Opened log file 'c:\DebuggingTV\0x27.txt' 1: kd> .symfix c:\mss 1: kd> .reload Connected to Windows Vista 6000 x64 target at (Tue May 28 19:35:20.079 2013 (UTC + 1:00)), ptr64 TRUE Loading Kernel Symbols ............................................................... ................................................................ ......... Loading User Symbols Loading unloaded module list ....Unable to enumerate user-mode unloaded modules, Win32 error 0n30 1: kd> x nt!ExFreePool fffff800`0193e840 nt!ExFreePool () 1: kd> x nt!ExFreePool* fffff800`01835d00 nt!ExFreePoolEx () fffff800`0193e840 nt!ExFreePool () fffff800`0193ce00 nt!ExFreePoolWithTag () fffff800`01c0a6b0 nt!ExFreePoolSanityChecks () 1: kd> u fffff800`01835d00 nt!ExFreePoolEx: fffff800`01835d00 33d2 xor edx,edx fffff800`01835d02 e9f9701000 jmp nt!ExFreePoolWithTag (fffff800`0193ce00) fffff800`01835d07 90 nop fffff800`01835d08 90 nop fffff800`01835d09 90 nop fffff800`01835d0a 90 nop fffff800`01835d0b 90 nop fffff800`01835d0c 90 nop 1: kd> u fffff800`0193e840 nt!ExFreePool: fffff800`0193e840 33d2 xor edx,edx fffff800`0193e842 e9b9e5ffff jmp nt!ExFreePoolWithTag (fffff800`0193ce00) fffff800`0193e847 90 nop fffff800`0193e848 90 nop fffff800`0193e849 90 nop fffff800`0193e84a 90 nop fffff800`0193e84b 90 nop fffff800`0193e84c 90 nop 1: kd> u fffff800`0193ce00 nt!ExFreePoolWithTag: fffff800`0193ce00 fff3 push rbx fffff800`0193ce02 55 push rbp fffff800`0193ce03 56 push rsi fffff800`0193ce04 57 push rdi fffff800`0193ce05 4156 push r14 fffff800`0193ce07 4157 push r15 fffff800`0193ce09 4881ec88000000 sub rsp,88h fffff800`0193ce10 8b0532d70200 mov eax,dword ptr [nt!ExpSpecialAllocations (fffff800`0196a548)] 1: kd> a fffff800`0193ce00 fffff800`0193ce00 ret fffff800`0193ce01 1: kd> u fffff800`0193ce00 nt!ExFreePoolWithTag: fffff800`0193ce00 c3 ret fffff800`0193ce01 f355 rep push rbp fffff800`0193ce03 56 push rsi fffff800`0193ce04 57 push rdi fffff800`0193ce05 4156 push r14 fffff800`0193ce07 4157 push r15 fffff800`0193ce09 4881ec88000000 sub rsp,88h fffff800`0193ce10 8b0532d70200 mov eax,dword ptr [nt!ExpSpecialAllocations (fffff800`0196a548)] 1: kd> !vm *** Virtual Memory Usage *** Physical Memory: 261872 ( 1047488 Kb) Page File: \??\C:\pagefile.sys Current: 1126400 Kb Free Space: 997512 Kb Minimum: 1126400 Kb Maximum: 1126400 Kb Available Pages: 145215 ( 580860 Kb) ResAvail Pages: 221744 ( 886976 Kb) Locked IO Pages: 0 ( 0 Kb) Free System PTEs: 268317995 (1073271980 Kb) Modified Pages: 7263 ( 29052 Kb) Modified PF Pages: 7254 ( 29016 Kb) NonPagedPool Usage: 8702 ( 34808 Kb) NonPagedPool Max: 98304 ( 393216 Kb) PagedPool 0 Usage: 8389 ( 33556 Kb) PagedPool 1 Usage: 5040 ( 20160 Kb) PagedPool 2 Usage: 789 ( 3156 Kb) PagedPool 3 Usage: 714 ( 2856 Kb) PagedPool 4 Usage: 766 ( 3064 Kb) PagedPool Usage: 15698 ( 62792 Kb) PagedPool Maximum: 33554432 ( 134217728 Kb) Session Commit: 4381 ( 17524 Kb) Shared Commit: 3831 ( 15324 Kb) Special Pool: 0 ( 0 Kb) Shared Process: 4548 ( 18192 Kb) PagedPool Commit: 15702 ( 62808 Kb) Driver Commit: 3148 ( 12592 Kb) Committed pages: 140170 ( 560680 Kb) Commit limit: 532419 ( 2129676 Kb) Total Private: 90224 ( 360896 Kb) 03bc svchost.exe 14626 ( 58504 Kb) 0340 svchost.exe 9608 ( 38432 Kb) 0100 SearchIndexer.e 8475 ( 33900 Kb) 0644 explorer.exe 5933 ( 23732 Kb) 03cc svchost.exe 5437 ( 21748 Kb) 03a0 svchost.exe 3922 ( 15688 Kb) 046c svchost.exe 3854 ( 15416 Kb) 054c svchost.exe 3647 ( 14588 Kb) 0184 audiodg.exe 3223 ( 12892 Kb) 0450 taskeng.exe 2459 ( 9836 Kb) 0530 spoolsv.exe 2214 ( 8856 Kb) 0710 vmtoolsd.exe 2143 ( 8572 Kb) 06fc MSASCui.exe 2005 ( 8020 Kb) 0894 dllhost.exe 1858 ( 7432 Kb) 0760 vmtoolsd.exe 1762 ( 7048 Kb) 040c svchost.exe 1645 ( 6580 Kb) 097c logon.scr 1628 ( 6512 Kb) 01ec csrss.exe 1572 ( 6288 Kb) 01a0 SLsvc.exe 1333 ( 5332 Kb) 0320 svchost.exe 1050 ( 4200 Kb) 0254 lsass.exe 965 ( 3860 Kb) 09e8 msdtc.exe 864 ( 3456 Kb) 02e8 svchost.exe 856 ( 3424 Kb) 0a80 wuauclt.exe 783 ( 3132 Kb) 0120 TPAutoConnSvc.e 781 ( 3124 Kb) 0004 System 747 ( 2988 Kb) 0708 VMwareTray.exe 744 ( 2976 Kb) 025c lsm.exe 738 ( 2952 Kb) 0a44 TPAutoConnect.e 725 ( 2900 Kb) 0218 services.exe 723 ( 2892 Kb) 0234 winlogon.exe 681 ( 2724 Kb) 08cc taskeng.exe 659 ( 2636 Kb) 01b8 csrss.exe 638 ( 2552 Kb) 0190 svchost.exe 635 ( 2540 Kb) 0624 dwm.exe 469 ( 1876 Kb) 01d8 wininit.exe 429 ( 1716 Kb) 0288 svchost.exe 279 ( 1116 Kb) 0174 smss.exe 114 ( 456 Kb) 1: kd> !poolused 3 *** CacheSize too low - increasing to 64 MB .cache 0x10000 Max cache size is : 67108864 bytes (0x10000 KB) Total memory in cache : 188592 bytes (0xb9 KB) Number of regions cached: 788 1548 full reads broken into 2098 partial reads counts: 1036 cached/1062 uncached, 49.38% cached bytes : 154272 cached/138328 uncached, 52.72% cached ** Transition PTEs are implicitly decoded ** Prototype PTEs are implicitly decoded .. Sorting by NonPaged Pool Consumed NonPaged Paged Tag Allocs Frees Diff Used Allocs Frees Diff Used EtwB 300 133 167 6328896 14 0 14 475136 Etw Buffer , Binary: nt!etw Cont 1081 3 1078 4970384 0 0 0 0 Contiguous physical memory allocations for device drivers DEVT 1 0 1 2106224 0 0 0 0 UNKNOWN pooltag 'DEVT', please update pooltag.txt File 124175 117882 6293 1969680 0 0 0 0 File objects Ntfr 10483 1356 9127 1169168 0 0 0 0 ERESOURCE , Binary: ntfs.sys FMsl 7030 1449 5581 1071552 0 0 0 0 STREAM_LIST_CTRL structure , Binary: fltmgr.sys AmlH 1 0 1 1048576 0 0 0 0 ACPI AMLI Pooltags MmCa 7599 3206 4393 971696 0 0 0 0 Mm control areas for mapped files , Binary: nt!mm RaRS 1000 0 1000 960000 0 0 0 0 RaidUnitAllocateResources , Binary: storport.sys Pool 12 7 5 930448 0 0 0 0 Pool tables, etc. iGig 1035 0 1035 830816 0 0 0 0 UNKNOWN pooltag 'iGig', please update pooltag.txt Thre 2228 1678 550 657056 0 0 0 0 Thread objects , Binary: nt!ps HTab 610 508 102 544976 0 0 0 0 Hash Table pool MmCi 1173 3 1170 537760 0 0 0 0 Mm control areas for images , Binary: nt!mm NtFs 9652 4055 5597 468160 18619 9663 8956 1821616 StrucSup.c , Binary: ntfs.sys Ntfn 7103 1504 5599 449216 0 0 0 0 SCB_NONPAGED , Binary: ntfs.sys FMfc 2693 388 2305 442560 0 0 0 0 FLTMGR_FILE_OBJECT_CONTEXT structure , Binary: fltmgr.sys Devi 630 259 371 433056 0 0 0 0 Device objects Even 73905 70686 3219 312704 0 0 0 0 Event objects ALPC 2373 1747 626 303040 0 0 0 0 ALPC port objects , Binary: nt!alpc Vad 17530 14869 2661 298032 0 0 0 0 Mm virtual address descriptors , Binary: nt!mm Mdl 7156 5870 1286 275760 0 0 0 0 Io, Mdls AmlC 1742 1738 4 262144 0 0 0 0 ACPI AMLI Pooltags PciB 580 234 346 250560 3757 3719 38 5200 PnP pci bus enumerator , Binary: pci.sys EcBp 2 0 2 246752 0 0 0 0 UNKNOWN pooltag 'EcBp', please update pooltag.txt AcpD 838 498 340 237120 0 0 0 0 ACPI device data , Binary: acpi.sys Io 205673 202910 2763 231120 38289 38284 5 288 general IO allocations , Binary: nt!io FOCX 22397 20087 2310 221760 0 0 0 0 File System Run Time File Object Context structure , Binary: nt!fsrtl ViMm 156 48 108 208800 129 34 95 586176 Video memory manager , Binary: dxgkrnl.sys NtfJ 4 0 4 204800 5 4 1 144 Unkown allocation , Binary: ntfs.sys Icp 2820 1066 1754 168256 0 0 0 0 I/O completion packets queue on a completion ports CDmp 20 12 8 165536 0 0 0 0 Crashdump driver , Binary: crashdmp.sys VoSm 14 9 5 163936 0 0 0 0 Bitmap allocations , Binary: volsnap.sys EtwR 1966 968 998 159680 0 0 0 0 Etw Registration , Binary: nt!etw CcSc 6048 5721 327 156960 0 0 0 0 Cache Manager Shared Cache Map , Binary: nt!cc WfpS 7 5 2 156272 0 0 0 0 WFP startup , Binary: netio.sys Irp 126879 126627 252 148928 0 0 0 0 Io, IRP packets MmAc 8947 8912 35 143360 0 0 0 0 Mm access log buffers , Binary: nt!mm HGIX 2 0 2 140000 0 0 0 0 UNKNOWN pooltag 'HGIX', please update pooltag.txt EtwG 402 55 347 133248 0 0 0 0 Etw Guid , Binary: nt!etw CcVa 1 0 1 131072 0 0 0 0 Cache Manager Initial array of Vacbs , Binary: nt!cc NSIk 495 132 363 114720 0 0 0 0 NSI RPC Tansactions , Binary: nsi.dll VadS 11258 9893 1365 109200 0 0 0 0 Mm virtual address descriptors (short) , Binary: nt!mm Ntfi 1754 1513 241 107968 0 0 0 0 IRP_CONTEXT , Binary: ntfs.sys usbp 1759 1648 111 103264 42 40 2 128 UNKNOWN pooltag 'usbp', please update pooltag.txt SeTd 72879 72163 716 91648 72899 72183 716 130208 Security Token dynamic part , Binary: nt!se Sema 1122 174 948 91008 0 0 0 0 Semaphore objects Mm 325 317 8 90816 16 11 5 1168 general Mm Allocations , Binary: nt!mm Dnod 427 287 140 78400 0 0 0 0 Device node structure CTGC 2 0 2 73728 0 0 0 0 UNKNOWN pooltag 'CTGC', please update pooltag.txt ScSc 4 0 4 66560 0 0 0 0 Mass storage driver tags Vadl 2175 1714 461 66384 0 0 0 0 Mm virtual address descriptors (long) , Binary: nt!mm Driv 135 2 133 65696 0 0 0 0 Driver objects VoSb 130 126 4 65536 0 0 0 0 Buffer allocations , Binary: volsnap.sys SpSy 90 1 89 58944 1451 958 493 137056 UNKNOWN pooltag 'SpSy', please update pooltag.txt ViSh 95 20 75 56976 0 0 0 0 Video scheduler , Binary: dxgkrnl.sys IPrq 5 0 5 56352 0 0 0 0 IP Request Control data , Binary: tcpip.sys ReTa 898 23 875 56192 0 0 0 0 Resource Extended Table MmSi 1144 3 1141 54768 0 0 0 0 Control area security image stubs , Binary: nt!mm TdxC 132 50 82 53792 0 0 0 0 TDX Connections , Binary: tdx.sys AlIn 204 39 165 52560 5 5 0 0 ALPC Internal allocation , Binary: nt!alpc FSrt 34 20 14 50528 59 46 13 10288 File System Run Time allocations (DO NOT USE!) , Binary: nt!fsrtl Hal 2552 2513 39 49168 89 88 1 144 Hardware Abstraction Layer , Binary: hal.dll LSbf 89 0 89 48496 37 1 36 21520 SMB1 buffer descriptor or srvnet allocation , Binary: srvnet.sys UHUB 39332 39263 69 47264 56 54 2 192 Universal Serial Bus Hub SMBi 119 105 14 45552 1 0 1 144 UNKNOWN pooltag 'SMBi', please update pooltag.txt ND 508 488 20 44640 1 0 1 144 general NDIS allocations , Binary: ndis.sys ClfC 8 0 8 44416 0 0 0 0 CLFS Log physical FCB lookaside list , Binary: clfs.sys Muta 1412 1101 311 42240 0 0 0 0 Mutant objects Proc 63 25 38 40736 0 0 0 0 Process objects , Binary: nt!ps Nhfs 20 0 20 40672 0 0 0 0 NetIO Hash Function State Data , Binary: tcpip.sys inte 110 0 110 38912 13 0 13 1184 UNKNOWN pooltag 'inte', please update pooltag.txt AfdE 72 3 69 38848 0 0 0 0 Afd endpoint structure , Binary: afd.sys Vadm 5257 4989 268 38592 0 0 0 0 UNKNOWN pooltag 'Vadm', please update pooltag.txt InPa 50 41 9 36864 0 0 0 0 Inet Port Assignments , Binary: tcpip.sys AleS 70 53 17 35904 0 0 0 0 ALE token info , Binary: tcpip.sys WfpH 700 145 555 33808 0 0 0 0 WFP hash , Binary: netio.sys UsbC 1373 1363 10 33472 22 22 0 0 UNKNOWN pooltag 'UsbC', please update pooltag.txt Time 120 21 99 33264 0 0 0 0 Timer objects , Binary: nt!ke UlXR 2 0 2 33024 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys Tdx 106 102 4 32912 0 0 0 0 TDX Generic Buffers (Address, Entity information, Interface change allocations) , Binary: tdx.sys VmBu 1 0 1 32768 0 0 0 0 I/O buffers , Binary: volmgrx.sys InPA 512 0 512 32768 0 0 0 0 Inet Port Assignment Arrays , Binary: tcpip.sys IdeP 52 32 20 32656 14 14 0 0 atapi IDE Gsem 196 0 196 31232 0 0 0 0 Gdi Semaphores AleE 76 0 76 30512 0 0 0 0 ALE endpoint context , Binary: tcpip.sys Wait 937574 937527 47 30320 0 0 0 0 WaitCompletion Packets , Binary: nt!io MmSP 8 0 8 29488 0 0 0 0 SLIST entries for system PTE NB queues , Binary: nt!mm AzBD 868 848 20 29456 0 0 0 0 UNKNOWN pooltag 'AzBD', please update pooltag.txt CM44 470 240 230 29440 0 0 0 0 Internal Configuration manager allocations , Binary: nt!cm LSSL 41 0 41 28864 15 13 2 128 SMBLIB allocation , Binary: srv2.sys NDif 31 3 28 27744 0 0 0 0 NDIS_TAG_IF , Binary: ndis.sys MmLd 181 44 137 27296 4 4 0 0 Mm load module database , Binary: nt!mm NDnd 4 0 4 26256 0 0 0 0 NDIS_TAG_POOL_NDIS , Binary: ndis.sys Pcsb 3 0 3 25776 0 0 0 0 PACER Send Buffers , Binary: pacer.sys FMic 2243 2221 22 25280 0 0 0 0 IRP_CTRL structure , Binary: fltmgr.sys ObjT 37 0 37 24864 0 0 0 0 object type objects , Binary: nt!ob KeIn 6 0 6 24576 0 0 0 0 UNKNOWN pooltag 'KeIn', please update pooltag.txt FxLg 6 0 6 24576 0 0 0 0 KMDF IFR log tag , Binary: wdf01000.sys EcXp 1 0 1 23280 0 0 0 0 UNKNOWN pooltag 'EcXp', please update pooltag.txt CcVl 15 1 14 22976 0 0 0 0 Cache Manager Vacb Level structures (large streams) , Binary: nt!cc FSro 289 6 283 22640 289 6 283 22640 File System Run Time , Binary: nt!fsrtl InPP 2 0 2 22400 0 0 0 0 Inet Port pool , Binary: tcpip.sys Tcpt 5 0 5 21984 0 0 0 0 TCP Timers , Binary: tcpip.sys VM3D 19 5 14 21904 9 2 7 368 Volume Manager , Binary: volmgr.sys Wdog 11 0 11 20864 2 0 2 96 Watchdog object/context allocation , Binary: watchdog.sys umbu 60 11 49 20800 14 9 5 576 UNKNOWN pooltag 'umbu', please update pooltag.txt I6nb 5 0 5 20480 0 0 0 0 IPv6 Neighbors , Binary: tcpip.sys WfpF 366 62 304 19456 0 0 0 0 WFP filters , Binary: netio.sys Fsb 38 0 38 19456 0 0 0 0 Fixed-Size Block pool , Binary: netio.sys Wmip 284 41 243 19440 939 631 308 32944 Wmi General purpose allocation TcpE 26 0 26 19312 0 0 0 0 TCP Endpoints , Binary: tcpip.sys LSwi 2 1 1 19200 0 0 0 0 SMB1 initial work context , Binary: srv.sys NDw1 8 0 8 18800 0 0 0 0 NDIS_TAG_WMI_GUID_TO_OID , Binary: ndis.sys IoCo 158 28 130 18720 0 0 0 0 UNKNOWN pooltag 'IoCo', please update pooltag.txt NDmo 13 0 13 18400 0 0 0 0 NDIS_TAG_M_OPEN_BLK , Binary: ndis.sys Frag 30941 29822 1119 17904 1259 757 502 8032 UNKNOWN pooltag 'Frag', please update pooltag.txt TcHT 4 0 4 17728 0 0 0 0 TCP Hash Tables , Binary: tcpip.sys EtwL 21 3 18 17728 0 0 0 0 ETW_LOGGER_CONTEXT , Binary: nt!etw VfAT 143 6 137 17536 0 0 0 0 Verifier AVL trees , Binary: nt!Vf BaNB 4 0 4 17280 0 0 0 0 UNKNOWN pooltag 'BaNB', please update pooltag.txt StBn 3 0 3 17232 0 0 0 0 UNKNOWN pooltag 'StBn', please update pooltag.txt Iptt 42 0 42 16992 0 0 0 0 IP Timer Tables , Binary: tcpip.sys NDfa 30 0 30 16800 0 0 0 0 NDIS_TAG_FILTER_ADDR , Binary: ndis.sys WfTi 20 0 20 16480 0 0 0 0 WFP timer RxIr 14 4 10 16480 0 0 0 0 RDBSS RxContext , Binary: rdbss.sys FlpS 4 0 4 16384 0 0 0 0 Framing Layer Serialized Requests , Binary: tcpip.sys IPpa 4 0 4 16384 0 0 0 0 IP Path information , Binary: tcpip.sys Ipur 4 0 4 16384 0 0 0 0 IP Unicast Routes , Binary: tcpip.sys IPss 4 0 4 16384 0 0 0 0 IP Session State , Binary: tcpip.sys Lfsr 1 0 1 16384 0 0 0 0 UNKNOWN pooltag 'Lfsr', please update pooltag.txt PfEL 2 1 1 16384 0 0 0 0 Pf Event logging buffers , Binary: nt!pf WfpC 7 5 2 16112 0 0 0 0 WFP callouts , Binary: netio.sys CcVp 93 60 33 16016 0 0 0 0 Cache Manager Array of Vacb pointers for a cached stream , Binary: nt!cc NbL4 100 50 50 15200 0 0 0 0 NetBT lower connection , Binary: netbt.sys Ioin 130 51 79 15200 0 0 0 0 Io interrupts AzWd 74 0 74 14528 0 0 0 0 HD Audio Class Driver (AzWidget) , Binary: HDAudio.sys PnpI 427 287 140 14096 0 0 0 0 PNPMGR instance path , Binary: nt!pnp NDam 1492 1474 18 14032 0 0 0 0 NdisAllocateMemory , Binary: ndis.sys ReSe 235 3 232 13504 0 0 0 0 Resource Semaphore Nbtl 132 50 82 13120 0 0 0 0 NetBT allocations WmiR 116 0 116 12992 0 0 0 0 Wmi Registration info blocks HDAu 80 37 43 12992 53 40 13 3040 UNKNOWN pooltag 'HDAu', please update pooltag.txt NDpp 6 0 6 12672 0 0 0 0 packet pool , Binary: ndis.sys vskg 2 0 2 12480 0 0 0 0 UNKNOWN pooltag 'vskg', please update pooltag.txt FlpM 3 0 3 12288 0 0 0 0 Framing Layer Multicast Groups , Binary: tcpip.sys I4nb 3 0 3 12288 0 0 0 0 IPv4 Neighbors , Binary: tcpip.sys SmBf 2 0 2 12288 0 0 0 0 SMB exchange buffer , Binary: mrxsmb.sys UNbl 6 0 6 11952 0 0 0 0 UDP NetBufferLists , Binary: tcpip.sys NDpf 8 0 8 11776 0 0 0 0 NDIS_TAG_FILTER , Binary: ndis.sys Nnnn 7 0 7 11472 0 0 0 0 NetIO NetBuffers And NetBufferLists , Binary: netio.sys Clfs 135 20 115 11152 179 151 28 266208 CLFS General buffer, or owner page lookaside list , Binary: clfs.sys LeGe 594 585 9 11024 0 0 0 0 Legacy Registry Mapping Module Buffers , Binary: tcpip.sys AfdB 8 0 8 10976 0 0 0 0 Afd data buffer , Binary: afd.sys TpWo 54 5 49 10976 0 0 0 0 Threadpool worker factory objects , Binary: nt!ex DxgK 113 40 73 10640 437 345 92 100736 Vista display driver support , Binary: dxgkrnl.sys WfpI 54 8 46 10400 0 0 0 0 WFP index , Binary: netio.sys Scbf 114 106 8 10240 0 0 0 0 Mass storage driver tags TmRm 527 512 15 10080 0 0 0 0 Tm KRESOURCEMANAGER object , Binary: nt!tm TNbl 3 0 3 10000 0 0 0 0 TCP Send NetBufferLists , Binary: tcpip.sys IPpv 1 0 1 9872 0 0 0 0 UNKNOWN pooltag 'IPpv', please update pooltag.txt MuoC 5 0 5 9808 10 10 0 0 MOUSE_POOL_TAG Mouse Class Driver Nnbl 5 0 5 9808 0 0 0 0 NetIO NetBufferLists , Binary: netio.sys EtwQ 340 137 203 9744 0 0 0 0 Etw Queue , Binary: nt!etw NbL2 32 0 32 9728 0 0 0 0 NetBT lower connection , Binary: netbt.sys Nnbf 5 0 5 9552 0 0 0 0 NetIO NetBuffers , Binary: netio.sys ReEv 198 4 194 9312 0 0 0 0 Resource Event UlPP 18 0 18 9216 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys NbtD 32 0 32 9216 0 0 0 0 NetBT connection , Binary: netbt.sys MmSd 79 9 70 8960 0 0 0 0 extended subsections used to map data files , Binary: nt!mm CcMb 64 22 42 8736 0 0 0 0 Cache Manager Mbcb , Binary: nt!cc VfIT 142 6 136 8704 0 0 0 0 Verifier Import Address Table information , Binary: nt!Vf UDNb 1 0 1 8592 0 0 0 0 UDP NetBuffers , Binary: tcpip.sys TcDN 1 0 1 8592 0 0 0 0 TCP Delayed Delivery Network Buffer Lists , Binary: tcpip.sys TSNb 1 0 1 8592 0 0 0 0 TCP Send NetBuffers , Binary: tcpip.sys moni 22 1 21 8544 3 0 3 304 UNKNOWN pooltag 'moni', please update pooltag.txt ObCi 194 106 88 8448 0 0 0 0 captured information for ObCreateObject , Binary: nt!ob NDpb 11 0 11 8336 0 0 0 0 protocol block , Binary: ndis.sys Pctw 1 0 1 8256 0 0 0 0 PACER Timer Wheels , Binary: pacer.sys I4ai 2 0 2 8192 0 0 0 0 IPv4 Local Address Identifiers , Binary: tcpip.sys I6ai 2 0 2 8192 0 0 0 0 IPv6 Local Address Identifiers , Binary: tcpip.sys I4ua 2 0 2 8192 0 0 0 0 IPv4 Local Unicast Addresses , Binary: tcpip.sys InF2 2 0 2 8192 0 0 0 0 Inet Generic Fixed Size Block pool 2 , Binary: tcpip.sys I6ma 2 0 2 8192 0 0 0 0 IPv6 Local Multicast Addresses , Binary: tcpip.sys I6ua 2 0 2 8192 0 0 0 0 IPv6 Local Unicast Addresses , Binary: tcpip.sys I4ba 2 0 2 8192 0 0 0 0 IPv4 Local Broadcast Addresses , Binary: tcpip.sys Nph1 2 0 2 8192 0 0 0 0 NetIO Protocol Header1 Data , Binary: netio.sys InF1 2 0 2 8192 0 0 0 0 Inet Generic Fixed Size Block pool 1 , Binary: tcpip.sys Mmdl 2247 2241 6 8000 0 0 0 0 Mm Mdls for flushes , Binary: nt!mm whea 7 0 7 8000 0 0 0 0 UNKNOWN pooltag 'whea', please update pooltag.txt NSIr 6457 6389 68 7968 0 0 0 0 NSI Generic Buffers , Binary: nsi.dll AzAd 32 0 32 7872 11 7 4 128 HD Audio Class Driver (AzPcAudDev) , Binary: HDAudio.sys AleP 15 0 15 7408 0 0 0 0 ALE process image path , Binary: tcpip.sys UdpA 163 139 24 7296 0 0 0 0 UDP Endpoints , Binary: tcpip.sys NMRb 64 9 55 7040 0 0 0 0 Network Module Registrar Bindings , Binary: tcpip.sys LScn 6 0 6 6912 0 0 0 0 SMB1 connection , Binary: srv.sys WmiG 29 11 18 6912 0 0 0 0 Allocation of WMIGUID TmTm 7 0 7 6720 0 0 0 0 Tm KTRANSACTIONMANAGER object , Binary: nt!tm MmIn 20 2 18 6624 0 0 0 0 Mm inpaged io structures , Binary: nt!mm msis 17 0 17 6624 3 0 3 336 UNKNOWN pooltag 'msis', please update pooltag.txt NMRm 58 0 58 6496 0 0 0 0 Network Module Registrar Modules , Binary: tcpip.sys Ksec 6 0 6 6464 617 615 2 12352 Security device driver , Binary: ksecdd.sys IPif 6 0 6 6240 0 0 0 0 IP Interfaces , Binary: tcpip.sys AcpS 277 158 119 5952 124 120 4 336 ACPI string data , Binary: acpi.sys Flng 34 20 14 5888 0 0 0 0 Framing Layer Generic Buffers (Tunnel/Port change notifications, ACLs) , Binary: tcpip.sys RaDf 40 0 40 5760 0 0 0 0 RaidInitializeDeferredQueue storport!_RAID_DEFERRED_QUEUE.FreeList , Binary: storport.sys RaME 2 0 2 5680 0 0 0 0 RiAllocateMiniportDeviceExtension , Binary: storport.sys SePa 21876 21839 37 5568 1 0 1 32 Process audit image names and captured policy structures , Binary: nt!se NDfb 3 0 3 5520 0 0 0 0 NDIS_TAG_LWFILTER_BLOCK , Binary: ndis.sys ScPC 2 0 2 5472 0 0 0 0 reset bus code Pcle 3 0 3 5472 0 0 0 0 PACER Lines , Binary: pacer.sys ArbM 111 0 111 5328 339 339 0 0 ARBITER_MISC_TAG , Binary: nt!arb ClfE 18 0 18 5184 0 0 0 0 CLFS Log CCB lookaside list , Binary: clfs.sys MmDm 32 0 32 5120 0 0 0 0 deferred MmUnlock entries , Binary: nt!mm NDch 72 57 15 5040 0 0 0 0 NDIS_TAG_CONFIG_HANDLE , Binary: ndis.sys FMis 114 111 3 4976 0 0 0 0 FLT_INSTANCE structure , Binary: fltmgr.sys AleD 20 8 12 4736 0 0 0 0 ALE remote endpoint , Binary: tcpip.sys FIcv 60 54 6 4704 0 0 0 0 FileInfo FS-filter Volume Context , Binary: fileinfo.sys Mmdi 14 3 11 4624 0 0 0 0 MDLs for physical memory allocations , Binary: nt!mm TcpL 17 1 16 4608 0 0 0 0 TCP Listeners , Binary: tcpip.sys NDoa 7 0 7 4608 0 0 0 0 NDIS_TAG_OID_ARRAY , Binary: ndis.sys AfdC 16 0 16 4592 0 0 0 0 Afd connection structure , Binary: afd.sys NLcp 2 0 2 4512 0 0 0 0 Network Layer Compartments , Binary: tcpip.sys Nb01 2 0 2 4400 0 0 0 0 NetBT hash table , Binary: netbt.sys NBSf 2 0 2 4336 0 0 0 0 FCB Ntft 65 57 8 4256 0 0 0 0 SCB (Prerestart) , Binary: ntfs.sys Etwp 2 0 2 4256 0 0 0 0 ETW per-processor block , Binary: nt!etw RxMs 1 0 1 4208 4 3 1 48 RDBSS miscellaneous , Binary: rdbss.sys HidC 37 12 25 4192 19 17 2 192 HID Class SMBH 1 0 1 4176 0 0 0 0 UNKNOWN pooltag 'SMBH', please update pooltag.txt CcBm 4 0 4 4160 0 0 0 0 Cache Manager Bitmap , Binary: nt!cc IPdc 2 0 2 4128 0 0 0 0 IP Destination Cache , Binary: tcpip.sys TdxT 12 0 12 4112 0 0 0 0 TDX Transport Provider Contexts , Binary: tdx.sys WanO 1 0 1 4096 0 0 0 0 NdisWan Tags (PPP Framing module for Remote Access) SmMm 1 0 1 4096 0 0 0 0 SMB mm allocated structures. , Binary: mrxsmb.sys CcZe 1 0 1 4096 0 0 0 0 Cache Manager Buffer of Zeros , Binary: nt!cc Plcl 1 0 1 4096 0 0 0 0 Cache aware pushlock entry. One per processor I4ma 1 0 1 4096 0 0 0 0 IPv4 Local Multicast Addresses , Binary: tcpip.sys InF0 1 0 1 4096 0 0 0 0 Inet Generic Fixed Size Block pool 0 , Binary: tcpip.sys MmRp 180 179 1 4096 0 0 0 0 Mm repurpose logging , Binary: nt!mm Nph2 1 0 1 4096 0 0 0 0 NetIO Protocol Header2 Data , Binary: netio.sys RaTM 3 2 1 4096 0 0 0 0 RaInitializeTagList storport!_QUEUE_TAG_LIST.Buffer , Binary: storport.sys TcCR 1 0 1 4096 0 0 0 0 TCP Connect Requests , Binary: tcpip.sys 8042 4 0 4 4048 12 12 0 0 PS/2 kb and mouse , Binary: i8042prt.sys Dlst 10295 10211 84 4032 0 0 0 0 UNKNOWN pooltag 'Dlst', please update pooltag.txt PX2. 