Reduce runtime for and allocations from BaseConsoleLogger.IndentString #8934
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
danmoseley
reviewed
Jun 22, 2023
danmoseley
reviewed
Jun 22, 2023
|
@stephentoub do we officially support writing directly into a string like this (it is newly created)? I know we do it in StringBuilder but that's corelib. |
Most definitely no. It will work today. Zero guarantees about it working tomorrow. |
|
I guess then it should use StringBuilder and then ToString(), which is allowed to do it😊 |
Just curious, how could it break? Assuming it's a fresh string, not interned, no other references, it's fixed and they stay inside it. |
For example, yes. Or it could intern it and hand the same instance out to someone else who created a string of the same length and contents as provided to the ctor. Or other such things. |
There is no way this can be broken on .NET Framework given how many places this is done. This would break a lot. All usage I've seen over the years is via string that the person just created. |
|
Is a pooled StringBuilder less desirable? Either way there's no reason to do it on .NET Core. |
|
Agreed on .NET Core, I personally missed that these APIs were added. A pooled string builder could be a replacement, but not always convenient in larger strings where you don't want to put the resulting builder back into the pool to avoid leaking. It also chunks in 8K blocks for reasons I don't understand. |
|
Can you share your benchmark code please? |
To avoid copies on resize and LOH I guess. Something we might consider in future is adding a mechanism to give a SB its buffers so we can pool nicely sized ones. |
|
Of course this change could add such a thing locally. |
|
It is sized to be under LOH, but LOH is 85K. :) Anyway, if StringBuilder pooling was good enough, |
|
Pooling has a cost, and also assumes it will be used again. String create is just straight line cost. |
|
For this case, I'd really like to see benchmarks on the much more maintainable approach of avoiding |
|
Sure, I'm sure Jeff can provide that, I've added a link to the telemetry data in the bug, at its worse this path allocates 358 MB/s over a 60 second period, 70% of which ends up on the LOH. Anything is better than String.Split. |
StringBuilder is kind of terrible for these kinds of situations as it copies the incoming strings into char[]'s just to then allocate a .NET string off them, which means memory will be 2x the incoming string length (actually likely more due to how StringBuilder works internally). When you are processing an incoming string and returning the result within the same call, in hot path areas (as GCPauseWatson has shown this to be), we are well past the point where we can choose the easiest solution, as we have ample evidence (i.e. thousands of results in GCPauseWatson of users experiencing long GC pauses due to heavy allocation activity in short time spans) showing it simply doesn't scale. Simply eliminating String.Split is a definite win either way, but creating unnecessary char[]s that cause GC pressure and more frequent long duration GCs is not a winning strategy. |
|
Benchmark source is here. TL;DRCachedStringBuilder is very slightly slower and more memory hungry than Optimized, but still a substantial improvement over Original. SummaryI added a new benchmark, CachedStringBuilder. It uses Full results below, but to summarize:
ProposalI propose using CachedStringBuilder in the product instead of Optimized, since I think the maintainability gain outweighs the small perf loss. I welcome feedback on the 512 character (1024 byte) upper bound on the cached builder's capacity. Results
```
BenchmarkDotNet=v0.13.5, OS=Windows 11 (10.0.22631.1900)
Intel Core i9-10900 CPU 2.80GHz, 1 CPU, 20 logical and 10 physical cores
[Host] : .NET Framework 4.8.1 (4.8.9166.0), X64 RyuJIT VectorSize=256
.NET 7.0 : .NET 7.0.7 (7.0.723.27404), X64 RyuJIT AVX2
.NET Framework 4.7.2 : .NET Framework 4.8.1 (4.8.9166.0), X64 RyuJIT VectorSize=256
|
|
@stephentoub i wonder what we could do (in .NET Core only, of course) to help make it possible to get closer to the unsafe/unsupported performance seen here. |
|
Does Benchmark.net show LOH? There were traces with LOH contribution here, so strings splits were greater than 42KB that you might want to check. |
What are these words could and closer you're using?
using System;
using System.Buffers;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.CompilerServices;
using BenchmarkDotNet.Attributes;
using BenchmarkDotNet.Jobs;
using BenchmarkDotNet.Running;
#pragma warning disable CS8500
#nullable enable
// Sanity check same results
var indenter = new MsBuildIndent() { StringCount = 10 };
foreach (string s in MsBuildIndent._fixedStringsToIndent)
{
string[] first = indenter.Nerdsnipe().ToArray();
string[] second = indenter.Optimized().ToArray();
if (!first.SequenceEqual(second)) throw new Exception("Not equal");
}
// Run benchmarks
BenchmarkRunner.Run<MsBuildIndent>();
[MemoryDiagnoser]
[SimpleJob(RuntimeMoniker.Net80)]
public class MsBuildIndent
{
private readonly List<string> _list = new();
private const int Indent = 5;
[Params(2, 4, 8, 16, 32, 64, 128, 256, 512)]
public int StringCount { get; set; }
private string[] _stringsToIndent = _fixedStringsToIndent;
private List<string> Run(Func<string, int, string> indent)
{
List<string> results = _list;
results.Clear();
for (int i = 0; i < StringCount; i++)
{
results.Add(indent(_stringsToIndent[i], Indent));
}
return results;
}
[Benchmark]
public List<string> Nerdsnipe() => Run(NerdsnipeStringIndenter.IndentString);
private static unsafe class NerdsnipeStringIndenter
{
[SkipLocalsInit]
internal static string IndentString(string? s, int indent)
{
if (s is null)
{
return string.Empty;
}
Span<StringSegment> segments = GetStringSegments(s, stackalloc StringSegment[128], out StringSegment[]? pooledArray);
int indentedStringLength = segments.Length * (Environment.NewLine.Length + indent);
foreach (StringSegment segment in segments)
{
indentedStringLength += segment.Length;
}
string result = string.Create(indentedStringLength, (s, (IntPtr)(&segments), indent), static (output, state) =>
{
