GDITAG_TRIANGLE_MESH\r\n",
"DElv": " devolume.sys - Drive extender disk set volume id record: DEVolume!VolumeIdentificationRecord\r\n",
"Reft": " refs.sys - SCB (Prerestart)\r\n",
"VmRr": " volmgrx.sys - Raw records\r\n",
"Refc": " refs.sys - CCB_DATA\r\n",
"UlHC": " http.sys - Http Connection\r\n",
"Gadb": " win32k!XDCOBJ::bAddColorTransform - GDITAG_DC_COLOR_TRANSFORM\r\n",
"LogA": " clfsapimp.sys - CLFS Kernel API test driver\r\n",
"NDmt": " ndis.sys - NDIS_TAG_MEDIA_TYPE_ARRAY\r\n",
"smms": " nt!store - ReadyBoost virtual store memory monitor context\r\n",
"UlHL": " http.sys - Internal Request RefTraceLog\r\n",
"SeGa": " nt!se - Granted Access allocations\r\n",
"DCto": " win32kbase!DirectComposition::CTelemetryInfo::_allocate - DCOMPOSITIONTAG_TELEMETRYINFO\r\n",
"Gapc": " win32kfull!UmfdQueueTryUnzombifyPffApc - GDITAG_UNZOMBIFY_APC\r\n",
"Vi31": " dxgmms2.sys - Video memory manager dummy page\r\n",
"Ppsu": " nt!pnp - plug-and-play subroutines for the I/O system\r\n",
"Fl4D": " tcpip.sys - FL4t DataLink Addresses\r\n",
"ObCi": " nt!ob - captured information for ObCreateObject\r\n",
"DCtc": " win32kbase!DirectComposition::CTileClumpMarshaler::_allocate - DCOMPOSITIONTAG_TILECLUMPMARSHALER\r\n",
"Navl": " tcpip.sys - Network Layer AVL Tree allocations\r\n",
"MQAP": " mqac.sys - MSMQ driver, CPacket allocations\r\n",
"LBxn": " <unknown> - TransportName\r\n",
"DCtz": " win32kbase!DirectComposition::CTextBrushMarshaler::SetBufferProperty - DCOMPOSITIONTAG_TEXTCONTENT\r\n",
"DCty": " win32kbase!DirectComposition::CTextBrushMarshaler::SetBufferProperty - DCOMPOSITIONTAG_TEXTFONTNAME\r\n",
"LBxm": " <unknown> - Master name\r\n",
"NMpt": " <unknown> - Generic AVL Tree allocations\r\n",
"DCts": " win32kbase!DirectComposition::_allocate - DCOMPOSITIONTAG_TELEMETRYSTRING\r\n",
"DbCb": " nt!dbg - Debug Print Callbacks\r\n",
"ScCi": " cdrom.sys - Cached inquiry buffer\r\n",
"VHtx": " vmusbhub.sys - Virtual Machine USB Hub Driver (text)\r\n",
"FstB": " <unknown> - ntos\\fstub\r\n",
"PfAL": " nt!pf - Pf Application launch event data\r\n",
"PpWI": " nt!pnp - PNP_DEVICE_WORK_ITEM_TAG\r\n",
"p2fi": " perm2dll.dll - Permedia2 display driver - fillpath.c\r\n",
"LS2o": " srv2.sys - SMB2 oplock break\r\n",
"Vi37": " dxgmms2.sys - Video memory manager DMA buffer global alloc table\r\n",
"Fstb": " <unknown> - ntos\\fstub\r\n",
"GMFF": " win32k.sys - GDITAG_FONT_MAPPER_FAMILY_FALLBACK\r\n",
"Ghmc": " win32k!GdiHandleManager::Create - GDITAG_HANDLE_MANAGER\r\n",
"Wrpr": " <unknown> - WAN_REQUEST_TAG\r\n",
"DCt3": " win32kbase!DirectComposition::CTranslateTransform3DMarshaler::_allocate - DCOMPOSITIONTAG_TRANSLATETRANSFORM3DMARSHALER\r\n",