1 0 1 4016 0 0 0 0 UNKNOWN pooltag ' PX2', please update pooltag.txt PXl. 1 0 1 4016 0 0 0 0 UNKNOWN pooltag ' PXl', please update pooltag.txt PcCr 37 29 8 3936 240 240 0 0 WDM audio stuff ClMl 7 0 7 3920 0 0 0 0 UNKNOWN pooltag 'ClMl', please update pooltag.txt RfsL 8 0 8 3888 6 0 6 23968 Bluetooth RFCOMM TDI driver PEAU 12 3 9 3856 194 43 151 19168 UNKNOWN pooltag 'PEAU', please update pooltag.txt CM 15573 15528 45 3840 16760 16747 13 1200 Configuration Manager (registry) , Binary: nt!cm Pcfc 3 0 3 3792 0 0 0 0 PACER Filter Contexts , Binary: pacer.sys ClfB 8 0 8 3712 0 0 0 0 CLFS Log base file lookaside list , Binary: clfs.sys TcpI 2 0 2 3680 0 0 0 0 TCP ISN buffers , Binary: tcpip.sys FMvo 111 109 2 3664 0 0 0 0 FLT_VOLUME structure , Binary: fltmgr.sys Cngb 38 18 20 3392 3701 3227 474 44928 CNG kmode crypto pool tag , Binary: ksecdd.sys Desk 10 0 10 3360 0 0 0 0 UNKNOWN pooltag 'Desk', please update pooltag.txt FMfl 2 0 2 3296 0 0 0 0 FLT_FILTER structure , Binary: fltmgr.sys FIPc 12785 12756 29 3248 0 0 0 0 FileInfo FS-filter Prefetch Context , Binary: fileinfo.sys AcpF 5915 5875 40 3200 0 0 0 0 ACPI interface data , Binary: acpi.sys TpWc 54 5 49 3136 0 0 0 0 Threadpool minipacket context , Binary: nt!ex NeWQ 38 0 38 3040 0 0 0 0 NetIO WorkQueue Data , Binary: tcpip.sys Adap 7 0 7 2912 0 0 0 0 Adapter objects NDan 31 4 27 2912 0 0 0 0 adapter name , Binary: ndis.sys NpFn 58 9 49 2880 0 0 0 0 Name block , Binary: npfs.sys FSmg 9 0 9 2880 0 0 0 0 File System Run Time , Binary: nt!fsrtl CcPc 141 116 25 2800 0 0 0 0 Cache Manager Private Cache Map , Binary: nt!cc NSpc 40 7 33 2704 0 0 0 0 NSI Proxy Contexts , Binary: nsi.dll NDco 14 7 7 2656 0 0 0 0 NDIS_TAG_CO , Binary: ndis.sys EtwS 33 6 27 2592 0 0 0 0 Etw DataSource , Binary: nt!etw IoCc 1706 1625 81 2592 0 0 0 0 Io completion context , Binary: nt!io MmSy 179 156 23 2576 0 0 0 0 Mm PTE and IO tracking logs , Binary: nt!mm KbdC 3 0 3 2576 10 10 0 0 Keyboard Class Driver OlmI 4 0 4 2560 0 0 0 0 Offload Manager Interfaces , Binary: tcpip.sys MuFc 11 2 9 2560 0 0 0 0 File Context , Binary: mup.sys LSwq 2 0 2 2528 0 0 0 0 SMB1 BlockTypeWorkQueue , Binary: srv.sys NtFL 417 415 2 2528 52 1 51 3264 LogSup.c , Binary: ntfs.sys TdxA 6 3 3 2496 0 0 0 0 TDX Transport Addresses , Binary: tdx.sys CTMM 28209 28192 17 2480 0 0 0 0 UNKNOWN pooltag 'CTMM', please update pooltag.txt PcCi 1 0 1 2416 0 0 0 0 WDM audio port class adapter device object stuff FxDr 6 0 6 2400 0 0 0 0 KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable. , Binary: wdf01000.sys IrbL 5 3 2 2336 0 0 0 0 UNKNOWN pooltag 'IrbL', please update pooltag.txt NMpc 11 0 11 2288 0 0 0 0 UNKNOWN pooltag 'NMpc', please update pooltag.txt AcpR 3 2 1 2256 183 176 7 1696 ACPI resource data , Binary: acpi.sys MmDT 19 14 5 2240 280 62 218 18448 Mm debug , Binary: nt!mm L2T1 1 0 1 2208 0 0 0 0 ndis\l2tp / MTAG_ADAPTERCB IPsi 6 0 6 2208 0 0 0 0 IP SubInterfaces , Binary: tcpip.sys TDIk 5 0 5 2192 0 0 0 0 TDI resource ClMc 13 5 8 2176 0 0 0 0 UNKNOWN pooltag 'ClMc', please update pooltag.txt NMhf 17 3 14 2128 0 0 0 0 Handle Factory pool , Binary: netio.sys Io.. 3 0 3 2096 0 0 0 0 UNKNOWN pooltag ' Io', please update pooltag.txt CCsw 2 0 2 2080 0 0 0 0 UNKNOWN pooltag 'CCsw', please update pooltag.txt PmPE 2 0 2 2080 0 0 0 0 Partition Manager partition entry , Binary: partmgr.sys HdCl 4 0 4 2080 23 22 1 128 HID Client Sample Driver AleL 4 0 4 2064 0 0 0 0 ALE LRU , Binary: tcpip.sys TcRL 1 0 1 2064 0 0 0 0 TCP Create And Connect Tcb Rate Limit Pool , Binary: tcpip.sys MmPa 64 0 64 2048 0 0 0 0 pagefile space deletion slist entries , Binary: nt!mm Nb16 7 0 7 2016 0 0 0 0 NetBT timer entry , Binary: netbt.sys NBqh 45 4 41 1968 0 0 0 0 Non-blocking queue entries used to carry the real data in the queue. Alep 14 0 14 1968 0 0 0 0 ALE process info , Binary: tcpip.sys Ussy 55 26 29 1920 0 0 0 0 USERTAG_SYSTEM , Binary: win32k!xxxDesktopThread TDIc 13 1 12 1920 0 0 0 0 TDI resource NpFr 28243 28215 28 1792 0 0 0 0 DATA_ENTRY records (read/write buffers) , Binary: npfs.sys WanJ 3 0 3 1776 0 0 0 0 LineUpInfo Call 12 0 12 1728 0 0 0 0 kernel callback object signature , Binary: nt!ex NMpt 24 4 20 1648 0 0 0 0 Generic AVL Tree allocations HidP 22 16 6 1632 0 0 0 0 HID Parser InNl 6 0 6 1632 0 0 0 0 UNKNOWN pooltag 'InNl', please update pooltag.txt Wind 6 0 6 1632 0 0 0 0 UNKNOWN pooltag 'Wind', please update pooltag.txt FLli 20 0 20 1600 0 0 0 0 per-file lock information Ntff 6 1 5 1600 3796 272 3524 4285184 FCB_DATA , Binary: ntfs.sys Itht 9 0 9 1584 0 0 0 0 IPsec hashtable , Binary: tcpip.sys Job 4 1 3 1552 0 0 0 0 UNKNOWN pooltag 'Job ', please update pooltag.txt Txfp 1 0 1 1536 0 0 0 0 UNKNOWN pooltag 'Txfp', please update pooltag.txt Nb05 6 1 5 1520 0 0 0 0 NetBT client element , Binary: netbt.sys LS2q 3 0 3 1488 0 0 0 0 SMB2 queue , Binary: srv2.sys SeSd 163 154 9 1440 252311 252299 12 1632 Security Descriptor , Binary: nt!se MntA 10 7 3 1424 2235 2209 26 2928 UNKNOWN pooltag 'MntA', please update pooltag.txt KSee 8 0 8 1408 0 0 0 0 event entry Prcr 8 0 8 1408 31 27 4 272 Processr driver allocations , Binary: processr.sys FMfr 2 1 1 1360 0 0 0 0 FLT_FRAME structure , Binary: fltmgr.sys Tdxo 4 0 4 1344 0 0 0 0 TDX Device Objects , Binary: tdx.sys NDof 7 3 4 1312 0 0 0 0 NDIS_TAG_OFFLOAD , Binary: ndis.sys Afdh 53 35 18 1312 0 0 0 0 Afd address list change buffer , Binary: afd.sys FMcr 2 0 2 1312 0 0 0 0 Context registration structures , Binary: fltmgr.sys LS2e 3 0 3 1280 0 0 0 0 SMB2 endpoint , Binary: srv2.sys NLcc 13 0 13 1248 0 0 0 0 Network Layer Client Contexts , Binary: tcpip.sys ClfD 2 0 2 1248 0 0 0 0 CLFS Log virtual FCB lookaside list , Binary: clfs.sys VoSh 73 47 26 1248 0 0 0 0 Bit history allocations , Binary: volsnap.sys MmWe 4 0 4 1216 0 0 0 0 Work entries for writing out modified filesystem pages. , Binary: nt!mm ClfG 4 0 4 1216 0 0 0 0 CLFS Log I/O Request lookaside list , Binary: clfs.sys FMfn 7 3 4 1216 18645 13231 5414 2394800 NAME_CACHE_NODE structure , Binary: fltmgr.sys Ipng 230 225 5 1200 0 0 0 0 IP Generic buffers (Address, Interface, Packetize, Route allocations) , Binary: tcpip.sys VoSc 942 932 10 1200 0 0 0 0 Snapshot context allocations , Binary: volsnap.sys Afdr 3 0 3 1184 0 0 0 0 Afd ERESOURCE buffer , Binary: afd.sys Afdl 93 65 28 1120 0 0 0 0 Afd lookaside lists buffer , Binary: afd.sys DOPE 7 0 7 1120 0 0 0 0 Device Object Power Extension (po component) AcdN 2 0 2 1120 0 0 0 0 TDI AcdObjectInfoG VoSt 117 112 5 1120 0 0 0 0 Temp table allocations , Binary: volsnap.sys AzCm 6 0 6 1104 162 162 0 0 HD Audio Class Driver (AzCommon) , Binary: HDAudio.sys Nb07 2 0 2 1088 0 0 0 0 NetBT datagram request tracker , Binary: netbt.sys NMRn 11 0 11 1056 0 0 0 0 Network Module Registrar Network Protocol Identifiers , Binary: tcpip.sys NDst 34 28 6 1056 0 0 0 0 NDIS_TAG_STRING , Binary: ndis.sys TcRD 1 0 1 1040 0 0 0 0 TCP Receive DPC Data , Binary: tcpip.sys TDIe 8 2 6 1024 0 0 0 0 TDI resource LBxp 1 0 1 1024 0 0 0 0 Transport ClfN 9 1 8 1024 0 0 0 0 CLFS Log base file lock , Binary: clfs.sys TDId 13 1 12 1024 0 0 0 0 TDI resource Mdp 2 0 2 1024 0 0 0 0 Memory Descriptor Lists , Binary: netio.sys CBRe 18 2 16 1024 0 0 0 0 CallbackRegistration FMng 9 5 4 1024 0 0 0 0 NAME_GENERATION_CONTEXT structure , Binary: fltmgr.sys TDIf 7 0 7 1008 0 0 0 0 TDI resource TDIa 43 36 7 1008 0 0 0 0 UNKNOWN pooltag 'TDIa', please update pooltag.txt Luaf 1 0 1 960 308 13 295 92704 LUA File Virtualization , Binary: luafv.sys SpWi 5 1 4 960 0 0 0 0 UNKNOWN pooltag 'SpWi', please update pooltag.txt NDrd 151 142 9 944 0 0 0 0 NDIS_TAG_REG_READ_DATA_BUFFER , Binary: ndis.sys HidU 266 258 8 928 0 0 0 0 UNKNOWN pooltag 'HidU', please update pooltag.txt VdPN 4 1 3 928 4792 4133 659 68512 Video display mode management , Binary: dxgkrnl.sys UlTP 1 0 1 896 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys Ala6 15 2 13 896 0 0 0 0 ALE remote endpoint IPv6 address , Binary: tcpip.sys PPMp 2 0 2 864 0 0 0 0 Kernel Processor Power Management Perf States. , Binary: nt!po Usla 6 0 6 864 0 0 0 0 USERTAG_LOOKASIDE , Binary: win32k!InitLockRecordLookaside Ala4 31 20 11 832 0 0 0 0 ALE remote endpoint IPv4 address , Binary: tcpip.sys CPnp 4142 4140 2 832 0 0 0 0 ClassPnP transfer packets , Binary: classpnp.sys PcSl 1 0 1 816 0 0 0 0 WDM audio stuff NDwh 5 0 5 816 0 0 0 0 NDIS_TAG_WRAPPER_HANDLE , Binary: ndis.sys TDIu 8 2 6 784 0 0 0 0 TDI resource vsks 4 2 2 784 0 0 0 0 UNKNOWN pooltag 'vsks', please update pooltag.txt PsQt 1 0 1 784 0 0 0 0 UNKNOWN pooltag 'PsQt', please update pooltag.txt KSed 8 0 8 768 0 0 0 0 event dpc item User 6 0 6 768 0 0 0 0 USERTAG_ERESOURCE , Binary: win32k!InitCreateUserCrit FLpc 8 0 8 768 0 0 0 0 UNKNOWN pooltag 'FLpc', please update pooltag.txt UlTT 6 0 6 768 0 0 0 0 Thread Tracker , Binary: http.sys NbtC 5 1 4 768 0 0 0 0 NetBT address element , Binary: netbt.sys Nbt0 5 1 4 768 0 0 0 0 NetBT name address , Binary: netbt.sys PX3. 1 0 1 752 0 0 0 0 UNKNOWN pooltag ' PX3', please update pooltag.txt PTPa 1 0 1 752 0 0 0 0 UNKNOWN pooltag 'PTPa', please update pooltag.txt IoCx 1 0 1 720 0 0 0 0 UNKNOWN pooltag 'IoCx', please update pooltag.txt AcpO 5 0 5 720 0 0 0 0 ACPI object data , Binary: acpi.sys Dprt 9 0 9 720 61 52 9 1376 Video port for Vista display drivers , Binary: dxgkrnl.sys WSKs 2 0 2 720 0 0 0 0 WSK socket , Binary: afd.sys aEoP 1 0 1 720 0 0 0 0 UNKNOWN pooltag 'aEoP', please update pooltag.txt FMrr 324 318 6 704 0 0 0 0 Per-processor Cache-aware rundown ref structure , Binary: fltmgr.sys IoTi 11 0 11 704 0 0 0 0 Io timers , Binary: nt!io WanN 1 0 1 704 0 0 0 0 NdisPacketPool Desc PXb. 1 0 1 688 0 0 0 0 UNKNOWN pooltag ' PXb', please update pooltag.txt TSic 6 0 6 688 0 0 0 0 Terminal Services - ICA_POOL_TAG , Binary: termdd.sys TmTx 517 516 1 688 0 0 0 0 Tm KTRANSACTION object , Binary: nt!tm LS2h 3 0 3 672 3 0 3 1424 SMB2 share , Binary: srv2.sys Dict 2 0 2 672 0 0 0 0 StorCreateDictionary storport!_STOR_DICTIONARY.Entries , Binary: storport.sys NDfv 1 0 1 656 0 0 0 0 NDIS_TAG_LWFILTER_DRIVER , Binary: ndis.sys FMct 211 208 3 656 0 0 0 0 TRACK_COMPLETION_NODES structure , Binary: fltmgr.sys AcpP 330 326 4 640 0 0 0 0 ACPI power data , Binary: acpi.sys ScB4 4 0 4 640 0 0 0 0 Storage descriptor header , Binary: classpnp.sys KSoh 37 33 4 640 0 0 0 0 object header FstB 10 9 1 640 0 0 0 0 ntos\fstub NDfm 3 0 3 624 0 0 0 0 NDIS_TAG_FAKE_MAC , Binary: ndis.sys ScLq 2 0 2 608 0 0 0 0 Release queue , Binary: classpnp.sys FMla 3 2 1 592 0 0 0 0 Per-processor IRPCTRL lookaside lists , Binary: fltmgr.sys AmlI 2 0 2 576 1 1 0 0 ACPI AMLI Pooltags CcWK 4 0 4 576 0 0 0 0 Kernel Cache Manager lookaside list , Binary: nt!cc DfCg 2 0 2 576 0 0 0 0 DFS Client PREFIXCACHE , Binary: dfsc.sys Vpb 5 0 5 560 0 0 0 0 Io, vpb's NDpn 77 67 10 560 0 0 0 0 NDIS_TAG_PARAMETER_NODE , Binary: ndis.sys EtwC 11 6 5 560 0 0 0 0 Etw Realtime Consumer , Binary: nt!etw PnpB 5 3 2 560 0 0 0 0 UNKNOWN pooltag 'PnpB', please update pooltag.txt AfdR 2 0 2 560 0 0 0 0 Afd remote address buffer , Binary: afd.sys Fwpp 10 3 7 544 4 1 3 10944 Windows Filtering Platform export driver. , Binary: fwpkclnt.sys AzWp 2 0 2 544 0 0 0 0 HD Audio Class Driver (AzWaveport, HdaWaveRTminiport) , Binary: HDAudio.sys Ra12 4 2 2 544 0 0 0 0 RaidBusEnumeratorAllocateUnitResources storport!_BUS_ENUM_RESOURCES.DataBuffer , Binary: storport.sys IoSh 79 68 11 528 0 0 0 0 Io shutdown packet , Binary: nt!io TdxM 1 0 1 528 0 0 0 0 TDX Message Indication Buffers , Binary: tdx.sys SMB2 2 1 1 528 0 0 0 0 UNKNOWN pooltag 'SMB2', please update pooltag.txt PmMA 7 6 1 528 0 0 0 0 UNKNOWN pooltag 'PmMA', please update pooltag.txt SmTp 10 5 5 528 0 0 0 0 SMB transport , Binary: mrxsmb.sys TTsp 1 0 1 528 0 0 0 0 TCP TCB Sends , Binary: tcpip.sys AlPi 1 0 1 512 0 0 0 0 ALE peer info , Binary: tcpip.sys TcpB 1 0 1 512 0 0 0 0 TCP Offload Blocks , Binary: tcpip.sys AlP6 1 0 1 512 0 0 0 0 ALE peer IPv6 address , Binary: tcpip.sys TcRH 1 0 1 512 0 0 0 0 TCP Reassembly Headers , Binary: tcpip.sys StCc 1 0 1 512 0 0 0 0 WFP stream inspection call context , Binary: netio.sys TcST 1 0 1 512 0 0 0 0 TCP Syn TCBs , Binary: tcpip.sys Ithk 9 0 9 512 0 0 0 0 UNKNOWN pooltag 'Ithk', please update pooltag.txt AlSP 1 0 1 512 0 0 0 0 ALE secure socket policy , Binary: tcpip.sys FlpC 8 0 8 512 0 0 0 0 Framing Layer Client Contexts , Binary: tcpip.sys AleU 1 0 1 512 0 0 0 0 ALE pend context , Binary: tcpip.sys AlP4 1 0 1 512 0 0 0 0 ALE peer IPv4 address , Binary: tcpip.sys AlPU 1 0 1 512 0 0 0 0 ALE secure socket policy update , Binary: tcpip.sys AlCi 1 0 1 512 0 0 0 0 ALE credential info , Binary: tcpip.sys WfpL 34 30 4 512 0 0 0 0 WFP fast cache , Binary: netio.sys StDa 1 0 1 512 0 0 0 0 WFP stream inspection data , Binary: netio.sys CcWk 451 443 8 512 0 0 0 0 Kernel Cache Manager lookaside list , Binary: nt!cc TcDM 1 0 1 512 0 0 0 0 TCP Delayed Delivery Memory Descriptor Lists , Binary: tcpip.sys AlLl 1 0 1 512 0 0 0 0 ALE remote endpoint LRU , Binary: tcpip.sys NtfT 9 5 4 512 0 0 0 0 SCB_SNAPSHOT , Binary: ntfs.sys AlSe 10 0 10 480 16340 15925 415 66400 ALPC client security , Binary: nt!alpc FlmC 3 0 3 480 0 0 0 0 Framing Layer Client Contexts , Binary: tcpip.sys InTl 6 0 6 480 0 0 0 0 UNKNOWN pooltag 'InTl', please update pooltag.txt AzFg 3 1 2 480 0 0 0 0 HD Audio Class Driver (Audio Function Group) , Binary: HDAudio.sys FxLa 6 0 6 480 0 0 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys SeCL 3 0 3 480 0 0 0 0 Security CONTEXT_TAG , Binary: nt!se NAcc 6 0 6 480 0 0 0 0 UNKNOWN pooltag 'NAcc', please update pooltag.txt WanM 5 0 5 464 0 0 0 0 Connection Table Tdxn 8 3 5 464 0 0 0 0 TDX Net Addresses , Binary: tdx.sys NLmc 2 0 2 448 0 0 0 0 UNKNOWN pooltag 'NLmc', please update pooltag.txt FMwi 19 15 4 448 0 0 0 0 Work item structures , Binary: fltmgr.sys aFDC 4 0 4 448 0 0 0 0 UNKNOWN pooltag 'aFDC', please update pooltag.txt ScCF 1 0 1 448 0 0 0 0 Feature descriptor , Binary: cdrom.sys Txts 2 0 2 448 0 0 0 0 UNKNOWN pooltag 'Txts', please update pooltag.txt Ntnu 2 0 2 432 2 0 2 208 UNKNOWN pooltag 'Ntnu', please update pooltag.txt Vm 1 0 1 432 1 0 1 80 General allocations , Binary: volmgrx.sys TcPt 1 0 1 432 0 0 0 0 TCP Partitions , Binary: tcpip.sys Batt 1 0 1 432 1 0 1 288 Battery class driver TmNR 2 0 2 416 0 0 0 0 UNKNOWN pooltag 'TmNR', please update pooltag.txt Ke 5 3 2 416 1 0 1 4096 Kernel data structures EcEn 1 0 1 416 0 0 0 0 UNKNOWN pooltag 'EcEn', please update pooltag.txt RaHI 2 0 2 416 0 0 0 0 RaSaveDriverInitData storport!_HW_INITIALIZATION_DATA , Binary: storport.sys KSdh 2 1 1 400 0 0 0 0 device header QoSc 5 0 5 400 0 0 0 0 UNKNOWN pooltag 'QoSc', please update pooltag.txt AzJd 7 0 7 400 0 0 0 0 HD Audio Class Driver (JackDetector) , Binary: HDAudio.sys PXd. 1 0 1 384 0 0 0 0 UNKNOWN pooltag ' PXd', please update pooltag.txt WanI 2 0 2 384 0 0 0 0 IoPacket ScLM 2 0 2 384 0 0 0 0 Media Change Detection , Binary: classpnp.sys ClfF 2 0 2 384 0 0 0 0 CLFS Log flush element lookaside list , Binary: clfs.sys Nbtw 2 0 2 384 0 0 0 0 NetBT device linkage names , Binary: netbt.sys TAPI 2 0 2 384 1 1 0 0 ntos\ndis\ndistapi ItoM 2 0 2 384 0 0 0 0 IPsec task offload interface , Binary: tcpip.sys FxLc 6 0 6 384 0 0 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys TWTa 2 0 2 384 0 0 0 0 Echo Request Timer Table , Binary: tcpip.sys Ntfc 10 7 3 384 512 321 191 24448 CCB_DATA , Binary: ntfs.sys ClfP 12 0 12 384 0 0 0 0 CLFS Log request state , Binary: clfs.sys PPMi 6 2 4 384 0 0 0 0 Kernel Processor Power Management Idle States. , Binary: nt!po SWfd 1 0 1 368 0 0 0 0 POOLTAG_DEVICE_FDOEXTENSION NDpc 22 21 1 368 0 0 0 0 NDIS_TAG_PROTOCOL_CONFIGURATION , Binary: ndis.sys Npfs 1 0 1 352 0 0 0 0 Npfs Allocations , Binary: npfs.sys RaRL 2 0 2 352 0 0 0 0 RaidInitializeResourceList storport!_RAID_RESOURCE_LIST , Binary: storport.sys LS2b 3 0 3 352 0 0 0 0 SMB2 buffer , Binary: srv2.sys UMB. 7 2 5 352 0 0 0 0 UNKNOWN pooltag ' UMB', please update pooltag.txt Wrps 5 1 4 336 0 0 0 0 WAN_STRING_TAG VoSf 1 0 1 336 0 0 0 0 Diff area file allocations , Binary: volsnap.sys NDar 1 0 1 336 0 0 0 0 NDIS_TAG_ALLOCATED_RESOURCES , Binary: ndis.sys PlWl 2 0 2 320 1 0 1 80 UNKNOWN pooltag 'PlWl', please update pooltag.txt NDdb 2 0 2 320 0 0 0 0 DMA block , Binary: ndis.sys AzMx 2 0 2 320 0 0 0 0 HD Audio Class Driver (AzMixerport) , Binary: HDAudio.sys VoSl 2 0 2 320 0 0 0 0 VolSnap (Volume Snapshot Driver) , Binary: volsnap.sys Tdxc 12 8 4 320 0 0 0 0 TDX Control Channels , Binary: tdx.sys cmut 4 0 4 320 0 0 0 0 UNKNOWN pooltag 'cmut', please update pooltag.txt MmHi 6 2 4 320 0 0 0 0 Mm image entry - allocated per session , Binary: nt!mm Gfsm 4 0 4 320 0 0 0 0 Gdi Fast mutex FSfm 4 0 4 320 0 0 0 0 File System Run Time Fast Mutex Lookaside List , Binary: nt!fsrtl IoEr 16 15 1 304 0 0 0 0 Io error log packets , Binary: nt!io PsQb 18 17 1 304 0 0 0 0 Process quota block , Binary: nt!ps HGCC 7 6 1 304 0 0 0 0 UNKNOWN pooltag 'HGCC', please update pooltag.txt Gla4 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_RGN_TYPE , Binary: win32k.sys ObNM 2 0 2 288 0 0 0 0 name buffer per processor lookaside pointers , Binary: nt!ob aFDT 3 0 3 288 0 0 0 0 UNKNOWN pooltag 'aFDT', please update pooltag.txt Gla1 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_DC_TYPE , Binary: win32k.sys RaDS 2 0 2 288 2 0 2 128 StorCreateAnsiString storport!_STRING.Buffer , Binary: storport.sys TcpN 2 0 2 288 0 0 0 0 TCP Name Service Interfaces , Binary: tcpip.sys ObCI 2 0 2 288 0 0 0 0 object creation lookaside list , Binary: nt!ob Gla8 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_PAL_TYPE , Binary: win32k.sys ExIC 2 0 2 288 0 0 0 0 UNKNOWN pooltag 'ExIC', please update pooltag.txt Gla5 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_SURF_TYPE , Binary: win32k.sys Gla; 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_RFONT_TYPE , Binary: win32k.sys MsFD 1 0 1 288 1 0 1 32 Mailslot root DCB and its name buffer MsFf 1 0 1 288 0 0 0 0 Mailslot FCB, File control block, Service side block for each created mailslot. TDIg 7 0 7 288 0 0 0 0 TDI resource Gla@ 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_BRUSH_TYPE , Binary: win32k.sys Gla: 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_LFONT_TYPE , Binary: win32k.sys AfdP 87 86 1 272 0 0 0 0 Afd poll info , Binary: afd.sys Plcp 1 0 1 272 0 0 0 0 Cache aware pushlock list (array of puchlock addresses) TcDQ 1 0 1 272 0 0 0 0 TCP Delay Queues , Binary: tcpip.sys KeSc 4 0 4 256 0 0 0 0 UNKNOWN pooltag 'KeSc', please update pooltag.txt pukm 4 0 4 256 0 0 0 0 UNKNOWN pooltag 'pukm', please update pooltag.txt ClfK 2 0 2 256 0 0 0 0 CLFS Log read completion element , Binary: clfs.sys TuPI 1 0 1 256 0 0 0 0 UNKNOWN pooltag 'TuPI', please update pooltag.txt NtFv 1881 1879 2 256 111 111 0 0 ViewSup.c , Binary: ntfs.sys NtfI 715 711 4 256 0 0 0 0 IO_CONTEXT , Binary: ntfs.sys SeSi 8 0 8 256 35396 35369 27 864 Security SID , Binary: nt!se DfCB 2 0 2 256 0 0 0 0 DFS Client allocations , Binary: dfsc.sys SMBc 1 0 1 256 0 0 0 0 UNKNOWN pooltag 'SMBc', please update pooltag.txt Sess 2 0 2 256 0 0 0 0 UNKNOWN pooltag 'Sess', please update pooltag.txt TcCC 1 0 1 256 0 0 0 0 TCP Create And Connect Tcb Pool , Binary: tcpip.sys Pium 2 0 2 256 0 0 0 0 UNKNOWN pooltag 'Pium', please update pooltag.txt HGFI 1 0 1 240 0 0 0 0 UNKNOWN pooltag 'HGFI', please update pooltag.txt FMfi 1 0 1 240 0 0 0 0 Fast IO dispatch table , Binary: fltmgr.sys Acpi 1 0 1 240 0 0 0 0 ACPI generic data , Binary: acpi.sys Drmk 3 0 3 240 18 15 3 192 UNKNOWN pooltag 'Drmk', please update pooltag.txt VM 1 0 1 240 17 14 3 400 General allocations , Binary: volmgr.sys Mmpr 3 0 3 240 0 0 0 0 Mm physical VAD roots , Binary: nt!mm UlXB 2 0 2 224 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys Scs$ 2 0 2 224 0 0 0 0 Tag for pnp class driver's SRB lookaside list TSrp 2 0 2 224 0 0 0 0 Terminal Services - RP_ALLOC_TAG , Binary: termdd.sys LBtn 2 0 2 224 0 0 0 0 Transport name DfCC 1 0 1 224 0 0 0 0 DFS Client allocations , Binary: dfsc.sys PXh. 1 0 1 224 0 0 0 0 UNKNOWN pooltag ' PXh', please update pooltag.txt RaCD 2 1 1 224 0 0 0 0 RaUnitScsiGetDumpPointersIoctl , Binary: storport.sys MmDb 1 0 1 224 0 0 0 0 NtMapViewOfSection service , Binary: nt!mm UlWI 1 0 1 208 0 0 0 0 Work Item , Binary: http.sys RxCt 2 0 2 208 4 0 4 224 RXCE transport , Binary: mrxsmb.sys LBdi 1 0 1 208 0 0 0 0 POOL_DOMAIN_INFO PX9. 1 0 1 192 0 0 0 0 UNKNOWN pooltag ' PX9', please update pooltag.txt PsDp 2 0 2 192 0 0 0 0 UNKNOWN pooltag 'PsDp', please update pooltag.txt KsoO 32 28 4 192 0 0 0 0 WDM audio stuff UlNP 1 0 1 192 0 0 0 0 Non-Paged Data , Binary: http.sys PmVE 1 0 1 192 0 0 0 0 Partition Manager volume entry , Binary: partmgr.sys LfsS 1 0 1 192 1 0 1 464 UNKNOWN pooltag 'LfsS', please update pooltag.txt TDIv 8 2 6 192 0 0 0 0 TDI resource Wnln 3 0 3 192 0 0 0 0 UNKNOWN pooltag 'Wnln', please update pooltag.txt Mmpv 16 14 2 192 0 0 0 0 Physical view VAD info , Binary: nt!mm Vprt 432 430 2 192 602 589 13 1680 Video port for legacy (pre-Vista) display drivers , Binary: videoprt.sys KCNw 3 1 2 192 0 0 0 0 UNKNOWN pooltag 'KCNw', please update pooltag.txt InNP 3 0 3 192 0 0 0 0 Inet Nsi Providers , Binary: tcpip.sys Dcdd 3 0 3 176 0 0 0 0 Canonical display driver , Binary: cdd.dll CPrh 1 0 1 176 0 0 0 0 UNKNOWN pooltag 'CPrh', please update pooltag.txt vmmp 15 12 3 176 0 0 0 0 UNKNOWN pooltag 'vmmp', please update pooltag.txt WSKL 1 0 1 176 0 0 0 0 UNKNOWN pooltag 'WSKL', please update pooltag.txt Mup 1 0 1 160 13 13 0 0 Multiple UNC provider allocations, generic , Binary: mup.sys FxL7 1 0 1 160 0 0 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys NDcs 14 9 5 160 4 4 0 0 NDIS_TAG_NET_CFG_OPS_ID , Binary: ndis.sys RawN 2 0 2 160 0 0 0 0 Raw Socket Nsi , Binary: tcpip.sys PnpJ 1 0 1 160 0 0 0 0 PNPMGR device event list , Binary: nt!pnp Flop 9 7 2 160 60 59 1 48 floppy driver UdpN 2 0 2 160 0 0 0 0 UDP Name Service Interfaces , Binary: tcpip.sys AcpA 4 2 2 160 0 0 0 0 ACPI arbiter data , Binary: acpi.sys Uspp 2 0 2 160 0 0 0 0 USERTAG_PNP , Binary: win32k!AllocateAndLinkHidTLCInf HGXP 2 1 1 160 0 0 0 0 UNKNOWN pooltag 'HGXP', please update pooltag.txt Uspo 6 4 2 160 0 0 0 0 USERTAG_POWER , Binary: win32k!QueuePowerRequest HGNM 3 0 3 144 0 0 0 0 UNKNOWN pooltag 'HGNM', please update pooltag.txt NBSn 2 1 1 144 0 0 0 0 copy of user NCB TcpM 1 0 1 144 0 0 0 0 TCP Offload Miscellaneous buffers , Binary: tcpip.sys ClMC 1 0 1 144 0 0 0 0 UNKNOWN pooltag 'ClMC', please update pooltag.txt FMpr 3 2 1 144 0 0 0 0 FLT_PRCB structure , Binary: fltmgr.sys MmNo 3 0 3 144 0 0 0 0 Inernal physical memory nodes , Binary: nt!mm WRKR 3 0 3 144 0 0 0 0 UNKNOWN pooltag 'WRKR', please update pooltag.txt VoSa 1 0 1 144 0 0 0 0 Application information allocations , Binary: volsnap.sys CcWq 3 0 3 144 0 0 0 0 Cache Manager Work Queue Item , Binary: nt!cc SMBI 6 5 1 144 0 0 0 0 UNKNOWN pooltag 'SMBI', please update pooltag.txt Wrpc 1 0 1 144 0 0 0 0 WAN_CONN_TAG Nb39 2 1 1 144 0 0 0 0 NetBT file objects , Binary: netbt.sys MmMl 8 6 2 144 0 0 0 0 physical memory range information , Binary: nt!mm WanS 1 0 1 128 0 0 0 0 AfCB/SapCB/VcCB PcIc 30 26 4 128 0 0 0 0 WDM audio stuff L2Ti 5 3 2 128 0 0 0 0 ndis\l2tp / MTAG_UTIL Cdic 1 0 1 128 0 0 0 0 CDFS Irp Context , Binary: cdfs.sys ScCI 100 99 1 128 0 0 0 0 Sense info buffers , Binary: cdrom.sys PcEi 2 0 2 128 0 0 0 0 UNKNOWN pooltag 'PcEi', please update pooltag.txt TQoS 2 0 2 128 0 0 0 0 TL QoS Client Data , Binary: tcpip.sys ScDs 1 0 1 128 0 0 0 0 start device paths CcVm 2 0 2 128 0 0 0 0 UNKNOWN pooltag 'CcVm', please update pooltag.txt SslC 1 0 1 128 0 0 0 0 SSL kernel mode client allocations , Binary: ksecdd.sys ParP 3 0 3 128 16 10 6 352 Parallel port driver Sc?? 1 0 1 128 0 0 0 0 Mass storage driver tags IPmf 2 0 2 128 0 0 0 0 IP Multicast Forwarding Entry pool , Binary: tcpip.sys PoIr 1 0 1 128 0 0 0 0 UNKNOWN pooltag 'PoIr', please update pooltag.txt RxCa 2 0 2 128 0 0 0 0 RXCE address , Binary: mrxsmb.sys AmlR 2 0 2 128 0 0 0 0 ACPI AMLI Pooltags Pcge 3 2 1 128 1 1 0 0 PACER Generic Buffers (DACL, SID allocations) , Binary: pacer.sys ScC7 15 14 1 128 0 0 0 0 Sense info buffer , Binary: classpnp.sys ArbN 2 0 2 128 0 0 0 0 UNKNOWN pooltag 'ArbN', please update pooltag.txt PXg. 1 0 1 128 0 0 0 0 UNKNOWN pooltag ' PXg', please update pooltag.txt Nb17 2 1 1 128 0 0 0 0 NetBT registry path , Binary: netbt.sys LS2p 2 0 2 128 0 0 0 0 SMB2 provider , Binary: srv2.sys NtfV 1 0 1 112 0 0 0 0 VPB , Binary: ntfs.sys VoSs 26 25 1 112 7 6 1 144 Short term allocations , Binary: volsnap.sys WfpM 1 0 1 112 0 0 0 0 WFP filter match buffers , Binary: netio.sys PX5. 