ReadOnlySpan<char> input = state.s;
foreach (StringSegment segment in *(Span<StringSegment>*)state.Item2)
{
// Append indent
output.Slice(0, state.indent).Fill(' ');
output = output.Slice(state.indent);
// Append string segment
input.Slice(0, segment.Length).CopyTo(output);
input = input.Slice(segment.TotalLength);
output = output.Slice(segment.Length);
// Append newline
Environment.NewLine.CopyTo(output);
output = output.Slice(Environment.NewLine.Length);
}
});
if (pooledArray is not null)
{
ArrayPool<StringSegment>.Shared.Return(pooledArray);
}
return result;
}
private static Span<StringSegment> GetStringSegments(ReadOnlySpan<char> input, Span<StringSegment> segments, out StringSegment[]? pooledArray)
{
if (input.IsEmpty)
{
segments = segments.Slice(0, 1);
segments[0] = new StringSegment(0, 0);
pooledArray = null;
return segments;
}
int segmentCount = 1 + input.Count('\n');
if (segmentCount <= segments.Length)
{
pooledArray = null;
segments = segments.Slice(0, segmentCount);
}
else
{
pooledArray = ArrayPool<StringSegment>.Shared.Rent(segments.Length);
segments = pooledArray.AsSpan(0, segmentCount);
}
for (int i = 0; i < segments.Length; i++)
{
int index = input.IndexOf('\n');
if (index < 0)
{
segments[i] = new StringSegment(input.Length, 0);
break;
}
int newLineLength = 1;
if (index > 0 && input[index - 1] == '\r')
{
newLineLength++;
index--;
}
segments[i] = new StringSegment(index, newLineLength);
input = input.Slice(index + newLineLength);
}
return segments;
}
private readonly record struct StringSegment(int Length, int NewLineLength)
{
public int TotalLength => Length + NewLineLength;
}
}
[Benchmark(Baseline = true)]
public List<string> Optimized() => Run(OptimizedStringIndenter.IndentString);
private static class OptimizedStringIndenter
{
internal static string IndentString(string? s, int indent)
{
if (s is null)
{
return string.Empty;
}
string newLine = Environment.NewLine;
using PooledSpan<StringSegment> segments = GetStringSegments(s);
int indentedStringLength = ComputeIndentedStringLength(segments, newLine, indent);
string indented = new string('\0', indentedStringLength);
unsafe
{
fixed (char* pInput = s)
fixed (char* pIndented = indented)
{
char* pSegment = pInput;
char* pOutput = pIndented;
foreach (var segment in segments)
{
// append indent
for (int i = 0; i < indent; i++)
{
*pOutput++ = ' ';
}
// append string segment
int byteCount = segment.Length * sizeof(char);
Buffer.MemoryCopy(pSegment, pOutput, byteCount, byteCount);
pOutput += segment.Length;
// append newLine
for (int i = 0; i < newLine.Length; i++)
{
*pOutput++ = newLine[i];
}
// move to next segment
pSegment += segment.TotalLength;
}
}
}
return indented;
// local method
static int ComputeIndentedStringLength(PooledSpan<StringSegment> segments, string newLine, int indent)
{
int indentedLength = segments.Length * (newLine.Length + indent);
foreach (var segment in segments)
{
indentedLength += segment.Length;
}
return indentedLength;
}
}
private static PooledSpan<StringSegment> GetStringSegments(string input)
{
if (input.Length == 0)
{
PooledSpan<StringSegment> emptyResult = new(1);
emptyResult.Span[0] = new StringSegment(0, 0);
return emptyResult;
}
int segmentCount = 1;
for (int i = 0; i < input.Length; i++)
{
if (input[i] == '\n')
{
segmentCount++;
}
}
PooledSpan<StringSegment> segments = new(segmentCount);
int start = 0;
int index = 0;
for (int i = 0; i < segmentCount; i++)
{
while (index < input.Length && input[index] != '\n')
{
index++;
}
// the input string didn't end with a newline
if (index == input.Length)
{
segments[i] = new StringSegment(index - start, 0);
break;
}
int newLineLength = 1;
bool endedWithReturnNewline = (index > 0) && (input[index - 1] == '\r');
if (endedWithReturnNewline)
{
newLineLength++;
index--;
}
segments[i] = new StringSegment(index - start, newLineLength);
start = index += newLineLength;
}
return segments;
}
private readonly record struct StringSegment(int Length, int NewLineLength)
{
public int TotalLength => Length + NewLineLength;
}
private ref struct PooledSpan<T>
{
private static readonly ArrayPool<T> Pool = ArrayPool<T>.Shared;
private readonly T[] _pooledArray;
public PooledSpan(int length)
{
_pooledArray = Pool.Rent(length);
Array.Clear(_pooledArray, 0, length);
Span = _pooledArray.AsSpan(0, length);
}
public void Dispose()
{
Pool.Return(_pooledArray);
}
public Span<T> Span { get; }
public int Length => Span.Length;
public Span<T>.Enumerator GetEnumerator() => Span.GetEnumerator();
public T this[int index]
{
get => Span[index];
set => Span[index] = value;
}
}
}
internal static readonly string[] _fixedStringsToIndent = new string[]
{
"c:\\Windows\\System32\\0\r\nc:\\Windows\\System32\\07409496-a423-4a3e-b620-2cfb01a9318d_HyperV-ComputeNetwork.dll\nc:\\Windows\\System32\\0ae3b998-9a38-4b72-a4c4-06849441518d_Servicing-Stack.dll\r\n",
"c:\\Windows\\System32\\4545ffe2-0dc4-4df4-9d02-299ef204635e_hvsocket.dll\r\nc:\\Windows\\System32\\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice.dll\nc:\\Windows\\System32\\6bea57fb-8dfb-4177-9ae8-42e8b3529933_RuntimeDeviceInstall.dll\n",
"c:\\Windows\\System32\\@AdvancedKeySettingsNotification.png\r\nc:\\Windows\\System32\\@AppHelpToast.png\r\nc:\\Windows\\System32\\@AudioToastIcon.png",
"c:\\Windows\\System32\\@BackgroundAccessToastIcon.png\nc:\\Windows\\System32\\@bitlockertoastimage.png\nc:\\Windows\\System32\\@edptoastimage.png",
"c:\\Windows\\System32\\@EnrollmentToastIcon.png\nc:\\Windows\\System32\\@facial-recognition-windows-hello.gif\r\nc:\\Windows\\System32\\@language_notification_icon.png",
"c:\\Windows\\System32\\@optionalfeatures.png\r\nc:\\Windows\\System32\\@StorageSenseToastIcon.png\r\nc:\\Windows\\System32\\@VpnToastIcon.png\n",
"c:\\Windows\\System32\\@WindowsHelloFaceToastIcon.png\nc:\\Windows\\System32\\@WindowsUpdateToastIcon.contrast-black.png\r\nc:\\Windows\\System32\\@WindowsUpdateToastIcon.contrast-white.png\n",
"c:\\Windows\\System32\\@WindowsUpdateToastIcon.png\nc:\\Windows\\System32\\@WirelessDisplayToast.png\r\nc:\\Windows\\System32\\@WLOGO_96x96.png\n",
"c:\\Windows\\System32\\aadauthhelper.dll\r\nc:\\Windows\\System32\\aadcloudap.dll\r\nc:\\Windows\\System32\\aadjcsp.dll\r\n",