"Dxdd": " win32k!DxLddmSharedPrimaryLockNotification - GDITAG_LOCKED_PRIMARY\r\n",
"Mup ": " mup.sys - Multiple UNC provider allocations, generic\r\n",
"CEP ": " wibcm.sys - CEP_INSTANCE_TAG\r\n",
"ScCo": " cdrom.sys - Device Notification buffer\r\n",
"Gi2c": " win32k.sys - GDITAG_DDCCI\r\n",
"DChd": " win32kbase!DirectComposition::CHolographicDisplayMarshaler::_allocate - DCOMPOSITIONTAG_HOLOGRAPHICDISPLAYMARSHALER\r\n",
"VVpc": " vhdparser.sys - Virtual Machine Storage VHD Parser Driver (context)\r\n",
"USqm": " win32k!_WinSqmAllocate - USERTAG_SQM\r\n",
"DCoc": " win32kbase!DirectComposition::CContainerShapeMarshaler::_allocate - DCOMPOSITIONTAG_CONTAINERSHAPEMARSHALER\r\n",
"Flop": " <unknown> - floppy driver\r\n",
"StCx": " netio.sys - WFP stream internal callout context\r\n",
"Lrxx": " <unknown> - Transceive context blocks\r\n",
"SmTr": " mrxsmb10.sys - SMB1 transact exchange\r\n",
"IoFs": " nt!io - Io shutdown packet\r\n",
"U802": " usb8023.sys - RNDIS USB 8023 driver\r\n",
"KSPI": " <unknown> - pin instance\r\n",
"SIfs": " <unknown> - Default tag for user's of ntsrv.h\r\n",
"FMvf": " fltmgr.sys - FLT_VERIFIER_EXTENSION structure\r\n",
"TdxI": " tdx.sys - TDX IO Control Buffers\r\n",
"FMvl": " fltmgr.sys - Array of FLT_VERIFIER_OBJECT structures\r\n",
"FMvo": " fltmgr.sys - FLT_VOLUME structure\r\n",
"FMvj": " fltmgr.sys - FLT_VERIFIER_OBJECT structure\r\n",
"WPAO": " BasicRender.sys - Basic Render Opened Allocation\r\n",
"WPAL": " BasicRender.sys - Basic Render Allocation\r\n",
"Call": " nt!ex - kernel callback object signature\r\n",
"WPAD": " BasicRender.sys - Basic Render Adapter\r\n",
"Vi19": " dxgmms2.sys - Video memory manager pool block array\r\n",
"Udp ": " <unknown> - Udp protocol (TCP/IP driver)\r\n",
"TWTs": " netiobvt.sys - BVT TW Generic Buffers\r\n",
"Aric": " tcpip.sys - ALE route inspection context\r\n",
"p2he": " perm2dll.dll - Permedia2 display driver - heap.c\r\n",
"RxCr": " rdbss.sys - RDBSS credential\r\n",
"RxCo": " rdbss.sys - RDBSS construction context\r\n",
"VM ": " volmgr.sys - General allocations\r\n",
"FSim": " nt!fsrtl - File System Run Time Mcb Initial Mapping Lookaside List\r\n",
"G ": " <unknown> - Gdi Generic allocations\r\n",
"MuIc": " mup.sys - IRP Context\r\n",
"Gcsl": " win32k!InitializeScripts - GDITAG_SCRIPTS\r\n",
"Pgm?": " <unknown> - Pgm (Pragmatic General Multicast) protocol: RMCast.sys\r\n",
"I4rd": " tcpip.sys - IPv4 Receive Datagrams Arguments\r\n",
"RxCa": " mrxsmb.sys - RXCE address\r\n",
"IMsg": " win32k!CInputManager::Create - INPUTMANAGER_SESSIONGLOBAL\r\n",
"DCac": " win32kbase!DirectComposition::CApplicationChannel::_allocate - DCOMPOSITIONTAG_APPLICATIONCHANNEL\r\n",
"DCsl": " win32kbase!DirectComposition::CScalarMarshaler::_allocate - DCOMPOSITIONTAG_SCALARMARSHALER\r\n",