1 0 1 112 0 0 0 0 UNKNOWN pooltag ' PX5', please update pooltag.txt Psta 5 2 3 96 0 0 0 0 Power management system state , Binary: nt!ps TcCM 1 0 1 96 0 0 0 0 TCP Congestion Control Manager Contexts , Binary: tcpip.sys PcDe 1 0 1 96 0 0 0 0 UNKNOWN pooltag 'PcDe', please update pooltag.txt AzCd 1 0 1 96 0 0 0 0 HD Audio Class Driver (CodecVendor) , Binary: HDAudio.sys UxSH 1 0 1 96 0 0 0 0 UNKNOWN pooltag 'UxSH', please update pooltag.txt UxSC 1 0 1 96 0 0 0 0 UNKNOWN pooltag 'UxSC', please update pooltag.txt PcEt 2 0 2 96 0 0 0 0 UNKNOWN pooltag 'PcEt', please update pooltag.txt RxTl 1 0 1 96 0 0 0 0 RDBSS toplevel IRP , Binary: rdbss.sys idle 2 0 2 96 0 0 0 0 Power Manager idle handler FSrN 1 0 1 96 36 3 33 5280 File System Run Time , Binary: nt!fsrtl Txfm 8 7 1 80 0 0 0 0 UNKNOWN pooltag 'Txfm', please update pooltag.txt FLln 1 0 1 80 0 0 0 0 shared lock tree node Txfl 2 1 1 80 6 2 4 384 TXF_FCB_CLEANUP , Binary: ntfs.sys RaDR 4 2 2 80 8 8 0 0 RaidpBuildAdapterBusRelations storport!_DEVICE_RELATIONS , Binary: storport.sys RMcc 1 0 1 80 0 0 0 0 UNKNOWN pooltag 'RMcc', please update pooltag.txt FLsh 1 0 1 80 0 0 0 0 shared file lock Nbta 1 0 1 80 0 0 0 0 NetBT DPC , Binary: netbt.sys TuPi 1 0 1 64 0 0 0 0 UNKNOWN pooltag 'TuPi', please update pooltag.txt RaPD 1 0 1 64 0 0 0 0 RaidGetPortData storport!RaidpPortData , Binary: storport.sys ScIn 1 0 1 64 0 0 0 0 Mass storage driver tags IoSD 4 3 1 64 0 0 0 0 Io system device buffer , Binary: nt!io Acpg 1 0 1 64 0 0 0 0 ACPI GPE data , Binary: acpi.sys EQSc 1 0 1 64 0 0 0 0 EQoS pacer client , Binary: tcpip.sys Nb37 4 3 1 64 0 0 0 0 NetBT lmhosts path , Binary: netbt.sys Nbtg 2 0 2 64 0 0 0 0 NetBT MDL buffer , Binary: netbt.sys RaAM 1 0 1 64 0 0 0 0 RaidAllocateAddressMapping storport!_MAPPED_ADDRESS , Binary: storport.sys Ccmp 1 0 1 64 0 0 0 0 UNKNOWN pooltag 'Ccmp', please update pooltag.txt L2T4 1 0 1 64 0 0 0 0 ndis\l2tp / MTAG_VCTABLE VoSi 1 0 1 64 0 0 0 0 Io status block allocations , Binary: volsnap.sys Nsic 1 0 1 64 0 0 0 0 UNKNOWN pooltag 'Nsic', please update pooltag.txt AzPx 1 0 1 64 0 0 0 0 HD Audio Class Driver (AzPower) , Binary: HDAudio.sys NQoS 1 0 1 64 0 0 0 0 UNKNOWN pooltag 'NQoS', please update pooltag.txt RaPC 1 0 1 48 0 0 0 0 RaInitializeConfiguration storport!_PORT_CONFIGURATION_INFORMATION.AccessRanges , Binary: storport.sys SmMs 1 0 1 48 13 6 7 1456 SMB miscellaneous , Binary: mrxsmb.sys Nbuf 1 0 1 48 0 0 0 0 NetIO Memory Descriptor List allocations , Binary: netio.sys AzRR 1 0 1 48 0 0 0 0 HD Audio Class Driver (SpdifEmbeddedRender, SpdifOut, Headphone, HBDAout) , Binary: HDAudio.sys TuV4 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'TuV4', please update pooltag.txt PTPc 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'PTPc', please update pooltag.txt CcBn 1 0 1 48 0 0 0 0 Cache Manager Bcb trim notification entry , Binary: nt!cc PTPn 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'PTPn', please update pooltag.txt L2Tw 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'L2Tw', please update pooltag.txt Pcna 3 2 1 48 0 0 0 0 PACER Filter Network Addresses , Binary: pacer.sys UlWQ 1 0 1 48 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys PcLR 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'PcLR', please update pooltag.txt Fsrc 1 0 1 48 0 0 0 0 Filesystem recognizer (fsrec.sys) , Binary: fsrec.sys WanW 1 0 1 48 0 0 0 0 SHA Encryption AzMi 1 0 1 48 0 0 0 0 HD Audio Class Driver (micin, MixedCapture) , Binary: HDAudio.sys IoUs 21 20 1 48 0 0 0 0 I/O SubSystem completion Context Allocation , Binary: nt!io Wnds 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'Wnds', please update pooltag.txt BkCh 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'BkCh', please update pooltag.txt Acpt 36 35 1 48 0 0 0 0 ACPI table data , Binary: acpi.sys FLTR 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'FLTR', please update pooltag.txt COMX 110 109 1 48 27 22 5 368 serial driver allocations , Binary: serial.sys Evel 1 0 1 48 0 0 0 0 EFS file system filter driver lookaside list Nb36 8 7 1 48 0 0 0 0 NetBT string , Binary: netbt.sys ScS2 1 0 1 48 0 0 0 0 Sense interpretation data , Binary: classpnp.sys PSwt 3 2 1 48 0 0 0 0 PDC_PSWT_TAG , Binary: pdc.sys L2Ts 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'L2Ts', please update pooltag.txt EcHb 2 1 1 32 0 0 0 0 UNKNOWN pooltag 'EcHb', please update pooltag.txt UlCN 1 0 1 32 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys Nb03 1 0 1 32 0 0 0 0 NetBT remote name address cache , Binary: netbt.sys RaUE 2 1 1 32 0 0 0 0 RaidUnitAllocateResources , Binary: storport.sys ScWs 1 0 1 32 0 0 0 0 Working set , Binary: classpnp.sys EMit 0 0 0 0 5586 5155 431 43680 UNKNOWN pooltag 'EMit', please update pooltag.txt IoFu 0 0 0 0 1 1 0 0 Io file utils , Binary: nt!pnp TmFN 672 672 0 0 0 0 0 0 UNKNOWN pooltag 'TmFN', please update pooltag.txt Nbtn 10 10 0 0 0 0 0 0 NetBT device string , Binary: netbt.sys ObSt 0 0 0 0 0 0 0 0 Object Manager temporary storage , Binary: nt!ob CcPp 0 0 0 0 9 9 0 0 Prefetcher instructions , Binary: nt!ccpf Txsc 0 0 0 0 8 1 7 1904 TXF_SCB , Binary: ntfs.sys LBpt 0 0 0 0 1 0 1 560 Paged transport EMqu 0 0 0 0 16 16 0 0 UNKNOWN pooltag 'EMqu', please update pooltag.txt PSet 0 0 0 0 341 211 130 10560 UNKNOWN pooltag 'PSet', please update pooltag.txt VmRb 0 0 0 0 1 0 1 16384 Raw record buffers , Binary: volmgrx.sys CcBc 2100 2100 0 0 0 0 0 0 Cache Manager Bcb from pool , Binary: nt!cc ScVs 0 0 0 0 1 1 0 0 Dvd functionality in cdrom.sys RtPb 29 29 0 0 0 0 0 0 UNKNOWN pooltag 'RtPb', please update pooltag.txt EcCr 27510 27510 0 0 0 0 0 0 UNKNOWN pooltag 'EcCr', please update pooltag.txt MmWs 1321 1321 0 0 0 0 0 0 PTE flush list for working set operations , Binary: nt!mm TdxB 57 57 0 0 0 0 0 0 TDX Transport Layer Buffers , Binary: tdx.sys NpFD 0 0 0 0 1 0 1 224 DCB, directory block , Binary: npfs.sys NDre 1891 1891 0 0 0 0 0 0 NDIS_TAG_OID_REQUEST , Binary: ndis.sys NDse 18 18 0 0 5 0 5 1008 NDIS_TAG_SECURITY , Binary: ndis.sys SeAi 0 0 0 0 2 2 0 0 Security Audit Work Item , Binary: nt!se ScDg 0 0 0 0 3 2 1 64 update disk geometry paths CM32 0 0 0 0 16 6 10 40960 Internal Configuration manager allocations , Binary: nt!cm NDsd 0 0 0 0 3 3 0 0 NDIS_TAG_NET_CFG_SEC_DESC , Binary: ndis.sys vskd 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'vskd', please update pooltag.txt ScB2 2 2 0 0 0 0 0 0 Registry path , Binary: classpnp.sys Txf0 0 0 0 0 16 16 0 0 UNKNOWN pooltag 'Txf0', please update pooltag.txt AlEB 0 0 0 0 13470 13470 0 0 UNKNOWN pooltag 'AlEB', please update pooltag.txt ClMn 0 0 0 0 97 90 7 1504 UNKNOWN pooltag 'ClMn', please update pooltag.txt FxL2 0 0 0 0 1 0 1 64 KMDF Loader Pool allocation , Binary: wdfldr.sys MsPp 0 0 0 0 4 0 4 1376 UNKNOWN pooltag 'MsPp', please update pooltag.txt TDIj 10 10 0 0 0 0 0 0 UNKNOWN pooltag 'TDIj', please update pooltag.txt Lfs 0 0 0 0 168 154 14 5680 Lfs allocations FxL3 0 0 0 0 7 7 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys is09 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'is09', please update pooltag.txt FLfl 0 0 0 0 20 0 20 2240 exported (non-private) file lock NtFd 0 0 0 0 7385 7331 54 5296 DirCtrl.c , Binary: ntfs.sys Mn01 0 0 0 0 1 1 0 0 ACPI method evaluation output buffer , Binary: monitor.sys ClfH 0 0 0 0 12 1 11 2112 CLFS Log I/O control block lookaside list , Binary: clfs.sys PfCH 0 0 0 0 15 13 2 4240 Pf Allocations , Binary: nt!pf NpFR 25098 25098 0 0 0 0 0 0 UNKNOWN pooltag 'NpFR', please update pooltag.txt PfFH 0 0 0 0 7 6 1 32768 Pf RpContext FileKeyHash buckets , Binary: nt!pf Ppde 0 0 0 0 3 3 0 0 routines to perform device removal , Binary: nt!pnp LBwi 50 50 0 0 0 0 0 0 Work item NSpg 29303 29303 0 0 0 0 0 0 NSI Proxy Generic Buffers , Binary: nsi.dll TXHT 0 0 0 0 7 7 0 0 UNKNOWN pooltag 'TXHT', please update pooltag.txt AzSd 0 0 0 0 1 1 0 0 HD Audio Class Driver (subdevicegraph) , Binary: HDAudio.sys Init 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'Init', please update pooltag.txt IoKB 0 0 0 0 2298 2298 0 0 Registry basic key block (temp allocation) , Binary: nt!io NtfM 0 0 0 0 28 3 25 2000 NTFS_MCB_ENTRY , Binary: ntfs.sys UlPS 0 0 0 0 6 0 6 480 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys EMst 0 0 0 0 191 104 87 5744 UNKNOWN pooltag 'EMst', please update pooltag.txt Nb30 148 148 0 0 0 0 0 0 NetBT registry string , Binary: netbt.sys NDw3 26 26 0 0 0 0 0 0 NDIS_TAG_WMI_EVENT_ITEM , Binary: ndis.sys AcpB 0 0 0 0 39 39 0 0 ACPI buffer data , Binary: acpi.sys MmFr 0 0 0 0 70 0 70 3360 ASLR fixup records , Binary: nt!mm Nb22 163 163 0 0 0 0 0 0 NetBT work item context , Binary: netbt.sys Symb 0 0 0 0 220 33 187 29920 Symbolic link objects IoRi 13 13 0 0 0 0 0 0 I/O SubSystem Driver Reinitialization Callback Packet , Binary: nt!io Dacl 0 0 0 0 22 21 1 112 Temp allocations for object DACLs Strg 6 6 0 0 3241 3201 40 3824 Dynamic Translated strings ScCM 1 1 0 0 0 0 0 0 Mode data buffer , Binary: cdrom.sys OPM 0 0 0 0 2 0 2 96 UNKNOWN pooltag ' OPM', please update pooltag.txt AlVi 0 0 0 0 515 439 76 12160 ALPC view , Binary: nt!alpc KSlw 6 6 0 0 0 0 0 0 UNKNOWN pooltag 'KSlw', please update pooltag.txt D2d 0 0 0 0 9 9 0 0 Device Object to DosName rtns (ntos\rtl\dev2dos.c) ScDM 5 5 0 0 0 0 0 0 mode data buffer MmSe 1659 1659 0 0 0 0 0 0 Mm secured VAD allocation , Binary: nt!mm MmRe 0 0 0 0 1046 2 1044 7191696 ASLR relocation blocks , Binary: nt!mm Ppin 0 0 0 0 47 47 0 0 plug-and-play initialization , Binary: nt!pnp LfsI 0 0 0 0 2 0 2 131072 Lfs allocations ObSq 0 0 0 0 232 194 38 10336 object security descriptors (query) , Binary: nt!ob Ppen 0 0 0 0 325 325 0 0 routines to perform device enumeration , Binary: nt!pnp RpcS 0 0 0 0 9 9 0 0 UNKNOWN pooltag 'RpcS', please update pooltag.txt UlCE 0 0 0 0 10 0 10 1728 Config Group Tree Entry , Binary: http.sys PooL 0 0 0 0 0 0 0 0 Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures EcMc 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'EcMc', please update pooltag.txt ObHd 0 0 0 0 205 156 49 5888 object handle count data base , Binary: nt!ob SeLu 0 0 0 0 3758 3758 0 0 Security LUID and Attributes array , Binary: nt!se ArbL 0 0 0 0 639 351 288 78336 ARBITER_ORDERING_LIST_TAG , Binary: nt!arb Txfn 0 0 0 0 1 0 1 20480 UNKNOWN pooltag 'Txfn', please update pooltag.txt CMCa 0 0 0 0 2 0 2 81920 Configuration Manager Cache (registry) , Binary: nt!cm FSel 0 0 0 0 22 18 4 192 File System Run Time Extra Create Parameter List , Binary: nt!fsrtl CMTr 0 0 0 0 3 3 0 0 Configuration Manager Transaction Tag , Binary: nt!cm rtPi 0 0 0 0 1 0 1 2064 UNKNOWN pooltag 'rtPi', please update pooltag.txt CMVe 0 0 0 0 2 0 2 272 Internal Configuration manager allocations , Binary: nt!cm Txfa 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'Txfa', please update pooltag.txt LS2x 0 0 0 0 4 0 4 176 SMB2 security context , Binary: srv2.sys PfVH 0 0 0 0 23 23 0 0 Pf Prefetch volume handles , Binary: nt!pf asmp 35 35 0 0 0 0 0 0 UNKNOWN pooltag 'asmp', please update pooltag.txt Ppcr 1 1 0 0 2 2 0 0 plug-and-play critical allocations , Binary: nt!pnp DG 0 0 0 0 3 3 0 0 UNKNOWN pooltag 'DG ', please update pooltag.txt CMVa 0 0 0 0 0 0 0 0 value cache value tag , Binary: nt!cm NpfF 0 0 0 0 58 9 49 10976 Npfs Allocations , Binary: npfs.sys PcRv 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'PcRv', please update pooltag.txt CMIn 0 0 0 0 5731 5591 140 5904 Configuration Manager Index Hint Tag , Binary: nt!cm FxL1 0 0 0 0 7 7 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys CMca 0 0 0 0 1 0 1 32 Internal Configuration manager allocations , Binary: nt!cm AfdS 0 0 0 0 2 2 0 0 Afd security info , Binary: afd.sys WL03 0 0 0 0 6 6 0 0 UNKNOWN pooltag 'WL03', please update pooltag.txt KSnv 0 0 0 0 30 30 0 0 registry name value PfET 0 0 0 0 2 0 2 163936 Pf Entry info tables , Binary: nt!pf KSau 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'KSau', please update pooltag.txt Ntfs 0 0 0 0 1 0 1 512 SCB_DATA , Binary: ntfs.sys RawE 1 1 0 0 0 0 0 0 Raw Socket Endpoints , Binary: tcpip.sys FIcs 0 0 0 0 9058 3635 5423 1041216 FileInfo FS-filter Stream Context , Binary: fileinfo.sys Ntrs 0 0 0 0 4 0 4 448 UNKNOWN pooltag 'Ntrs', please update pooltag.txt PcSi 0 0 0 0 7 0 7 736 UNKNOWN pooltag 'PcSi', please update pooltag.txt MmId 807 807 0 0 0 0 0 0 PFN identity buffer for setting PFN priorities , Binary: nt!mm Txtr 0 0 0 0 2 0 2 928 TXF_TRANS (Txf transaction context) , Binary: ntfs.sys TCPr 0 0 0 0 0 0 0 0 TCP request pool , Binary: TCP ClMp 0 0 0 0 22 0 22 1168 UNKNOWN pooltag 'ClMp', please update pooltag.txt EMev 0 0 0 0 87812 87812 0 0 UNKNOWN pooltag 'EMev', please update pooltag.txt Ppdd 0 0 0 0 10 10 0 0 new Plug-And-Play driver entries and IRPs , Binary: nt!pnp SAad 0 0 0 0 20 9 11 1824 SrvAdmin buffer , Binary: srvnet.sys CM11 0 0 0 0 2 0 2 8192 Internal Configuration manager allocations , Binary: nt!cm ScC1 0 0 0 0 2 0 2 256 Registry path buffer , Binary: classpnp.sys ScB1 2 2 0 0 0 0 0 0 Query registry parameters , Binary: classpnp.sys MuUn 0 0 0 0 5 0 5 736 UNC provider , Binary: mup.sys NtFf 3 3 0 0 7120 7114 6 131344 FsCtrl.c , Binary: ntfs.sys IdeX 4 4 0 0 13 13 0 0 PCI IDE ClfI 0 0 0 0 12 1 11 999440 CLFS Log marshal buffer lookaside list , Binary: clfs.sys PcDi 0 0 0 0 10 0 10 800 WDM audio stuff VRWD 0 0 0 0 12 12 0 0 UNKNOWN pooltag 'VRWD', please update pooltag.txt CM21 0 0 0 0 1 1 0 0 Internal Configuration manager allocations , Binary: nt!cm Txfo 0 0 0 0 3 0 3 9120 TXF_FO , Binary: ntfs.sys wido 25 25 0 0 0 0 0 0 UNKNOWN pooltag 'wido', please update pooltag.txt ReRe 0 0 0 0 1 0 1 160 UNKNOWN pooltag 'ReRe', please update pooltag.txt Rxbw 24 24 0 0 0 0 0 0 RDBSS allocations , Binary: rdbss.sys NDw2 8 8 0 0 0 0 0 0 NDIS_TAG_WMI_OID_SUPPORTED_LIST , Binary: ndis.sys VMSI 0 0 0 0 2 2 0 0 Volume Manager , Binary: volmgr.sys EtwD 0 0 0 0 29 29 0 0 Etw DataBlock , Binary: nt!etw Sect 0 0 0 0 26079 25311 768 124064 Section objects UlRD 0 0 0 0 7 7 0 0 Registry Data , Binary: http.sys UlSD 0 0 0 0 2 1 1 80 Security Data , Binary: http.sys EcOf 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'EcOf', please update pooltag.txt Obtb 0 0 0 0 208 59 149 419072 object tables via EX handle.c , Binary: nt!ob PsSl 0 0 0 0 2 0 2 208 UNKNOWN pooltag 'PsSl', please update pooltag.txt cbuf 0 0 0 0 21 2 19 624 UNKNOWN pooltag 'cbuf', please update pooltag.txt MmLn 0 0 0 0 103 103 0 0 temporary name buffer for driver loads , Binary: nt!mm KSfi 5 5 0 0 0 0 0 0 UNKNOWN pooltag 'KSfi', please update pooltag.txt EQSp 0 0 0 0 2 2 0 0 EQoS generic policy data , Binary: tcpip.sys ScCs 0 0 0 0 1 0 1 64 Assorted string data , Binary: cdrom.sys KSsi 0 0 0 0 2 2 0 0 software bus interface LSsh 0 0 0 0 1 0 1 560 SMB1 share , Binary: srv.sys TunP 0 0 0 0 81 80 1 288 Tunnel cache oddsized pool-allocated elements KSpi 5 5 0 0 0 0 0 0 UNKNOWN pooltag 'KSpi', please update pooltag.txt NtFI 0 0 0 0 14446 14394 52 7280 IndexSup.c , Binary: ntfs.sys AzSt 2 2 0 0 0 0 0 0 HD Audio Class Driver (AzWaveCyclicStream, HdaWaveRTstream) , Binary: HDAudio.sys Txfb 0 0 0 0 13 13 0 0 UNKNOWN pooltag 'Txfb', please update pooltag.txt FMdl 4 4 0 0 0 0 0 0 Array of DEVICE_OBJECT pointers , Binary: fltmgr.sys MuDn 0 0 0 0 11 11 0 0 Device name , Binary: mup.sys CcPT 16 16 0 0 0 0 0 0 Prefetcher trace , Binary: nt!ccpf TxTb 0 0 0 0 2 0 2 15968 UNKNOWN pooltag 'TxTb', please update pooltag.txt Txf1 0 0 0 0 3 3 0 0 UNKNOWN pooltag 'Txf1', please update pooltag.txt CmVn 0 0 0 0 1106 1106 0 0 captured value name , Binary: nt!cm PcEr 22 22 0 0 0 0 0 0 UNKNOWN pooltag 'PcEr', please update pooltag.txt PcPr 87 87 0 0 0 0 0 0 WDM audio stuff Mem 0 0 0 0 147 147 0 0 UNKNOWN pooltag 'Mem ', please update pooltag.txt EcCu 6472 6472 0 0 0 0 0 0 UNKNOWN pooltag 'EcCu', please update pooltag.txt SeAk 0 0 0 0 162 53 109 5680 Security Account Name , Binary: nt!se CMVw 0 0 0 0 7352 3964 3388 379456 registry mapped view of file , Binary: nt!cm VoSp 0 0 0 0 3 3 0 0 Pnp id allocations , Binary: volsnap.sys CMUw 0 0 0 0 16 16 0 0 Configuration Manager Unit of Work Tag , Binary: nt!cm Txfe 0 0 0 0 2 0 2 160 TXF_FCB_EXTENSION , Binary: ntfs.sys AlHd 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'AlHd', please update pooltag.txt NMRg 8 8 0 0 0 0 0 0 Network Module Registrar Generic Buffers , Binary: tcpip.sys FIOc 0 0 0 0 13070 13070 0 0 FileInfo FS-filter Prefetch Open Context , Binary: fileinfo.sys ppmp 922 922 0 0 0 0 0 0 UNKNOWN pooltag 'ppmp', please update pooltag.txt SMBt 2 2 0 0 0 0 0 0 UNKNOWN pooltag 'SMBt', please update pooltag.txt IoNm 0 0 0 0 88660 86753 1907 308480 Io parsing names , Binary: nt!io PoSL 0 0 0 0 2 0 2 64 Power shutdown event list Txdl 0 0 0 0 1 0 1 64 TXF_DELETED_LINK , Binary: ntfs.sys Nb28 4 4 0 0 0 0 0 0 NetBT name server addresses , Binary: netbt.sys RaSI 3 3 0 0 0 0 0 0 StorUnmapSenseInfo storport!_EXTENDED_REQUEST_BLOCK.Srb.SenseInfoBuffer , Binary: storport.sys Txvl 0 0 0 0 2 0 2 640 TXF_VSCB , Binary: ntfs.sys Nb38 4 4 0 0 0 0 0 0 NetBT string , Binary: netbt.sys Pnp9 0 0 0 0 3 0 3 288 PNPMGR HW profile notify , Binary: nt!pnp Cbrb 0 0 0 0 6 0 6 288 UNKNOWN pooltag 'Cbrb', please update pooltag.txt RaDI 0 0 0 0 4 4 0 0 RaidUnitGetDeviceId , Binary: storport.sys MmZw 2 2 0 0 0 0 0 0 Work items for zeroing pages and pagefiles , Binary: nt!mm FIcp 0 0 0 0 4 0 4 448 FileInfo FS-filter Extra Create Parameter , Binary: fileinfo.sys ObDi 0 0 0 0 1216 201 1015 48720 object directory , Binary: nt!ob EMpr 0 0 0 0 12 0 12 768 UNKNOWN pooltag 'EMpr', please update pooltag.txt ScDC 1 1 0 0 0 0 0 0 disable cache paths CM26 0 0 0 0 11 3 8 131072 Internal Configuration manager allocations , Binary: nt!cm CM16 0 0 0 0 71 0 71 372736 Internal Configuration manager allocations , Binary: nt!cm CIsc 21 21 0 0 265 121 144 566816 Code Integrity core dll , Binary: ci.dll NLap 1 1 0 0 0 0 0 0 Network Layer Netio Helper Function allocations , Binary: tcpip.sys Mn0B 0 0 0 0 9 9 0 0 Registry value buffer , Binary: monitor.sys NDoc 689 689 0 0 0 0 0 0 NDIS_TAG_OPEN_CONTEXT , Binary: ndis.sys RxCd 0 0 0 0 2 2 0 0 RXCE TDI , Binary: mrxsmb.sys ScCP 14 14 0 0 0 0 0 0 ClassPnP misc allocations , Binary: classpnp.sys NpFC 0 0 0 0 36 34 2 64 ROOT_DCB CCB , Binary: npfs.sys ArbA 0 0 0 0 112 1 111 466640 ARBITER_ALLOCATION_STATE_TAG , Binary: nt!arb KSce 0 0 0 0 95 41 54 3456 create item entry KSde 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'KSde', please update pooltag.txt KSbe 0 0 0 0 10 10 0 0 UNKNOWN pooltag 'KSbe', please update pooltag.txt FIvp 0 0 0 0 59 59 0 0 FileInfo FS-filter Volume Properties , Binary: fileinfo.sys Pccr 1324 1324 0 0 0 0 0 0 PACER Filter Clone Requests , Binary: pacer.sys VadF 0 0 0 0 0 0 0 0 VADs created by a FreeVM splitting , Binary: nt!mm Nb23 4 4 0 0 0 0 0 0 NetBT lmhosts path , Binary: netbt.sys PpRb 18 18 0 0 0 0 0 0 UNKNOWN pooltag 'PpRb', please update pooltag.txt apth 998 998 0 0 0 0 0 0 UNKNOWN pooltag 'apth', please update pooltag.txt Nb33 16 16 0 0 0 0 0 0 NetBT registry data , Binary: netbt.sys DQUD 32 32 0 0 0 0 0 0 UNKNOWN pooltag 'DQUD', please update pooltag.txt Ppio 40 40 0 0 14247 14247 0 0 plug-and-play IO system APIs , Binary: nt!pnp TCPc 0 0 0 0 0 0 0 0 TCP/IP network protocol , Binary: TCP IrpS 0 0 0 0 0 0 0 0 UNKNOWN pooltag 'IrpS', please update pooltag.txt Nbtk 6 6 0 0 0 0 0 0 NetBT transport address , Binary: netbt.sys SYPK 0 0 0 0 32 32 0 0 Kernel mode system partition detection allocations , Binary: syspart.lib NtFA 103 103 0 0 17172 17172 0 0 AttrSup.c , Binary: ntfs.sys SeUs 0 0 0 0 33340 33340 0 0 Security Captured Unicode string , Binary: nt!se BatM 0 0 0 0 1 0 1 128 Control method battery driver Wmiw 35 35 0 0 0 0 0 0 Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL FSim 0 0 0 0 6432 1237 5195 748080 File System Run Time Mcb Initial Mapping Lookaside List , Binary: nt!fsrtl PmPT 10 10 0 0 0 0 0 0 Partition Manager partition table cache , Binary: partmgr.sys Txfc 0 0 0 0 27 14 13 3408 TXF_FCB , Binary: ntfs.sys SeLs 0 0 0 0 32 18 14 1248 Security Logon Session , Binary: nt!se CcPF 0 0 0 0 15 15 0 0 Prefetcher file name , Binary: nt!ccpf AlRr 0 0 0 0 41 3 38 3648 ALPC resource reserves , Binary: nt!Alpc TXIS 0 0 0 0 4 4 0 0 UNKNOWN pooltag 'TXIS', please update pooltag.txt AlRe 0 0 0 0 237 199 38 5472 ALPC section region , Binary: nt!alpc KseS 0 0 0 0 3 3 0 0 Security driver allocs for LSA proper , Binary: ksecdd.sys IoSe 0 0 0 0 4208 3813 395 20368 Io security related , Binary: nt!io PcKd 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'PcKd', please update pooltag.txt mltr 0 0 0 0 32 27 5 2240 UNKNOWN pooltag 'mltr', please update pooltag.txt FwSD 0 0 0 0 6 6 0 0 WFP security descriptor , Binary: tcpip.sys MmSg 0 0 0 0 1 0 1 112 Mm segments , Binary: nt!mm ScIO 10 10 0 0 0 0 0 0 ClassPnP device control , Binary: classpnp.sys Key 0 0 0 0 260502 259772 730 116672 Key objects Mn0A 0 0 0 0 2 2 0 0 Registry subkey info buffer , Binary: monitor.sys NpFw 1 1 0 0 263 263 0 0 Write block , Binary: npfs.sys CM13 0 0 0 0 1 0 1 4096 Internal Configuration manager allocations , Binary: nt!cm CMnb 0 0 0 0 298 35 263 29456 registry notify blocks , Binary: nt!cm CMpb 0 0 0 0 472 240 232 22272 registry post blocks , Binary: nt!cm SeAl 0 0 0 0 22 22 0 0 UNKNOWN pooltag 'SeAl', please update pooltag.txt Nb27 4 4 0 0 0 0 0 0 NetBT bind list cache , Binary: netbt.sys FxLb 0 0 0 0 6 6 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys InAD 41 41 0 0 0 0 0 0 Inet Ancillary Data , Binary: tcpip.sys CMpi 0 0 0 0 2443 2248 195 11376 Internal Configuration manager allocations , Binary: nt!cm MVSN 0 0 0 0 1 0 1 96 UNKNOWN pooltag 'MVSN', please update pooltag.txt CMci 0 0 0 0 873046 873046 0 0 Internal Configuration manager allocations , Binary: nt!cm AcpM 10069 10069 0 0 7 5 2 176 ACPI miscellaneous data , Binary: acpi.sys Pnp1 258 258 0 0 0 0 0 0 PNPMGR IRP completion context , Binary: nt!pnp FxL5 0 0 0 0 7 6 1 144 KMDF Loader Pool allocation , Binary: wdfldr.sys KdIo 104 104 0 0 0 0 0 0 UNKNOWN pooltag 'KdIo', please update pooltag.txt NpFW 0 0 0 0 23 23 0 0 Write block , Binary: npfs.sys MmIh 0 0 0 0 36 36 0 0 Image header allocation for Se validation , Binary: nt!mm Ppsu 0 0 0 0 511 225 286 24512 plug-and-play subroutines for the I/O system , Binary: nt!pnp MmPh 4 4 0 0 0 0 0 0 Physical memory nodes for querying memory ranges , Binary: nt!mm AmlT 1950 1950 0 0 0 0 0 0 ACPI AMLI Pooltags MsFr 0 0 0 0 1 0 1 4096 Mailslot read buffer, buffer created for pended reads issued. PfFK 0 0 0 0 11778 6362 5416 259968 Pf RpContext FileKeyHashEntry , Binary: nt!pf KSat 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'KSat', please update pooltag.txt CM35 0 0 0 0 5 0 5 413696 Internal Configuration manager allocations , Binary: nt!cm PnpK 0 0 0 0 356 356 0 0 PNPMGR device event entry , Binary: nt!pnp WDIs 0 0 0 0 16 0 16 65536 UNKNOWN pooltag 'WDIs', please update pooltag.txt CM25 0 0 0 0 2751 0 2751 11923456 Internal Configuration manager allocations , Binary: nt!cm RaSN 4 4 0 0 0 0 0 0 RaidBusEnumeratorAllocateUnitResources storport!