"c:\\Windows\\System32\\aadtb.dll\r\nc:\\Windows\\System32\\aadWamExtension.dll\nc:\\Windows\\System32\\AarSvc.dll",
"c:\\Windows\\System32\\AboutSettingsHandlers.dll\r\nc:\\Windows\\System32\\AboveLockAppHost.dll\r\nc:\\Windows\\System32\\accessibilitycpl.dll\n",
"c:\\Windows\\System32\\accountaccessor.dll\r\nc:\\Windows\\System32\\AccountsRt.dll\r\nc:\\Windows\\System32\\AcGenral.dll",
"c:\\Windows\\System32\\AcLayers.dll\r\nc:\\Windows\\System32\\acledit.dll\r\nc:\\Windows\\System32\\aclui.dll\n",
"c:\\Windows\\System32\\acmigration.dll\nc:\\Windows\\System32\\ACPBackgroundManagerPolicy.dll\r\nc:\\Windows\\System32\\acppage.dll\r\n",
"c:\\Windows\\System32\\acproxy.dll\nc:\\Windows\\System32\\AcSpecfc.dll\nc:\\Windows\\System32\\ActionCenter.dll\r\n",
"c:\\Windows\\System32\\ActionCenterCPL.dll\r\nc:\\Windows\\System32\\ActionQueue.dll\r\nc:\\Windows\\System32\\ActivationClient.dll\r\n",
"c:\\Windows\\System32\\ActivationManager.dll\nc:\\Windows\\System32\\ActivationVdev.dll\nc:\\Windows\\System32\\activeds.dll\n",
"c:\\Windows\\System32\\activeds.tlb\nc:\\Windows\\System32\\ActiveHours.png\nc:\\Windows\\System32\\ActiveSyncCsp.dll\r\n",
"c:\\Windows\\System32\\ActiveSyncProvider.dll\nc:\\Windows\\System32\\actxprxy.dll\nc:\\Windows\\System32\\AcWinRT.dll\r\n",
"c:\\Windows\\System32\\AcXtrnal.dll\r\nc:\\Windows\\System32\\adal.dll\r\nc:\\Windows\\System32\\AdaptiveCards.dll\r\n",
"c:\\Windows\\System32\\AddressParser.dll\nc:\\Windows\\System32\\adhapi.dll\r\nc:\\Windows\\System32\\adhsvc.dll\n",
"c:\\Windows\\System32\\AdmTmpl.dll\r\nc:\\Windows\\System32\\adprovider.dll\nc:\\Windows\\System32\\adrclient.dll",
"c:\\Windows\\System32\\adsldp.dll\r\nc:\\Windows\\System32\\adsldpc.dll\nc:\\Windows\\System32\\adsmsext.dll\n",
"c:\\Windows\\System32\\adsnt.dll\r\nc:\\Windows\\System32\\adtschema.dll\r\nc:\\Windows\\System32\\AdvancedEmojiDS.dll\r\n",
"c:\\Windows\\System32\\advapi32.dll\r\nc:\\Windows\\System32\\advapi32res.dll\nc:\\Windows\\System32\\advpack.dll",
"c:\\Windows\\System32\\aeevts.dll\nc:\\Windows\\System32\\aeinv.dll\r\nc:\\Windows\\System32\\aepic.dll",
"c:\\Windows\\System32\\agentactivationruntime.dll\nc:\\Windows\\System32\\agentactivationruntimestarter.exe\nc:\\Windows\\System32\\agentactivationruntimewindows.dll\r\n",
"c:\\Windows\\System32\\AgentService.exe\r\nc:\\Windows\\System32\\AggregatorHost.exe\nc:\\Windows\\System32\\aitstatic.exe",
"c:\\Windows\\System32\\AJRouter.dll\nc:\\Windows\\System32\\alg.exe\nc:\\Windows\\System32\\amcompat.tlb",
"c:\\Windows\\System32\\amsi.dll\r\nc:\\Windows\\System32\\amsiproxy.dll\r\nc:\\Windows\\System32\\amstream.dll",
"c:\\Windows\\System32\\Analog.Shell.Broker.dll\nc:\\Windows\\System32\\AnalogCommonProxyStub.dll\r\nc:\\Windows\\System32\\apds.dll\r\n",
"c:\\Windows\\System32\\APHostClient.dll\r\nc:\\Windows\\System32\\APHostRes.dll\nc:\\Windows\\System32\\APHostService.dll",
"c:\\Windows\\System32\\apisampling.dll\r\nc:\\Windows\\System32\\ApiSetHost.AppExecutionAlias.dll\r\nc:\\Windows\\System32\\apisetschema.dll",
"c:\\Windows\\System32\\APMon.dll\r\nc:\\Windows\\System32\\APMonUI.dll\r\nc:\\Windows\\System32\\AppContracts.dll\n",
"c:\\Windows\\System32\\AppExtension.dll\r\nc:\\Windows\\System32\\apphelp.dll\nc:\\Windows\\System32\\Apphlpdm.dll\r\n",
"c:\\Windows\\System32\\AppHostRegistrationVerifier.exe\r\nc:\\Windows\\System32\\appidapi.dll\r\nc:\\Windows\\System32\\appidcertstorecheck.exe\r\n",
"c:\\Windows\\System32\\appidpolicyconverter.exe\r\nc:\\Windows\\System32\\AppIdPolicyEngineApi.dll\nc:\\Windows\\System32\\appidsvc.dll",
"c:\\Windows\\System32\\appidtel.exe\r\nc:\\Windows\\System32\\appinfo.dll\r\nc:\\Windows\\System32\\appinfoext.dll",
"c:\\Windows\\System32\\AppInstallerBackgroundUpdate.exe\r\nc:\\Windows\\System32\\AppInstallerPrompt.Desktop.dll\nc:\\Windows\\System32\\ApplicationControlCSP.dll\r\n",
"c:\\Windows\\System32\\ApplicationFrame.dll\nc:\\Windows\\System32\\ApplicationFrameHost.exe\r\nc:\\Windows\\System32\\AppListBackupLauncher.dll",
"c:\\Windows\\System32\\AppLockerCSP.dll\r\nc:\\Windows\\System32\\ApplySettingsTemplateCatalog.exe\r\nc:\\Windows\\System32\\ApplyTrustOffline.exe",
"c:\\Windows\\System32\\AppManagementConfiguration.dll\nc:\\Windows\\System32\\appmgmts.dll\r\nc:\\Windows\\System32\\appmgr.dll\n",
"c:\\Windows\\System32\\AppMon.dll\r\nc:\\Windows\\System32\\AppointmentActivation.dll\r\nc:\\Windows\\System32\\AppointmentApis.dll\n",
"c:\\Windows\\System32\\appraiser.dll\nc:\\Windows\\System32\\AppReadiness.dll\r\nc:\\Windows\\System32\\apprepapi.dll",
"c:\\Windows\\System32\\AppResolver.dll\r\nc:\\Windows\\System32\\ApproveChildRequest.exe\r\nc:\\Windows\\System32\\appsruprov.dll",
"c:\\Windows\\System32\\AppVCatalog.dll\nc:\\Windows\\System32\\AppVClient.exe\r\nc:\\Windows\\System32\\AppvClientEventLog.dll",
"c:\\Windows\\System32\\AppVClientPS.dll\r\nc:\\Windows\\System32\\AppVDllSurrogate.exe\r\nc:\\Windows\\System32\\AppVEntStreamingManager.dll\r\n",
"c:\\Windows\\System32\\AppVEntSubsystemController.dll\nc:\\Windows\\System32\\AppVEntSubsystems64.dll\nc:\\Windows\\System32\\AppVEntVirtualization.dll\r\n",
"c:\\Windows\\System32\\appverif.chm\r\nc:\\Windows\\System32\\appverif.exe\r\nc:\\Windows\\System32\\appverif.ico",
"c:\\Windows\\System32\\appverifUI.dll\r\nc:\\Windows\\System32\\appvetwclientres.dll\nc:\\Windows\\System32\\appvetwsharedperformance.dll\r\n",
"c:\\Windows\\System32\\appvetwstreamingux.dll\r\nc:\\Windows\\System32\\AppVFileSystemMetadata.dll\nc:\\Windows\\System32\\AppVIntegration.dll\r\n",
"c:\\Windows\\System32\\AppVManifest.dll\nc:\\Windows\\System32\\AppVNice.exe\nc:\\Windows\\System32\\AppVOrchestration.dll",
"c:\\Windows\\System32\\AppVPolicy.dll\nc:\\Windows\\System32\\AppVPublishing.dll\nc:\\Windows\\System32\\AppVReporting.dll",
"c:\\Windows\\System32\\AppVScripting.dll\r\nc:\\Windows\\System32\\AppVSentinel.dll\nc:\\Windows\\System32\\AppVShNotify.exe\n",
"c:\\Windows\\System32\\AppVStreamingUX.dll\nc:\\Windows\\System32\\AppVStreamMap.dll\nc:\\Windows\\System32\\AppVTerminator.dll\n",
"c:\\Windows\\System32\\appwiz.cpl\nc:\\Windows\\System32\\AppxAllUserStore.dll\r\nc:\\Windows\\System32\\AppXApplicabilityBlob.dll",