"ScPA": " <unknown> - Access Ranges\r\n",
"ScCs": " cdrom.sys - Assorted string data\r\n",
"Udf4": " udfs.sys - Udfs logical volume integrity descriptor buffer\r\n",
"Afp ": " <unknown> - SFM File server\r\n",
"PmPT": " partmgr.sys - Partition Manager partition table cache\r\n",
"NDlp": " ndis.sys - NDIS_TAG_LOOP_PKT\r\n",
"SmSh": " mrxsmb.sys - SMB shadow file (fast loopback)\r\n",
"InPa": " tcpip.sys - Inet Port Assignments\r\n",
"Vkou": " vmbkmcl.sys - Hyper-V VMBus KMCL driver (outgoing packets)\r\n",
"SWpd": " <unknown> - POOLTAG_DEVICE_PDOEXTENSION\r\n",
"FLli": " <unknown> - per-file lock information\r\n",
"ScCr": " cdrom.sys - Registry string\r\n",
"RfAD": " rfcomm.sys - RFCOMM Address\r\n",
"NDlb": " ndis.sys - lookahead buffer\r\n",
"PpUB": " nt!pnp - PNP_USER_BLOCK_TAG\r\n",
"Dwd ": " <unknown> - wd90c24a video driver\r\n",
"Lrna": " <unknown> - Netbios Addresses\r\n",
"CmcK": " hal.dll - HAL CMC Kernel Log\r\n",
"UNbl": " tcpip.sys - UDP NetBufferLists\r\n",
"Lrnf": " <unknown> - Non paged FCB\r\n",
"VmRm": " volmgrx.sys - RAID-5 emergency mappings\r\n",
"InPA": " tcpip.sys - Inet Port Assignment Arrays\r\n",
"UdpN": " tcpip.sys - UDP Name Service Interfaces\r\n",
"InPE": " tcpip.sys - Inet Port Exclusions\r\n",
"CmcD": " hal.dll - HAL CMC Driver Log\r\n",
"MSTa": " <unknown> - associated stream header\r\n",
"ALPC": " nt!alpc - ALPC port objects\r\n",
"NSpg": " nsi.dll - NSI Proxy Generic Buffers\r\n",
"NDfv": " ndis.sys - NDIS_TAG_LWFILTER_DRIVER\r\n",
"Lrnt": " <unknown> - Non paged transport\r\n",
"NSpc": " nsi.dll - NSI Proxy Contexts\r\n",
"InPP": " tcpip.sys - Inet Port pool\r\n",
"VPrs": " passthruparser.sys - Virtual Machine Storage Passthrough Parser Driver\r\n",
"CmcT": " hal.dll - HAL CMC temporary Log\r\n",
"CMnb": " nt!cm - registry notify blocks\r\n",
"Vkin": " vmbkmcl.sys - Hyper-V VMBus KMCL driver (incoming packets)\r\n",
"IMhq": " win32k!CInputQueue::Create - INPUTMANAGER_INPUTQUEUE\r\n",
"Gh?>": " win32k.sys - GDITAG_HMGR_ICMCXF_TYPE\r\n",
"Petw": " pacer.sys - PACER ETW\r\n",
"LS2W": " srv2.sys - SMB2 special workitem\r\n",
"Ttfd": " win32k.sys - GDITAG_TT_FONT\r\n",
"ScR?": " <unknown> - Partition Manager\r\n",
"LS2c": " srv2.sys - SMB2 connection\r\n",
"LS2b": " srv2.sys - SMB2 buffer\r\n",
"LS2e": " srv2.sys - SMB2 endpoint\r\n",
"Uslr": " win32k!InitLockRecordLookaside - USERTAG_LOCKRECORD\r\n",
"Dlck": " <unknown> - deadlock verifier (part of driver verifier) structures\r\n",
"LS2f": " srv2.sys - SMB2 file\r\n",
"LS2i": " srv2.sys - SMB2 client\r\n",
"LS2h": " srv2.sys - SMB2 share\r\n",
"ObWm": " nt!ob - Object Manager wait blocks\r\n",
"LS2l": " srv2.sys - SMB2 lease\r\n",