_BUS_ENUM_RESOURCES.SenseInfo , Binary: storport.sys UIRP 0 0 0 0 0 0 0 0 UNKNOWN pooltag 'UIRP', please update pooltag.txt CM45 0 0 0 0 2 0 2 96 Internal Configuration manager allocations , Binary: nt!cm UlCH 0 0 0 0 4 0 4 512 Config Group Tree Header , Binary: http.sys NtfC 0 0 0 0 9781 8865 916 190528 CCB , Binary: ntfs.sys Nbtm 132 132 0 0 0 0 0 0 NetBT EA buffer , Binary: netbt.sys PcSt 0 0 0 0 7 0 7 608 WDM audio stuff RaQT 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'RaQT', please update pooltag.txt IoFs 0 0 0 0 1 0 1 48 Io shutdown packet , Binary: nt!io PcRt 2 2 0 0 0 0 0 0 UNKNOWN pooltag 'PcRt', please update pooltag.txt AlMs 0 0 0 0 244 67 177 4078592 ALPC message , Binary: nt!alpc Etwr 137 137 0 0 0 0 0 0 Etw ReplyQueue Entry , Binary: nt!etw armp 36 36 0 0 0 0 0 0 UNKNOWN pooltag 'armp', please update pooltag.txt Rx?? 0 0 0 0 19 19 0 0 RDBSS allocations , Binary: rdbss.sys Pnp8 59 59 0 0 0 0 0 0 PNPMGR async target device change notify , Binary: nt!pnp CMHb 0 0 0 0 8 8 0 0 Internal Configuration manager allocations , Binary: nt!cm NtFW 53 53 0 0 0 0 0 0 Write.c , Binary: ntfs.sys Txfk 0 0 0 0 6 0 6 192 UNKNOWN pooltag 'Txfk', please update pooltag.txt CMLb 0 0 0 0 5 5 0 0 Internal Configuration manager allocations , Binary: nt!cm SMBr 0 0 0 0 18 18 0 0 UNKNOWN pooltag 'SMBr', please update pooltag.txt TmCs 0 0 0 0 6 6 0 0 UNKNOWN pooltag 'TmCs', please update pooltag.txt AFGp 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'AFGp', please update pooltag.txt CMSb 0 0 0 0 3 2 1 32768 internal stash buffer pool tag , Binary: nt!cm NtFC 0 0 0 0 14530 12222 2308 479408 Create.c , Binary: ntfs.sys CMNb 0 0 0 0 120688 118755 1933 121424 Configuration Manager Name Tag , Binary: nt!cm BaPd 8 8 0 0 0 0 0 0 UNKNOWN pooltag 'BaPd', please update pooltag.txt Txfq 0 0 0 0 1 0 1 64 Txf quota block , Binary: ntfs.sys SePr 0 0 0 0 257 257 0 0 Security Privilege Set , Binary: nt!se TxfQ 0 0 0 0 1 0 1 128 UNKNOWN pooltag 'TxfQ', please update pooltag.txt SWdn 0 0 0 0 1 1 0 0 device name TCPC 0 0 0 0 0 0 0 0 TCP connection pool , Binary: TCP NpPp 0 0 0 0 4 0 4 1120 UNKNOWN pooltag 'NpPp', please update pooltag.txt KSpf 5 5 0 0 0 0 0 0 UNKNOWN pooltag 'KSpf', please update pooltag.txt SWii 0 0 0 0 1 1 0 0 instance ID PXa. 1 1 0 0 0 0 0 0 UNKNOWN pooltag ' PXa', please update pooltag.txt SWda 0 0 0 0 9 0 9 576 POOLTAG_DEVICE_ASSOCIATION RpcM 24 24 0 0 497 325 172 36368 all msrpc.sys allocations not covered elsewhere , Binary: msrpc.sys Ntf0 0 0 0 0 9311 3740 5571 381760 General pool allocation , Binary: ntfs.sys FSrs 2 2 0 0 0 0 0 0 File System Run Time Work Item for low-stack posting , Binary: nt!fsrtl PXc. 1 1 0 0 0 0 0 0 UNKNOWN pooltag ' PXc', please update pooltag.txt SWbi 0 0 0 0 3 3 0 0 bus ID CMcb 0 0 0 0 1 0 1 112 Internal Configuration manager allocations , Binary: nt!cm PmRP 0 0 0 0 1 0 1 144 Partition Manager registry path , Binary: partmgr.sys MuIc 52 52 0 0 0 0 0 0 IRP Context , Binary: mup.sys SWki 0 0 0 0 14 14 0 0 key information RaRl 271 271 0 0 0 0 0 0 RaidBusEnumeratorAllocateReportLunsResources storport!_BUS_ENUM_RESOURCES.DataBuffer , Binary: storport.sys PnpL 310 310 0 0 0 0 0 0 PNPMGR device event workitem , Binary: nt!pnp Nb29 8 8 0 0 0 0 0 0 NetBT registry string , Binary: netbt.sys NpFc 0 0 0 0 169 83 86 22016 CCB, client control block , Binary: npfs.sys KSff 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'KSff', please update pooltag.txt PfED 0 0 0 0 1 1 0 0 Pf Generic event data , Binary: nt!pf CcPD 0 0 0 0 11 11 0 0 Prefetcher trace dump , Binary: nt!ccpf Sdba 56 56 0 0 884 616 268 28448 Application compatibility Sdb* allocations ScDN 0 0 0 0 1 1 0 0 disk name code VadL 0 0 0 0 0 0 0 0 UNKNOWN pooltag 'VadL', please update pooltag.txt ScLA 1 1 0 0 0 0 0 0 allocation to check for autorun disable , Binary: classpnp.sys UlHT 0 0 0 0 1 0 1 2240 Hash Table , Binary: http.sys ScDA 1 1 0 0 0 0 0 0 Info Exceptions MuSp 0 0 0 0 1 0 1 160 UNKNOWN pooltag 'MuSp', please update pooltag.txt EcUi 8 8 0 0 0 0 0 0 UNKNOWN pooltag 'EcUi', please update pooltag.txt PmTE 0 0 0 0 53 52 1 96 Partition Manager table entry , Binary: partmgr.sys SMB1 5 5 0 0 0 0 0 0 UNKNOWN pooltag 'SMB1', please update pooltag.txt PRFd 4 4 0 0 0 0 0 0 Performance Diagnostics Structures , Binary: nt!wdi apna 2 2 0 0 0 0 0 0 UNKNOWN pooltag 'apna', please update pooltag.txt AtmA 0 0 0 0 1056 456 600 53152 Atoms CcPL 641 641 0 0 0 0 0 0 Prefetcher read list , Binary: nt!ccpf KLRG 0 0 0 0 8 5 3 304 UNKNOWN pooltag 'KLRG', please update pooltag.txt NDwi 847 847 0 0 0 0 0 0 NDIS_TAG_WORK_ITEM , Binary: ndis.sys Vga 0 0 0 0 2 1 1 7712 UNKNOWN pooltag 'Vga ', please update pooltag.txt AlMl 0 0 0 0 1 0 1 262144 UNKNOWN pooltag 'AlMl', please update pooltag.txt Nls 1 1 0 0 0 0 0 0 Nls strings MmCp 14 14 0 0 0 0 0 0 Colored page counts for physical memory allocations , Binary: nt!mm TxfR 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'TxfR', please update pooltag.txt LSlb 0 0 0 0 7 5 2 176 SRVLIB security descriptor/registry buffer , Binary: srv2.sys VoSv 0 0 0 0 1 0 1 160 VolSnap (Volume Snapshot Driver) , Binary: volsnap.sys MIsa 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'MIsa', please update pooltag.txt NtFa 6 6 0 0 2 0 2 160 AllocSup.c , Binary: ntfs.sys ObDu 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'ObDu', please update pooltag.txt PnpD 0 0 0 0 14 0 14 1568 UNKNOWN pooltag 'PnpD', please update pooltag.txt Txfg 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'Txfg', please update pooltag.txt LSdb 0 0 0 0 4 1 3 336 SMB1 data buffer , Binary: srv.sys CAPa 0 0 0 0 5 0 5 800 UNKNOWN pooltag 'CAPa', please update pooltag.txt PsEx 51 51 0 0 0 0 0 0 Process exit APC , Binary: nt!ps NtFB 1 1 0 0 25 20 5 93824 BitmpSup.c , Binary: ntfs.sys PcDf 2 2 0 0 0 0 0 0 UNKNOWN pooltag 'PcDf', please update pooltag.txt PfRD 0 0 0 0 23 23 0 0 Pf Allocations , Binary: nt!pf PfTD 0 0 0 0 59 59 0 0 Pf Trace Dump , Binary: nt!pf Pnp7 0 0 0 0 4 4 0 0 PNPMGR deferred notify entry , Binary: nt!pnp PfRQ 0 0 0 0 23 23 0 0 Pf Prefetch request buffers , Binary: nt!pf TmLl 0 0 0 0 1 0 1 688 UNKNOWN pooltag 'TmLl', please update pooltag.txt Gi2c 0 0 0 0 2 0 2 96 GDITAG_DDCCI , Binary: win32k.sys NtFl 0 0 0 0 0 0 0 0 Unknown NTFS source module , Binary: ntfs.sys PnpC 0 0 0 0 12 0 12 1344 PNPMGR target device notify , Binary: nt!pnp TmLn 0 0 0 0 8 8 0 0 UNKNOWN pooltag 'TmLn', please update pooltag.txt Fstb 18 18 0 0 5 5 0 0 ntos\fstub Keye 0 0 0 0 51 4 47 75232 UNKNOWN pooltag 'Keye', please update pooltag.txt STCE 0 0 0 0 1 1 0 0 New MMC compliant storage drivers NtFR 3 3 0 0 57 57 0 0 RestrSup.c , Binary: ntfs.sys Txfv 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'Txfv', please update pooltag.txt CcPw 2 2 0 0 0 0 0 0 Prefetcher enable worker , Binary: nt!ccpf NDca 0 0 0 0 3 3 0 0 NDIS_TAG_NET_CFG_OPS_ACL , Binary: ndis.sys waR 58 58 0 0 0 0 0 0 UNKNOWN pooltag ' waR', please update pooltag.txt Nb25 4 4 0 0 0 0 0 0 NetBT device bindings , Binary: netbt.sys TmEn 672 672 0 0 0 0 0 0 Tm KENLISTMENT object , Binary: nt!tm NtfE 0 0 0 0 164 109 55 18480 INDEX_CONTEXT , Binary: ntfs.sys Pnp6 0 0 0 0 24 24 0 0 PNPMGR resource request , Binary: nt!pnp PfRC 0 0 0 0 8 8 0 0 Pf Allocations , Binary: nt!pf IoDn 0 0 0 0 9 9 0 0 Io device name info , Binary: nt!io PfSC 23 23 0 0 0 0 0 0 Pf Allocations , Binary: nt!pf PfMP 0 0 0 0 23 23 0 0 Pf Prefetch metadata buffers , Binary: nt!pf Txfi 0 0 0 0 4 2 2 192 TXF_FCB_INFO , Binary: ntfs.sys RtlT 0 0 0 0 13 13 0 0 Temporary RTL allocation , Binary: nt!rtl AtmT 0 0 0 0 9 1 8 7552 Atom tables NtFE 0 0 0 0 263 263 0 0 Ea.c , Binary: ntfs.sys MsvC 0 0 0 0 3 1 2 912 Msv/Ntlm client package , Binary: ksecdd.sys MmSm 0 0 0 0 6393 2257 4136 330880 segments used to map data files , Binary: nt!mm CM8 0 0 0 0 1006 1006 0 0 Internal Configuration manager allocations , Binary: nt!cm CM7 0 0 0 0 617 605 12 576 Internal Configuration manager allocations , Binary: nt!cm FMtr 0 0 0 0 232 232 0 0 Temporary Registry information , Binary: fltmgr.sys IoEa 384 384 0 0 0 0 0 0 Io extended attributes , Binary: nt!io CM1 0 0 0 0 28 28 0 0 Internal Configuration manager allocations , Binary: nt!cm CM2 0 0 0 0 28 28 0 0 Internal Configuration manager allocations , Binary: nt!cm CM3 0 0 0 0 28 28 0 0 Internal Configuration manager allocations , Binary: nt!cm CM4 0 0 0 0 28 28 0 0 Internal Configuration manager allocations , Binary: nt!cm ACPI 4 4 0 0 0 0 0 0 UNKNOWN pooltag 'ACPI', please update pooltag.txt AlHa 0 0 0 0 497 142 355 52144 ALPC port handle table , Binary: nt!alpc USBD 2 2 0 0 0 0 0 0 Universal Serial Bus Class Driver FIvn 0 0 0 0 59 57 2 112 FileInfo FS-filter Volume Name , Binary: fileinfo.sys VoSr 0 0 0 0 2 2 0 0 Device relations allocations , Binary: volsnap.sys NDda 0 0 0 0 3 3 0 0 NDIS_TAG_NET_CFG_DACL , Binary: ndis.sys FIcn 0 0 0 0 2101 2099 2 512 FileInfo FS-filter Create Retry Path , Binary: fileinfo.sys _STR 110827 110827 0 0 0 0 0 0 UNKNOWN pooltag '_STR', please update pooltag.txt CMSc 0 0 0 0 1508 1077 431 127360 security cache pooltag , Binary: nt!cm ScDS 6 6 0 0 0 0 0 0 srb allocation ScCS 99 99 0 0 0 0 0 0 Srb allocation , Binary: cdrom.sys Mn0E 0 0 0 0 1 1 0 0 Buffer for E-EDID v.1.x base block, if any, populated by miniport , Binary: monitor.sys EcMn 30445 30445 0 0 0 0 0 0 UNKNOWN pooltag 'EcMn', please update pooltag.txt ScCc 82 82 0 0 0 0 0 0 Context of completion routine , Binary: cdrom.sys EcMl 30767 30767 0 0 0 0 0 0 UNKNOWN pooltag 'EcMl', please update pooltag.txt PcSb 0 0 0 0 9 0 9 288 UNKNOWN pooltag 'PcSb', please update pooltag.txt EcIl 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'EcIl', please update pooltag.txt PsSb 1 1 0 0 0 0 0 0 Initial process parameter block (temporary allocation) , Binary: nt!ps PsPb 61 61 0 0 0 0 0 0 Captured process parameter block (temporary allocation) , Binary: nt!ps LBpn 0 0 0 0 2 0 2 160 Paged Name Pp 0 0 0 0 61934 61311 623 95760 UNKNOWN pooltag 'Pp ', please update pooltag.txt DfCI 0 0 0 0 5 5 0 0 DFS Client allocations , Binary: dfsc.sys AcpI 860 860 0 0 3868 3764 104 7248 ACPI irp data , Binary: acpi.sys IoRN 0 0 0 0 95 95 0 0 Registry key name (temp allocation) , Binary: nt!io LBea 0 0 0 0 2 2 0 0 Ea buffer PlPi 24 24 0 0 0 0 0 0 UNKNOWN pooltag 'PlPi', please update pooltag.txt Ipas 95 95 0 0 0 0 0 0 IP Buffers for Address Sort , Binary: tcpip.sys PcCb 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'PcCb', please update pooltag.txt CMRm 0 0 0 0 10 5 5 800 Configuration Manager Resource Manager Tag , Binary: nt!cm LBan 0 0 0 0 2 2 0 0 Server announcement LBbn 0 0 0 0 2 0 2 224 Name DbgP 0 0 0 0 2 1 1 32 UNKNOWN pooltag 'DbgP', please update pooltag.txt Wrpr 2 2 0 0 0 0 0 0 WAN_REQUEST_TAG NMRc 36 36 0 0 0 0 0 0 Network Module Registrar Arrays , Binary: tcpip.sys RaEt 1 1 0 0 0 0 0 0 RaidBusEnumeratorProcessBusUnit , Binary: storport.sys PsFn 62 62 0 0 0 0 0 0 Captured image file name buffer (temporary allocation) , Binary: nt!ps MmRl 35593 35593 0 0 0 0 0 0 temporary readlists for file prefetch , Binary: nt!mm Toke 0 0 0 0 72879 72163 716 1099280 Token objects , Binary: nt!se apms 213 213 0 0 0 0 0 0 UNKNOWN pooltag 'apms', please update pooltag.txt ScC9 381 381 0 0 0 0 0 0 Device Control SRB , Binary: classpnp.sys NtfD 0 0 0 0 1 0 1 192 DEALLOCATED_RECORDS , Binary: ntfs.sys MmSt 0 0 0 0 8826 3206 5620 8281456 Mm section object prototype ptes , Binary: nt!mm BIG 0 0 0 0 0 0 0 0 Large session pool allocations (ntos\ex\pool.c) , Binary: nt!mm Pprl 0 0 0 0 3 3 0 0 routines to manipulate relations list , Binary: nt!pnp ClfA 0 0 0 0 39 0 39 5616 CLFS Log container lookaside list , Binary: clfs.sys SeAc 41 41 0 0 76548 76542 6 688 Security ACL , Binary: nt!se PfRL 0 0 0 0 7019 7019 0 0 Pf Prefetch read list , Binary: nt!pf AFGr 0 0 0 0 1 0 1 64 UNKNOWN pooltag 'AFGr', please update pooltag.txt Pnp2 104 104 0 0 0 0 0 0 PNPMGR device action request , Binary: nt!pnp ScLF 153 153 0 0 0 0 0 0 File Object Extension , Binary: classpnp.sys FSun 4 4 0 0 0 0 0 0 File System Run Time , Binary: nt!fsrtl AfdX 0 0 0 0 199 140 59 12256 Afd context buffer , Binary: afd.sys UlUL 0 0 0 0 7 7 0 0 URL , Binary: http.sys PfNL 0 0 0 0 35 34 1 294912 Pf Name logging buffers , Binary: nt!pf PfLB 0 0 0 0 8 0 8 262144 Pf Log buffers , Binary: nt!pf PfPB 11290 11290 0 0 0 0 0 0 Pf Pfn query buffers , Binary: nt!pf Nb14 4 4 0 0 0 0 0 0 NetBT lmhosts path , Binary: netbt.sys Senm 5 5 0 0 2 2 0 0 Serenum (RS-232 serial bus enumerator) SeSc 0 0 0 0 125039 125032 7 576 Captured Security Descriptor , Binary: nt!se CM39 0 0 0 0 624 144 480 227328 Internal Configuration manager allocations , Binary: nt!cm CM29 0 0 0 0 66 33 33 540672 Internal Configuration manager allocations , Binary: nt!cm Pnp5 0 0 0 0 82 82 0 0 PNPMGR assign resources context , Binary: nt!pnp SpLd 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'SpLd', please update pooltag.txt IoBo 1 1 0 0 0 0 0 0 Io boot disk information , Binary: nt!io SeAp 0 0 0 0 2 2 0 0 Security Audit Parameter Record , Binary: nt!se ObDm 0 0 0 0 5 0 5 400 object device map , Binary: nt!ob WmDS 0 0 0 0 2 0 2 16480 Wmi DataSource chunks NtFD 11749 11749 0 0 56 56 0 0 DevioSup.c , Binary: ntfs.sys ObNm 0 0 0 0 30395 29363 1032 63664 object names , Binary: nt!ob RRle 0 0 0 0 13725 12545 1180 94400 RTL_RANGE_LIST_ENTRY_TAG WmIS 0 0 0 0 1 0 1 196656 Wmi InstanceSet chunks ObNS 0 0 0 0 5 5 0 0 UNKNOWN pooltag 'ObNS', please update pooltag.txt CcPB 99 99 0 0 0 0 0 0 Prefetcher trace buffer , Binary: nt!ccpf ArbR 0 0 0 0 222 0 222 10656 ARBITER_RANGE_LIST_TAG , Binary: nt!arb CcPv 0 0 0 0 9 9 0 0 Prefetcher volume info , Binary: nt!ccpf TmNo 13 13 0 0 0 0 0 0 Tm Notification , Binary: nt!tm Dire 0 0 0 0 44 6 38 16544 Directory objects ScC8 0 0 0 0 1 1 0 0 Registry value name , Binary: classpnp.sys SWdr 0 0 0 0 8 0 8 1776 device reference SWbr 0 0 0 0 7 0 7 1168 bus reference SWre 6 6 0 0 0 0 0 0 relations PLDe 0 0 0 0 2 0 2 352 UNKNOWN pooltag 'PLDe', please update pooltag.txt Mmxx 22 22 0 0 0 0 0 0 Mm temporary allocations , Binary: nt!mm NpAt 0 0 0 0 3314 3130 184 14720 UNKNOWN pooltag 'NpAt', please update pooltag.txt CM38 0 0 0 0 36 36 0 0 Internal Configuration manager allocations , Binary: nt!cm WmiD 118 118 0 0 0 0 0 0 Wmi Registration DataSouce NpFt 1589 1589 0 0 0 0 0 0 UNKNOWN pooltag 'NpFt', please update pooltag.txt BLes 0 0 0 0 5 5 0 0 UNKNOWN pooltag 'BLes', please update pooltag.txt CIcr 0 0 0 0 27185 27104 81 112672 Code Integrity allocations for image integrity checking , Binary: ci.dll CM28 0 0 0 0 6 3 3 24576 Internal Configuration manager allocations , Binary: nt!cm CMAl 0 0 0 0 1634 1208 426 1744896 internal registry memory allocator pool tag , Binary: nt!cm Nbtj 6 6 0 0 0 0 0 0 NetBT EA buffer , Binary: netbt.sys SLS 0 0 0 0 176 176 0 0 UNKNOWN pooltag 'SLS ', please update pooltag.txt IrpL 0 0 0 0 0 0 0 0 UNKNOWN pooltag 'IrpL', please update pooltag.txt Psap 132 132 0 0 0 0 0 0 Block used to hold a user mode APC while its queued to a thread , Binary: nt!ps PnpN 1 1 0 0 0 0 0 0 PNPMGR PDO array , Binary: nt!pnp Mp10 0 0 0 0 109 109 0 0 UNKNOWN pooltag 'Mp10', please update pooltag.txt PnpM 0 0 0 0 1 1 0 0 PNPMGR veto buffer , Binary: nt!pnp PcDW 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'PcDW', please update pooltag.txt None 0 0 0 0 20 10 10 37568 call to ExAllocatePool AlCI 0 0 0 0 495 140 355 45440 ALPC communication info , Binary: nt!alpc EcCb 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'EcCb', please update pooltag.txt MdlP 0 0 0 0 0 0 0 0 MDL per processor lookaside list pointers KStc 0 0 0 0 5 5 0 0 UNKNOWN pooltag 'KStc', please update pooltag.txt KScp 2 2 0 0 0 0 0 0 object creation parameters auxiliary copy CcPh 0 0 0 0 18 18 0 0 Prefetcher header preallocation , Binary: nt!ccpf Txis 0 0 0 0 1 0 1 64 TXF_ISO_SNAPSHOT , Binary: ntfs.sys NDcm 1 1 0 0 0 0 0 0 NDIS_TAG_CM , Binary: ndis.sys KSpp 510 510 0 0 0 0 0 0 irp system buffer property/method/event parameter Txls 0 0 0 0 1 0 1 48 TXF_CANCEL_LSN , Binary: ntfs.sys AfdL 351 351 0 0 0 0 0 0 Afd local address buffer , Binary: afd.sys NBSr 0 0 0 0 2 2 0 0 registry allocations NbtX 60 60 0 0 0 0 0 0 NetBT datagram , Binary: netbt.sys Ntfm 0 0 0 0 3 1 2 992 NTFS_MCB_ARRAY , Binary: ntfs.sys SeFS 0 0 0 0 2 0 2 64 Security File System Notify Context , Binary: nt!se Txfs 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'Txfs', please update pooltag.txt MmFl 90 90 0 0 0 0 0 0 MDLs for large clusters for flushes , Binary: nt!mm NtfS 0 0 0 0 3 0 3 1824 SCB_INDEX , Binary: ntfs.sys PfTt 0 0 0 0 60 60 0 0 Pf Translation tables , Binary: nt!pf IoOp 0 0 0 0 0 0 0 0 I/O subsystem open packet , Binary: nt!io SeLS 0 0 0 0 1 0 1 144 Security Logon Session tracking array , Binary: nt!se Ntf9 2172 2172 0 0 0 0 0 0 Large Temporary Buffer , Binary: ntfs.sys AlSc 0 0 0 0 141 103 38 4864 ALPC section , Binary: nt!alpc Nb26 4 4 0 0 0 0 0 0 NetBT device exports , Binary: netbt.sys NtFS 0 0 0 0 468 128 340 81856 SecurSup.c , Binary: ntfs.sys EcIo 22752 22752 0 0 0 0 0 0 UNKNOWN pooltag 'EcIo', please update pooltag.txt SMB6 2 2 0 0 0 0 0 0 UNKNOWN pooltag 'SMB6', please update pooltag.txt HGKS 4 4 0 0 0 0 0 0 UNKNOWN pooltag 'HGKS', please update pooltag.txt IoFc 0 0 0 0 1 0 1 144 Io name transmogrify operation , Binary: nt!io ARFT 0 0 0 0 3 0 3 192 UNKNOWN pooltag 'ARFT', please update pooltag.txt NtfF 0 0 0 0 3352 1290 2062 2870304 FCB_INDEX , Binary: ntfs.sys Pwmi 18 18 0 0 0 0 0 0 PACER WMI notifications , Binary: pacer.sys VoSo 0 0 0 0 2 0 2 96 Old heap entry allocations , Binary: volsnap.sys NtFF 0 0 0 0 39 39 0 0 FileInfo.c , Binary: ntfs.sys Txfu 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'Txfu', please update pooltag.txt NtFU 0 0 0 0 27058 26915 143 25024 usnsup.c , Binary: ntfs.sys ScPD 0 0 0 0 0 0 0 0 SRB_DATA allocations WmGE 0 0 0 0 1 0 1 81968 Wmi GuidEntry chunks FMus 0 0 0 0 5 3 2 64 Unicode string , Binary: fltmgr.sys UlCP 0 0 0 0 3 2 1 592 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys EP.. 0 0 0 0 2 1 1 112 UNKNOWN pooltag ' EP', please update pooltag.txt NpFs 0 0 0 0 13240 13217 23 2208 Client security context , Binary: npfs.sys WmMR 0 0 0 0 1 0 1 960 Wmi MofResouce chunks Rqrv 0 0 0 0 8928 8928 0 0 Registry query buffer ObCl 0 0 0 0 0 0 0 0 UNKNOWN pooltag 'ObCl', please update pooltag.txt WmiI 0 0 0 0 1 1 0 0 Wmi Instance Names ScVk 1 1 0 0 0 0 0 0 read buffer for DVD keys KsRp 0 0 0 0 5 5 0 0 UNKNOWN pooltag 'KsRp', please update pooltag.txt ObSc 0 0 0 0 18143 17722 421 98672 Object security descriptor cache block , Binary: nt!ob KRC 0 0 0 0 8 8 0 0 UNKNOWN pooltag 'KRC ', please update pooltag.txt Txfh 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'Txfh', please update pooltag.txt PcPc 0 0 0 0 2 0 2 160 WDM audio stuff ClfO 0 0 0 0 1 0 1 4096 CLFS Log zero page , Binary: clfs.sys PcFp 0 0 0 0 4 0 4 2848 WDM audio stuff Symt 0 0 0 0 220 33 187 11552 Symbolic link target strings Afdt 0 0 0 0 8 2 6 688 Afd transport address buffer , Binary: afd.sys Ntfo 0 0 0 0 3552 1502 2050 407040 SCB_INDEX normalized named buffer , Binary: ntfs.sys Perf 109 109 0 0 0 0 0 0 UNKNOWN pooltag 'Perf', please update pooltag.txt Nbti 8 8 0 0 0 0 0 0 NetBT device list , Binary: netbt.sys SWid 0 0 0 0 7 0 7 672 device ID EtwP 0 0 0 0 3008 3000 8 1264 Etw Pool , Binary: nt!etw RaSr 11 11 0 0 0 0 0 0 RaidAllocateSrb storport!_SCSI_REQUEST_BLOCK , Binary: storport.sys Se 1 1 0 0 132789 132789 0 0 General security allocations , Binary: nt!se CM20 0 0 0 0 1 0 1 8192 Internal Configuration manager allocations , Binary: nt!cm CM10 0 0 0 0 19 6 13 37648 Internal Configuration manager allocations , Binary: nt!cm PfVA 18 18 0 0 0 0 0 0 Pf VA prefetching buffers , Binary: nt!pf CcPM 0 0 0 0 9 9 0 0 Prefetcher metadata , Binary: nt!ccpf TCPT 0 0 0 0 0 0 0 0 TCB pool , Binary: TCP Mmlk 362 362 0 0 0 0 0 0 ProbeAndLock MDL tracker , Binary: nt!mm DfCo 0 0 0 0 1 0 1 144 DFS Client allocations , Binary: dfsc.sys NDpo 8 8 0 0 0 0 0 0 NDIS_TAG_PORT , Binary: ndis.sys BCDK 0 0 0 0 30 30 0 0 Kernel boot configuration data. , Binary: nt!init SWpd 1 1 0 0 0 0 0 0 POOLTAG_DEVICE_PDOEXTENSION MsFN 0 0 0 0 1 0 1 64 Mailslot FCB name buffer, name for each created mailslot CM27 0 0 0 0 17 6 11 17568 Internal Configuration manager allocations , Binary: nt!cm CM17 0 0 0 0 9 0 9 147456 Internal Configuration manager allocations , Binary: nt!cm SeSa 0 0 0 0 142 142 0 0 Security SID and Attributes , Binary: nt!se SeTa 0 0 0 0 142 142 0 0 Security Temporary Array , Binary: nt!se Info 1292 1292 0 0 0 0 0 0 general system information allocations Ntfl 0 0 0 0 5 0 5 1280 LCB , Binary: ntfs.sys TOTAL 2314339 2234842 79497 35294128 2846062 2757232 88830 60800288 1: kd> g Break instruction exception - code 80000003 (first chance) ******************************************************************************* * * * You are seeing this message because you pressed either * * CTRL+C (if you run console kernel debugger) or, * * CTRL+BREAK (if you run GUI kernel debugger), * * on your debugger machine's keyboard. * * * * THIS IS NOT A BUG OR A SYSTEM CRASH * * * * If you did not intend to break into the debugger, press the "g" key, then * * press the "Enter" key now. This message might immediately reappear. If it * * does, press "g" and "Enter" again. * * * ******************************************************************************* nt!RtlpBreakWithStatusInstruction: fffff800`018472a0 cc int 3 0: kd> !vm *** Virtual Memory Usage *** Physical Memory: 261872 ( 1047488 Kb) Page File: \??\C:\pagefile.sys Current: 1126400 Kb Free Space: 998836 Kb Minimum: 1126400 Kb Maximum: 1126400 Kb Available Pages: 135547 ( 542188 Kb) ResAvail Pages: 218633 ( 874532 Kb) Locked IO Pages: 0 ( 0 Kb) Free System PTEs: 268316971 (1073267884 Kb) Modified Pages: 6496 ( 25984 Kb) Modified PF Pages: 6487 ( 25948 Kb) NonPagedPool Usage: 14208 ( 56832 Kb) NonPagedPool Max: 98304 ( 393216 Kb) PagedPool 0 Usage: 8676 ( 34704 Kb) PagedPool 1 Usage: 5786 ( 23144 Kb) PagedPool 2 Usage: 1569 ( 6276 Kb) PagedPool 3 Usage: 1488 ( 5952 Kb) PagedPool 4 Usage: 1543 ( 6172 Kb) PagedPool Usage: 19062 ( 76248 Kb) PagedPool Maximum: 33554432 ( 134217728 Kb) Session Commit: 5401 ( 21604 Kb) Shared Commit: 4909 ( 19636 Kb) Special Pool: 0 ( 0 Kb) Shared Process: 4716 ( 18864 Kb) PagedPool Commit: 19062 ( 76248 Kb) Driver Commit: 3148 ( 12592 Kb) Committed pages: 149655 ( 598620 Kb) Commit limit: 532419 ( 2129676 Kb) Total Private: 90945 ( 363780 Kb) 03bc svchost.exe 14626 ( 58504 Kb) 0340 svchost.exe 9621 ( 38484 Kb) 0100 SearchIndexer.e 8623 ( 34492 Kb) 0644 explorer.exe 7546 ( 30184 Kb) 03cc svchost.exe 5450 ( 21800 Kb) 03a0 svchost.exe 3922 ( 15688 Kb) 046c svchost.exe 3854 ( 15416 Kb) 054c svchost.exe 3647 ( 14588 Kb) 0184 audiodg.exe 3223 ( 12892 Kb) 0450 taskeng.exe 2459 ( 9836 Kb) 0530 spoolsv.exe 2214 ( 8856 Kb) 0710 vmtoolsd.exe 2168 ( 8672 Kb) 06fc MSASCui.exe 2005 ( 8020 Kb) 0894 dllhost.exe 1858 ( 7432 Kb) 0760 vmtoolsd.exe 1762 ( 7048 Kb) 040c svchost.exe 1672 ( 6688 Kb) 01ec csrss.exe 1578 ( 6312 Kb) 01a0 SLsvc.exe 1333 ( 5332 Kb) 0320 svchost.exe 1078 ( 4312 Kb) 0254 lsass.exe 982 ( 3928 Kb) 02e8 svchost.exe 871 ( 3484 Kb) 09e8 msdtc.exe 864 ( 3456 Kb) 0a80 wuauclt.exe 783 ( 3132 Kb) 0120 TPAutoConnSvc.e 782 ( 3128 Kb) 025c lsm.exe 766 ( 3064 Kb) 0004 System 747 ( 2988 Kb) 0708 VMwareTray.exe 744 ( 2976 Kb) 0a44 TPAutoConnect.e 725 ( 2900 Kb) 0218 services.exe 723 ( 2892 Kb) 0234 winlogon.exe 681 ( 2724 Kb) 08cc taskeng.exe 659 ( 2636 Kb) 01b8 csrss.exe 638 ( 2552 Kb) 0190 svchost.exe 635 ( 2540 Kb) 0624 dwm.exe 469 ( 1876 Kb) 01d8 wininit.exe 429 ( 1716 Kb) 009c notepad.exe 415 ( 1660 Kb) 0288 svchost.exe 279 ( 1116 Kb) 0174 smss.exe 114 ( 456 Kb) 097c logon.scr 0 ( 0 Kb) 0: kd> g Break instruction exception - code 80000003 (first chance) ******************************************************************************* * * * You are seeing this message because you pressed either * * CTRL+C (if you run console kernel debugger) or, * * CTRL+BREAK (if you run GUI kernel debugger), * * on your debugger machine's keyboard. * * * * THIS IS NOT A BUG OR A SYSTEM CRASH * * * * If you did not intend to break into the debugger, press the "g" key, then * * press the "Enter" key now. This message might immediately reappear. If it * * does, press "g" and "Enter" again. * * * ******************************************************************************* nt!RtlpBreakWithStatusInstruction: fffff800`018472a0 cc int 3 1: kd> !vm *** Virtual Memory Usage *** Physical Memory: 261872 ( 1047488 Kb) Page File: \??