"c:\\Windows\\System32\\AppxApplicabilityEngine.dll\nc:\\Windows\\System32\\AppXDeploymentClient.dll\r\nc:\\Windows\\System32\\AppXDeploymentExtensions.desktop.dll",
"c:\\Windows\\System32\\AppXDeploymentExtensions.onecore.dll\nc:\\Windows\\System32\\AppXDeploymentServer.dll\r\nc:\\Windows\\System32\\AppxPackaging.dll",
"c:\\Windows\\System32\\AppxProvisioning.xml\r\nc:\\Windows\\System32\\AppxSip.dll\r\nc:\\Windows\\System32\\AppxStreamingDataSourcePS.dll\n",
"c:\\Windows\\System32\\AppxSysprep.dll\r\nc:\\Windows\\System32\\Apx01000.dll\r\nc:\\Windows\\System32\\archiveint.dll",
"c:\\Windows\\System32\\ARP.EXE\nc:\\Windows\\System32\\asferror.dll\nc:\\Windows\\System32\\aspnet_counters.dll\n",
"c:\\Windows\\System32\\AssignedAccessCsp.dll\nc:\\Windows\\System32\\AssignedAccessGuard.exe\nc:\\Windows\\System32\\AssignedAccessManager.dll",
"c:\\Windows\\System32\\assignedaccessmanagersvc.dll\nc:\\Windows\\System32\\assignedaccessproviderevents.dll\nc:\\Windows\\System32\\AssignedAccessRuntime.dll",
"c:\\Windows\\System32\\AssignedAccessShellProxy.dll\nc:\\Windows\\System32\\asycfilt.dll\nc:\\Windows\\System32\\at.exe\r\n",
"c:\\Windows\\System32\\AtBroker.exe\nc:\\Windows\\System32\\atl.dll\nc:\\Windows\\System32\\atlthunk.dll\n",
"c:\\Windows\\System32\\atmlib.dll\nc:\\Windows\\System32\\AttestationWmiProvider.dll\r\nc:\\Windows\\System32\\attrib.exe\n",
"c:\\Windows\\System32\\audiodg.exe\r\nc:\\Windows\\System32\\AudioEndpointBuilder.dll\r\nc:\\Windows\\System32\\AudioEng.dll",
"c:\\Windows\\System32\\AudioHandlers.dll\r\nc:\\Windows\\System32\\AUDIOKSE.dll\r\nc:\\Windows\\System32\\audioresourceregistrar.dll",
"c:\\Windows\\System32\\AudioSes.dll\r\nc:\\Windows\\System32\\audiosrv.dll\r\nc:\\Windows\\System32\\AudioSrvPolicyManager.dll\r\n",
"c:\\Windows\\System32\\auditcse.dll\nc:\\Windows\\System32\\AuditNativeSnapIn.dll\nc:\\Windows\\System32\\auditpol.exe\r\n",
"c:\\Windows\\System32\\auditpolcore.dll\r\nc:\\Windows\\System32\\AuditPolicyGPInterop.dll\nc:\\Windows\\System32\\auditpolmsg.dll",
"c:\\Windows\\System32\\AuthBroker.dll\nc:\\Windows\\System32\\AuthBrokerUI.dll\r\nc:\\Windows\\System32\\authentication.dll\r\n",
"c:\\Windows\\System32\\AuthExt.dll\nc:\\Windows\\System32\\authfwcfg.dll\r\nc:\\Windows\\System32\\AuthFWGP.dll",
"c:\\Windows\\System32\\AuthFWSnapin.dll\r\nc:\\Windows\\System32\\AuthFWWizFwk.dll\r\nc:\\Windows\\System32\\AuthHost.exe\n",
"c:\\Windows\\System32\\AuthHostProxy.dll\r\nc:\\Windows\\System32\\authui.dll\nc:\\Windows\\System32\\authz.dll\r\n",
"c:\\Windows\\System32\\autochk.exe\r\nc:\\Windows\\System32\\autopilot.dll\r\nc:\\Windows\\System32\\autopilotdiag.dll\n",
"c:\\Windows\\System32\\autoplay.dll\nc:\\Windows\\System32\\autotimesvc.dll\r\nc:\\Windows\\System32\\AverageRoom.bin",
"c:\\Windows\\System32\\avicap32.dll\r\nc:\\Windows\\System32\\avifil32.dll\r\nc:\\Windows\\System32\\avrt.dll",
"c:\\Windows\\System32\\AxInstSv.dll\nc:\\Windows\\System32\\AxInstUI.exe\nc:\\Windows\\System32\\azman.msc\r\n",
"c:\\Windows\\System32\\azroles.dll\nc:\\Windows\\System32\\azroleui.dll\r\nc:\\Windows\\System32\\AzSqlExt.dll\n",
"c:\\Windows\\System32\\baaupdate.exe\nc:\\Windows\\System32\\BackgroundMediaPolicy.dll\nc:\\Windows\\System32\\backgroundTaskHost.exe",
"c:\\Windows\\System32\\BackgroundTransferHost.exe\r\nc:\\Windows\\System32\\BamSettingsClient.dll\r\nc:\\Windows\\System32\\BarcodeProvisioningPlugin.dll",
"c:\\Windows\\System32\\basecsp.dll\r\nc:\\Windows\\System32\\basesrv.dll\r\nc:\\Windows\\System32\\batmeter.dll",
"c:\\Windows\\System32\\bcastdvr.proxy.dll\nc:\\Windows\\System32\\BcastDVRBroker.dll\r\nc:\\Windows\\System32\\BcastDVRClient.dll",
"c:\\Windows\\System32\\BcastDVRCommon.dll\r\nc:\\Windows\\System32\\bcastdvruserservice.dll\r\nc:\\Windows\\System32\\bcd.dll",
"c:\\Windows\\System32\\bcdboot.exe\nc:\\Windows\\System32\\bcdedit.exe\r\nc:\\Windows\\System32\\bcdprov.dll\r\n",
"c:\\Windows\\System32\\bcdsrv.dll\nc:\\Windows\\System32\\BCP47Langs.dll\nc:\\Windows\\System32\\BCP47mrm.dll",
"c:\\Windows\\System32\\bcrypt.dll\nc:\\Windows\\System32\\bcryptprimitives.dll\r\nc:\\Windows\\System32\\bdaplgin.ax\n",
"c:\\Windows\\System32\\bdechangepin.exe\nc:\\Windows\\System32\\BdeHdCfg.exe\nc:\\Windows\\System32\\BdeHdCfgLib.dll",
"c:\\Windows\\System32\\bderepair.dll\nc:\\Windows\\System32\\bdesvc.dll\nc:\\Windows\\System32\\BdeSysprep.dll\r\n",
"c:\\Windows\\System32\\bdeui.dll\r\nc:\\Windows\\System32\\BdeUISrv.exe\r\nc:\\Windows\\System32\\bdeunlock.exe\r\n",
"c:\\Windows\\System32\\BFE.DLL\r\nc:\\Windows\\System32\\bi.dll\nc:\\Windows\\System32\\bidispl.dll\n",
"c:\\Windows\\System32\\bindfltapi.dll\nc:\\Windows\\System32\\BingASDS.dll\r\nc:\\Windows\\System32\\BingFilterDS.dll\r\n",
"c:\\Windows\\System32\\BingMaps.dll\r\nc:\\Windows\\System32\\BingOnlineServices.dll\nc:\\Windows\\System32\\BioCredProv.dll",
"c:\\Windows\\System32\\BioIso.exe\nc:\\Windows\\System32\\bisrv.dll\nc:\\Windows\\System32\\BitLockerCsp.dll\n",
"c:\\Windows\\System32\\BitLockerDeviceEncryption.exe\r\nc:\\Windows\\System32\\BitLockerWizard.exe\nc:\\Windows\\System32\\BitLockerWizardElev.exe",
"c:\\Windows\\System32\\bitsadmin.exe\r\nc:\\Windows\\System32\\bitsigd.dll\nc:\\Windows\\System32\\bitsperf.dll",
"c:\\Windows\\System32\\BitsProxy.dll\r\nc:\\Windows\\System32\\biwinrt.dll\nc:\\Windows\\System32\\BlbEvents.dll",
"c:\\Windows\\System32\\blbres.dll\nc:\\Windows\\System32\\blb_ps.dll\r\nc:\\Windows\\System32\\BluetoothApis.dll\n",
"c:\\Windows\\System32\\BluetoothDesktopHandlers.dll\r\nc:\\Windows\\System32\\BluetoothPairingSystemToastIcon.contrast-black.png\r\nc:\\Windows\\System32\\BluetoothPairingSystemToastIcon.contrast-high.png",
"c:\\Windows\\System32\\BluetoothPairingSystemToastIcon.contrast-white.png\nc:\\Windows\\System32\\BluetoothPairingSystemToastIcon.png\r\nc:\\Windows\\System32\\BluetoothSystemToastIcon.contrast-white.png\r\n",
"c:\\Windows\\System32\\BluetoothSystemToastIcon.png\r\nc:\\Windows\\System32\\bnmanager.dll\nc:\\Windows\\System32\\boot.sdi",
"c:\\Windows\\System32\\bootim.exe\r\nc:\\Windows\\System32\\BootMenuUX.dll\r\nc:\\Windows\\System32\\bootsect.exe",
"c:\\Windows\\System32\\bootstr.dll\r\nc:\\Windows\\System32\\bootsvc.dll\nc:\\Windows\\System32\\bootux.dll",