"Gcac": " win32k.sys - GDITAG_FONTCACHE\r\n",
"LS2n": " srv2.sys - SMB2 channel\r\n",
"LS2q": " srv2.sys - SMB2 queue\r\n",
"LS2p": " srv2.sys - SMB2 provider\r\n",
"LS2s": " srv2.sys - SMB2 session\r\n",
"DCjb": " win32kbase!DirectComposition::CBackdropBrushMarshaler::_allocate - DCOMPOSITIONTAG_BACKDROPBRUSHMARSHALER\r\n",
"IKeO": " tcpip.sys - IPsec key object\r\n",
"LS2t": " srv2.sys - SMB2 treeconnect\r\n",
"LS2w": " srv2.sys - SMB2 workitem\r\n",
"NbtI": " netbt.sys - NetBT listen requests\r\n",
"LS2x": " srv2.sys - SMB2 security context\r\n",
"Gcap": " <unknown> - Gdi capture buffer\r\n",
"Ntfi": " ntfs.sys - IRP_CONTEXT\r\n",
"IoFu": " nt!pnp - Io file utils\r\n",
"IbW0": " wibwmi.sys - WIBWMI0_TAG Windows Infiniband WMI Manager\r\n",
"IbW1": " wibwmi.sys - WIBWMI1_TAG\r\n",
"IbW2": " wibwmi.sys - WIBWMI2_TAG\r\n",
"FtpA": " mpsdrv.sys - MPSDRV FTP protocol analyzer\r\n",
"ppRT": " pvhdparser.sys - Proxy Virtual Machine Storage VHD Parser Driver (parser)\r\n",
"NS??": " <unknown> - Netware server allocations\r\n",
"Gpfe": " win32k!PFFMEMOBJ::bAllocPFEData - GDITAG_PFF_INDEXES\r\n",
"NbtL": " netbt.sys - NetBT datagram\r\n",
"ScCv": " cdrom.sys - Read buffer for rpc2 check\r\n",
"VmTx": " volmgrx.sys - Transactions\r\n",
"DChs": " win32kbase!DirectComposition::CSharedHolographicInteropTextureMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDHOLOGRAPHICINTEROPTEXTUREMARSHALER\r\n",
"Dh 0": " <unknown> - DirectDraw/3D default object\r\n",
"Dh 1": " <unknown> - DirectDraw/3D DirectDraw object\r\n",
"Dh 2": " <unknown> - DirectDraw/3D Surface object\r\n",
"Dh 3": " <unknown> - DirectDraw/3D Direct3D context object\r\n",
"Dh 4": " <unknown> - DirectDraw/3D VideoPort object\r\n",
"Dh 5": " <unknown> - DirectDraw/3D MotionComp object\r\n",
"WlLb": " writelog.sys - Writelog library buffer\r\n",
"VidR": " videoprt.sys - VideoPort Allocation on behalf of Miniport\r\n",
"SDc ": " smbdirect.sys - SMB Direct MR buffers\r\n",
"Vi02": " dxgmms2.sys - Video memory manager local alloc\r\n",
"RSVO": " <unknown> - Validate Queue\r\n",
"SWfd": " <unknown> - POOLTAG_DEVICE_FDOEXTENSION\r\n",
"LS2$": " srv2.sys - SMB2 misc. allocation\r\n",
"Dqv ": " <unknown> - qv (qvision) video driver\r\n",
"WofH": " wof.sys - Wof handle context\r\n",
"PsAp": " nt!ps - Process APC queued by user mode process\r\n",
"DCjl": " win32kbase!DirectComposition::CLinearGradientBrushMarshaler::_allocate - DCOMPOSITIONTAG_LINEARGRADIENTBRUSHMARSHALER\r\n",
"LS20": " srvnet.sys - SRVNET LookasideList level 20 allocation 832K Bytes\r\n",
"Pcfl": " pacer.sys - PACER Flows\r\n",
"Ntfk": " ntfs.sys - FILE_LOCK\r\n",
"VfIT": " nt!Vf - Verifier Import Address Table information\r\n",