\C:\pagefile.sys Current: 1126400 Kb Free Space: 1003900 Kb Minimum: 1126400 Kb Maximum: 1126400 Kb Available Pages: 110531 ( 442124 Kb) ResAvail Pages: 211090 ( 844360 Kb) Locked IO Pages: 0 ( 0 Kb) Free System PTEs: 268314411 (1073257644 Kb) Modified Pages: 6464 ( 25856 Kb) Modified PF Pages: 6428 ( 25712 Kb) NonPagedPool Usage: 21193 ( 84772 Kb) NonPagedPool Max: 98304 ( 393216 Kb) PagedPool 0 Usage: 9541 ( 38164 Kb) PagedPool 1 Usage: 7483 ( 29932 Kb) PagedPool 2 Usage: 3251 ( 13004 Kb) PagedPool 3 Usage: 3210 ( 12840 Kb) PagedPool 4 Usage: 3255 ( 13020 Kb) PagedPool Usage: 26740 ( 106960 Kb) PagedPool Maximum: 33554432 ( 134217728 Kb) Session Commit: 8462 ( 33848 Kb) Shared Commit: 4616 ( 18464 Kb) Special Pool: 0 ( 0 Kb) Shared Process: 5184 ( 20736 Kb) PagedPool Commit: 26740 ( 106960 Kb) Driver Commit: 3148 ( 12592 Kb) Committed pages: 170478 ( 681912 Kb) Commit limit: 532419 ( 2129676 Kb) Total Private: 93647 ( 374588 Kb) 03bc svchost.exe 14818 ( 59272 Kb) 0340 svchost.exe 9621 ( 38484 Kb) 0100 SearchIndexer.e 8661 ( 34644 Kb) 0644 explorer.exe 6817 ( 27268 Kb) 03cc svchost.exe 5604 ( 22416 Kb) 046c svchost.exe 4188 ( 16752 Kb) 03a0 svchost.exe 3978 ( 15912 Kb) 054c svchost.exe 3647 ( 14588 Kb) 0184 audiodg.exe 3252 ( 13008 Kb) 0450 taskeng.exe 2459 ( 9836 Kb) 0530 spoolsv.exe 2214 ( 8856 Kb) 0710 vmtoolsd.exe 2161 ( 8644 Kb) 06fc MSASCui.exe 2005 ( 8020 Kb) 0894 dllhost.exe 1858 ( 7432 Kb) 0760 vmtoolsd.exe 1761 ( 7044 Kb) 040c svchost.exe 1658 ( 6632 Kb) 01ec csrss.exe 1561 ( 6244 Kb) 01a0 SLsvc.exe 1333 ( 5332 Kb) 0254 lsass.exe 1110 ( 4440 Kb) 0320 svchost.exe 1100 ( 4400 Kb) 0af4 ieuser.exe 1034 ( 4136 Kb) 03f0 SearchProtocolH 981 ( 3924 Kb) 02e8 svchost.exe 885 ( 3540 Kb) 0584 SearchFilterHos 879 ( 3516 Kb) 09e8 msdtc.exe 864 ( 3456 Kb) 0a80 wuauclt.exe 783 ( 3132 Kb) 0120 TPAutoConnSvc.e 782 ( 3128 Kb) 025c lsm.exe 767 ( 3068 Kb) 0218 services.exe 749 ( 2996 Kb) 0004 System 747 ( 2988 Kb) 0708 VMwareTray.exe 744 ( 2976 Kb) 0a44 TPAutoConnect.e 741 ( 2964 Kb) 0234 winlogon.exe 662 ( 2648 Kb) 08cc taskeng.exe 659 ( 2636 Kb) 01b8 csrss.exe 638 ( 2552 Kb) 0190 svchost.exe 635 ( 2540 Kb) 0624 dwm.exe 469 ( 1876 Kb) 01d8 wininit.exe 429 ( 1716 Kb) 0288 svchost.exe 279 ( 1116 Kb) 0174 smss.exe 114 ( 456 Kb) 097c logon.scr 0 ( 0 Kb) 08ec iexplore.exe 0 ( 0 Kb) 0430 iexplore.exe 0 ( 0 Kb) 009c notepad.exe 0 ( 0 Kb) 1: kd> !poolused 3 .. Sorting by NonPaged Pool Consumed NonPaged Paged Tag Allocs Frees Diff Used Allocs Frees Diff Used MmAc 10806 8912 1894 7757824 0 0 0 0 Mm access log buffers , Binary: nt!mm PfPB 12401 11290 1111 7034384 0 0 0 0 Pf Pfn query buffers , Binary: nt!pf EtwB 300 133 167 6328896 14 0 14 475136 Etw Buffer , Binary: nt!etw Irp 138950 126627 12323 5716064 0 0 0 0 Io, IRP packets File 136451 117882 18569 5703504 0 0 0 0 File objects Io 220221 202910 17311 5447664 38987 38284 703 1564288 general IO allocations , Binary: nt!io Cont 1081 3 1078 4970384 0 0 0 0 Contiguous physical memory allocations for device drivers Wait 952467 937527 14940 4331616 0 0 0 0 WaitCompletion Packets , Binary: nt!io Ntf9 2453 2172 281 2584576 0 0 0 0 Large Temporary Buffer , Binary: ntfs.sys Pool 14 7 7 2552464 0 0 0 0 Pool tables, etc. DEVT 1 0 1 2106224 0 0 0 0 UNKNOWN pooltag 'DEVT', please update pooltag.txt VoSb 207 126 81 1867776 0 0 0 0 Buffer allocations , Binary: volsnap.sys NSpg 30943 29303 1640 1630240 0 0 0 0 NSI Proxy Generic Buffers , Binary: nsi.dll usbp 6695 1648 5047 1584064 42 40 2 128 UNKNOWN pooltag 'usbp', please update pooltag.txt Ntfr 10601 1356 9245 1184272 0 0 0 0 ERESOURCE , Binary: ntfs.sys FMsl 7196 1449 5747 1103424 0 0 0 0 STREAM_LIST_CTRL structure , Binary: fltmgr.sys MmCa 7994 3206 4788 1051728 0 0 0 0 Mm control areas for mapped files , Binary: nt!mm AmlH 1 0 1 1048576 0 0 0 0 ACPI AMLI Pooltags RaRS 1000 0 1000 960000 0 0 0 0 RaidUnitAllocateResources , Binary: storport.sys Thre 2467 1678 789 943856 0 0 0 0 Thread objects , Binary: nt!ps iGig 1035 0 1035 830816 0 0 0 0 UNKNOWN pooltag 'iGig', please update pooltag.txt Mdl 7462 5870 1592 790448 0 0 0 0 Io, Mdls MmRp 366 179 187 765952 0 0 0 0 Mm repurpose logging , Binary: nt!mm Even 78019 70686 7333 708320 0 0 0 0 Event objects NpFR 27005 25098 1907 564928 0 0 0 0 UNKNOWN pooltag 'NpFR', please update pooltag.txt HTab 610 508 102 544976 0 0 0 0 Hash Table pool COMX 118 109 9 540720 27 22 5 368 serial driver allocations , Binary: serial.sys MmCi 1174 3 1171 538208 0 0 0 0 Mm control areas for images , Binary: nt!mm Vad 19558 14869 4689 525168 0 0 0 0 Mm virtual address descriptors , Binary: nt!mm NtFs 10137 4055 6082 506960 19387 9663 9724 1913728 StrucSup.c , Binary: ntfs.sys Ntfn 7269 1504 5765 462496 0 0 0 0 SCB_NONPAGED , Binary: ntfs.sys FMfc 2760 388 2372 455424 0 0 0 0 FLTMGR_FILE_OBJECT_CONTEXT structure , Binary: fltmgr.sys Devi 642 259 383 441248 0 0 0 0 Device objects AfdP 1107 86 1021 438640 0 0 0 0 Afd poll info , Binary: afd.sys SeTd 75500 72163 3337 427136 75523 72183 3340 588704 Security Token dynamic part , Binary: nt!se ALPC 2628 1747 881 425664 0 0 0 0 ALPC port objects , Binary: nt!alpc FOCX 23555 20087 3468 332928 0 0 0 0 File System Run Time File Object Context structure , Binary: nt!fsrtl SePa 23988 21839 2149 322576 1 0 1 32 Process audit image names and captured policy structures , Binary: nt!se CM 15630 15528 102 296592 16897 16747 150 108544 Configuration Manager (registry) , Binary: nt!cm CcPB 108 99 9 294912 0 0 0 0 Prefetcher trace buffer , Binary: nt!ccpf UHUB 43067 39263 3804 289952 56 54 2 192 Universal Serial Bus Hub CcSc 6319 5721 598 287040 0 0 0 0 Cache Manager Shared Cache Map , Binary: nt!cc AmlC 1742 1738 4 262144 0 0 0 0 ACPI AMLI Pooltags PciB 580 234 346 250560 3757 3719 38 5200 PnP pci bus enumerator , Binary: pci.sys EcBp 2 0 2 246752 0 0 0 0 UNKNOWN pooltag 'EcBp', please update pooltag.txt MmWs 1419 1321 98 241648 0 0 0 0 PTE flush list for working set operations , Binary: nt!mm AcpD 838 498 340 237120 0 0 0 0 ACPI device data , Binary: acpi.sys HidU 1500 258 1242 218112 0 0 0 0 UNKNOWN pooltag 'HidU', please update pooltag.txt ViMm 168 48 120 210912 135 34 101 587040 Video memory manager , Binary: dxgkrnl.sys NtfJ 4 0 4 204800 5 4 1 144 Unkown allocation , Binary: ntfs.sys UsbC 3891 1363 2528 194624 22 22 0 0 UNKNOWN pooltag 'UsbC', please update pooltag.txt VadS 12267 9893 2374 189920 0 0 0 0 Mm virtual address descriptors (short) , Binary: nt!mm EtwR 2143 968 1175 188000 0 0 0 0 Etw Registration , Binary: nt!etw Icp 2843 1066 1777 170464 0 0 0 0 I/O completion packets queue on a completion ports InPa 82 41 41 167936 0 0 0 0 Inet Port Assignments , Binary: tcpip.sys CDmp 20 12 8 165536 0 0 0 0 Crashdump driver , Binary: crashdmp.sys VoSm 14 9 5 163936 0 0 0 0 Bitmap allocations , Binary: volsnap.sys Ntfi 1867 1513 354 158592 0 0 0 0 IRP_CONTEXT , Binary: ntfs.sys WfpS 7 5 2 156272 0 0 0 0 WFP startup , Binary: netio.sys NtFL 464 415 49 152448 66 1 65 4160 LogSup.c , Binary: ntfs.sys Hal 3805 2513 1292 143152 89 88 1 144 Hardware Abstraction Layer , Binary: hal.dll HGIX 2 0 2 140000 0 0 0 0 UNKNOWN pooltag 'HGIX', please update pooltag.txt Vadm 5954 4989 965 138960 0 0 0 0 UNKNOWN pooltag 'Vadm', please update pooltag.txt NpFr 30266 28215 2051 138752 0 0 0 0 DATA_ENTRY records (read/write buffers) , Binary: npfs.sys EtwG 412 55 357 137088 0 0 0 0 Etw Guid , Binary: nt!etw CcVa 1 0 1 131072 0 0 0 0 Cache Manager Initial array of Vacbs , Binary: nt!cc NSIk 495 132 363 114720 0 0 0 0 NSI RPC Tansactions , Binary: nsi.dll Sema 1274 174 1100 105728 0 0 0 0 Semaphore objects MmId 824 807 17 104400 0 0 0 0 PFN identity buffer for setting PFN priorities , Binary: nt!mm Vadl 2432 1714 718 103392 0 0 0 0 Mm virtual address descriptors (long) , Binary: nt!mm CPnp 4376 4140 236 98176 0 0 0 0 ClassPnP transfer packets , Binary: classpnp.sys CcBc 2564 2100 464 96512 0 0 0 0 Cache Manager Bcb from pool , Binary: nt!cc AleS 95 53 42 91104 0 0 0 0 ALE token info , Binary: tcpip.sys Mm 325 317 8 90816 16 11 5 1168 general Mm Allocations , Binary: nt!mm CTMM 30030 28192 1838 89888 0 0 0 0 UNKNOWN pooltag 'CTMM', please update pooltag.txt NtFv 2567 1879 688 88064 113 111 2 736 ViewSup.c , Binary: ntfs.sys Muta 1691 1101 590 79616 0 0 0 0 Mutant objects Dnod 427 287 140 78400 0 0 0 0 Device node structure CTGC 2 0 2 73728 0 0 0 0 UNKNOWN pooltag 'CTGC', please update pooltag.txt TcpE 98 0 98 73456 0 0 0 0 TCP Endpoints , Binary: tcpip.sys FMic 2316 2221 95 69664 0 0 0 0 IRP_CTRL structure , Binary: fltmgr.sys ScSc 4 0 4 66560 0 0 0 0 Mass storage driver tags Driv 135 2 133 65696 0 0 0 0 Driver objects CM44 748 240 508 65024 0 0 0 0 Internal Configuration manager allocations , Binary: nt!cm AleE 148 0 148 59312 0 0 0 0 ALE endpoint context , Binary: tcpip.sys SpSy 90 1 89 58944 1451 958 493 137056 UNKNOWN pooltag 'SpSy', please update pooltag.txt ReTa 930 23 907 58304 0 0 0 0 Resource Extended Table ViSh 101 20 81 58032 0 0 0 0 Video scheduler , Binary: dxgkrnl.sys IPrq 5 0 5 56352 0 0 0 0 IP Request Control data , Binary: tcpip.sys AfdE 109 3 106 55424 0 0 0 0 Afd endpoint structure , Binary: afd.sys MmSi 1145 3 1142 54816 0 0 0 0 Control area security image stubs , Binary: nt!mm AlIn 224 39 185 54480 5 5 0 0 ALPC Internal allocation , Binary: nt!alpc TdxC 132 50 82 53792 0 0 0 0 TDX Connections , Binary: tdx.sys NDre 2161 1891 270 52864 0 0 0 0 NDIS_TAG_OID_REQUEST , Binary: ndis.sys FSrt 39 20 19 51248 66 46 20 26480 File System Run Time allocations (DO NOT USE!) , Binary: nt!fsrtl NSIr 6743 6389 354 49376 0 0 0 0 NSI Generic Buffers , Binary: nsi.dll LSbf 89 0 89 48496 37 1 36 21520 SMB1 buffer descriptor or srvnet allocation , Binary: srvnet.sys NtFD 11866 11749 117 47232 56 56 0 0 DevioSup.c , Binary: ntfs.sys Proc 69 25 44 47168 0 0 0 0 Process objects , Binary: nt!ps SMBi 119 105 14 45552 1 0 1 144 UNKNOWN pooltag 'SMBi', please update pooltag.txt UdpA 288 139 149 45296 0 0 0 0 UDP Endpoints , Binary: tcpip.sys ND 508 488 20 44640 1 0 1 144 general NDIS allocations , Binary: ndis.sys ClfC 8 0 8 44416 0 0 0 0 CLFS Log physical FCB lookaside list , Binary: clfs.sys ScC9 726 381 345 44160 0 0 0 0 Device Control SRB , Binary: classpnp.sys AfdB 145 0 145 42656 0 0 0 0 Afd data buffer , Binary: afd.sys Gsem 264 0 264 42112 0 0 0 0 Gdi Semaphores TcDM 11 0 11 41472 0 0 0 0 TCP Delayed Delivery Memory Descriptor Lists , Binary: tcpip.sys Nhfs 20 0 20 40672 0 0 0 0 NetIO Hash Function State Data , Binary: tcpip.sys WfpH 774 145 629 40592 0 0 0 0 WFP hash , Binary: netio.sys Frag 32280 29822 2458 39328 1293 757 536 8576 UNKNOWN pooltag 'Frag', please update pooltag.txt inte 110 0 110 38912 13 0 13 1184 UNKNOWN pooltag 'inte', please update pooltag.txt Time 127 21 106 35616 0 0 0 0 Timer objects , Binary: nt!ke CcMb 192 22 170 35360 0 0 0 0 Cache Manager Mbcb , Binary: nt!cc UlXR 2 0 2 33024 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys Tdx 109 102 7 33008 0 0 0 0 TDX Generic Buffers (Address, Entity information, Interface change allocations) , Binary: tdx.sys VmBu 1 0 1 32768 0 0 0 0 I/O buffers , Binary: volmgrx.sys InPA 512 0 512 32768 0 0 0 0 Inet Port Assignment Arrays , Binary: tcpip.sys Perf 113 109 4 32768 0 0 0 0 UNKNOWN pooltag 'Perf', please update pooltag.txt IdeP 52 32 20 32656 14 14 0 0 atapi IDE CcPL 778 641 137 32048 0 0 0 0 Prefetcher read list , Binary: nt!ccpf MmRl 35754 35593 161 31072 0 0 0 0 temporary readlists for file prefetch , Binary: nt!mm AzBD 884 848 36 30992 0 0 0 0 UNKNOWN pooltag 'AzBD', please update pooltag.txt MmSP 8 0 8 29488 0 0 0 0 SLIST entries for system PTE NB queues , Binary: nt!mm Scbf 129 106 23 29440 0 0 0 0 Mass storage driver tags LSSL 41 0 41 28864 15 13 2 128 SMBLIB allocation , Binary: srv2.sys NDif 31 3 28 27744 0 0 0 0 NDIS_TAG_IF , Binary: ndis.sys PsPb 67 61 6 27568 0 0 0 0 Captured process parameter block (temporary allocation) , Binary: nt!ps MmLd 181 44 137 27296 4 4 0 0 Mm load module database , Binary: nt!mm TcDN 5 0 5 26832 0 0 0 0 TCP Delayed Delivery Network Buffer Lists , Binary: tcpip.sys NDnd 4 0 4 26256 0 0 0 0 NDIS_TAG_POOL_NDIS , Binary: ndis.sys Pcsb 3 0 3 25776 0 0 0 0 PACER Send Buffers , Binary: pacer.sys UNbl 26 0 26 25392 0 0 0 0 UDP NetBufferLists , Binary: tcpip.sys ObjT 37 0 37 24864 0 0 0 0 object type objects , Binary: nt!ob FxLg 6 0 6 24576 0 0 0 0 KMDF IFR log tag , Binary: wdf01000.sys KeIn 6 0 6 24576 0 0 0 0 UNKNOWN pooltag 'KeIn', please update pooltag.txt PcRt 3 2 1 24576 0 0 0 0 UNKNOWN pooltag 'PcRt', please update pooltag.txt FSro 300 6 294 23520 300 6 294 23520 File System Run Time , Binary: nt!fsrtl EcXp 1 0 1 23280 0 0 0 0 UNKNOWN pooltag 'EcXp', please update pooltag.txt CcVl 15 1 14 22976 0 0 0 0 Cache Manager Vacb Level structures (large streams) , Binary: nt!cc InPP 2 0 2 22400 0 0 0 0 Inet Port pool , Binary: tcpip.sys Tcpt 5 0 5 21984 0 0 0 0 TCP Timers , Binary: tcpip.sys VM3D 19 5 14 21904 9 2 7 368 Volume Manager , Binary: volmgr.sys Pccr 1406 1324 82 20992 0 0 0 0 PACER Filter Clone Requests , Binary: pacer.sys IoCo 173 28 145 20880 0 0 0 0 UNKNOWN pooltag 'IoCo', please update pooltag.txt Wdog 11 0 11 20864 2 0 2 96 Watchdog object/context allocation , Binary: watchdog.sys umbu 60 11 49 20800 14 9 5 576 UNKNOWN pooltag 'umbu', please update pooltag.txt FMis 122 111 11 20528 0 0 0 0 FLT_INSTANCE structure , Binary: fltmgr.sys IPpa 5 0 5 20480 0 0 0 0 IP Path information , Binary: tcpip.sys I6nb 5 0 5 20480 0 0 0 0 IPv6 Neighbors , Binary: tcpip.sys Fsb 38 0 38 19456 0 0 0 0 Fixed-Size Block pool , Binary: netio.sys WfpF 366 62 304 19456 0 0 0 0 WFP filters , Binary: netio.sys Wmip 284 41 243 19440 939 631 308 32944 Wmi General purpose allocation CcVp 109 60 49 19408 0 0 0 0 Cache Manager Array of Vacb pointers for a cached stream , Binary: nt!cc AfdL 524 351 173 19376 0 0 0 0 Afd local address buffer , Binary: afd.sys LSwi 2 1 1 19200 0 0 0 0 SMB1 initial work context , Binary: srv.sys NDw1 8 0 8 18800 0 0 0 0 NDIS_TAG_WMI_GUID_TO_OID , Binary: ndis.sys NDmo 13 0 13 18400 0 0 0 0 NDIS_TAG_M_OPEN_BLK , Binary: ndis.sys FMvo 119 109 10 18320 0 0 0 0 FLT_VOLUME structure , Binary: fltmgr.sys TcHT 4 0 4 17728 0 0 0 0 TCP Hash Tables , Binary: tcpip.sys EtwL 21 3 18 17728 0 0 0 0 ETW_LOGGER_CONTEXT , Binary: nt!etw VfAT 143 6 137 17536 0 0 0 0 Verifier AVL trees , Binary: nt!Vf BaNB 4 0 4 17280 0 0 0 0 UNKNOWN pooltag 'BaNB', please update pooltag.txt StBn 3 0 3 17232 0 0 0 0 UNKNOWN pooltag 'StBn', please update pooltag.txt Iptt 42 0 42 16992 0 0 0 0 IP Timer Tables , Binary: tcpip.sys NDfa 30 0 30 16800 0 0 0 0 NDIS_TAG_FILTER_ADDR , Binary: ndis.sys RxIr 16 4 12 16608 0 0 0 0 RDBSS RxContext , Binary: rdbss.sys WfTi 20 0 20 16480 0 0 0 0 WFP timer Ipur 4 0 4 16384 0 0 0 0 IP Unicast Routes , Binary: tcpip.sys FlpS 4 0 4 16384 0 0 0 0 Framing Layer Serialized Requests , Binary: tcpip.sys Lfsr 1 0 1 16384 0 0 0 0 UNKNOWN pooltag 'Lfsr', please update pooltag.txt IPss 4 0 4 16384 0 0 0 0 IP Session State , Binary: tcpip.sys PfEL 2 1 1 16384 0 0 0 0 Pf Event logging buffers , Binary: nt!pf Ioin 134 51 83 16288 0 0 0 0 Io interrupts WfpC 7 5 2 16112 0 0 0 0 WFP callouts , Binary: netio.sys NbL4 100 50 50 15200 0 0 0 0 NetBT lower connection , Binary: netbt.sys AzWd 74 0 74 14528 0 0 0 0 HD Audio Class Driver (AzWidget) , Binary: HDAudio.sys AfdC 52 0 52 14384 0 0 0 0 Afd connection structure , Binary: afd.sys ReSe 248 3 245 14128 0 0 0 0 Resource Semaphore PnpI 427 287 140 14096 0 0 0 0 PNPMGR instance path , Binary: nt!pnp NDam 1492 1474 18 14032 0 0 0 0 NdisAllocateMemory , Binary: ndis.sys _STR 111163 110827 336 13824 0 0 0 0 UNKNOWN pooltag '_STR', please update pooltag.txt TNbl 8 0 8 13520 0 0 0 0 TCP Send NetBufferLists , Binary: tcpip.sys IoEa 551 384 167 13360 0 0 0 0 Io extended attributes , Binary: nt!io Nbtl 132 50 82 13120 0 0 0 0 NetBT allocations HDAu 80 37 43 12992 53 40 13 3040 UNKNOWN pooltag 'HDAu', please update pooltag.txt WmiR 116 0 116 12992 0 0 0 0 Wmi Registration info blocks FIPc 12871 12756 115 12880 0 0 0 0 FileInfo FS-filter Prefetch Context , Binary: fileinfo.sys NDpp 6 0 6 12672 0 0 0 0 packet pool , Binary: ndis.sys MmSd 108 9 99 12672 0 0 0 0 extended subsections used to map data files , Binary: nt!mm vskg 2 0 2 12480 0 0 0 0 UNKNOWN pooltag 'vskg', please update pooltag.txt FlpM 3 0 3 12288 0 0 0 0 Framing Layer Multicast Groups , Binary: tcpip.sys I4nb 3 0 3 12288 0 0 0 0 IPv4 Neighbors , Binary: tcpip.sys SmBf 2 0 2 12288 0 0 0 0 SMB exchange buffer , Binary: mrxsmb.sys NDpf 8 0 8 11776 0 0 0 0 NDIS_TAG_FILTER , Binary: ndis.sys TpWo 57 5 52 11648 0 0 0 0 Threadpool worker factory objects , Binary: nt!ex DxgK 125 40 85 11600 493 345 148 180480 Vista display driver support , Binary: dxgkrnl.sys Nnnn 7 0 7 11472 0 0 0 0 NetIO NetBuffers And NetBufferLists , Binary: netio.sys Clfs 135 20 115 11152 179 151 28 266208 CLFS General buffer, or owner page lookaside list , Binary: clfs.sys LeGe 594 585 9 11024 0 0 0 0 Legacy Registry Mapping Module Buffers , Binary: tcpip.sys ObCi 216 106 110 10560 0 0 0 0 captured information for ObCreateObject , Binary: nt!ob TAPI 20 0 20 10464 1 1 0 0 ntos\ndis\ndistapi WfpI 54 8 46 10400 0 0 0 0 WFP index , Binary: netio.sys KSpp 586 510 76 10256 0 0 0 0 irp system buffer property/method/event parameter ReEv 215 4 211 10128 0 0 0 0 Resource Event TmRm 527 512 15 10080 0 0 0 0 Tm KRESOURCEMANAGER object , Binary: nt!tm IPpv 1 0 1 9872 0 0 0 0 UNKNOWN pooltag 'IPpv', please update pooltag.txt MuoC 5 0 5 9808 10 10 0 0 MOUSE_POOL_TAG Mouse Class Driver Nnbl 5 0 5 9808 0 0 0 0 NetIO NetBufferLists , Binary: netio.sys EtwQ 340 137 203 9744 0 0 0 0 Etw Queue , Binary: nt!etw NbL2 32 0 32 9728 0 0 0 0 NetBT lower connection , Binary: netbt.sys CcWk 593 443 150 9600 0 0 0 0 Kernel Cache Manager lookaside list , Binary: nt!cc Nnbf 5 0 5 9552 0 0 0 0 NetIO NetBuffers , Binary: netio.sys MmFl 118 90 28 9360 0 0 0 0 MDLs for large clusters for flushes , Binary: nt!mm UlPP 18 0 18 9216 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys NbtD 32 0 32 9216 0 0 0 0 NetBT connection , Binary: netbt.sys Ipas 250 95 155 8816 0 0 0 0 IP Buffers for Address Sort , Binary: tcpip.sys VfIT 142 6 136 8704 0 0 0 0 Verifier Import Address Table information , Binary: nt!Vf TSNb 1 0 1 8592 0 0 0 0 TCP Send NetBuffers , Binary: tcpip.sys UDNb 1 0 1 8592 0 0 0 0 UDP NetBuffers , Binary: tcpip.sys moni 22 1 21 8544 3 0 3 304 UNKNOWN pooltag 'moni', please update pooltag.txt Info 1392 1292 100 8512 0 0 0 0 general system information allocations NDpb 11 0 11 8336 0 0 0 0 protocol block , Binary: ndis.sys Pctw 1 0 1 8256 0 0 0 0 PACER Timer Wheels , Binary: pacer.sys InF0 2 0 2 8192 0 0 0 0 Inet Generic Fixed Size Block pool 0 , Binary: tcpip.sys TcCR 2 0 2 8192 0 0 0 0 TCP Connect Requests , Binary: tcpip.sys I4ai 2 0 2 8192 0 0 0 0 IPv4 Local Address Identifiers , Binary: tcpip.sys I6ai 2 0 2 8192 0 0 0 0 IPv6 Local Address Identifiers , Binary: tcpip.sys I6ua 2 0 2 8192 0 0 0 0 IPv6 Local Unicast Addresses , Binary: tcpip.sys I4ba 2 0 2 8192 0 0 0 0 IPv4 Local Broadcast Addresses , Binary: tcpip.sys I4ua 2 0 2 8192 0 0 0 0 IPv4 Local Unicast Addresses , Binary: tcpip.sys InF1 2 0 2 8192 0 0 0 0 Inet Generic Fixed Size Block pool 1 , Binary: tcpip.sys InF2 2 0 2 8192 0 0 0 0 Inet Generic Fixed Size Block pool 2 , Binary: tcpip.sys I6ma 2 0 2 8192 0 0 0 0 IPv6 Local Multicast Addresses , Binary: tcpip.sys Nph1 2 0 2 8192 0 0 0 0 NetIO Protocol Header1 Data , Binary: netio.sys Mmdl 2247 2241 6 8000 0 0 0 0 Mm Mdls for flushes , Binary: nt!mm whea 7 0 7 8000 0 0 0 0 UNKNOWN pooltag 'whea', please update pooltag.txt AzAd 32 0 32 7872 11 7 4 128 HD Audio Class Driver (AzPcAudDev) , Binary: HDAudio.sys FIcv 64 54 10 7840 0 0 0 0 FileInfo FS-filter Volume Context , Binary: fileinfo.sys AleP 15 0 15 7408 0 0 0 0 ALE process image path , Binary: tcpip.sys NtFW 124 53 71 7360 0 0 0 0 Write.c , Binary: ntfs.sys NMRb 64 9 55 7040 0 0 0 0 Network Module Registrar Bindings , Binary: tcpip.sys LScn 6 0 6 6912 0 0 0 0 SMB1 connection , Binary: srv.sys WmiG 29 11 18 6912 0 0 0 0 Allocation of WMIGUID VoSc 986 932 54 6800 0 0 0 0 Snapshot context allocations , Binary: volsnap.sys TmTm 7 0 7 6720 0 0 0 0 Tm KTRANSACTIONMANAGER object , Binary: nt!tm MmIn 20 2 18 6624 0 0 0 0 Mm inpaged io structures , Binary: nt!mm msis 17 0 17 6624 3 0 3 336 UNKNOWN pooltag 'msis', please update pooltag.txt NMRm 58 0 58 6496 0 0 0 0 Network Module Registrar Modules , Binary: tcpip.sys Ksec 6 0 6 6464 665 615 50 185152 Security device driver , Binary: ksecdd.sys IPif 6 0 6 6240 0 0 0 0 IP Interfaces , Binary: tcpip.sys VoSt 139 112 27 6048 0 0 0 0 Temp table allocations , Binary: volsnap.sys AcpS 277 158 119 5952 124 120 4 336 ACPI string data , Binary: acpi.sys Flng 34 20 14 5888 0 0 0 0 Framing Layer Generic Buffers (Tunnel/Port change notifications, ACLs) , Binary: tcpip.sys RaDf 40 0 40 5760 0 0 0 0 RaidInitializeDeferredQueue storport!_RAID_DEFERRED_QUEUE.FreeList , Binary: storport.sys RaME 2 0 2 5680 0 0 0 0 RiAllocateMiniportDeviceExtension , Binary: storport.sys NDfb 3 0 3 5520 0 0 0 0 NDIS_TAG_LWFILTER_BLOCK , Binary: ndis.sys Pcle 3 0 3 5472 0 0 0 0 PACER Lines , Binary: pacer.sys ScPC 2 0 2 5472 0 0 0 0 reset bus code NDwi 901 847 54 5376 0 0 0 0 NDIS_TAG_WORK_ITEM , Binary: ndis.sys ArbM 111 0 111 5328 339 339 0 0 ARBITER_MISC_TAG , Binary: nt!arb ClfE 18 0 18 5184 0 0 0 0 CLFS Log CCB lookaside list , Binary: clfs.sys IoCc 1786 1625 161 5152 0 0 0 0 Io completion context , Binary: nt!io MmDm 32 0 32 5120 0 0 0 0 deferred MmUnlock entries , Binary: nt!mm NDch 72 57 15 5040 0 0 0 0 NDIS_TAG_CONFIG_HANDLE , Binary: ndis.sys PcCr 43 29 14 5024 240 240 0 0 WDM audio stuff CcPc 160 116 44 4928 0 0 0 0 Cache Manager Private Cache Map , Binary: nt!cc AleD 20 8 12 4736 0 0 0 0 ALE remote endpoint , Binary: tcpip.sys Mmdi 15 3 12 4720 0 0 0 0 MDLs for physical memory allocations , Binary: nt!mm NDoa 7 0 7 4608 0 0 0 0 NDIS_TAG_OID_ARRAY , Binary: ndis.sys TcpL 17 1 16 4608 0 0 0 0 TCP Listeners , Binary: tcpip.sys NLcp 2 0 2 4512 0 0 0 0 Network Layer Compartments , Binary: tcpip.sys MmSe 1751 1659 92 4416 0 0 0 0 Mm secured VAD allocation , Binary: nt!mm Nb01 2 0 2 4400 0 0 0 0 NetBT hash table , Binary: netbt.sys NBSf 2 0 2 4336 0 0 0 0 FCB Etwp 2 0 2 4256 0 0 0 0 ETW per-processor block , Binary: nt!etw Ntft 65 57 8 4256 0 0 0 0 SCB (Prerestart) , Binary: ntfs.sys RxMs 1 0 1 4208 4 3 1 48 RDBSS miscellaneous , Binary: rdbss.sys HidC 37 12 25 4192 19 17 2 192 HID Class SMBH 1 0 1 4176 0 0 0 0 UNKNOWN pooltag 'SMBH', please update pooltag.txt CcBm 4 0 4 4160 0 0 0 0 Cache Manager Bitmap , Binary: nt!cc IPdc 2 0 2 4128 0 0 0 0 IP Destination Cache , Binary: tcpip.sys TdxT 12 0 12 4112 0 0 0 0 TDX Transport Provider Contexts , Binary: tdx.sys SmMm 1 0 1 4096 0 0 0 0 SMB mm allocated structures. , Binary: mrxsmb.sys RaTM 3 2 1 4096 0 0 0 0 RaInitializeTagList storport!_QUEUE_TAG_LIST.Buffer , Binary: storport.sys WanO 1 0 1 4096 0 0 0 0 NdisWan Tags (PPP Framing module for Remote Access) Nph2 1 0 1 4096 0 0 0 0 NetIO Protocol Header2 Data , Binary: netio.sys Plcl 1 0 1 4096 0 0 0 0 Cache aware pushlock entry. One per processor CcZe 1 0 1 4096 0 0 0 0 Cache Manager Buffer of Zeros , Binary: nt!cc I4ma 1 0 1 4096 0 0 0 0 IPv4 Local Multicast Addresses , Binary: tcpip.sys 8042 4 0 4 4048 12 12 0 0 PS/2 kb and mouse , Binary: i8042prt.sys Dlst 10295 10211 84 4032 0 0 0 0 UNKNOWN pooltag 'Dlst', please update pooltag.txt PX2. 