"c:\\Windows\\System32\\BOOTVID.DLL\r\nc:\\Windows\\System32\\bopomofo.uce\nc:\\Windows\\System32\\bridgeres.dll\n",
"c:\\Windows\\System32\\bridgeunattend.exe\r\nc:\\Windows\\System32\\BrokerFileDialog.dat\nc:\\Windows\\System32\\BrokerFileDialog.dll",
"c:\\Windows\\System32\\BrokerLib.dll\nc:\\Windows\\System32\\browcli.dll\nc:\\Windows\\System32\\browser.dll",
"c:\\Windows\\System32\\browserbroker.dll\nc:\\Windows\\System32\\browserexport.exe\r\nc:\\Windows\\System32\\browser_broker.exe",
"c:\\Windows\\System32\\browseui.dll\r\nc:\\Windows\\System32\\BTAGService.dll\nc:\\Windows\\System32\\BthAvctpSvc.dll\r\n",
"c:\\Windows\\System32\\BthAvrcp.dll\r\nc:\\Windows\\System32\\BthAvrcpAppSvc.dll\nc:\\Windows\\System32\\bthci.dll\n",
"c:\\Windows\\System32\\BthMtpContextHandler.dll\nc:\\Windows\\System32\\bthpanapi.dll\nc:\\Windows\\System32\\BthpanContextHandler.dll\r\n",
"c:\\Windows\\System32\\bthprops.cpl\r\nc:\\Windows\\System32\\BthRadioMedia.dll\nc:\\Windows\\System32\\bthserv.dll",
"c:\\Windows\\System32\\BthTelemetry.dll\r\nc:\\Windows\\System32\\bthudtask.exe\r\nc:\\Windows\\System32\\btpanui.dll\r\n",
"c:\\Windows\\System32\\Bubbles.scr\r\nc:\\Windows\\System32\\BWContextHandler.dll\nc:\\Windows\\System32\\ByteCodeGenerator.exe\r\n",
"c:\\Windows\\System32\\c4d66f00-b6f0-4439-ac9b-c5ea13fe54d7_HyperV-ComputeCore.dll\r\nc:\\Windows\\System32\\cabapi.dll\r\nc:\\Windows\\System32\\cabinet.dll",
"c:\\Windows\\System32\\cabview.dll\nc:\\Windows\\System32\\cacls.exe\nc:\\Windows\\System32\\calc.exe",
"c:\\Windows\\System32\\CallButtons.dll\r\nc:\\Windows\\System32\\CallButtons.ProxyStub.dll\nc:\\Windows\\System32\\CallHistoryClient.dll",
"c:\\Windows\\System32\\CameraCaptureUI.dll\nc:\\Windows\\System32\\CameraSettingsUIHost.exe\r\nc:\\Windows\\System32\\camext.dll\r\n",
"c:\\Windows\\System32\\CapabilityAccessHandlers.dll\nc:\\Windows\\System32\\CapabilityAccessManager.dll\nc:\\Windows\\System32\\CapabilityAccessManagerClient.dll\r\n",
"c:\\Windows\\System32\\capauthz.dll\nc:\\Windows\\System32\\capiprovider.dll\r\nc:\\Windows\\System32\\capisp.dll",
"c:\\Windows\\System32\\CaptureService.dll\nc:\\Windows\\System32\\CastingShellExt.dll\nc:\\Windows\\System32\\CastLaunch.dll",
"c:\\Windows\\System32\\CastSrv.exe\nc:\\Windows\\System32\\catsrv.dll\nc:\\Windows\\System32\\catsrvps.dll\r\n",
"c:\\Windows\\System32\\catsrvut.dll\r\nc:\\Windows\\System32\\CBDHSvc.dll\r\nc:\\Windows\\System32\\cca.dll\n",
"c:\\Windows\\System32\\ccmcore.dll\r\nc:\\Windows\\System32\\CcmFramework.h\nc:\\Windows\\System32\\CcmFramework.ini",
"c:\\Windows\\System32\\ccmperf.dll\r\nc:\\Windows\\System32\\CcmUsrCse.dll\nc:\\Windows\\System32\\cdd.dll\r\n",
"c:\\Windows\\System32\\cdosys.dll\nc:\\Windows\\System32\\cdp.dll\nc:\\Windows\\System32\\cdprt.dll\r\n",
"c:\\Windows\\System32\\cdpsvc.dll\r\nc:\\Windows\\System32\\cdpusersvc.dll\r\nc:\\Windows\\System32\\cellulardatacapabilityhandler.dll",
"c:\\Windows\\System32\\cemapi.dll\r\nc:\\Windows\\System32\\cero.rs\nc:\\Windows\\System32\\certca.dll",
"c:\\Windows\\System32\\certcli.dll\r\nc:\\Windows\\System32\\certCredProvider.dll\r\nc:\\Windows\\System32\\certenc.dll\n",
"c:\\Windows\\System32\\CertEnroll.dll\nc:\\Windows\\System32\\CertEnrollCtrl.exe\nc:\\Windows\\System32\\CertEnrollUI.dll\r\n",
"c:\\Windows\\System32\\certlm.msc\nc:\\Windows\\System32\\certmgr.dll\r\nc:\\Windows\\System32\\certmgr.msc",
"c:\\Windows\\System32\\CertPKICmdlet.dll\nc:\\Windows\\System32\\CertPolEng.dll\r\nc:\\Windows\\System32\\certprop.dll",
"c:\\Windows\\System32\\certreq.exe\r\nc:\\Windows\\System32\\certutil.exe\nc:\\Windows\\System32\\cewmdm.dll\r\n",
"c:\\Windows\\System32\\cfgbkend.dll\nc:\\Windows\\System32\\cfgmgr32.dll\r\nc:\\Windows\\System32\\CfgSPCellular.dll",
"c:\\Windows\\System32\\CfgSPPolicy.dll\r\nc:\\Windows\\System32\\cflapi.dll\nc:\\Windows\\System32\\cfmifs.dll",
"c:\\Windows\\System32\\cfmifsproxy.dll\r\nc:\\Windows\\System32\\Chakra.dll\r\nc:\\Windows\\System32\\Chakradiag.dll",
"c:\\Windows\\System32\\Chakrathunk.dll\nc:\\Windows\\System32\\change.exe\nc:\\Windows\\System32\\changepk.exe\n",
"c:\\Windows\\System32\\charmap.exe\nc:\\Windows\\System32\\chartv.dll\r\nc:\\Windows\\System32\\ChatApis.dll",
"c:\\Windows\\System32\\chcp.com\r\nc:\\Windows\\System32\\CheckNetIsolation.exe\r\nc:\\Windows\\System32\\chglogon.exe",
"c:\\Windows\\System32\\chgport.exe\nc:\\Windows\\System32\\chgusr.exe\r\nc:\\Windows\\System32\\chkdsk.exe\n",
"c:\\Windows\\System32\\chkntfs.exe\nc:\\Windows\\System32\\choice.exe\nc:\\Windows\\System32\\ChsStrokeDS.dll\n",
"c:\\Windows\\System32\\chs_singlechar_pinyin.dat\nc:\\Windows\\System32\\ChtBopomofoDS.dll\r\nc:\\Windows\\System32\\ChtCangjieDS.dll",
"c:\\Windows\\System32\\ChtHkStrokeDS.dll\nc:\\Windows\\System32\\ChtQuickDS.dll\nc:\\Windows\\System32\\ChxAPDS.dll",
"c:\\Windows\\System32\\ChxDecoder.dll\nc:\\Windows\\System32\\ChxHAPDS.dll\nc:\\Windows\\System32\\chxinputrouter.dll",
"c:\\Windows\\System32\\chxranker.dll\nc:\\Windows\\System32\\CHxReadingStringIME.dll\r\nc:\\Windows\\System32\\ci.dll\r\n",
"c:\\Windows\\System32\\cic.dll\nc:\\Windows\\System32\\CIDiag.exe\r\nc:\\Windows\\System32\\cimfs.dll\r\n",
"c:\\Windows\\System32\\cipher.exe\nc:\\Windows\\System32\\CIRCoInst.dll\nc:\\Windows\\System32\\CiTool.exe\r\n",
"c:\\Windows\\System32\\CIWmi.dll\r\nc:\\Windows\\System32\\clbcatq.dll\nc:\\Windows\\System32\\cldapi.dll",
"c:\\Windows\\System32\\cleanmgr.exe\r\nc:\\Windows\\System32\\CleanPCCSP.dll\nc:\\Windows\\System32\\clfsw32.dll\n",
"c:\\Windows\\System32\\cliconfg.dll\r\nc:\\Windows\\System32\\cliconfg.exe\r\nc:\\Windows\\System32\\cliconfg.rll\r\n",
"c:\\Windows\\System32\\clip.exe\r\nc:\\Windows\\System32\\ClipboardServer.dll\r\nc:\\Windows\\System32\\Clipc.dll\n",
"c:\\Windows\\System32\\ClipDLS.exe\nc:\\Windows\\System32\\ClipRenew.exe\r\nc:\\Windows\\System32\\ClipSVC.dll\r\n",
"c:\\Windows\\System32\\ClipUp.exe\r\nc:\\Windows\\System32\\clipwinrt.dll\r\nc:\\Windows\\System32\\cloudAP.dll",
"c:\\Windows\\System32\\CloudDomainJoinAUG.dll\r\nc:\\Windows\\System32\\CloudDomainJoinDataModelServer.dll\r\nc:\\Windows\\System32\\CloudExperienceHost.dll\n",