"EtwW": " nt!etw - Etw WorkItem\r\n",
"EtwT": " nt!etw - Etw provider traits\r\n",
"EtwU": " nt!etw - Etw Periodic Capture State\r\n",
"CmVn": " nt!cm - captured value name\r\n",
"EtwS": " nt!etw - Etw DataSource\r\n",
"EtwP": " nt!etw - Etw Pool\r\n",
"Ucte": " http.sys - Entity Pool\r\n",
"Txre": " ntfs.sys - TXF_TOPS_RANGE_ENTRY\r\n",
"Envr": " <unknown> - Environment strings\r\n",
"EtwZ": " nt!etw - Etw compression support\r\n",
"UlTA": " http.sys - Address Pool\r\n",
"EtwX": " nt!etw - Etw profiling support\r\n",
"EtwF": " nt!etw - Etw Filter\r\n",
"EtwG": " nt!etw - Etw Guid\r\n",
"EtwD": " nt!etw - Etw DataBlock\r\n",
"RaEW": " tcpip.sys - Raw Socket Endpoint Work Queue Contexts\r\n",
"EtwB": " nt!etw - Etw Buffer\r\n",
"EtwC": " nt!etw - Etw Realtime Consumer\r\n",
"RBRl": " <unknown> - RedBook - Remove lock\r\n",
"EtwA": " nt!etw - Etw APC\r\n",
"EtwL": " nt!etw - Etw LoggerContext\r\n",
"VmRc": " volmgrx.sys - Raw configurations\r\n",
"EtwK": " nt!etw - Etw SoftRestart support\r\n",
"EtwH": " nt!etw - Etw Private Handle Demuxing\r\n",
"DCck": " win32kbase!DirectComposition::CBaseExpressionMarshaler::SetBufferProperty - DCOMPOSITIONTAG_DEBUGTAG\r\n",
"Etwt": " nt!etw - Etw temporary buffer\r\n",
"IneI": " tcpip.sys - Inet Inspects\r\n",
"IIwc": " <unknown> - Work Context\r\n",
"Etws": " nt!etw - Etw stack cache\r\n",
"Etwp": " nt!etw - Etw TracingBlock\r\n",
"Etwq": " nt!etw - Etw ReplyQueue\r\n",
"Refd": " refs.sys - DEALLOCATED_CLUSTERS\r\n",
"VsC4": " vmswitch.sys - Virtual Machine Network Switch Driver (chimney path4 context)\r\n",
"Obtb": " nt!ob - object tables via EX handle.c\r\n",
"Usri": " win32k!NtUserRegisterRawInputDevices - USERTAG_RAWINPUTDEVICE\r\n",
"RaEt": " storport.sys - RaidBusEnumeratorProcessBusUnit\r\n",
"KSCI": " <unknown> - clock instance\r\n",
"Etwb": " nt!etw - Etw provider tracking\r\n",
"Etwc": " nt!etw - Etw rundown reference counters\r\n",
"vDMW": " dmvsc.sys - Virtual Machine Dynamic Memory VSC Driver (WDF)\r\n",
"Etwa": " nt!etw - Etw server silo state\r\n",
"virt": " vmm.sys - Virtual Machine Manager (VPC/VS)\r\n",
"VmRb": " volmgrx.sys - Raw record buffers\r\n",
"Etwl": " nt!etw - Etw stack look-aside list entry\r\n",
"Etwm": " nt!etw - Etw BitMap\r\n",
"DCwt": " win32kbase!DirectComposition::CApplicationChannel::GetWeakReferenceBase - DCOMPOSITIONTAG_WEAKREFERENCETABLEENTRY\r\n",
"Uspc": " win32k!CreatePointerDeviceInfo - USERTAG_POINTERDEVICE\r\n",
"MuUn": " mup.sys - UNC provider\r\n",
"CcVp": " nt!cc - Cache Manager Array of Vacb pointers for a cached stream\r\n",
"DEag": " devolume.sys - Drive extender disk set array: DEVolume!DEDiskSet *\r\n",
"D851": " <unknown> - 8514a video driver\r\n",
"I4nb": " tcpip.sys - IPv4 Neighbors\r\n",