1 0 1 4016 0 0 0 0 UNKNOWN pooltag ' PX2', please update pooltag.txt PXl. 1 0 1 4016 0 0 0 0 UNKNOWN pooltag ' PXl', please update pooltag.txt ClMl 7 0 7 3920 0 0 0 0 UNKNOWN pooltag 'ClMl', please update pooltag.txt RfsL 8 0 8 3888 6 0 6 23968 Bluetooth RFCOMM TDI driver PEAU 12 3 9 3856 194 43 151 19168 UNKNOWN pooltag 'PEAU', please update pooltag.txt Pcfc 3 0 3 3792 0 0 0 0 PACER Filter Contexts , Binary: pacer.sys FMct 226 208 18 3744 0 0 0 0 TRACK_COMPLETION_NODES structure , Binary: fltmgr.sys ClfB 8 0 8 3712 0 0 0 0 CLFS Log base file lookaside list , Binary: clfs.sys FMrr 347 318 29 3696 0 0 0 0 Per-processor Cache-aware rundown ref structure , Binary: fltmgr.sys TcpI 2 0 2 3680 0 0 0 0 TCP ISN buffers , Binary: tcpip.sys Afdl 166 65 101 3456 0 0 0 0 Afd lookaside lists buffer , Binary: afd.sys NtFI 21 0 21 3456 16742 14394 2348 424192 IndexSup.c , Binary: ntfs.sys Cngb 38 18 20 3392 4142 3227 915 129968 CNG kmode crypto pool tag , Binary: ksecdd.sys Psap 162 132 30 3360 0 0 0 0 Block used to hold a user mode APC while its queued to a thread , Binary: nt!ps Desk 10 0 10 3360 0 0 0 0 UNKNOWN pooltag 'Desk', please update pooltag.txt TdxA 7 3 4 3328 0 0 0 0 TDX Transport Addresses , Binary: tdx.sys TpWc 57 5 52 3328 0 0 0 0 Threadpool minipacket context , Binary: nt!ex FMfl 2 0 2 3296 0 0 0 0 FLT_FILTER structure , Binary: fltmgr.sys AcpF 5915 5875 40 3200 0 0 0 0 ACPI interface data , Binary: acpi.sys NeWQ 38 0 38 3040 0 0 0 0 NetIO WorkQueue Data , Binary: tcpip.sys SeSd 170 154 16 3008 262779 252299 10480 1865216 Security Descriptor , Binary: nt!se CcPT 22 16 6 2976 0 0 0 0 Prefetcher trace , Binary: nt!ccpf NpFn 60 9 51 2944 0 0 0 0 Name block , Binary: npfs.sys NpFt 1671 1589 82 2928 0 0 0 0 UNKNOWN pooltag 'NpFt', please update pooltag.txt NDan 31 4 27 2912 0 0 0 0 adapter name , Binary: ndis.sys Adap 7 0 7 2912 0 0 0 0 Adapter objects NSpc 43 7 36 2896 0 0 0 0 NSI Proxy Contexts , Binary: nsi.dll FSmg 9 0 9 2880 0 0 0 0 File System Run Time , Binary: nt!fsrtl NDco 14 7 7 2656 0 0 0 0 NDIS_TAG_CO , Binary: ndis.sys EtwS 33 6 27 2592 0 0 0 0 Etw DataSource , Binary: nt!etw KbdC 3 0 3 2576 10 10 0 0 Keyboard Class Driver MmSy 179 156 23 2576 0 0 0 0 Mm PTE and IO tracking logs , Binary: nt!mm MuFc 11 2 9 2560 0 0 0 0 File Context , Binary: mup.sys OlmI 4 0 4 2560 0 0 0 0 Offload Manager Interfaces , Binary: tcpip.sys LSwq 2 0 2 2528 0 0 0 0 SMB1 BlockTypeWorkQueue , Binary: srv.sys PcCi 1 0 1 2416 0 0 0 0 WDM audio port class adapter device object stuff FxDr 6 0 6 2400 0 0 0 0 KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable. , Binary: wdf01000.sys Sdba 74 56 18 2368 926 616 310 32768 Application compatibility Sdb* allocations IrbL 5 3 2 2336 0 0 0 0 UNKNOWN pooltag 'IrbL', please update pooltag.txt NMpc 11 0 11 2288 0 0 0 0 UNKNOWN pooltag 'NMpc', please update pooltag.txt AcpR 3 2 1 2256 183 176 7 1696 ACPI resource data , Binary: acpi.sys MmDT 19 14 5 2240 280 62 218 18448 Mm debug , Binary: nt!mm RtPb 31 29 2 2208 0 0 0 0 UNKNOWN pooltag 'RtPb', please update pooltag.txt IPsi 6 0 6 2208 0 0 0 0 IP SubInterfaces , Binary: tcpip.sys L2T1 1 0 1 2208 0 0 0 0 ndis\l2tp / MTAG_ADAPTERCB TDIk 5 0 5 2192 0 0 0 0 TDI resource ClMc 13 5 8 2176 0 0 0 0 UNKNOWN pooltag 'ClMc', please update pooltag.txt FLli 27 0 27 2160 0 0 0 0 per-file lock information NMhf 17 3 14 2128 0 0 0 0 Handle Factory pool , Binary: netio.sys Io.. 3 0 3 2096 0 0 0 0 UNKNOWN pooltag ' Io', please update pooltag.txt CCsw 2 0 2 2080 0 0 0 0 UNKNOWN pooltag 'CCsw', please update pooltag.txt PmPE 2 0 2 2080 0 0 0 0 Partition Manager partition entry , Binary: partmgr.sys HdCl 4 0 4 2080 23 22 1 128 HID Client Sample Driver AleL 4 0 4 2064 0 0 0 0 ALE LRU , Binary: tcpip.sys TcRL 1 0 1 2064 0 0 0 0 TCP Create And Connect Tcb Rate Limit Pool , Binary: tcpip.sys Job 5 1 4 2048 0 0 0 0 UNKNOWN pooltag 'Job ', please update pooltag.txt MmPa 64 0 64 2048 0 0 0 0 pagefile space deletion slist entries , Binary: nt!mm Nb16 7 0 7 2016 0 0 0 0 NetBT timer entry , Binary: netbt.sys NBqh 45 4 41 1968 0 0 0 0 Non-blocking queue entries used to carry the real data in the queue. Alep 14 0 14 1968 0 0 0 0 ALE process info , Binary: tcpip.sys Afd 31 0 31 1968 0 0 0 0 AFD objects , Binary: afd.sys TDIc 13 1 12 1920 0 0 0 0 TDI resource Ussy 55 26 29 1920 0 0 0 0 USERTAG_SYSTEM , Binary: win32k!xxxDesktopThread PsEx 67 51 16 1792 0 0 0 0 Process exit APC , Binary: nt!ps WanJ 3 0 3 1776 0 0 0 0 LineUpInfo Call 12 0 12 1728 0 0 0 0 kernel callback object signature , Binary: nt!ex AcpM 10081 10069 12 1728 7 5 2 176 ACPI miscellaneous data , Binary: acpi.sys NMpt 24 4 20 1648 0 0 0 0 Generic AVL Tree allocations Wind 6 0 6 1632 0 0 0 0 UNKNOWN pooltag 'Wind', please update pooltag.txt InNl 6 0 6 1632 0 0 0 0 UNKNOWN pooltag 'InNl', please update pooltag.txt HidP 22 16 6 1632 0 0 0 0 HID Parser KSoh 43 33 10 1600 0 0 0 0 object header Ntff 6 1 5 1600 3921 272 3649 4437184 FCB_DATA , Binary: ntfs.sys Itht 9 0 9 1584 0 0 0 0 IPsec hashtable , Binary: tcpip.sys RpcM 38 24 14 1568 651 325 326 188688 all msrpc.sys allocations not covered elsewhere , Binary: msrpc.sys Txfp 1 0 1 1536 0 0 0 0 UNKNOWN pooltag 'Txfp', please update pooltag.txt AmlT 1974 1950 24 1536 0 0 0 0 ACPI AMLI Pooltags Nb05 6 1 5 1520 0 0 0 0 NetBT client element , Binary: netbt.sys LS2q 3 0 3 1488 0 0 0 0 SMB2 queue , Binary: srv2.sys InAD 72 41 31 1488 0 0 0 0 Inet Ancillary Data , Binary: tcpip.sys MntA 10 7 3 1424 2563 2209 354 19856 UNKNOWN pooltag 'MntA', please update pooltag.txt KSee 8 0 8 1408 0 0 0 0 event entry Prcr 8 0 8 1408 31 27 4 272 Processr driver allocations , Binary: processr.sys WfpL 40 30 10 1376 0 0 0 0 WFP fast cache , Binary: netio.sys FMfr 2 1 1 1360 0 0 0 0 FLT_FRAME structure , Binary: fltmgr.sys Tdxo 4 0 4 1344 0 0 0 0 TDX Device Objects , Binary: tdx.sys NDof 7 3 4 1312 0 0 0 0 NDIS_TAG_OFFLOAD , Binary: ndis.sys Afdh 53 35 18 1312 0 0 0 0 Afd address list change buffer , Binary: afd.sys FMcr 2 0 2 1312 0 0 0 0 Context registration structures , Binary: fltmgr.sys ScLF 173 153 20 1280 0 0 0 0 File Object Extension , Binary: classpnp.sys LS2e 3 0 3 1280 0 0 0 0 SMB2 endpoint , Binary: srv2.sys NLcc 13 0 13 1248 0 0 0 0 Network Layer Client Contexts , Binary: tcpip.sys VoSh 73 47 26 1248 0 0 0 0 Bit history allocations , Binary: volsnap.sys ClfD 2 0 2 1248 0 0 0 0 CLFS Log virtual FCB lookaside list , Binary: clfs.sys ClfG 4 0 4 1216 0 0 0 0 CLFS Log I/O Request lookaside list , Binary: clfs.sys MmWe 4 0 4 1216 0 0 0 0 Work entries for writing out modified filesystem pages. , Binary: nt!mm FMfn 7 3 4 1216 19582 13231 6351 3031952 NAME_CACHE_NODE structure , Binary: fltmgr.sys Ipng 230 225 5 1200 0 0 0 0 IP Generic buffers (Address, Interface, Packetize, Route allocations) , Binary: tcpip.sys Afdr 3 0 3 1184 0 0 0 0 Afd ERESOURCE buffer , Binary: afd.sys ScCI 108 99 9 1152 0 0 0 0 Sense info buffers , Binary: cdrom.sys NtfI 729 711 18 1152 0 0 0 0 IO_CONTEXT , Binary: ntfs.sys AcdN 2 0 2 1120 0 0 0 0 TDI AcdObjectInfoG DOPE 7 0 7 1120 0 0 0 0 Device Object Power Extension (po component) AzCm 6 0 6 1104 162 162 0 0 HD Audio Class Driver (AzCommon) , Binary: HDAudio.sys Nb07 2 0 2 1088 0 0 0 0 NetBT datagram request tracker , Binary: netbt.sys NMRn 11 0 11 1056 0 0 0 0 Network Module Registrar Network Protocol Identifiers , Binary: tcpip.sys NDst 34 28 6 1056 0 0 0 0 NDIS_TAG_STRING , Binary: ndis.sys TcRD 1 0 1 1040 0 0 0 0 TCP Receive DPC Data , Binary: tcpip.sys ScCP 22 14 8 1024 0 0 0 0 ClassPnP misc allocations , Binary: classpnp.sys Mdp 2 0 2 1024 0 0 0 0 Memory Descriptor Lists , Binary: netio.sys FMng 9 5 4 1024 0 0 0 0 NAME_GENERATION_CONTEXT structure , Binary: fltmgr.sys CBRe 18 2 16 1024 0 0 0 0 CallbackRegistration LBxp 1 0 1 1024 0 0 0 0 Transport TDId 13 1 12 1024 0 0 0 0 TDI resource ClfN 9 1 8 1024 0 0 0 0 CLFS Log base file lock , Binary: clfs.sys TDIe 8 2 6 1024 0 0 0 0 TDI resource TDIf 7 0 7 1008 0 0 0 0 TDI resource TDIa 43 36 7 1008 0 0 0 0 UNKNOWN pooltag 'TDIa', please update pooltag.txt SpWi 5 1 4 960 0 0 0 0 UNKNOWN pooltag 'SpWi', please update pooltag.txt PcPr 97 87 10 960 0 0 0 0 WDM audio stuff Luaf 1 0 1 960 2687 13 2674 662672 LUA File Virtualization , Binary: luafv.sys NDrd 151 142 9 944 0 0 0 0 NDIS_TAG_REG_READ_DATA_BUFFER , Binary: ndis.sys VdPN 4 1 3 928 5284 4133 1151 131024 Video display mode management , Binary: dxgkrnl.sys HGCC 10 6 4 928 0 0 0 0 UNKNOWN pooltag 'HGCC', please update pooltag.txt ScCS 107 99 8 896 0 0 0 0 Srb allocation , Binary: cdrom.sys Ala6 15 2 13 896 0 0 0 0 ALE remote endpoint IPv6 address , Binary: tcpip.sys Ala4 33 20 13 896 0 0 0 0 ALE remote endpoint IPv4 address , Binary: tcpip.sys UlTP 1 0 1 896 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys PPMp 2 0 2 864 0 0 0 0 Kernel Processor Power Management Perf States. , Binary: nt!po Usla 6 0 6 864 0 0 0 0 USERTAG_LOOKASIDE , Binary: win32k!InitLockRecordLookaside PcSl 1 0 1 816 0 0 0 0 WDM audio stuff NDwh 5 0 5 816 0 0 0 0 NDIS_TAG_WRAPPER_HANDLE , Binary: ndis.sys TDIu 8 2 6 784 0 0 0 0 TDI resource vsks 4 2 2 784 0 0 0 0 UNKNOWN pooltag 'vsks', please update pooltag.txt PsQt 1 0 1 784 0 0 0 0 UNKNOWN pooltag 'PsQt', please update pooltag.txt UlTT 6 0 6 768 0 0 0 0 Thread Tracker , Binary: http.sys NbtC 5 1 4 768 0 0 0 0 NetBT address element , Binary: netbt.sys KSed 8 0 8 768 0 0 0 0 event dpc item FLpc 8 0 8 768 0 0 0 0 UNKNOWN pooltag 'FLpc', please update pooltag.txt User 6 0 6 768 0 0 0 0 USERTAG_ERESOURCE , Binary: win32k!InitCreateUserCrit Nbt0 5 1 4 768 0 0 0 0 NetBT name address , Binary: netbt.sys PX3. 1 0 1 752 0 0 0 0 UNKNOWN pooltag ' PX3', please update pooltag.txt PTPa 1 0 1 752 0 0 0 0 UNKNOWN pooltag 'PTPa', please update pooltag.txt PsFn 68 62 6 736 0 0 0 0 Captured image file name buffer (temporary allocation) , Binary: nt!ps WSKs 2 0 2 720 0 0 0 0 WSK socket , Binary: afd.sys AcpO 5 0 5 720 0 0 0 0 ACPI object data , Binary: acpi.sys Dprt 9 0 9 720 61 52 9 1376 Video port for Vista display drivers , Binary: dxgkrnl.sys aEoP 1 0 1 720 0 0 0 0 UNKNOWN pooltag 'aEoP', please update pooltag.txt IoCx 1 0 1 720 0 0 0 0 UNKNOWN pooltag 'IoCx', please update pooltag.txt WanN 1 0 1 704 0 0 0 0 NdisPacketPool Desc IoTi 11 0 11 704 0 0 0 0 Io timers , Binary: nt!io TmTx 517 516 1 688 0 0 0 0 Tm KTRANSACTION object , Binary: nt!tm TSic 6 0 6 688 0 0 0 0 Terminal Services - ICA_POOL_TAG , Binary: termdd.sys PXb. 1 0 1 688 0 0 0 0 UNKNOWN pooltag ' PXb', please update pooltag.txt LS2h 3 0 3 672 3 0 3 1424 SMB2 share , Binary: srv2.sys Dict 2 0 2 672 0 0 0 0 StorCreateDictionary storport!_STOR_DICTIONARY.Entries , Binary: storport.sys NDfv 1 0 1 656 0 0 0 0 NDIS_TAG_LWFILTER_DRIVER , Binary: ndis.sys AcpP 330 326 4 640 0 0 0 0 ACPI power data , Binary: acpi.sys FstB 10 9 1 640 0 0 0 0 ntos\fstub ScB4 4 0 4 640 0 0 0 0 Storage descriptor header , Binary: classpnp.sys NDfm 3 0 3 624 0 0 0 0 NDIS_TAG_FAKE_MAC , Binary: ndis.sys ScLq 2 0 2 608 0 0 0 0 Release queue , Binary: classpnp.sys AfdR 3 0 3 608 0 0 0 0 Afd remote address buffer , Binary: afd.sys FMla 3 2 1 592 0 0 0 0 Per-processor IRPCTRL lookaside lists , Binary: fltmgr.sys Mmpv 20 14 6 576 0 0 0 0 Physical view VAD info , Binary: nt!mm DfCg 2 0 2 576 0 0 0 0 DFS Client PREFIXCACHE , Binary: dfsc.sys AmlI 2 0 2 576 1 1 0 0 ACPI AMLI Pooltags Pnp8 63 59 4 576 0 0 0 0 PNPMGR async target device change notify , Binary: nt!pnp CcWK 4 0 4 576 0 0 0 0 Kernel Cache Manager lookaside list , Binary: nt!cc NDpn 77 67 10 560 0 0 0 0 NDIS_TAG_PARAMETER_NODE , Binary: ndis.sys Uspo 11 4 7 560 0 0 0 0 USERTAG_POWER , Binary: win32k!QueuePowerRequest PnpB 5 3 2 560 0 0 0 0 UNKNOWN pooltag 'PnpB', please update pooltag.txt Vpb 5 0 5 560 0 0 0 0 Io, vpb's EtwC 11 6 5 560 0 0 0 0 Etw Realtime Consumer , Binary: nt!etw Mmlk 375 362 13 544 0 0 0 0 ProbeAndLock MDL tracker , Binary: nt!mm AzWp 2 0 2 544 0 0 0 0 HD Audio Class Driver (AzWaveport, HdaWaveRTminiport) , Binary: HDAudio.sys MmCp 15 14 1 544 0 0 0 0 Colored page counts for physical memory allocations , Binary: nt!mm Ra12 4 2 2 544 0 0 0 0 RaidBusEnumeratorAllocateUnitResources storport!_BUS_ENUM_RESOURCES.DataBuffer , Binary: storport.sys Fwpp 10 3 7 544 4 1 3 10944 Windows Filtering Platform export driver. , Binary: fwpkclnt.sys TTsp 1 0 1 528 0 0 0 0 TCP TCB Sends , Binary: tcpip.sys PmMA 7 6 1 528 0 0 0 0 UNKNOWN pooltag 'PmMA', please update pooltag.txt TdxM 1 0 1 528 0 0 0 0 TDX Message Indication Buffers , Binary: tdx.sys IoSh 79 68 11 528 0 0 0 0 Io shutdown packet , Binary: nt!io SMB2 2 1 1 528 0 0 0 0 UNKNOWN pooltag 'SMB2', please update pooltag.txt SmTp 10 5 5 528 0 0 0 0 SMB transport , Binary: mrxsmb.sys AlSe 11 0 11 528 16572 15925 647 103520 ALPC client security , Binary: nt!alpc StCc 1 0 1 512 0 0 0 0 WFP stream inspection call context , Binary: netio.sys TcRH 1 0 1 512 0 0 0 0 TCP Reassembly Headers , Binary: tcpip.sys AlSP 1 0 1 512 0 0 0 0 ALE secure socket policy , Binary: tcpip.sys AleU 1 0 1 512 0 0 0 0 ALE pend context , Binary: tcpip.sys TcpB 1 0 1 512 0 0 0 0 TCP Offload Blocks , Binary: tcpip.sys TcST 1 0 1 512 0 0 0 0 TCP Syn TCBs , Binary: tcpip.sys Ithk 9 0 9 512 0 0 0 0 UNKNOWN pooltag 'Ithk', please update pooltag.txt AlCi 1 0 1 512 0 0 0 0 ALE credential info , Binary: tcpip.sys AlP6 1 0 1 512 0 0 0 0 ALE peer IPv6 address , Binary: tcpip.sys NtfT 9 5 4 512 0 0 0 0 SCB_SNAPSHOT , Binary: ntfs.sys StDa 1 0 1 512 0 0 0 0 WFP stream inspection data , Binary: netio.sys AlP4 1 0 1 512 0 0 0 0 ALE peer IPv4 address , Binary: tcpip.sys FlpC 8 0 8 512 0 0 0 0 Framing Layer Client Contexts , Binary: tcpip.sys AlLl 1 0 1 512 0 0 0 0 ALE remote endpoint LRU , Binary: tcpip.sys AlPi 1 0 1 512 0 0 0 0 ALE peer info , Binary: tcpip.sys AlPU 1 0 1 512 0 0 0 0 ALE secure socket policy update , Binary: tcpip.sys KsoO 38 28 10 480 0 0 0 0 WDM audio stuff InTl 6 0 6 480 0 0 0 0 UNKNOWN pooltag 'InTl', please update pooltag.txt NAcc 6 0 6 480 0 0 0 0 UNKNOWN pooltag 'NAcc', please update pooltag.txt FlmC 3 0 3 480 0 0 0 0 Framing Layer Client Contexts , Binary: tcpip.sys AzFg 3 1 2 480 0 0 0 0 HD Audio Class Driver (Audio Function Group) , Binary: HDAudio.sys FxLa 6 0 6 480 0 0 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys SeCL 3 0 3 480 0 0 0 0 Security CONTEXT_TAG , Binary: nt!se Tdxn 8 3 5 464 0 0 0 0 TDX Net Addresses , Binary: tdx.sys WanM 5 0 5 464 0 0 0 0 Connection Table waR 62 58 4 448 0 0 0 0 UNKNOWN pooltag ' waR', please update pooltag.txt aFDC 4 0 4 448 0 0 0 0 UNKNOWN pooltag 'aFDC', please update pooltag.txt ScCF 1 0 1 448 0 0 0 0 Feature descriptor , Binary: cdrom.sys Txts 2 0 2 448 0 0 0 0 UNKNOWN pooltag 'Txts', please update pooltag.txt FMwi 19 15 4 448 0 0 0 0 Work item structures , Binary: fltmgr.sys NLmc 2 0 2 448 0 0 0 0 UNKNOWN pooltag 'NLmc', please update pooltag.txt Vm 1 0 1 432 1 0 1 80 General allocations , Binary: volmgrx.sys TcPt 1 0 1 432 0 0 0 0 TCP Partitions , Binary: tcpip.sys Batt 1 0 1 432 1 0 1 288 Battery class driver Ntnu 2 0 2 432 2 0 2 208 UNKNOWN pooltag 'Ntnu', please update pooltag.txt TmNR 2 0 2 416 0 0 0 0 UNKNOWN pooltag 'TmNR', please update pooltag.txt RaHI 2 0 2 416 0 0 0 0 RaSaveDriverInitData storport!_HW_INITIALIZATION_DATA , Binary: storport.sys EcEn 1 0 1 416 0 0 0 0 UNKNOWN pooltag 'EcEn', please update pooltag.txt Ke 5 3 2 416 1 0 1 4096 Kernel data structures AzJd 7 0 7 400 0 0 0 0 HD Audio Class Driver (JackDetector) , Binary: HDAudio.sys FSfm 5 0 5 400 0 0 0 0 File System Run Time Fast Mutex Lookaside List , Binary: nt!fsrtl KSdh 2 1 1 400 0 0 0 0 device header QoSc 5 0 5 400 0 0 0 0 UNKNOWN pooltag 'QoSc', please update pooltag.txt ClfF 2 0 2 384 0 0 0 0 CLFS Log flush element lookaside list , Binary: clfs.sys PPMi 6 2 4 384 0 0 0 0 Kernel Processor Power Management Idle States. , Binary: nt!po Nbtw 2 0 2 384 0 0 0 0 NetBT device linkage names , Binary: netbt.sys PnpL 318 310 8 384 0 0 0 0 PNPMGR device event workitem , Binary: nt!pnp TWTa 2 0 2 384 0 0 0 0 Echo Request Timer Table , Binary: tcpip.sys Ntfc 10 7 3 384 564 321 243 31104 CCB_DATA , Binary: ntfs.sys FxLc 6 0 6 384 0 0 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys ScLM 2 0 2 384 0 0 0 0 Media Change Detection , Binary: classpnp.sys ItoM 2 0 2 384 0 0 0 0 IPsec task offload interface , Binary: tcpip.sys PXd. 1 0 1 384 0 0 0 0 UNKNOWN pooltag ' PXd', please update pooltag.txt WanI 2 0 2 384 0 0 0 0 IoPacket ClfP 12 0 12 384 0 0 0 0 CLFS Log request state , Binary: clfs.sys NDpc 22 21 1 368 0 0 0 0 NDIS_TAG_PROTOCOL_CONFIGURATION , Binary: ndis.sys SWfd 1 0 1 368 0 0 0 0 POOLTAG_DEVICE_FDOEXTENSION LS2b 3 0 3 352 0 0 0 0 SMB2 buffer , Binary: srv2.sys RaRL 2 0 2 352 0 0 0 0 RaidInitializeResourceList storport!_RAID_RESOURCE_LIST , Binary: storport.sys Npfs 1 0 1 352 0 0 0 0 Npfs Allocations , Binary: npfs.sys UMB. 7 2 5 352 0 0 0 0 UNKNOWN pooltag ' UMB', please update pooltag.txt NDar 1 0 1 336 0 0 0 0 NDIS_TAG_ALLOCATED_RESOURCES , Binary: ndis.sys VoSf 1 0 1 336 0 0 0 0 Diff area file allocations , Binary: volsnap.sys Wrps 5 1 4 336 0 0 0 0 WAN_STRING_TAG PlWl 2 0 2 320 1 0 1 80 UNKNOWN pooltag 'PlWl', please update pooltag.txt Gfsm 4 0 4 320 0 0 0 0 Gdi Fast mutex cmut 4 0 4 320 0 0 0 0 UNKNOWN pooltag 'cmut', please update pooltag.txt Tdxc 12 8 4 320 0 0 0 0 TDX Control Channels , Binary: tdx.sys VoSl 2 0 2 320 0 0 0 0 VolSnap (Volume Snapshot Driver) , Binary: volsnap.sys AzMx 2 0 2 320 0 0 0 0 HD Audio Class Driver (AzMixerport) , Binary: HDAudio.sys NDdb 2 0 2 320 0 0 0 0 DMA block , Binary: ndis.sys MmHi 6 2 4 320 0 0 0 0 Mm image entry - allocated per session , Binary: nt!mm IoEr 16 15 1 304 0 0 0 0 Io error log packets , Binary: nt!io PsQb 18 17 1 304 0 0 0 0 Process quota block , Binary: nt!ps TDIg 7 0 7 288 0 0 0 0 TDI resource RaDS 2 0 2 288 2 0 2 128 StorCreateAnsiString storport!_STRING.Buffer , Binary: storport.sys Gla: 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_LFONT_TYPE , Binary: win32k.sys MsFD 1 0 1 288 1 0 1 32 Mailslot root DCB and its name buffer aFDT 3 0 3 288 0 0 0 0 UNKNOWN pooltag 'aFDT', please update pooltag.txt PcIc 35 26 9 288 0 0 0 0 WDM audio stuff Gla@ 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_BRUSH_TYPE , Binary: win32k.sys WanF 1 0 1 288 0 0 0 0 NdisWan Tags (PPP Framing module for Remote Access) ObNM 2 0 2 288 0 0 0 0 name buffer per processor lookaside pointers , Binary: nt!ob Gla8 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_PAL_TYPE , Binary: win32k.sys TcpN 2 0 2 288 0 0 0 0 TCP Name Service Interfaces , Binary: tcpip.sys Gla1 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_DC_TYPE , Binary: win32k.sys Gla; 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_RFONT_TYPE , Binary: win32k.sys Gla5 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_SURF_TYPE , Binary: win32k.sys ObCI 2 0 2 288 0 0 0 0 object creation lookaside list , Binary: nt!ob MsFf 1 0 1 288 0 0 0 0 Mailslot FCB, File control block, Service side block for each created mailslot. ExIC 2 0 2 288 0 0 0 0 UNKNOWN pooltag 'ExIC', please update pooltag.txt Gla4 2 0 2 288 0 0 0 0 GDITAG_HMGR_LOOKASIDE_RGN_TYPE , Binary: win32k.sys NbtX 63 60 3 288 0 0 0 0 NetBT datagram , Binary: netbt.sys PTCD 1 0 1 272 0 0 0 0 UNKNOWN pooltag 'PTCD', please update pooltag.txt Plcp 1 0 1 272 0 0 0 0 Cache aware pushlock list (array of puchlock addresses) TcDQ 1 0 1 272 0 0 0 0 TCP Delay Queues , Binary: tcpip.sys AzSt 3 2 1 272 0 0 0 0 HD Audio Class Driver (AzWaveCyclicStream, HdaWaveRTstream) , Binary: HDAudio.sys RawE 2 1 1 272 0 0 0 0 Raw Socket Endpoints , Binary: tcpip.sys pukm 4 0 4 256 0 0 0 0 UNKNOWN pooltag 'pukm', please update pooltag.txt TcCC 1 0 1 256 0 0 0 0 TCP Create And Connect Tcb Pool , Binary: tcpip.sys ClfK 2 0 2 256 0 0 0 0 CLFS Log read completion element , Binary: clfs.sys Sess 2 0 2 256 0 0 0 0 UNKNOWN pooltag 'Sess', please update pooltag.txt DfCB 2 0 2 256 0 0 0 0 DFS Client allocations , Binary: dfsc.sys Pium 2 0 2 256 0 0 0 0 UNKNOWN pooltag 'Pium', please update pooltag.txt TuPI 1 0 1 256 0 0 0 0 UNKNOWN pooltag 'TuPI', please update pooltag.txt SeSi 8 0 8 256 36133 35369 764 26976 Security SID , Binary: nt!se KeSc 4 0 4 256 0 0 0 0 UNKNOWN pooltag 'KeSc', please update pooltag.txt SMBc 1 0 1 256 0 0 0 0 UNKNOWN pooltag 'SMBc', please update pooltag.txt Mmpr 3 0 3 240 0 0 0 0 Mm physical VAD roots , Binary: nt!mm Drmk 3 0 3 240 18 15 3 192 UNKNOWN pooltag 'Drmk', please update pooltag.txt Acpi 1 0 1 240 0 0 0 0 ACPI generic data , Binary: acpi.sys HGFI 1 0 1 240 0 0 0 0 UNKNOWN pooltag 'HGFI', please update pooltag.txt VM 1 0 1 240 17 14 3 400 General allocations , Binary: volmgr.sys FMfi 1 0 1 240 0 0 0 0 Fast IO dispatch table , Binary: fltmgr.sys Scs$ 2 0 2 224 0 0 0 0 Tag for pnp class driver's SRB lookaside list UlXB 2 0 2 224 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys PXh. 1 0 1 224 0 0 0 0 UNKNOWN pooltag ' PXh', please update pooltag.txt MmDb 1 0 1 224 0 0 0 0 NtMapViewOfSection service , Binary: nt!mm LBtn 2 0 2 224 0 0 0 0 Transport name DfCC 1 0 1 224 0 0 0 0 DFS Client allocations , Binary: dfsc.sys RaCD 2 1 1 224 0 0 0 0 RaUnitScsiGetDumpPointersIoctl , Binary: storport.sys TSrp 2 0 2 224 0 0 0 0 Terminal Services - RP_ALLOC_TAG , Binary: termdd.sys RxCt 2 0 2 208 4 0 4 224 RXCE transport , Binary: mrxsmb.sys UlWI 1 0 1 208 0 0 0 0 Work Item , Binary: http.sys LBdi 1 0 1 208 0 0 0 0 POOL_DOMAIN_INFO TdxB 60 57 3 192 0 0 0 0 TDX Transport Layer Buffers , Binary: tdx.sys KScp 3 2 1 192 0 0 0 0 object creation parameters auxiliary copy PsDp 2 0 2 192 0 0 0 0 UNKNOWN pooltag 'PsDp', please update pooltag.txt Vprt 432 430 2 192 602 589 13 1680 Video port for legacy (pre-Vista) display drivers , Binary: videoprt.sys TDIv 8 2 6 192 0 0 0 0 TDI resource KCNw 3 1 2 192 0 0 0 0 UNKNOWN pooltag 'KCNw', please update pooltag.txt Nb22 165 163 2 192 0 0 0 0 NetBT work item context , Binary: netbt.sys Wnln 3 0 3 192 0 0 0 0 UNKNOWN pooltag 'Wnln', please update pooltag.txt InNP 3 0 3 192 0 0 0 0 Inet Nsi Providers , Binary: tcpip.sys LfsS 1 0 1 192 1 0 1 464 UNKNOWN pooltag 'LfsS', please update pooltag.txt PmVE 1 0 1 192 0 0 0 0 Partition Manager volume entry , Binary: partmgr.sys PX9. 