"c:\\Windows\\System32\\CloudExperienceHostBroker.dll\nc:\\Windows\\System32\\CloudExperienceHostBroker.exe\r\nc:\\Windows\\System32\\CloudExperienceHostCommon.dll\n",
"c:\\Windows\\System32\\CloudExperienceHostRedirection.dll\r\nc:\\Windows\\System32\\CloudExperienceHostUser.dll\r\nc:\\Windows\\System32\\cloudidsvc.dll\r\n",
"c:\\Windows\\System32\\CloudIdWxhExtension.dll\nc:\\Windows\\System32\\CloudNotifications.exe\nc:\\Windows\\System32\\CloudRecoveryDownloadTool.dll\n",
"c:\\Windows\\System32\\CloudRestoreLauncher.dll\nc:\\Windows\\System32\\clrhost.dll\nc:\\Windows\\System32\\clusapi.dll",
"c:\\Windows\\System32\\cmcfg32.dll\r\nc:\\Windows\\System32\\cmd.exe\r\nc:\\Windows\\System32\\cmdext.dll\n",
"c:\\Windows\\System32\\cmdial32.dll\nc:\\Windows\\System32\\cmdkey.exe\nc:\\Windows\\System32\\cmdl32.exe",
"c:\\Windows\\System32\\cmgrcspps.dll\nc:\\Windows\\System32\\cmifw.dll\r\nc:\\Windows\\System32\\cmintegrator.dll\r\n",
"c:\\Windows\\System32\\cmlua.dll\r\nc:\\Windows\\System32\\cmmon32.exe\nc:\\Windows\\System32\\cmpbk32.dll",
"c:\\Windows\\System32\\cmstp.exe\r\nc:\\Windows\\System32\\cmstplua.dll\r\nc:\\Windows\\System32\\cmutil.dll",
"c:\\Windows\\System32\\cngcredui.dll\r\nc:\\Windows\\System32\\cngprovider.dll\r\nc:\\Windows\\System32\\cnvfat.dll\n",
"c:\\Windows\\System32\\cob-au.rs\r\nc:\\Windows\\System32\\CodeIntegrityAggregator.dll\nc:\\Windows\\System32\\cofire.exe\n",
"c:\\Windows\\System32\\cofiredm.dll\r\nc:\\Windows\\System32\\colbact.dll\nc:\\Windows\\System32\\COLORCNV.DLL\n",
"c:\\Windows\\System32\\colorcpl.exe\nc:\\Windows\\System32\\colorui.dll\nc:\\Windows\\System32\\combase.dll",
"c:\\Windows\\System32\\comcat.dll\nc:\\Windows\\System32\\comctl32.dll\nc:\\Windows\\System32\\comdlg32.dll",
"c:\\Windows\\System32\\comexp.msc\nc:\\Windows\\System32\\coml2.dll\nc:\\Windows\\System32\\comp.exe\r\n",
"c:\\Windows\\System32\\compact.exe\nc:\\Windows\\System32\\CompatAggregator.dll\r\nc:\\Windows\\System32\\CompatTelRunner.exe\n",
"c:\\Windows\\System32\\compmgmt.msc\r\nc:\\Windows\\System32\\CompMgmtLauncher.exe\nc:\\Windows\\System32\\ComposableShellProxyStub.dll\r\n",
"c:\\Windows\\System32\\ComposerFramework.dll\nc:\\Windows\\System32\\CompPkgSrv.exe\r\nc:\\Windows\\System32\\CompPkgSup.dll",
"c:\\Windows\\System32\\compstui.dll\nc:\\Windows\\System32\\computecore.dll\r\nc:\\Windows\\System32\\computelibeventlog.dll\r\n",
"c:\\Windows\\System32\\computenetwork.dll\nc:\\Windows\\System32\\ComputerDefaults.exe\nc:\\Windows\\System32\\ComputerToastIcon.contrast-white.png\r\n",
"c:\\Windows\\System32\\ComputerToastIcon.png\nc:\\Windows\\System32\\computestorage.dll\nc:\\Windows\\System32\\comrepl.dll",
"c:\\Windows\\System32\\comres.dll\nc:\\Windows\\System32\\comsnap.dll\nc:\\Windows\\System32\\comsvcs.dll\r\n",
"c:\\Windows\\System32\\comuid.dll\nc:\\Windows\\System32\\concrt140.dll\r\nc:\\Windows\\System32\\concrt140d.dll",
"c:\\Windows\\System32\\configmanager2.dll\nc:\\Windows\\System32\\ConfigureExpandedStorage.dll\nc:\\Windows\\System32\\conhost.exe\r\n",
"c:\\Windows\\System32\\ConhostV1.dll\nc:\\Windows\\System32\\connect.dll\nc:\\Windows\\System32\\ConnectedAccountState.dll\r\n",
"c:\\Windows\\System32\\consent.exe\r\nc:\\Windows\\System32\\ConsentExperienceCommon.dll\r\nc:\\Windows\\System32\\ConsentUX.dll",
"c:\\Windows\\System32\\ConsentUxClient.dll\nc:\\Windows\\System32\\console.dll\nc:\\Windows\\System32\\ConsoleLogon.dll\n",
"c:\\Windows\\System32\\ConstraintIndex.Search.dll\r\nc:\\Windows\\System32\\ContactActivation.dll\r\nc:\\Windows\\System32\\ContactApis.dll\r\n",
"c:\\Windows\\System32\\ContactHarvesterDS.dll\nc:\\Windows\\System32\\container.dll\nc:\\Windows\\System32\\containerdevicemanagement.dll\r\n",
"c:\\Windows\\System32\\ContentDeliveryManager.Utilities.dll\nc:\\Windows\\System32\\control.exe\r\nc:\\Windows\\System32\\convert.exe\n",
"c:\\Windows\\System32\\convertvhd.exe\nc:\\Windows\\System32\\coreaudiopolicymanagerext.dll\nc:\\Windows\\System32\\coredpus.dll",
"c:\\Windows\\System32\\coredpussvr.exe\r\nc:\\Windows\\System32\\coreglobconfig.dll\nc:\\Windows\\System32\\CoreMas.dll\n",
"c:\\Windows\\System32\\CoreMessaging.dll\nc:\\Windows\\System32\\CoreMmRes.dll\nc:\\Windows\\System32\\CorePrivacySettingsStore.dll\r\n",
"c:\\Windows\\System32\\CoreShell.dll\r\nc:\\Windows\\System32\\CoreShellAPI.dll\nc:\\Windows\\System32\\CoreShellExtFramework.dll",
"c:\\Windows\\System32\\CoreUIComponents.dll\r\nc:\\Windows\\System32\\correngine.dll\nc:\\Windows\\System32\\CourtesyEngine.dll",
"c:\\Windows\\System32\\CPFilters.dll\nc:\\Windows\\System32\\CredDialogBroker.dll\r\nc:\\Windows\\System32\\CredentialEnrollmentManager.exe",
"c:\\Windows\\System32\\CredentialEnrollmentManagerForUser.dll\nc:\\Windows\\System32\\CredentialUIBroker.exe\nc:\\Windows\\System32\\CredProv2faHelper.dll",
"c:\\Windows\\System32\\CredProvCommonCore.dll\nc:\\Windows\\System32\\CredProvDataModel.dll\r\nc:\\Windows\\System32\\CredProvHelper.dll",
"c:\\Windows\\System32\\credprovhost.dll\r\nc:\\Windows\\System32\\credprovs.dll\r\nc:\\Windows\\System32\\credprovslegacy.dll",
"c:\\Windows\\System32\\credssp.dll\r\nc:\\Windows\\System32\\credui.dll\nc:\\Windows\\System32\\credwiz.exe\n",
"c:\\Windows\\System32\\crypt32.dll\nc:\\Windows\\System32\\cryptbase.dll\nc:\\Windows\\System32\\cryptcatsvc.dll",
"c:\\Windows\\System32\\cryptdlg.dll\nc:\\Windows\\System32\\cryptdll.dll\r\nc:\\Windows\\System32\\cryptext.dll",
"c:\\Windows\\System32\\cryptnet.dll\nc:\\Windows\\System32\\cryptngc.dll\r\nc:\\Windows\\System32\\CryptoWinRT.dll",
"c:\\Windows\\System32\\cryptsp.dll\r\nc:\\Windows\\System32\\cryptsvc.dll\nc:\\Windows\\System32\\crypttpmeksvc.dll\n",
"c:\\Windows\\System32\\cryptui.dll\nc:\\Windows\\System32\\cryptuiwizard.dll\r\nc:\\Windows\\System32\\cryptxml.dll\r\n",
"c:\\Windows\\System32\\cscapi.dll\nc:\\Windows\\System32\\cscdll.dll\nc:\\Windows\\System32\\CscMig.dll\n",
"c:\\Windows\\System32\\cscobj.dll\r\nc:\\Windows\\System32\\cscript.exe\r\nc:\\Windows\\System32\\cscsvc.dll",
"c:\\Windows\\System32\\cscui.dll\nc:\\Windows\\System32\\CspCellularSettings.dll\r\nc:\\Windows\\System32\\csplte.dll\n",
"c:\\Windows\\System32\\CspProxy.dll\r\nc:\\Windows\\System32\\csrr.rs\nc:\\Windows\\System32\\csrsrv.dll\n",