"CcVl": " nt!cc - Cache Manager Vacb Level structures (large streams)\r\n",
"IBCM": " wibcm.sys - CM_INSTANCE_TAG Windows Infiniband Communications Manager\r\n",
"Gfda": " win32k!UmfdAllocation::Create - GDITAG_UMFD_ALLOCATION\r\n",
"Ugwm": " win32kfull!CWindowGroup::operator new - USERTAG_GROUP_WINDOW_MANAGEMENT\r\n",
"Gfdf": " win32k!InitializeDefaultFamilyFonts - GDITAG_FONT_DEFAULT_FAMILY\r\n",
"NEPK": " newt_ndis6.sys - NEWT Packet\r\n",
"I6nb": " tcpip.sys - IPv6 Neighbors\r\n",
"VHDo": " vhdmp.sys - VHD footer\r\n",
"Usih": " win32k!SetImeHotKey - USERTAG_IMEHOTKEY\r\n",
"MSro": " refs.sys - Minstore container rotation buffer\r\n",
"Giga": " win32k.sys - GDITAG_PRIVATEGAMMA\r\n",
"MSrm": " refs.sys - Minstore range map\r\n",
"MSrk": " refs.sys - Minstore key rules\r\n",
"Reff": " refs.sys - FCB_DATA\r\n",
"MRXx": " <unknown> - Client side caching for SMB\r\n",
"MSre": " refs.sys - Minstore AVL lite entries (incl. and primarily SmsRangeMapEntry)\r\n",
"MSrb": " refs.sys - Minstore redo block\r\n",
"MSrc": " refs.sys - Minstore tx run cache\r\n",
"FDpd": " win32k.sys - GDITAG_UMFD_PDEV\r\n",
"MSrv": " refs.sys - Minstore reserved buffers\r\n",
"RaPD": " storport.sys - RaidGetPortData storport!RaidpPortData\r\n",
"MSrr": " refs.sys - Minstore AVL lite entries (incl. and primarily SmsRCRangeMapEntry)\r\n",
"MSrp": " refs.sys - Minstore read cache pages array\r\n",
"TMsg": " dxgkrnl!CreateSessionTokenManager - TOKENMANAGER_SESSIONGLOBAL\r\n",
"DCcx": " win32kbase!DirectComposition::CSharedWriteCaptureControllerMarshaler::_allocate - DCOMPOSITIONTAG_WRITECAPTURECONTROLLERMARSHALER\r\n",
"Ufsc": " <unknown> - User FULLSCREEN\r\n",
"Asy4": " <unknown> - ndis / ASYNC_FRAME_TAG\r\n",
"Asy3": " <unknown> - ndis / ASYNC_ADAPTER_TAG\r\n",
"dcam": " <unknown> - WDM mini driver for IEEE 1394 digital camera\r\n",
"Asy1": " <unknown> - ndis / ASYNC_IOCTX_TAG\r\n",
"TunK": " <unknown> - Tunnel cache temporary key value\r\n",
"smR?": " nt!store - ReadyBoost virtual forward progress resources\r\n",
"Gdtd": " win32k!GreAcquireSemaphoreAndValidate - GDITAG_SEMAPHORE_VALIDATE\r\n",
"rbRx": " <unknown> - RedBook - Read Xtra info\r\n",
"TunL": " <unknown> - Tunnel cache lookaside-allocated elements\r\n",
"GFil": " win32k.sys - GDITAG_FILEPATH\r\n",
"EtwR": " nt!etw - Etw KM RegEntry\r\n",
"FVE0": " fvevol.sys - General allocations\r\n",
"Vprt": " videoprt.sys - Video port for legacy (pre-Vista) display drivers\r\n",
"DCct": " win32kbase!DirectComposition::CApplicationChannel::AllocateTableEntry - DCOMPOSITIONTAG_CHANNELTABLE\r\n",
"FCpi": " dxgkrnl!CreateFlipPropertySet - FLIPCONTENT_PROPERTYBLOBINDEXBUFFER\r\n",
"Tun4 ": " <unknown> - Tunnel cache allocation for long file name\r\n",