1 0 1 192 0 0 0 0 UNKNOWN pooltag ' PX9', please update pooltag.txt UlNP 1 0 1 192 0 0 0 0 Non-Paged Data , Binary: http.sys Dcdd 3 0 3 176 0 0 0 0 Canonical display driver , Binary: cdd.dll vmmp 15 12 3 176 0 0 0 0 UNKNOWN pooltag 'vmmp', please update pooltag.txt CPrh 1 0 1 176 0 0 0 0 UNKNOWN pooltag 'CPrh', please update pooltag.txt WSKL 1 0 1 176 0 0 0 0 UNKNOWN pooltag 'WSKL', please update pooltag.txt PcEr 24 22 2 160 0 0 0 0 UNKNOWN pooltag 'PcEr', please update pooltag.txt Uspp 2 0 2 160 0 0 0 0 USERTAG_PNP , Binary: win32k!AllocateAndLinkHidTLCInf NbtO 1 0 1 160 0 0 0 0 NetBT adapter status , Binary: netbt.sys Mup 1 0 1 160 13 13 0 0 Multiple UNC provider allocations, generic , Binary: mup.sys PnpJ 1 0 1 160 0 0 0 0 PNPMGR device event list , Binary: nt!pnp RawN 2 0 2 160 0 0 0 0 Raw Socket Nsi , Binary: tcpip.sys Flop 9 7 2 160 64 59 5 176 floppy driver mEoP 1 0 1 160 0 0 0 0 UNKNOWN pooltag 'mEoP', please update pooltag.txt NDcs 14 9 5 160 4 4 0 0 NDIS_TAG_NET_CFG_OPS_ID , Binary: ndis.sys HGXP 2 1 1 160 0 0 0 0 UNKNOWN pooltag 'HGXP', please update pooltag.txt MuIc 53 52 1 160 0 0 0 0 IRP Context , Binary: mup.sys AcpA 4 2 2 160 0 0 0 0 ACPI arbiter data , Binary: acpi.sys UdpN 2 0 2 160 0 0 0 0 UDP Name Service Interfaces , Binary: tcpip.sys FxL7 1 0 1 160 0 0 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys FMpr 3 2 1 144 0 0 0 0 FLT_PRCB structure , Binary: fltmgr.sys HGNM 3 0 3 144 0 0 0 0 UNKNOWN pooltag 'HGNM', please update pooltag.txt WRKR 3 0 3 144 0 0 0 0 UNKNOWN pooltag 'WRKR', please update pooltag.txt NBSn 2 1 1 144 0 0 0 0 copy of user NCB LBwi 53 50 3 144 0 0 0 0 Work item SMBI 6 5 1 144 0 0 0 0 UNKNOWN pooltag 'SMBI', please update pooltag.txt ClMC 1 0 1 144 0 0 0 0 UNKNOWN pooltag 'ClMC', please update pooltag.txt MmNo 3 0 3 144 0 0 0 0 Inernal physical memory nodes , Binary: nt!mm VoSa 1 0 1 144 0 0 0 0 Application information allocations , Binary: volsnap.sys Nb39 2 1 1 144 0 0 0 0 NetBT file objects , Binary: netbt.sys TcpM 1 0 1 144 0 0 0 0 TCP Offload Miscellaneous buffers , Binary: tcpip.sys CcWq 3 0 3 144 0 0 0 0 Cache Manager Work Queue Item , Binary: nt!cc Wrpc 1 0 1 144 0 0 0 0 WAN_CONN_TAG MmMl 8 6 2 144 0 0 0 0 physical memory range information , Binary: nt!mm ArbN 2 0 2 128 0 0 0 0 UNKNOWN pooltag 'ArbN', please update pooltag.txt IPmf 2 0 2 128 0 0 0 0 IP Multicast Forwarding Entry pool , Binary: tcpip.sys PoIr 1 0 1 128 0 0 0 0 UNKNOWN pooltag 'PoIr', please update pooltag.txt ScC7 15 14 1 128 0 0 0 0 Sense info buffer , Binary: classpnp.sys PXg. 1 0 1 128 0 0 0 0 UNKNOWN pooltag ' PXg', please update pooltag.txt AmlR 2 0 2 128 0 0 0 0 ACPI AMLI Pooltags ScDs 1 0 1 128 0 0 0 0 start device paths WanS 1 0 1 128 0 0 0 0 AfCB/SapCB/VcCB ParP 3 0 3 128 16 10 6 352 Parallel port driver Nb17 2 1 1 128 0 0 0 0 NetBT registry path , Binary: netbt.sys SslC 1 0 1 128 0 0 0 0 SSL kernel mode client allocations , Binary: ksecdd.sys LS2p 2 0 2 128 0 0 0 0 SMB2 provider , Binary: srv2.sys TQoS 2 0 2 128 0 0 0 0 TL QoS Client Data , Binary: tcpip.sys Cdic 1 0 1 128 0 0 0 0 CDFS Irp Context , Binary: cdfs.sys Pcge 3 2 1 128 1 1 0 0 PACER Generic Buffers (DACL, SID allocations) , Binary: pacer.sys L2Ti 5 3 2 128 0 0 0 0 ndis\l2tp / MTAG_UTIL Sc?? 1 0 1 128 0 0 0 0 Mass storage driver tags Psta 6 2 4 128 0 0 0 0 Power management system state , Binary: nt!ps PcDf 3 2 1 128 0 0 0 0 UNKNOWN pooltag 'PcDf', please update pooltag.txt CcVm 2 0 2 128 0 0 0 0 UNKNOWN pooltag 'CcVm', please update pooltag.txt PcEi 2 0 2 128 0 0 0 0 UNKNOWN pooltag 'PcEi', please update pooltag.txt RxCa 2 0 2 128 0 0 0 0 RXCE address , Binary: mrxsmb.sys VoSs 26 25 1 112 7 6 1 144 Short term allocations , Binary: volsnap.sys WfpM 1 0 1 112 0 0 0 0 WFP filter match buffers , Binary: netio.sys PX5. 1 0 1 112 0 0 0 0 UNKNOWN pooltag ' PX5', please update pooltag.txt NtfV 1 0 1 112 0 0 0 0 VPB , Binary: ntfs.sys FLex 1 0 1 96 0 0 0 0 exclusive file lock FSrN 1 0 1 96 51 3 48 7680 File System Run Time , Binary: nt!fsrtl AzCd 1 0 1 96 0 0 0 0 HD Audio Class Driver (CodecVendor) , Binary: HDAudio.sys TcCM 1 0 1 96 0 0 0 0 TCP Congestion Control Manager Contexts , Binary: tcpip.sys PcDe 1 0 1 96 0 0 0 0 UNKNOWN pooltag 'PcDe', please update pooltag.txt MwoW 3 0 3 96 0 0 0 0 UNKNOWN pooltag 'MwoW', please update pooltag.txt UxSC 1 0 1 96 0 0 0 0 UNKNOWN pooltag 'UxSC', please update pooltag.txt UxSH 1 0 1 96 0 0 0 0 UNKNOWN pooltag 'UxSH', please update pooltag.txt gEoP 1 0 1 96 0 0 0 0 UNKNOWN pooltag 'gEoP', please update pooltag.txt PcEt 2 0 2 96 0 0 0 0 UNKNOWN pooltag 'PcEt', please update pooltag.txt idle 2 0 2 96 0 0 0 0 Power Manager idle handler RxTl 1 0 1 96 0 0 0 0 RDBSS toplevel IRP , Binary: rdbss.sys Nbta 1 0 1 80 0 0 0 0 NetBT DPC , Binary: netbt.sys RMcc 1 0 1 80 0 0 0 0 UNKNOWN pooltag 'RMcc', please update pooltag.txt FLln 1 0 1 80 0 0 0 0 shared lock tree node Txfl 2 1 1 80 6 2 4 384 TXF_FCB_CLEANUP , Binary: ntfs.sys RaDR 4 2 2 80 8 8 0 0 RaidpBuildAdapterBusRelations storport!_DEVICE_RELATIONS , Binary: storport.sys Txfm 8 7 1 80 0 0 0 0 UNKNOWN pooltag 'Txfm', please update pooltag.txt FLsh 1 0 1 80 0 0 0 0 shared file lock NDoc 691 689 2 64 0 0 0 0 NDIS_TAG_OPEN_CONTEXT , Binary: ndis.sys TuPi 1 0 1 64 0 0 0 0 UNKNOWN pooltag 'TuPi', please update pooltag.txt VoSi 1 0 1 64 0 0 0 0 Io status block allocations , Binary: volsnap.sys CcOb 1 0 1 64 0 0 0 0 Cache Manager Overlap Bcb , Binary: nt!cc PTWI 1 0 1 64 0 0 0 0 UNKNOWN pooltag 'PTWI', please update pooltag.txt RaPD 1 0 1 64 0 0 0 0 RaidGetPortData storport!RaidpPortData , Binary: storport.sys Ccmp 1 0 1 64 0 0 0 0 UNKNOWN pooltag 'Ccmp', please update pooltag.txt IoSD 4 3 1 64 0 0 0 0 Io system device buffer , Binary: nt!io EQSc 1 0 1 64 0 0 0 0 EQoS pacer client , Binary: tcpip.sys Acpg 1 0 1 64 0 0 0 0 ACPI GPE data , Binary: acpi.sys AzPx 1 0 1 64 0 0 0 0 HD Audio Class Driver (AzPower) , Binary: HDAudio.sys Nb37 4 3 1 64 0 0 0 0 NetBT lmhosts path , Binary: netbt.sys RaAM 1 0 1 64 0 0 0 0 RaidAllocateAddressMapping storport!_MAPPED_ADDRESS , Binary: storport.sys ScIn 1 0 1 64 0 0 0 0 Mass storage driver tags Nbtg 2 0 2 64 0 0 0 0 NetBT MDL buffer , Binary: netbt.sys Nsic 1 0 1 64 0 0 0 0 UNKNOWN pooltag 'Nsic', please update pooltag.txt SeAc 42 41 1 64 79740 76542 3198 696064 Security ACL , Binary: nt!se NQoS 1 0 1 64 0 0 0 0 UNKNOWN pooltag 'NQoS', please update pooltag.txt L2T4 1 0 1 64 0 0 0 0 ndis\l2tp / MTAG_VCTABLE AzRR 1 0 1 48 0 0 0 0 HD Audio Class Driver (SpdifEmbeddedRender, SpdifOut, Headphone, HBDAout) , Binary: HDAudio.sys Nbuf 1 0 1 48 0 0 0 0 NetIO Memory Descriptor List allocations , Binary: netio.sys PTPc 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'PTPc', please update pooltag.txt CcBn 1 0 1 48 0 0 0 0 Cache Manager Bcb trim notification entry , Binary: nt!cc PSwt 3 2 1 48 0 0 0 0 PDC_PSWT_TAG , Binary: pdc.sys L2Tw 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'L2Tw', please update pooltag.txt Pcna 3 2 1 48 0 0 0 0 PACER Filter Network Addresses , Binary: pacer.sys BkCh 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'BkCh', please update pooltag.txt UlWQ 1 0 1 48 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys PcLR 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'PcLR', please update pooltag.txt WanW 1 0 1 48 0 0 0 0 SHA Encryption RaPC 1 0 1 48 0 0 0 0 RaInitializeConfiguration storport!_PORT_CONFIGURATION_INFORMATION.AccessRanges , Binary: storport.sys Nb36 8 7 1 48 0 0 0 0 NetBT string , Binary: netbt.sys Fsrc 1 0 1 48 0 0 0 0 Filesystem recognizer (fsrec.sys) , Binary: fsrec.sys TuV4 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'TuV4', please update pooltag.txt iEoP 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'iEoP', please update pooltag.txt Evel 1 0 1 48 0 0 0 0 EFS file system filter driver lookaside list Wnds 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'Wnds', please update pooltag.txt Acpt 36 35 1 48 0 0 0 0 ACPI table data , Binary: acpi.sys FLTR 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'FLTR', please update pooltag.txt AzMi 1 0 1 48 0 0 0 0 HD Audio Class Driver (micin, MixedCapture) , Binary: HDAudio.sys L2Ts 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'L2Ts', please update pooltag.txt SmMs 1 0 1 48 13 6 7 1456 SMB miscellaneous , Binary: mrxsmb.sys jEoP 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'jEoP', please update pooltag.txt PTPn 1 0 1 48 0 0 0 0 UNKNOWN pooltag 'PTPn', please update pooltag.txt ScS2 1 0 1 48 0 0 0 0 Sense interpretation data , Binary: classpnp.sys IoUs 21 20 1 48 0 0 0 0 I/O SubSystem completion Context Allocation , Binary: nt!io ScWs 1 0 1 32 0 0 0 0 Working set , Binary: classpnp.sys Nb03 1 0 1 32 0 0 0 0 NetBT remote name address cache , Binary: netbt.sys EcHb 2 1 1 32 0 0 0 0 UNKNOWN pooltag 'EcHb', please update pooltag.txt fEoP 1 0 1 32 0 0 0 0 UNKNOWN pooltag 'fEoP', please update pooltag.txt UlCN 1 0 1 32 0 0 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys RaUE 2 1 1 32 0 0 0 0 RaidUnitAllocateResources , Binary: storport.sys MmSg 0 0 0 0 1 0 1 112 Mm segments , Binary: nt!mm MsPp 0 0 0 0 4 0 4 1376 UNKNOWN pooltag 'MsPp', please update pooltag.txt TDIj 10 10 0 0 0 0 0 0 UNKNOWN pooltag 'TDIj', please update pooltag.txt CM13 0 0 0 0 1 0 1 4096 Internal Configuration manager allocations , Binary: nt!cm AlEB 0 0 0 0 13592 13470 122 230720 UNKNOWN pooltag 'AlEB', please update pooltag.txt armp 36 36 0 0 0 0 0 0 UNKNOWN pooltag 'armp', please update pooltag.txt FLfl 0 0 0 0 27 0 27 3024 exported (non-private) file lock NtFd 0 0 0 0 9363 7331 2032 210400 DirCtrl.c , Binary: ntfs.sys Mn01 0 0 0 0 1 1 0 0 ACPI method evaluation output buffer , Binary: monitor.sys PfCH 0 0 0 0 15 13 2 4240 Pf Allocations , Binary: nt!pf RaRl 271 271 0 0 0 0 0 0 RaidBusEnumeratorAllocateReportLunsResources storport!_BUS_ENUM_RESOURCES.DataBuffer , Binary: storport.sys PfFH 0 0 0 0 7 6 1 32768 Pf RpContext FileKeyHash buckets , Binary: nt!pf Txf0 0 0 0 0 16 16 0 0 UNKNOWN pooltag 'Txf0', please update pooltag.txt Ppde 0 0 0 0 3 3 0 0 routines to perform device removal , Binary: nt!pnp AtmA 0 0 0 0 1362 456 906 84320 Atoms IoRN 0 0 0 0 95 95 0 0 Registry key name (temp allocation) , Binary: nt!io MmSt 0 0 0 0 9249 3206 6043 8774672 Mm section object prototype ptes , Binary: nt!mm TXHT 0 0 0 0 7 7 0 0 UNKNOWN pooltag 'TXHT', please update pooltag.txt Init 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'Init', please update pooltag.txt IoKB 0 0 0 0 2298 2298 0 0 Registry basic key block (temp allocation) , Binary: nt!io NtfM 0 0 0 0 28 3 25 2000 NTFS_MCB_ENTRY , Binary: ntfs.sys ScB2 2 2 0 0 0 0 0 0 Registry path , Binary: classpnp.sys SMB6 2 2 0 0 0 0 0 0 UNKNOWN pooltag 'SMB6', please update pooltag.txt EtwP 0 0 0 0 3200 3000 200 34448 Etw Pool , Binary: nt!etw Nb30 148 148 0 0 0 0 0 0 NetBT registry string , Binary: netbt.sys NDw3 26 26 0 0 0 0 0 0 NDIS_TAG_WMI_EVENT_ITEM , Binary: ndis.sys MmFr 0 0 0 0 70 0 70 3360 ASLR fixup records , Binary: nt!mm Symb 0 0 0 0 222 33 189 30240 Symbolic link objects vskd 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'vskd', please update pooltag.txt IoRi 13 13 0 0 0 0 0 0 I/O SubSystem Driver Reinitialization Callback Packet , Binary: nt!io Dacl 0 0 0 0 22 21 1 112 Temp allocations for object DACLs Strg 6 6 0 0 6883 3201 3682 411024 Dynamic Translated strings OPM 0 0 0 0 2 0 2 96 UNKNOWN pooltag ' OPM', please update pooltag.txt AlVi 0 0 0 0 561 439 122 19520 ALPC view , Binary: nt!alpc KSlw 6 6 0 0 0 0 0 0 UNKNOWN pooltag 'KSlw', please update pooltag.txt D2d 0 0 0 0 13 9 4 128 Device Object to DosName rtns (ntos\rtl\dev2dos.c) VoSr 0 0 0 0 2 2 0 0 Device relations allocations , Binary: volsnap.sys RtlT 0 0 0 0 13 13 0 0 Temporary RTL allocation , Binary: nt!rtl MmRe 0 0 0 0 1047 2 1045 7214064 ASLR relocation blocks , Binary: nt!mm PmTE 0 0 0 0 53 52 1 96 Partition Manager table entry , Binary: partmgr.sys Txfc 0 0 0 0 27 14 13 3408 TXF_FCB , Binary: ntfs.sys NDsd 0 0 0 0 3 3 0 0 NDIS_TAG_NET_CFG_SEC_DESC , Binary: ndis.sys LfsI 0 0 0 0 2 0 2 131072 Lfs allocations ObSq 0 0 0 0 266 194 72 22848 object security descriptors (query) , Binary: nt!ob UlCE 0 0 0 0 10 0 10 1728 Config Group Tree Entry , Binary: http.sys CM32 0 0 0 0 16 6 10 40960 Internal Configuration manager allocations , Binary: nt!cm ObHd 0 0 0 0 243 156 87 8704 object handle count data base , Binary: nt!ob SeLu 0 0 0 0 3919 3758 161 5328 Security LUID and Attributes array , Binary: nt!se ArbL 0 0 0 0 639 351 288 78336 ARBITER_ORDERING_LIST_TAG , Binary: nt!arb Txfn 0 0 0 0 1 0 1 20480 UNKNOWN pooltag 'Txfn', please update pooltag.txt KSau 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'KSau', please update pooltag.txt CMTr 0 0 0 0 3 3 0 0 Configuration Manager Transaction Tag , Binary: nt!cm rtPi 0 0 0 0 1 0 1 2064 UNKNOWN pooltag 'rtPi', please update pooltag.txt CMVe 0 0 0 0 3604 0 3604 461328 Internal Configuration manager allocations , Binary: nt!cm Txfa 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'Txfa', please update pooltag.txt LS2x 0 0 0 0 4 0 4 176 SMB2 security context , Binary: srv2.sys FxL3 0 0 0 0 7 7 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys PfVH 0 0 0 0 23 23 0 0 Pf Prefetch volume handles , Binary: nt!pf asmp 35 35 0 0 0 0 0 0 UNKNOWN pooltag 'asmp', please update pooltag.txt Ppcr 1 1 0 0 2 2 0 0 plug-and-play critical allocations , Binary: nt!pnp TmFN 672 672 0 0 0 0 0 0 UNKNOWN pooltag 'TmFN', please update pooltag.txt NpfF 0 0 0 0 60 9 51 11424 Npfs Allocations , Binary: npfs.sys PcRv 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'PcRv', please update pooltag.txt LBpt 0 0 0 0 1 0 1 560 Paged transport FxL1 0 0 0 0 7 7 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys EMqu 0 0 0 0 16 16 0 0 UNKNOWN pooltag 'EMqu', please update pooltag.txt AfdS 0 0 0 0 2 2 0 0 Afd security info , Binary: afd.sys FxL2 0 0 0 0 1 0 1 64 KMDF Loader Pool allocation , Binary: wdfldr.sys VmRb 0 0 0 0 1 0 1 16384 Raw record buffers , Binary: volmgrx.sys KSnv 0 0 0 0 35 30 5 288 registry name value PfET 0 0 0 0 2 0 2 163936 Pf Entry info tables , Binary: nt!pf Ntfs 0 0 0 0 1 0 1 512 SCB_DATA , Binary: ntfs.sys FIcs 0 0 0 0 9541 3635 5906 1133952 FileInfo FS-filter Stream Context , Binary: fileinfo.sys Ntrs 0 0 0 0 4 0 4 448 UNKNOWN pooltag 'Ntrs', please update pooltag.txt PcSi 0 0 0 0 7 0 7 736 UNKNOWN pooltag 'PcSi', please update pooltag.txt SeAi 0 0 0 0 2 2 0 0 Security Audit Work Item , Binary: nt!se EcCr 27510 27510 0 0 0 0 0 0 UNKNOWN pooltag 'EcCr', please update pooltag.txt NDse 18 18 0 0 5 0 5 1008 NDIS_TAG_SECURITY , Binary: ndis.sys ClMp 0 0 0 0 22 0 22 1168 UNKNOWN pooltag 'ClMp', please update pooltag.txt EMev 0 0 0 0 87812 87812 0 0 UNKNOWN pooltag 'EMev', please update pooltag.txt ScDg 0 0 0 0 3 2 1 64 update disk geometry paths Ppdd 0 0 0 0 10 10 0 0 new Plug-And-Play driver entries and IRPs , Binary: nt!pnp Lfs 0 0 0 0 180 154 26 8560 Lfs allocations ScCs 0 0 0 0 1 0 1 64 Assorted string data , Binary: cdrom.sys CM11 0 0 0 0 2 0 2 8192 Internal Configuration manager allocations , Binary: nt!cm ScC1 0 0 0 0 2 0 2 256 Registry path buffer , Binary: classpnp.sys ScB1 2 2 0 0 0 0 0 0 Query registry parameters , Binary: classpnp.sys NtFf 3 3 0 0 7130 7114 16 181536 FsCtrl.c , Binary: ntfs.sys IdeX 4 4 0 0 13 13 0 0 PCI IDE ClfI 0 0 0 0 12 1 11 999440 CLFS Log marshal buffer lookaside list , Binary: clfs.sys PcDi 0 0 0 0 10 0 10 800 WDM audio stuff VRWD 0 0 0 0 12 12 0 0 UNKNOWN pooltag 'VRWD', please update pooltag.txt CM21 0 0 0 0 1 1 0 0 Internal Configuration manager allocations , Binary: nt!cm ClfH 0 0 0 0 12 1 11 2112 CLFS Log I/O control block lookaside list , Binary: clfs.sys AzSd 0 0 0 0 1 1 0 0 HD Audio Class Driver (subdevicegraph) , Binary: HDAudio.sys Txfo 0 0 0 0 4 0 4 9200 TXF_FO , Binary: ntfs.sys ReRe 0 0 0 0 1 0 1 160 UNKNOWN pooltag 'ReRe', please update pooltag.txt Rxbw 24 24 0 0 0 0 0 0 RDBSS allocations , Binary: rdbss.sys NDw2 8 8 0 0 0 0 0 0 NDIS_TAG_WMI_OID_SUPPORTED_LIST , Binary: ndis.sys VMSI 0 0 0 0 2 2 0 0 Volume Manager , Binary: volmgr.sys Sect 0 0 0 0 27539 25311 2228 358720 Section objects UlRD 0 0 0 0 7 7 0 0 Registry Data , Binary: http.sys UlSD 0 0 0 0 2 1 1 80 Security Data , Binary: http.sys EcOf 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'EcOf', please update pooltag.txt UlPS 0 0 0 0 6 0 6 480 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys NpFD 0 0 0 0 1 0 1 224 DCB, directory block , Binary: npfs.sys AcpB 0 0 0 0 39 39 0 0 ACPI buffer data , Binary: acpi.sys ScCM 1 1 0 0 0 0 0 0 Mode data buffer , Binary: cdrom.sys cbuf 0 0 0 0 21 2 19 624 UNKNOWN pooltag 'cbuf', please update pooltag.txt ScDM 5 5 0 0 0 0 0 0 mode data buffer Ppin 0 0 0 0 47 47 0 0 plug-and-play initialization , Binary: nt!pnp KSfi 5 5 0 0 0 0 0 0 UNKNOWN pooltag 'KSfi', please update pooltag.txt EQSp 0 0 0 0 2 2 0 0 EQoS generic policy data , Binary: tcpip.sys Ppen 0 0 0 0 325 325 0 0 routines to perform device enumeration , Binary: nt!pnp KSsi 0 0 0 0 2 2 0 0 software bus interface RpcS 0 0 0 0 23 9 14 1568 UNKNOWN pooltag 'RpcS', please update pooltag.txt PooL 0 0 0 0 0 0 0 0 Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures TunP 0 0 0 0 316 80 236 68032 Tunnel cache oddsized pool-allocated elements KSpi 5 5 0 0 0 0 0 0 UNKNOWN pooltag 'KSpi', please update pooltag.txt EcMc 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'EcMc', please update pooltag.txt Txfb 0 0 0 0 13 13 0 0 UNKNOWN pooltag 'Txfb', please update pooltag.txt FMdl 4 4 0 0 0 0 0 0 Array of DEVICE_OBJECT pointers , Binary: fltmgr.sys CMCa 0 0 0 0 2 0 2 81920 Configuration Manager Cache (registry) , Binary: nt!cm FSel 0 0 0 0 22 18 4 192 File System Run Time Extra Create Parameter List , Binary: nt!fsrtl TxTb 0 0 0 0 2 0 2 15968 UNKNOWN pooltag 'TxTb', please update pooltag.txt DG 0 0 0 0 3 3 0 0 UNKNOWN pooltag 'DG ', please update pooltag.txt CMVa 0 0 0 0 0 0 0 0 value cache value tag , Binary: nt!cm CMIn 0 0 0 0 5953 5591 362 13984 Configuration Manager Index Hint Tag , Binary: nt!cm CMca 0 0 0 0 1 0 1 32 Internal Configuration manager allocations , Binary: nt!cm WL03 0 0 0 0 6 6 0 0 UNKNOWN pooltag 'WL03', please update pooltag.txt EcCu 6472 6472 0 0 0 0 0 0 UNKNOWN pooltag 'EcCu', please update pooltag.txt Txtr 0 0 0 0 2 0 2 928 TXF_TRANS (Txf transaction context) , Binary: ntfs.sys CMVw 0 0 0 0 7352 3964 3388 379456 registry mapped view of file , Binary: nt!cm DQUD 32 32 0 0 0 0 0 0 UNKNOWN pooltag 'DQUD', please update pooltag.txt CMUw 0 0 0 0 16 16 0 0 Configuration Manager Unit of Work Tag , Binary: nt!cm AlHd 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'AlHd', please update pooltag.txt NMRg 8 8 0 0 0 0 0 0 Network Module Registrar Generic Buffers , Binary: tcpip.sys ppmp 922 922 0 0 0 0 0 0 UNKNOWN pooltag 'ppmp', please update pooltag.txt SMBt 2 2 0 0 0 0 0 0 UNKNOWN pooltag 'SMBt', please update pooltag.txt Txdl 0 0 0 0 1 0 1 64 TXF_DELETED_LINK , Binary: ntfs.sys Nb28 4 4 0 0 0 0 0 0 NetBT name server addresses , Binary: netbt.sys RaSI 3 3 0 0 0 0 0 0 StorUnmapSenseInfo storport!_EXTENDED_REQUEST_BLOCK.Srb.SenseInfoBuffer , Binary: storport.sys SAad 0 0 0 0 21 9 12 1904 SrvAdmin buffer , Binary: srvnet.sys Txvl 0 0 0 0 2 0 2 640 TXF_VSCB , Binary: ntfs.sys Nb38 4 4 0 0 0 0 0 0 NetBT string , Binary: netbt.sys Pnp9 0 0 0 0 3 0 3 288 PNPMGR HW profile notify , Binary: nt!pnp Cbrb 0 0 0 0 6 0 6 288 UNKNOWN pooltag 'Cbrb', please update pooltag.txt MuUn 0 0 0 0 5 0 5 736 UNC provider , Binary: mup.sys RaDI 0 0 0 0 4 4 0 0 RaidUnitGetDeviceId , Binary: storport.sys MmZw 2 2 0 0 0 0 0 0 Work items for zeroing pages and pagefiles , Binary: nt!mm ObDi 0 0 0 0 1290 201 1089 52272 object directory , Binary: nt!ob EMpr 0 0 0 0 12 0 12 768 UNKNOWN pooltag 'EMpr', please update pooltag.txt ScDC 1 1 0 0 0 0 0 0 disable cache paths CM26 0 0 0 0 11 3 8 131072 Internal Configuration manager allocations , Binary: nt!cm CM16 0 0 0 0 72 0 72 376832 Internal Configuration manager allocations , Binary: nt!cm CIsc 21 21 0 0 265 121 144 566816 Code Integrity core dll , Binary: ci.dll wido 25 25 0 0 0 0 0 0 UNKNOWN pooltag 'wido', please update pooltag.txt EtwD 0 0 0 0 29 29 0 0 Etw DataBlock , Binary: nt!etw Mn0B 0 0 0 0 9 9 0 0 Registry value buffer , Binary: monitor.sys RxCd 0 0 0 0 2 2 0 0 RXCE TDI , Binary: mrxsmb.sys Obtb 0 0 0 0 231 59 172 485392 object tables via EX handle.c , Binary: nt!ob PsSl 0 0 0 0 2 0 2 208 UNKNOWN pooltag 'PsSl', please update pooltag.txt ArbA 0 0 0 0 112 1 111 466640 ARBITER_ALLOCATION_STATE_TAG , Binary: nt!arb KSce 0 0 0 0 102 41 61 3904 create item entry MmLn 0 0 0 0 103 103 0 0 temporary name buffer for driver loads , Binary: nt!mm KSde 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'KSde', please update pooltag.txt KSbe 0 0 0 0 10 10 0 0 UNKNOWN pooltag 'KSbe', please update pooltag.txt LSsh 0 0 0 0 1 0 1 560 SMB1 share , Binary: srv.sys MuDn 0 0 0 0 11 11 0 0 Device name , Binary: mup.sys Txf1 0 0 0 0 3 3 0 0 UNKNOWN pooltag 'Txf1', please update pooltag.txt CmVn 0 0 0 0 1494 1106 388 17488 captured value name , Binary: nt!cm IrpS 0 0 0 0 0 0 0 0 UNKNOWN pooltag 'IrpS', please update pooltag.txt Nbtk 6 6 0 0 0 0 0 0 NetBT transport address , Binary: netbt.sys Mem 0 0 0 0 148 147 1 32 UNKNOWN pooltag 'Mem ', please update pooltag.txt NtFA 103 103 0 0 19127 17172 1955 454960 AttrSup.c , Binary: ntfs.sys SeUs 0 0 0 0 35643 33340 2303 135152 Security Captured Unicode string , Binary: nt!se BatM 0 0 0 0 1 0 1 128 Control method battery driver Wmiw 35 35 0 0 0 0 0 0 Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL SeAk 0 0 0 0 162 53 109 5680 Security Account Name , Binary: nt!se PmPT 10 10 0 0 0 0 0 0 Partition Manager partition table cache , Binary: partmgr.sys SeLs 0 0 0 0 32 18 14 1248 Security Logon Session , Binary: nt!se VoSp 0 0 0 0 3 3 0 0 Pnp id allocations , Binary: volsnap.sys Txfe 0 0 0 0 2 0 2 160 TXF_FCB_EXTENSION , Binary: ntfs.sys CcPF 0 0 0 0 21 15 6 960 Prefetcher file name , Binary: nt!ccpf FIOc 0 0 0 0 13157 13070 87 5568 FileInfo FS-filter Prefetch Open Context , Binary: fileinfo.sys AlRr 0 0 0 0 46 3 43 4128 ALPC resource reserves , Binary: nt!Alpc TXIS 0 0 0 0 4 4 0 0 UNKNOWN pooltag 'TXIS', please update pooltag.txt AlRe 0 0 0 0 260 199 61 8784 ALPC section region , Binary: nt!alpc IoNm 0 0 0 0 98798 86753 12045 1880256 Io parsing names , Binary: nt!io PoSL 0 0 0 0 2 0 2 64 Power shutdown event list IoSe 0 0 0 0 5111 3813 1298 414976 Io security related , Binary: nt!io PcKd 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'PcKd', please update pooltag.txt mltr 0 0 0 0 32 27 5 2240 UNKNOWN pooltag 'mltr', please update pooltag.txt FwSD 0 0 0 0 6 6 0 0 WFP security descriptor , Binary: tcpip.sys ScIO 10 10 0 0 0 0 0 0 ClassPnP device control , Binary: classpnp.sys Key 0 0 0 0 281372 259772 21600 3455872 Key objects Mn0A 0 0 0 0 2 2 0 0 Registry subkey info buffer , Binary: monitor.sys FIcp 0 0 0 0 4 0 4 448 FileInfo FS-filter Extra Create Parameter , Binary: fileinfo.sys Nb27 4 4 0 0 0 0 0 0 NetBT bind list cache , Binary: netbt.sys NLap 1 1 0 0 0 0 0 0 Network Layer Netio Helper Function allocations , Binary: tcpip.sys NpFC 0 0 0 0 55 34 21 672 ROOT_DCB CCB , Binary: npfs.sys CMpi 0 0 0 0 2443 2248 195 11376 Internal Configuration manager allocations , Binary: nt!cm MVSN 0 0 0 0 1 0 1 96 UNKNOWN pooltag 'MVSN', please update pooltag.txt FIvp 0 0 0 0 63 59 4 768 FileInfo FS-filter Volume Properties , Binary: fileinfo.sys CMci 0 0 0 0 987508 873046 114462 9156960 Internal Configuration manager allocations , Binary: nt!cm VadF 0 0 0 0 0 0 0 0 VADs created by a FreeVM splitting , Binary: nt!mm Nb23 4 4 0 0 0 0 0 0 NetBT lmhosts path , Binary: netbt.sys PpRb 18 18 0 0 0 0 0 0 UNKNOWN pooltag 'PpRb', please update pooltag.txt apth 998 998 0 0 0 0 0 0 UNKNOWN pooltag 'apth', please update pooltag.txt Nb33 16 16 0 0 0 0 0 0 NetBT registry data , Binary: netbt.sys FxL5 0 0 0 0 7 6 1 144 KMDF Loader Pool allocation , Binary: wdfldr.sys KdIo 104 104 0 0 0 0 0 0 UNKNOWN pooltag 'KdIo', please update pooltag.txt NpFW 0 0 0 0 42 23 19 912 Write block , Binary: npfs.sys Ppio 40 40 0 0 14425 14247 178 10240 plug-and-play IO system APIs , Binary: nt!pnp MmIh 0 0 0 0 36 36 0 0 Image header allocation for Se validation , Binary: nt!mm Ppsu 0 0 0 0 511 225 286 24512 plug-and-play subroutines for the I/O system , Binary: nt!pnp MmPh 4 4 0 0 0 0 0 0 Physical memory nodes for querying memory ranges , Binary: nt!mm TCPc 0 0 0 0 0 0 0 0 TCP/IP network protocol , Binary: TCP SYPK 0 0 0 0 32 32 0 0 Kernel mode system partition detection allocations , Binary: syspart.lib KSat 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'KSat', please update pooltag.txt CM35 0 0 0 0 5 0 5 413696 Internal Configuration manager allocations , Binary: nt!cm FSim 0 0 0 0 6528 1237 5291 761904 File System Run Time Mcb Initial Mapping Lookaside List , Binary: nt!fsrtl CM25 0 0 0 0 2751 0 2751 11923456 Internal Configuration manager allocations , Binary: nt!cm UIRP 0 0 0 0 0 0 0 0 UNKNOWN pooltag 'UIRP', please update pooltag.txt CM45 0 0 0 0 57 0 57 2736 Internal Configuration manager allocations , Binary: nt!cm UlCH 0 0 0 0 4 0 4 512 Config Group Tree Header , Binary: http.sys NtfC 0 0 0 0 12272 8865 3407 708656 CCB , Binary: ntfs.sys Nbtm 132 132 0 0 0 0 0 0 NetBT EA buffer , Binary: netbt.sys PcSt 0 0 0 0 7 0 7 608 WDM audio stuff RaQT 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'RaQT', please update pooltag.txt IoFs 0 0 0 0 1 0 1 48 Io shutdown packet , Binary: nt!io AlMs 0 0 0 0 279 67 212 4107712 ALPC message , Binary: nt!alpc Etwr 137 137 0 0 0 0 0 0 Etw ReplyQueue Entry , Binary: nt!etw TCPr 0 0 0 0 0 0 0 0 TCP request pool , Binary: TCP Rx?? 0 0 0 0 19 19 0 0 RDBSS allocations , Binary: rdbss.sys KseS 0 0 0 0 3 3 0 0 Security driver allocs for LSA proper , Binary: ksecdd.sys EMst 0 0 0 0 191 104 87 5744 UNKNOWN pooltag 'EMst', please update pooltag.txt Txfk 0 0 0 0 6 0 6 192 UNKNOWN pooltag 'Txfk', please update pooltag.txt SMBr 0 0 0 0 18 18 0 0 UNKNOWN pooltag 'SMBr', please update pooltag.txt TmCs 0 0 0 0 6 6 0 0 UNKNOWN pooltag 'TmCs', please update pooltag.txt AFGp 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'AFGp', please update pooltag.txt NtFC 0 0 0 0 14890 12222 2668 544752 Create.c , Binary: ntfs.sys BaPd 8 8 0 0 0 0 0 0 UNKNOWN pooltag 'BaPd', please update pooltag.txt NpFw 1 1 0 0 265 263 2 1648 Write block , Binary: npfs.sys SePr 0 0 0 0 265 257 8 320 Security Privilege Set , Binary: nt!se TxfQ 0 0 0 0 1 0 1 128 UNKNOWN pooltag 'TxfQ', please update pooltag.txt CMnb 0 0 0 0 370 35 335 37520 registry notify blocks , Binary: nt!cm CMpb 0 0 0 0 805 240 565 54240 registry post blocks , Binary: nt!cm SeAl 0 0 0 0 22 22 0 0 UNKNOWN pooltag 'SeAl', please update pooltag.txt FxLb 0 0 0 0 6 6 0 0 KMDF Loader Pool allocation , Binary: wdfldr.sys SWdn 0 0 0 0 1 1 0 0 device name TCPC 0 0 0 0 0 0 0 0 TCP connection pool , Binary: TCP NpPp 0 0 0 0 4 0 4 1120 UNKNOWN pooltag 'NpPp', please update pooltag.txt KSpf 5 5 0 0 0 0 0 0 UNKNOWN pooltag 'KSpf', please update pooltag.txt PXa. 1 1 0 0 0 0 0 0 UNKNOWN pooltag ' PXa', please update pooltag.txt SWda 0 0 0 0 9 0 9 576 POOLTAG_DEVICE_ASSOCIATION FSrs 2 2 0 0 0 0 0 0 File System Run Time Work Item for low-stack posting , Binary: nt!fsrtl PXc. 1 1 0 0 0 0 0 0 UNKNOWN pooltag ' PXc', please update pooltag.txt Nb29 8 8 0 0 0 0 0 0 NetBT registry string , Binary: netbt.sys NpFc 0 0 0 0 189 83 106 27136 CCB, client control block , Binary: npfs.sys Pnp1 258 258 0 0 0 0 0 0 PNPMGR IRP completion context , Binary: nt!pnp KSff 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'KSff', please update pooltag.txt PfED 0 0 0 0 1 1 0 0 Pf Generic event data , Binary: nt!pf CcPD 0 0 0 0 17 11 6 205344 Prefetcher trace dump , Binary: nt!ccpf PSet 0 0 0 0 353 211 142 10944 UNKNOWN pooltag 'PSet', please update pooltag.txt MsFr 0 0 0 0 1 0 1 4096 Mailslot read buffer, buffer created for pended reads issued. ScDN 0 0 0 0 1 1 0 0 disk name code PfFK 0 0 0 0 12285 6362 5923 284304 Pf RpContext FileKeyHashEntry , Binary: nt!pf VadL 0 0 0 0 0 0 0 0 UNKNOWN pooltag 'VadL', please update pooltag.txt ScLA 1 1 0 0 0 0 0 0 allocation to check for autorun disable , Binary: classpnp.sys UlHT 0 0 0 0 1 0 1 2240 Hash Table , Binary: http.sys ScDA 1 1 0 0 0 0 0 0 Info Exceptions PnpK 0 0 0 0 364 356 8 1856 PNPMGR device event entry , Binary: nt!pnp EcUi 8 8 0 0 0 0 0 0 UNKNOWN pooltag 'EcUi', please update pooltag.txt WDIs 0 0 0 0 16 0 16 65536 UNKNOWN pooltag 'WDIs', please update pooltag.txt RaSN 4 4 0 0 0 0 0 0 RaidBusEnumeratorAllocateUnitResources storport!