"c:\\Windows\\System32\\csrss.exe\r\nc:\\Windows\\System32\\CSystemEventsBrokerClient.dll\nc:\\Windows\\System32\\ctac.json",
"c:\\Windows\\System32\\ctfmon.exe\r\nc:\\Windows\\System32\\cttune.exe\nc:\\Windows\\System32\\cttunesvr.exe\n",
"c:\\Windows\\System32\\curl.exe\nc:\\Windows\\System32\\CustomInstallExec.exe\r\nc:\\Windows\\System32\\CustomShellHost.exe",
"c:\\Windows\\System32\\cuzzapi.dll\nc:\\Windows\\System32\\cxcredprov.dll\r\nc:\\Windows\\System32\\CXHProvisioningServer.dll",
"c:\\Windows\\System32\\C_037.NLS\nc:\\Windows\\System32\\C_10000.NLS\r\nc:\\Windows\\System32\\C_10001.NLS\r\n",
"c:\\Windows\\System32\\C_10002.NLS\nc:\\Windows\\System32\\C_10003.NLS\r\nc:\\Windows\\System32\\C_10004.NLS",
"c:\\Windows\\System32\\C_10005.NLS\nc:\\Windows\\System32\\C_10006.NLS\nc:\\Windows\\System32\\C_10007.NLS",
"c:\\Windows\\System32\\C_10008.NLS\r\nc:\\Windows\\System32\\C_10010.NLS\nc:\\Windows\\System32\\C_10017.NLS",
"c:\\Windows\\System32\\C_10021.NLS\nc:\\Windows\\System32\\C_10029.NLS\r\nc:\\Windows\\System32\\C_10079.NLS",
"c:\\Windows\\System32\\C_10081.NLS\r\nc:\\Windows\\System32\\C_10082.NLS\nc:\\Windows\\System32\\C_1026.NLS",
"c:\\Windows\\System32\\C_1047.NLS\r\nc:\\Windows\\System32\\C_1140.NLS\r\nc:\\Windows\\System32\\C_1141.NLS\r\n",
"c:\\Windows\\System32\\C_1142.NLS\nc:\\Windows\\System32\\C_1143.NLS\nc:\\Windows\\System32\\C_1144.NLS",
"c:\\Windows\\System32\\C_1145.NLS\r\nc:\\Windows\\System32\\C_1146.NLS\nc:\\Windows\\System32\\C_1147.NLS\n",
"c:\\Windows\\System32\\C_1148.NLS\nc:\\Windows\\System32\\C_1149.NLS\r\nc:\\Windows\\System32\\C_1250.NLS",
"c:\\Windows\\System32\\C_1251.NLS\nc:\\Windows\\System32\\C_1252.NLS\nc:\\Windows\\System32\\C_1253.NLS",
"c:\\Windows\\System32\\C_1254.NLS\r\nc:\\Windows\\System32\\C_1255.NLS\r\nc:\\Windows\\System32\\C_1256.NLS",
"c:\\Windows\\System32\\C_1257.NLS\r\nc:\\Windows\\System32\\C_1258.NLS\r\nc:\\Windows\\System32\\C_1361.NLS",
"c:\\Windows\\System32\\C_20000.NLS\r\nc:\\Windows\\System32\\C_20001.NLS\nc:\\Windows\\System32\\C_20002.NLS\r\n",
"c:\\Windows\\System32\\C_20003.NLS\nc:\\Windows\\System32\\C_20004.NLS\r\nc:\\Windows\\System32\\C_20005.NLS\r\n",
"c:\\Windows\\System32\\C_20105.NLS\r\nc:\\Windows\\System32\\C_20106.NLS\r\nc:\\Windows\\System32\\C_20107.NLS",
"c:\\Windows\\System32\\C_20108.NLS\nc:\\Windows\\System32\\C_20127.NLS\nc:\\Windows\\System32\\C_20261.NLS",
"c:\\Windows\\System32\\C_20269.NLS\r\nc:\\Windows\\System32\\C_20273.NLS\r\nc:\\Windows\\System32\\C_20277.NLS\n",
"c:\\Windows\\System32\\C_20278.NLS\r\nc:\\Windows\\System32\\C_20280.NLS\nc:\\Windows\\System32\\C_20284.NLS",
"c:\\Windows\\System32\\C_20285.NLS\r\nc:\\Windows\\System32\\C_20290.NLS\r\nc:\\Windows\\System32\\C_20297.NLS\n",
"c:\\Windows\\System32\\C_20420.NLS\r\nc:\\Windows\\System32\\C_20423.NLS\nc:\\Windows\\System32\\C_20424.NLS\n",
"c:\\Windows\\System32\\C_20833.NLS\nc:\\Windows\\System32\\C_20838.NLS\nc:\\Windows\\System32\\C_20866.NLS\n",
"c:\\Windows\\System32\\C_20871.NLS\r\nc:\\Windows\\System32\\C_20880.NLS\nc:\\Windows\\System32\\C_20905.NLS\r\n",
"c:\\Windows\\System32\\C_20924.NLS\nc:\\Windows\\System32\\C_20932.NLS\r\nc:\\Windows\\System32\\C_20936.NLS\n",
"c:\\Windows\\System32\\C_20949.NLS\nc:\\Windows\\System32\\C_21025.NLS\r\nc:\\Windows\\System32\\C_21027.NLS",
"c:\\Windows\\System32\\C_21866.NLS\nc:\\Windows\\System32\\C_28591.NLS\nc:\\Windows\\System32\\C_28592.NLS\r\n",
"c:\\Windows\\System32\\C_28593.NLS\nc:\\Windows\\System32\\C_28594.NLS\nc:\\Windows\\System32\\C_28595.NLS\n",
"c:\\Windows\\System32\\C_28596.NLS\r\nc:\\Windows\\System32\\C_28597.NLS\r\nc:\\Windows\\System32\\C_28598.NLS\n",
"c:\\Windows\\System32\\C_28599.NLS\nc:\\Windows\\System32\\c_28603.nls\r\nc:\\Windows\\System32\\C_28605.NLS",
"c:\\Windows\\System32\\C_437.NLS\nc:\\Windows\\System32\\C_500.NLS\r\nc:\\Windows\\System32\\C_708.NLS",
"c:\\Windows\\System32\\C_720.NLS\nc:\\Windows\\System32\\C_737.NLS\nc:\\Windows\\System32\\C_775.NLS\n",
"c:\\Windows\\System32\\C_850.NLS\r\nc:\\Windows\\System32\\C_852.NLS\nc:\\Windows\\System32\\C_855.NLS",
"c:\\Windows\\System32\\C_857.NLS\nc:\\Windows\\System32\\C_858.NLS\r\nc:\\Windows\\System32\\C_860.NLS",
"c:\\Windows\\System32\\C_861.NLS\nc:\\Windows\\System32\\C_862.NLS\nc:\\Windows\\System32\\C_863.NLS\n",
"c:\\Windows\\System32\\C_864.NLS\r\nc:\\Windows\\System32\\C_865.NLS\nc:\\Windows\\System32\\C_866.NLS\n",
"c:\\Windows\\System32\\C_869.NLS\nc:\\Windows\\System32\\C_870.NLS\nc:\\Windows\\System32\\C_874.NLS\n",
"c:\\Windows\\System32\\C_875.NLS\nc:\\Windows\\System32\\C_932.NLS\r\nc:\\Windows\\System32\\C_936.NLS\r\n",
"c:\\Windows\\System32\\C_949.NLS\nc:\\Windows\\System32\\C_950.NLS\r\nc:\\Windows\\System32\\C_G18030.DLL",
"c:\\Windows\\System32\\c_GSM7.DLL\nc:\\Windows\\System32\\C_IS2022.DLL\nc:\\Windows\\System32\\C_ISCII.DLL\n",
"c:\\Windows\\System32\\d2d1.dll\nc:\\Windows\\System32\\d2d1debug3.dll\r\nc:\\Windows\\System32\\d3d10.dll",
"c:\\Windows\\System32\\d3d10core.dll\r\nc:\\Windows\\System32\\d3d10level9.dll\r\nc:\\Windows\\System32\\d3d10ref.dll",
"c:\\Windows\\System32\\d3d10sdklayers.dll\r\nc:\\Windows\\System32\\d3d10warp.dll\r\nc:\\Windows\\System32\\d3d10_1.dll\n",
"c:\\Windows\\System32\\d3d10_1core.dll\r\nc:\\Windows\\System32\\d3d11.dll\nc:\\Windows\\System32\\d3d11on12.dll\r\n",
"c:\\Windows\\System32\\d3d11_3SDKLayers.dll\nc:\\Windows\\System32\\D3D12.dll\nc:\\Windows\\System32\\D3D12Core.dll\n",
"c:\\Windows\\System32\\d3d12SDKLayers.dll\nc:\\Windows\\System32\\d3d8thk.dll\nc:\\Windows\\System32\\d3d9.dll",
"c:\\Windows\\System32\\d3d9on12.dll\nc:\\Windows\\System32\\D3DCompiler_47.dll\nc:\\Windows\\System32\\d3dconfig.exe",
"c:\\Windows\\System32\\d3dref9.dll\r\nc:\\Windows\\System32\\D3DSCache.dll\r\nc:\\Windows\\System32\\d4d78066-e6db-44b7-b5cd-2eb82dce620c_HyperV-ComputeLegacy.dll",
"c:\\Windows\\System32\\dab.dll\nc:\\Windows\\System32\\dabapi.dll\nc:\\Windows\\System32\\DAConn.dll\r\n",
"c:\\Windows\\System32\\dafAspInfraProvider.dll\r\nc:\\Windows\\System32\\dafBth.dll\nc:\\Windows\\System32\\DafDnsSd.dll\n",
"c:\\Windows\\System32\\dafDockingProvider.dll\r\nc:\\Windows\\System32\\DAFESCL.dll\r\nc:\\Windows\\System32\\DafGip.dll\r\n",