"DCvc": " win32kbase!DirectComposition::CVisualMarshaler::AllocateChildrenArray - DCOMPOSITIONTAG_VISUALMARSHALERCHILDREN\r\n",
"UsKe": " win32k!CreateKernelEvent - USERTAG_KEVENT\r\n",
"Gfsf": " win32k!bInitStockFontsInternal - GDITAG_FONT_STOCKFONT\r\n",
"AlEv": " nt!alpc - ALPC eventlog queue\r\n",
"ScPr": " <unknown> - resource list copy\r\n",
"VHDy": " vhdmp.sys - VHD dynamic header\r\n",
"DCcp": " win32kbase!DirectComposition::CPushLockCriticalSection::_allocate - DCOMPOSITIONTAG_PUSHLOCKCRITICALSECTION\r\n",
"Gh?0": " win32k.sys - GDITAG_HMGR_DEF_TYPE\r\n",
"Wnf ": " nt!wnf - Windows Notification Facility\r\n",
"BTUR": " bthuart.sys - Bluetooth UART minidriver\r\n",
"ODMg": " dxgkrnl.sys - Output Duplication component\r\n",
"DCab": " win32kbase!DirectComposition::CAnimationBinding::_allocate - DCOMPOSITIONTAG_ANIMATIONBINDING\r\n",
"Ahca": " ahcache.sys - Appcompat kernel cache pool tag\r\n",
"DCae": " win32kbase!DirectComposition::CAnimationMarshaler::SetBufferProperty - DCOMPOSITIONTAG_ANIMATIONTIMEEVENTDATA\r\n",
"DCag": " win32kbase!DirectComposition::CAnimationMarshaler::SetBufferProperty - DCOMPOSITIONTAG_ANIMATIONSCENARIOGUID\r\n",
"SrOI": " sr.sys - Overwrite information\r\n",
"fpgn": " wof.sys - Compressed file general\r\n",
"AzTs": " HDAudio.sys - HD Audio Class Driver (TestSet1000, TestSet1001)\r\n",
"Driv": " <unknown> - Driver objects\r\n",
"DCal": " win32kbase!DirectComposition::CAnimationTimeList::_allocate - DCOMPOSITIONTAG_ANIMATIONTIMELIST\r\n",
"DCam": " win32kbase!DirectComposition::CCompositionAmbientLight::_allocate - DCOMPOSITIONTAG_AMBIENTLIGHTMARSHALER\r\n",
"DCan": " win32kbase!DirectComposition::CAnimationMarshaler::_allocate - DCOMPOSITIONTAG_ANIMATIONMARSHALER\r\n",
"Uskd": " win32k!xxxCreateDesktopEx2 - USERTAG_KERNELDESKTOPINFO\r\n",
"ScB1": " classpnp.sys - Query registry parameters\r\n",
"ScB2": " classpnp.sys - Registry path\r\n",
"ScB4": " classpnp.sys - Storage descriptor header\r\n",
"ScB5": " classpnp.sys - FDO relations\r\n",
"BT8x": " <unknown> - WDM mini drivers for Brooktree 848,829, etc.\r\n",
"rbIp": " <unknown> - RedBook - Irp pointer block\r\n",
"DCay": " win32kbase!DirectComposition::CAnalogTextureTargetMarshaler::_allocate - DCOMPOSITIONTAG_ANALOGTEXTURETARGETMARSHALER\r\n",
"DCaz": " win32kbase!DirectComposition::CAnalogCompositorMarshaler::_allocate - DCOMPOSITIONTAG_ANALOGCOMPOSITORMARSHALER\r\n",
"smIt": " nt!store or rdyboost.sys - ReadyBoost store ETA timers\r\n",
"Vib1": " dxgmms2.sys - GPU scheduler flip queue entry\r\n",
"IpBP": " ipsec.sys - buffer pools\r\n",
"Gldv": " win32k.sys - GDITAG_LDEV\r\n",
"Gfvi": " win32k!bUnloadAllButPermanentFonts - GDITAG_FONTVICTIM\r\n",