_BUS_ENUM_RESOURCES.SenseInfo , Binary: storport.sys SMB1 5 5 0 0 0 0 0 0 UNKNOWN pooltag 'SMB1', please update pooltag.txt PRFd 4 4 0 0 0 0 0 0 Performance Diagnostics Structures , Binary: nt!wdi apna 2 2 0 0 0 0 0 0 UNKNOWN pooltag 'apna', please update pooltag.txt KLRG 0 0 0 0 8 5 3 304 UNKNOWN pooltag 'KLRG', please update pooltag.txt CMHb 0 0 0 0 8 8 0 0 Internal Configuration manager allocations , Binary: nt!cm CMLb 0 0 0 0 5 5 0 0 Internal Configuration manager allocations , Binary: nt!cm CMSb 0 0 0 0 3 2 1 32768 internal stash buffer pool tag , Binary: nt!cm CMNb 0 0 0 0 164185 118755 45430 8441568 Configuration Manager Name Tag , Binary: nt!cm TxfR 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'TxfR', please update pooltag.txt LSlb 0 0 0 0 7 5 2 176 SRVLIB security descriptor/registry buffer , Binary: srv2.sys VoSv 0 0 0 0 1 0 1 160 VolSnap (Volume Snapshot Driver) , Binary: volsnap.sys MIsa 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'MIsa', please update pooltag.txt Txfq 0 0 0 0 1 0 1 64 Txf quota block , Binary: ntfs.sys ObDu 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'ObDu', please update pooltag.txt PnpD 0 0 0 0 14 0 14 1568 UNKNOWN pooltag 'PnpD', please update pooltag.txt LSdb 0 0 0 0 4 1 3 336 SMB1 data buffer , Binary: srv.sys CAPa 0 0 0 0 5 0 5 800 UNKNOWN pooltag 'CAPa', please update pooltag.txt NtFB 1 1 0 0 25 20 5 93824 BitmpSup.c , Binary: ntfs.sys SWii 0 0 0 0 1 1 0 0 instance ID PfRD 0 0 0 0 23 23 0 0 Pf Allocations , Binary: nt!pf PfTD 0 0 0 0 69 59 10 1777664 Pf Trace Dump , Binary: nt!pf Pnp7 0 0 0 0 4 4 0 0 PNPMGR deferred notify entry , Binary: nt!pnp PfRQ 0 0 0 0 23 23 0 0 Pf Prefetch request buffers , Binary: nt!pf Ntf0 0 0 0 0 10155 3740 6415 459872 General pool allocation , Binary: ntfs.sys SWbi 0 0 0 0 3 3 0 0 bus ID Gi2c 0 0 0 0 2 0 2 96 GDITAG_DDCCI , Binary: win32k.sys CMcb 0 0 0 0 1 0 1 112 Internal Configuration manager allocations , Binary: nt!cm PmRP 0 0 0 0 1 0 1 144 Partition Manager registry path , Binary: partmgr.sys NtFl 0 0 0 0 0 0 0 0 Unknown NTFS source module , Binary: ntfs.sys PnpC 0 0 0 0 12 0 12 1344 PNPMGR target device notify , Binary: nt!pnp SWki 0 0 0 0 14 14 0 0 key information TmLn 0 0 0 0 8 8 0 0 UNKNOWN pooltag 'TmLn', please update pooltag.txt Fstb 18 18 0 0 5 5 0 0 ntos\fstub Keye 0 0 0 0 54 4 50 80032 UNKNOWN pooltag 'Keye', please update pooltag.txt STCE 0 0 0 0 1 1 0 0 New MMC compliant storage drivers NtFR 3 3 0 0 57 57 0 0 RestrSup.c , Binary: ntfs.sys Txfv 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'Txfv', please update pooltag.txt CcPw 2 2 0 0 0 0 0 0 Prefetcher enable worker , Binary: nt!ccpf Nb25 4 4 0 0 0 0 0 0 NetBT device bindings , Binary: netbt.sys TmEn 672 672 0 0 0 0 0 0 Tm KENLISTMENT object , Binary: nt!tm NtfE 0 0 0 0 183 109 74 24864 INDEX_CONTEXT , Binary: ntfs.sys Pnp6 0 0 0 0 24 24 0 0 PNPMGR resource request , Binary: nt!pnp PfRC 0 0 0 0 12 8 4 192 Pf Allocations , Binary: nt!pf IoDn 0 0 0 0 13 9 4 896 Io device name info , Binary: nt!io PfSC 23 23 0 0 0 0 0 0 Pf Allocations , Binary: nt!pf PfMP 0 0 0 0 23 23 0 0 Pf Prefetch metadata buffers , Binary: nt!pf Txfi 0 0 0 0 4 2 2 192 TXF_FCB_INFO , Binary: ntfs.sys MuSp 0 0 0 0 1 0 1 160 UNKNOWN pooltag 'MuSp', please update pooltag.txt AtmT 0 0 0 0 10 1 9 8496 Atom tables NtFE 0 0 0 0 266 263 3 96 Ea.c , Binary: ntfs.sys MsvC 0 0 0 0 3 1 2 912 Msv/Ntlm client package , Binary: ksecdd.sys MmSm 0 0 0 0 6612 2257 4355 348400 segments used to map data files , Binary: nt!mm CM8 0 0 0 0 1009 1006 3 192 Internal Configuration manager allocations , Binary: nt!cm CM7 0 0 0 0 617 605 12 576 Internal Configuration manager allocations , Binary: nt!cm FMtr 0 0 0 0 248 232 16 1536 Temporary Registry information , Binary: fltmgr.sys Vga 0 0 0 0 2 1 1 7712 UNKNOWN pooltag 'Vga ', please update pooltag.txt AlMl 0 0 0 0 1 0 1 262144 UNKNOWN pooltag 'AlMl', please update pooltag.txt Nls 1 1 0 0 0 0 0 0 Nls strings CM1 0 0 0 0 28 28 0 0 Internal Configuration manager allocations , Binary: nt!cm CM2 0 0 0 0 28 28 0 0 Internal Configuration manager allocations , Binary: nt!cm NtFa 6 6 0 0 3 0 3 240 AllocSup.c , Binary: ntfs.sys CM3 0 0 0 0 28 28 0 0 Internal Configuration manager allocations , Binary: nt!cm CM4 0 0 0 0 28 28 0 0 Internal Configuration manager allocations , Binary: nt!cm Txfg 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'Txfg', please update pooltag.txt ACPI 4 4 0 0 0 0 0 0 UNKNOWN pooltag 'ACPI', please update pooltag.txt AlHa 0 0 0 0 566 142 424 62080 ALPC port handle table , Binary: nt!alpc TmLl 0 0 0 0 1 0 1 688 UNKNOWN pooltag 'TmLl', please update pooltag.txt ScDS 6 6 0 0 0 0 0 0 srb allocation NDca 0 0 0 0 3 3 0 0 NDIS_TAG_NET_CFG_OPS_ACL , Binary: ndis.sys Mn0E 0 0 0 0 1 1 0 0 Buffer for E-EDID v.1.x base block, if any, populated by miniport , Binary: monitor.sys EcMl 30767 30767 0 0 0 0 0 0 UNKNOWN pooltag 'EcMl', please update pooltag.txt PcSb 0 0 0 0 9 0 9 288 UNKNOWN pooltag 'PcSb', please update pooltag.txt EcIl 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'EcIl', please update pooltag.txt PsSb 1 1 0 0 0 0 0 0 Initial process parameter block (temporary allocation) , Binary: nt!ps LBpn 0 0 0 0 2 0 2 160 Paged Name Pp 0 0 0 0 62493 61311 1182 780768 UNKNOWN pooltag 'Pp ', please update pooltag.txt DfCI 0 0 0 0 5 5 0 0 DFS Client allocations , Binary: dfsc.sys AcpI 860 860 0 0 3868 3764 104 7248 ACPI irp data , Binary: acpi.sys Txsc 0 0 0 0 8 1 7 1904 TXF_SCB , Binary: ntfs.sys LBea 0 0 0 0 2 2 0 0 Ea buffer USBD 2 2 0 0 0 0 0 0 Universal Serial Bus Class Driver PcCb 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'PcCb', please update pooltag.txt FIvn 0 0 0 0 63 57 6 304 FileInfo FS-filter Volume Name , Binary: fileinfo.sys CMRm 0 0 0 0 10 5 5 800 Configuration Manager Resource Manager Tag , Binary: nt!cm NDda 0 0 0 0 3 3 0 0 NDIS_TAG_NET_CFG_DACL , Binary: ndis.sys FIcn 0 0 0 0 2730 2099 631 184816 FileInfo FS-filter Create Retry Path , Binary: fileinfo.sys LBan 0 0 0 0 2 2 0 0 Server announcement LBbn 0 0 0 0 2 0 2 224 Name DbgP 0 0 0 0 2 1 1 32 UNKNOWN pooltag 'DbgP', please update pooltag.txt Wrpr 2 2 0 0 0 0 0 0 WAN_REQUEST_TAG NMRc 36 36 0 0 0 0 0 0 Network Module Registrar Arrays , Binary: tcpip.sys RaEt 1 1 0 0 0 0 0 0 RaidBusEnumeratorProcessBusUnit , Binary: storport.sys CMSc 0 0 0 0 1508 1077 431 127360 security cache pooltag , Binary: nt!cm Toke 0 0 0 0 75500 72163 3337 5064384 Token objects , Binary: nt!se apms 213 213 0 0 0 0 0 0 UNKNOWN pooltag 'apms', please update pooltag.txt NtfD 0 0 0 0 2 0 2 384 DEALLOCATED_RECORDS , Binary: ntfs.sys EcMn 30445 30445 0 0 0 0 0 0 UNKNOWN pooltag 'EcMn', please update pooltag.txt Pprl 0 0 0 0 3 3 0 0 routines to manipulate relations list , Binary: nt!pnp ClfA 0 0 0 0 39 0 39 5616 CLFS Log container lookaside list , Binary: clfs.sys ScCc 82 82 0 0 0 0 0 0 Context of completion routine , Binary: cdrom.sys CcPp 0 0 0 0 11 9 2 48384 Prefetcher instructions , Binary: nt!ccpf AFGr 0 0 0 0 1 0 1 64 UNKNOWN pooltag 'AFGr', please update pooltag.txt FSun 4 4 0 0 0 0 0 0 File System Run Time , Binary: nt!fsrtl AfdX 0 0 0 0 365 140 225 46112 Afd context buffer , Binary: afd.sys UlUL 0 0 0 0 7 7 0 0 URL , Binary: http.sys PfLB 0 0 0 0 8 0 8 262144 Pf Log buffers , Binary: nt!pf PlPi 24 24 0 0 0 0 0 0 UNKNOWN pooltag 'PlPi', please update pooltag.txt Nb14 4 4 0 0 0 0 0 0 NetBT lmhosts path , Binary: netbt.sys CM19 0 0 0 0 1 0 1 256 Internal Configuration manager allocations , Binary: nt!cm SeSc 0 0 0 0 128923 125032 3891 710032 Captured Security Descriptor , Binary: nt!se CM39 0 0 0 0 624 144 480 227328 Internal Configuration manager allocations , Binary: nt!cm CM29 0 0 0 0 66 33 33 540672 Internal Configuration manager allocations , Binary: nt!cm Pnp5 0 0 0 0 82 82 0 0 PNPMGR assign resources context , Binary: nt!pnp SpLd 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'SpLd', please update pooltag.txt IoBo 1 1 0 0 0 0 0 0 Io boot disk information , Binary: nt!io SeAp 0 0 0 0 2 2 0 0 Security Audit Parameter Record , Binary: nt!se ObDm 0 0 0 0 5 0 5 400 object device map , Binary: nt!ob WmDS 0 0 0 0 2 0 2 16480 Wmi DataSource chunks ObSt 0 0 0 0 0 0 0 0 Object Manager temporary storage , Binary: nt!ob ObNm 0 0 0 0 37218 29363 7855 1979120 object names , Binary: nt!ob RRle 0 0 0 0 13725 12545 1180 94400 RTL_RANGE_LIST_ENTRY_TAG WmIS 0 0 0 0 1 0 1 196656 Wmi InstanceSet chunks BIG 0 0 0 0 0 0 0 0 Large session pool allocations (ntos\ex\pool.c) , Binary: nt!mm PfRL 0 0 0 0 7019 7019 0 0 Pf Prefetch read list , Binary: nt!pf ObNS 0 0 0 0 5 5 0 0 UNKNOWN pooltag 'ObNS', please update pooltag.txt Pnp2 104 104 0 0 0 0 0 0 PNPMGR device action request , Binary: nt!pnp PfNL 0 0 0 0 35 34 1 294912 Pf Name logging buffers , Binary: nt!pf ArbR 0 0 0 0 222 0 222 10656 ARBITER_RANGE_LIST_TAG , Binary: nt!arb CcPv 0 0 0 0 11 9 2 192 Prefetcher volume info , Binary: nt!ccpf Nbtn 10 10 0 0 0 0 0 0 NetBT device string , Binary: netbt.sys Senm 5 5 0 0 2 2 0 0 Serenum (RS-232 serial bus enumerator) is09 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'is09', please update pooltag.txt TmNo 13 13 0 0 0 0 0 0 Tm Notification , Binary: nt!tm Dire 0 0 0 0 44 6 38 16544 Directory objects ScC8 0 0 0 0 1 1 0 0 Registry value name , Binary: classpnp.sys SWdr 0 0 0 0 8 0 8 1776 device reference SWbr 0 0 0 0 7 0 7 1168 bus reference SWre 6 6 0 0 0 0 0 0 relations PLDe 0 0 0 0 2 0 2 352 UNKNOWN pooltag 'PLDe', please update pooltag.txt Mmxx 22 22 0 0 0 0 0 0 Mm temporary allocations , Binary: nt!mm NpAt 0 0 0 0 3478 3130 348 27840 UNKNOWN pooltag 'NpAt', please update pooltag.txt CM38 0 0 0 0 47 36 11 31680 Internal Configuration manager allocations , Binary: nt!cm WmiD 118 118 0 0 0 0 0 0 Wmi Registration DataSouce BLes 0 0 0 0 5 5 0 0 UNKNOWN pooltag 'BLes', please update pooltag.txt CIcr 0 0 0 0 27185 27104 81 112672 Code Integrity allocations for image integrity checking , Binary: ci.dll CM28 0 0 0 0 6 3 3 24576 Internal Configuration manager allocations , Binary: nt!cm CMAl 0 0 0 0 1634 1208 426 1744896 internal registry memory allocator pool tag , Binary: nt!cm Nbtj 6 6 0 0 0 0 0 0 NetBT EA buffer , Binary: netbt.sys SLS 0 0 0 0 324 176 148 10464 UNKNOWN pooltag 'SLS ', please update pooltag.txt PnpN 1 1 0 0 0 0 0 0 PNPMGR PDO array , Binary: nt!pnp Mp10 0 0 0 0 113 109 4 15552 UNKNOWN pooltag 'Mp10', please update pooltag.txt PcDW 0 0 0 0 2 2 0 0 UNKNOWN pooltag 'PcDW', please update pooltag.txt None 0 0 0 0 20 10 10 37568 call to ExAllocatePool AlCI 0 0 0 0 564 140 424 54272 ALPC communication info , Binary: nt!alpc MdlP 0 0 0 0 0 0 0 0 MDL per processor lookaside list pointers KStc 0 0 0 0 5 5 0 0 UNKNOWN pooltag 'KStc', please update pooltag.txt IrpL 0 0 0 0 0 0 0 0 UNKNOWN pooltag 'IrpL', please update pooltag.txt CcPh 0 0 0 0 22 18 4 7728 Prefetcher header preallocation , Binary: nt!ccpf NDcm 1 1 0 0 0 0 0 0 NDIS_TAG_CM , Binary: ndis.sys ScVs 0 0 0 0 1 1 0 0 Dvd functionality in cdrom.sys PnpM 0 0 0 0 1 1 0 0 PNPMGR veto buffer , Binary: nt!pnp Ntfm 0 0 0 0 3 1 2 992 NTFS_MCB_ARRAY , Binary: ntfs.sys EcCb 1 1 0 0 0 0 0 0 UNKNOWN pooltag 'EcCb', please update pooltag.txt NtfS 0 0 0 0 3 0 3 1824 SCB_INDEX , Binary: ntfs.sys Txis 0 0 0 0 1 0 1 64 TXF_ISO_SNAPSHOT , Binary: ntfs.sys IoOp 0 0 0 0 0 0 0 0 I/O subsystem open packet , Binary: nt!io Txls 0 0 0 0 1 0 1 48 TXF_CANCEL_LSN , Binary: ntfs.sys NBSr 0 0 0 0 2 2 0 0 registry allocations SeFS 0 0 0 0 2 0 2 64 Security File System Notify Context , Binary: nt!se AlSc 0 0 0 0 161 103 58 7424 ALPC section , Binary: nt!alpc Txfs 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'Txfs', please update pooltag.txt Nb26 4 4 0 0 0 0 0 0 NetBT device exports , Binary: netbt.sys NtFS 0 0 0 0 485 128 357 86064 SecurSup.c , Binary: ntfs.sys PfTt 0 0 0 0 70 60 10 45056 Pf Translation tables , Binary: nt!pf IoFu 0 0 0 0 1 1 0 0 Io file utils , Binary: nt!pnp IoFc 0 0 0 0 1 0 1 144 Io name transmogrify operation , Binary: nt!io SeLS 0 0 0 0 1 0 1 144 Security Logon Session tracking array , Binary: nt!se NtfF 0 0 0 0 3378 1290 2088 2906496 FCB_INDEX , Binary: ntfs.sys EMit 0 0 0 0 5586 5155 431 43680 UNKNOWN pooltag 'EMit', please update pooltag.txt EcIo 22752 22752 0 0 0 0 0 0 UNKNOWN pooltag 'EcIo', please update pooltag.txt HGKS 4 4 0 0 0 0 0 0 UNKNOWN pooltag 'HGKS', please update pooltag.txt Pwmi 18 18 0 0 0 0 0 0 PACER WMI notifications , Binary: pacer.sys ARFT 0 0 0 0 3 0 3 192 UNKNOWN pooltag 'ARFT', please update pooltag.txt NtFF 0 0 0 0 39 39 0 0 FileInfo.c , Binary: ntfs.sys Txfu 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'Txfu', please update pooltag.txt ScPD 0 0 0 0 0 0 0 0 SRB_DATA allocations WmGE 0 0 0 0 1 0 1 81968 Wmi GuidEntry chunks FMus 0 0 0 0 5 3 2 64 Unicode string , Binary: fltmgr.sys VoSo 0 0 0 0 2 0 2 96 Old heap entry allocations , Binary: volsnap.sys NtFU 0 0 0 0 27434 26915 519 95584 usnsup.c , Binary: ntfs.sys EP.. 0 0 0 0 2 1 1 112 UNKNOWN pooltag ' EP', please update pooltag.txt NpFs 0 0 0 0 14215 13217 998 95808 Client security context , Binary: npfs.sys WmMR 0 0 0 0 1 0 1 960 Wmi MofResouce chunks ObCl 0 0 0 0 0 0 0 0 UNKNOWN pooltag 'ObCl', please update pooltag.txt UlCP 0 0 0 0 3 2 1 592 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys ScVk 1 1 0 0 0 0 0 0 read buffer for DVD keys KsRp 0 0 0 0 5 5 0 0 UNKNOWN pooltag 'KsRp', please update pooltag.txt Rqrv 0 0 0 0 8945 8928 17 16640 Registry query buffer WmiI 0 0 0 0 1 1 0 0 Wmi Instance Names Txfh 0 0 0 0 1 1 0 0 UNKNOWN pooltag 'Txfh', please update pooltag.txt PcPc 0 0 0 0 2 0 2 160 WDM audio stuff ClfO 0 0 0 0 1 0 1 4096 CLFS Log zero page , Binary: clfs.sys ObSc 0 0 0 0 19502 17722 1780 446992 Object security descriptor cache block , Binary: nt!ob PcFp 0 0 0 0 4 0 4 2848 WDM audio stuff Symt 0 0 0 0 222 33 189 11664 Symbolic link target strings KRC 0 0 0 0 8 8 0 0 UNKNOWN pooltag 'KRC ', please update pooltag.txt Afdt 0 0 0 0 8 2 6 688 Afd transport address buffer , Binary: afd.sys Nbti 8 8 0 0 0 0 0 0 NetBT device list , Binary: netbt.sys SWid 0 0 0 0 7 0 7 672 device ID Ntfo 0 0 0 0 3602 1502 2100 414240 SCB_INDEX normalized named buffer , Binary: ntfs.sys RaSr 11 11 0 0 0 0 0 0 RaidAllocateSrb storport!_SCSI_REQUEST_BLOCK , Binary: storport.sys ClMn 0 0 0 0 97 90 7 1504 UNKNOWN pooltag 'ClMn', please update pooltag.txt Se 1 1 0 0 144768 132789 11979 1066240 General security allocations , Binary: nt!se PfVA 18 18 0 0 0 0 0 0 Pf VA prefetching buffers , Binary: nt!pf CM20 0 0 0 0 1 0 1 8192 Internal Configuration manager allocations , Binary: nt!cm CM10 0 0 0 0 19 6 13 37648 Internal Configuration manager allocations , Binary: nt!cm CcPM 0 0 0 0 11 9 2 12352 Prefetcher metadata , Binary: nt!ccpf DfCo 0 0 0 0 1 0 1 144 DFS Client allocations , Binary: dfsc.sys TCPT 0 0 0 0 0 0 0 0 TCB pool , Binary: TCP BCDK 0 0 0 0 30 30 0 0 Kernel boot configuration data. , Binary: nt!init SWpd 1 1 0 0 0 0 0 0 POOLTAG_DEVICE_PDOEXTENSION NDpo 8 8 0 0 0 0 0 0 NDIS_TAG_PORT , Binary: ndis.sys CM27 0 0 0 0 17 6 11 17568 Internal Configuration manager allocations , Binary: nt!cm CM17 0 0 0 0 9 0 9 147456 Internal Configuration manager allocations , Binary: nt!cm SeSa 0 0 0 0 154 142 12 1120 Security SID and Attributes , Binary: nt!se SeTa 0 0 0 0 154 142 12 656 Security Temporary Array , Binary: nt!se MsFN 0 0 0 0 1 0 1 64 Mailslot FCB name buffer, name for each created mailslot Ntfl 0 0 0 0 5 0 5 1280 LCB , Binary: ntfs.sys TOTAL 2419087 2234842 184245 86732448 3115477 2757232 358245 106024064 1: kd> u fffff800`0193ce00 nt!ExFreePoolWithTag: fffff800`0193ce00 c3 ret fffff800`0193ce01 f355 rep push rbp fffff800`0193ce03 56 push rsi fffff800`0193ce04 57 push rdi fffff800`0193ce05 4156 push r14 fffff800`0193ce07 4157 push r15 fffff800`0193ce09 4881ec88000000 sub rsp,88h fffff800`0193ce10 8b0532d70200 mov eax,dword ptr [nt!ExpSpecialAllocations (fffff800`0196a548)] 1: kd> a fffff800`0193ce00 fffff800`0193ce00 push rbx ^ Couldn't resolve 'push rbx' fffff800`0193ce00 1: kd> ew fffff800`0193ce00 fff3 1: kd> u fffff800`0193ce00 nt!ExFreePoolWithTag: fffff800`0193ce00 f3ff5556 rep call qword ptr [rbp+56h] fffff800`0193ce04 57 push rdi fffff800`0193ce05 4156 push r14 fffff800`0193ce07 4157 push r15 fffff800`0193ce09 4881ec88000000 sub rsp,88h fffff800`0193ce10 8b0532d70200 mov eax,dword ptr [nt!ExpSpecialAllocations (fffff800`0196a548)] fffff800`0193ce16 4c8bf1 mov r14,rcx fffff800`0193ce19 85c0 test eax,eax 1: kd> ew fffff800`0193ce00 f3ff 1: kd> u fffff800`0193ce00 nt!ExFreePoolWithTag: fffff800`0193ce00 fff3 push rbx fffff800`0193ce02 55 push rbp fffff800`0193ce03 56 push rsi fffff800`0193ce04 57 push rdi fffff800`0193ce05 4156 push r14 fffff800`0193ce07 4157 push r15 fffff800`0193ce09 4881ec88000000 sub rsp,88h fffff800`0193ce10 8b0532d70200 mov eax,dword ptr [nt!ExpSpecialAllocations (fffff800`0196a548)] 1: kd> g Break instruction exception - code 80000003 (first chance) ******************************************************************************* * * * You are seeing this message because you pressed either * * CTRL+C (if you run console kernel debugger) or, * * CTRL+BREAK (if you run GUI kernel debugger), * * on your debugger machine's keyboard. * * * * THIS IS NOT A BUG OR A SYSTEM CRASH * * * * If you did not intend to break into the debugger, press the "g" key, then * * press the "Enter" key now. This message might immediately reappear. If it * * does, press "g" and "Enter" again. * * * ******************************************************************************* nt!RtlpBreakWithStatusInstruction: fffff800`018472a0 cc int 3 0: kd> !vm *** Virtual Memory Usage *** Physical Memory: 261872 ( 1047488 Kb) Page File: \??\C:\pagefile.sys Current: 1126400 Kb Free Space: 1004416 Kb Minimum: 1126400 Kb Maximum: 1126400 Kb Available Pages: 109396 ( 437584 Kb) ResAvail Pages: 211065 ( 844260 Kb) Locked IO Pages: 0 ( 0 Kb) Free System PTEs: 268314411 (1073257644 Kb) Modified Pages: 6615 ( 26460 Kb) Modified PF Pages: 6579 ( 26316 Kb) NonPagedPool Usage: 21368 ( 85472 Kb) NonPagedPool Max: 98304 ( 393216 Kb) PagedPool 0 Usage: 9611 ( 38444 Kb) PagedPool 1 Usage: 7494 ( 29976 Kb) PagedPool 2 Usage: 3260 ( 13040 Kb) PagedPool 3 Usage: 3219 ( 12876 Kb) PagedPool 4 Usage: 3268 ( 13072 Kb) PagedPool Usage: 26852 ( 107408 Kb) PagedPool Maximum: 33554432 ( 134217728 Kb) Session Commit: 8547 ( 34188 Kb) Shared Commit: 4550 ( 18200 Kb) Special Pool: 0 ( 0 Kb) Shared Process: 5010 ( 20040 Kb) PagedPool Commit: 26852 ( 107408 Kb) Driver Commit: 3148 ( 12592 Kb) Committed pages: 169521 ( 678084 Kb) Commit limit: 532419 ( 2129676 Kb) Total Private: 93030 ( 372120 Kb) 03bc svchost.exe 15124 ( 60496 Kb) 0340 svchost.exe 10613 ( 42452 Kb) 0100 SearchIndexer.e 8660 ( 34640 Kb) 0644 explorer.exe 6873 ( 27492 Kb) 03cc svchost.exe 5552 ( 22208 Kb) 046c svchost.exe 4217 ( 16868 Kb) 03a0 svchost.exe 3936 ( 15744 Kb) 054c svchost.exe 3647 ( 14588 Kb) 0184 audiodg.exe 3244 ( 12976 Kb) 0450 taskeng.exe 2466 ( 9864 Kb) 0530 spoolsv.exe 2214 ( 8856 Kb) 0710 vmtoolsd.exe 2148 ( 8592 Kb) 06fc MSASCui.exe 2005 ( 8020 Kb) 0894 dllhost.exe 1858 ( 7432 Kb) 0760 vmtoolsd.exe 1761 ( 7044 Kb) 040c svchost.exe 1642 ( 6568 Kb) 01ec csrss.exe 1561 ( 6244 Kb) 01a0 SLsvc.exe 1333 ( 5332 Kb) 0254 lsass.exe 1134 ( 4536 Kb) 0320 svchost.exe 1085 ( 4340 Kb) 0af4 ieuser.exe 1046 ( 4184 Kb) 09e8 msdtc.exe 864 ( 3456 Kb) 02e8 svchost.exe 856 ( 3424 Kb) 0a80 wuauclt.exe 783 ( 3132 Kb) 0120 TPAutoConnSvc.e 781 ( 3124 Kb) 025c lsm.exe 770 ( 3080 Kb) 0004 System 747 ( 2988 Kb) 0a44 TPAutoConnect.e 745 ( 2980 Kb) 0708 VMwareTray.exe 744 ( 2976 Kb) 0218 services.exe 736 ( 2944 Kb) 0234 winlogon.exe 662 ( 2648 Kb) 08cc taskeng.exe 659 ( 2636 Kb) 01b8 csrss.exe 638 ( 2552 Kb) 0190 svchost.exe 635 ( 2540 Kb) 0624 dwm.exe 469 ( 1876 Kb) 01d8 wininit.exe 429 ( 1716 Kb) 0288 svchost.exe 279 ( 1116 Kb) 0174 smss.exe 114 ( 456 Kb) 0988 iexplore.exe 0 ( 0 Kb) 097c logon.scr 0 ( 0 Kb) 08ec iexplore.exe 0 ( 0 Kb) 0584 SearchFilterHos 0 ( 0 Kb) 0430 iexplore.exe 0 ( 0 Kb) 03f0 SearchProtocolH 0 ( 0 Kb) 009c notepad.exe 0 ( 0 Kb) 0: kd> .logclose Closing open log file c:\DebuggingTV\0x27.txt