"c:\\Windows\\System32\\DAFIoT.dll\r\nc:\\Windows\\System32\\DAFIPP.dll\nc:\\Windows\\System32\\DAFMCP.dll\r\n",
"c:\\Windows\\System32\\dafpos.dll\r\nc:\\Windows\\System32\\DafPrintProvider.dll\r\nc:\\Windows\\System32\\dafupnp.dll\n",
"c:\\Windows\\System32\\dafWCN.dll\r\nc:\\Windows\\System32\\dafWfdProvider.dll\r\nc:\\Windows\\System32\\DAFWiProv.dll\n",
"c:\\Windows\\System32\\DAFWSD.dll\nc:\\Windows\\System32\\DAMediaManager.dll\nc:\\Windows\\System32\\DAMM.dll",
"c:\\Windows\\System32\\DaOtpCredentialProvider.dll\nc:\\Windows\\System32\\das.dll\r\nc:\\Windows\\System32\\dasHost.exe",
"c:\\Windows\\System32\\dataclen.dll\nc:\\Windows\\System32\\DataExchange.dll\r\nc:\\Windows\\System32\\DataExchangeHost.exe",
"c:\\Windows\\System32\\DataStoreCacheDumpTool.exe\r\nc:\\Windows\\System32\\datusage.dll\r\nc:\\Windows\\System32\\davclnt.dll",
"c:\\Windows\\System32\\davhlpr.dll\nc:\\Windows\\System32\\DavSyncProvider.dll\nc:\\Windows\\System32\\daxexec.dll\r\n",
"c:\\Windows\\System32\\dbgcore.dll\r\nc:\\Windows\\System32\\dbgeng.dll\nc:\\Windows\\System32\\dbghelp.dll\n",
"c:\\Windows\\System32\\DbgModel.dll\nc:\\Windows\\System32\\dbnetlib.dll\r\nc:\\Windows\\System32\\dbnmpntw.dll",
"c:\\Windows\\System32\\dccw.exe\r\nc:\\Windows\\System32\\dciman32.dll\nc:\\Windows\\System32\\dcntel.dll\r\n",
"c:\\Windows\\System32\\dcomcnfg.exe\nc:\\Windows\\System32\\dcomp.dll\r\nc:\\Windows\\System32\\dcsvc.dll",
"c:\\Windows\\System32\\DDACLSys.dll\nc:\\Windows\\System32\\DdcClaimsApi.dll\nc:\\Windows\\System32\\DdcComImplementationsDesktop.dll",
"c:\\Windows\\System32\\DDDS.dll\nc:\\Windows\\System32\\ddisplay.dll\r\nc:\\Windows\\System32\\ddodiag.exe\n",
"c:\\Windows\\System32\\DDOIProxy.dll\r\nc:\\Windows\\System32\\DDORes.dll\r\nc:\\Windows\\System32\\ddpchunk.dll",
"c:\\Windows\\System32\\ddptrace.dll\r\nc:\\Windows\\System32\\ddputils.dll\nc:\\Windows\\System32\\ddp_ps.dll",
"c:\\Windows\\System32\\ddraw.dll\r\nc:\\Windows\\System32\\ddrawex.dll\r\nc:\\Windows\\System32\\declaredconfiguration.dll",
"c:\\Windows\\System32\\DefaultAccountTile.png\r\nc:\\Windows\\System32\\DefaultDeviceManager.dll\nc:\\Windows\\System32\\DefaultHrtfs.bin\n",
"c:\\Windows\\System32\\DefaultPrinterProvider.dll\nc:\\Windows\\System32\\DefaultQuestions.json\nc:\\Windows\\System32\\Defrag.exe",
"c:\\Windows\\System32\\defragproxy.dll\nc:\\Windows\\System32\\defragres.dll\nc:\\Windows\\System32\\defragsvc.dll\r\n",
"c:\\Windows\\System32\\delegatorprovider.dll\nc:\\Windows\\System32\\DeliveryOptimizationMIProv.mof\r\nc:\\Windows\\System32\\DeliveryOptimizationMIProvUninstall.mof",
"c:\\Windows\\System32\\deploymentcsphelper.exe\r\nc:\\Windows\\System32\\deploymentcsps.dll\r\nc:\\Windows\\System32\\desk.cpl\n",
"c:\\Windows\\System32\\deskadp.dll\nc:\\Windows\\System32\\deskmon.dll\nc:\\Windows\\System32\\desktopimgdownldr.exe\r\n",
"c:\\Windows\\System32\\DesktopShellAppStateContract.dll\r\nc:\\Windows\\System32\\DesktopShellExt.dll\r\nc:\\Windows\\System32\\DesktopSwitcherDataModel.dll",
"c:\\Windows\\System32\\DesktopView.Internal.Broker.dll\nc:\\Windows\\System32\\DesktopView.Internal.Broker.ProxyStub.dll\r\nc:\\Windows\\System32\\DetailedReading-Default.xml",
"c:\\Windows\\System32\\DevDispItemProvider.dll\r\nc:\\Windows\\System32\\DeveloperOptionsSettingsHandlers.dll\nc:\\Windows\\System32\\devenum.dll",
"c:\\Windows\\System32\\deviceaccess.dll\nc:\\Windows\\System32\\deviceassociation.dll\nc:\\Windows\\System32\\DeviceCensus.exe",
"c:\\Windows\\System32\\DeviceCenter.dll\nc:\\Windows\\System32\\DeviceCompanionAppInstall.dll\nc:\\Windows\\System32\\DeviceCredential.dll\n",
"c:\\Windows\\System32\\DeviceCredentialDeployment.exe\r\nc:\\Windows\\System32\\DeviceDirectoryClient.dll\nc:\\Windows\\System32\\DeviceDisplayStatusManager.dll",
"c:\\Windows\\System32\\DeviceDriverRetrievalClient.dll\nc:\\Windows\\System32\\DeviceEject.exe\nc:\\Windows\\System32\\DeviceElementSource.dll",
"c:\\Windows\\System32\\DeviceEnroller.exe\r\nc:\\Windows\\System32\\DeviceFlows.DataModel.dll\r\nc:\\Windows\\System32\\DeviceMetadataRetrievalClient.dll\n",
"c:\\Windows\\System32\\devicengccredprov.dll\nc:\\Windows\\System32\\DevicePairing.dll\r\nc:\\Windows\\System32\\DevicePairingExperienceMEM.dll",
"c:\\Windows\\System32\\DevicePairingFolder.dll\nc:\\Windows\\System32\\DevicePairingProxy.dll\r\nc:\\Windows\\System32\\DevicePairingWizard.exe",
"c:\\Windows\\System32\\DeviceProperties.exe\nc:\\Windows\\System32\\DeviceReactivation.dll\r\nc:\\Windows\\System32\\deviceregistration.dll\n",
"c:\\Windows\\System32\\DeviceSetupManager.dll\r\nc:\\Windows\\System32\\DeviceSetupManagerAPI.dll\nc:\\Windows\\System32\\DeviceSetupStatusProvider.dll\r\n",
"c:\\Windows\\System32\\DevicesFlowBroker.dll\nc:\\Windows\\System32\\DeviceSoftwareInstallationClient.dll\nc:\\Windows\\System32\\DeviceUpdateAgent.dll",
"c:\\Windows\\System32\\DeviceUpdateCenterCsp.dll\r\nc:\\Windows\\System32\\DeviceUxRes.dll\nc:\\Windows\\System32\\devinv.dll",
"c:\\Windows\\System32\\devmgmt.msc\nc:\\Windows\\System32\\devmgr.dll\r\nc:\\Windows\\System32\\DevModeRunAsUserConfig.msc",
"c:\\Windows\\System32\\devobj.dll\r\nc:\\Windows\\System32\\DevPropMgr.dll\nc:\\Windows\\System32\\DevQueryBroker.dll",
"c:\\Windows\\System32\\devrtl.dll\nc:\\Windows\\System32\\dfdts.dll\r\nc:\\Windows\\System32\\DFDWiz.exe\n",
"c:\\Windows\\System32\\dfrgui.exe\r\nc:\\Windows\\System32\\dfscli.dll\r\nc:\\Windows\\System32\\dfshim.dll",
"c:\\Windows\\System32\\DfsShlEx.dll\nc:\\Windows\\System32\\dggpext.dll\nc:\\Windows\\System32\\dhcpcmonitor.dll",
"c:\\Windows\\System32\\dhcpcore.dll\nc:\\Windows\\System32\\dhcpcore6.dll\nc:\\Windows\\System32\\dhcpcsvc.dll\n",
"c:\\Windows\\System32\\dhcpcsvc6.dll\r\nc:\\Windows\\System32\\dhcpsapi.dll\r\nc:\\Windows\\System32\\DHolographicDisplay.dll\r\n",
"c:\\Windows\\System32\\DiagCpl.dll\nc:\\Windows\\System32\\diagnosticdataquery.dll\r\nc:\\Windows\\System32\\DiagnosticDataSettings.dll",
"c:\\Windows\\System32\\DiagnosticInvoker.dll\r\nc:\\Windows\\System32\\DiagnosticLogCSP.dll\r\nc:\\Windows\\System32\\diagperf.dll\n",
"c:\\Windows\\System32\\DiagSvc.dll\nc:\\Windows\\System32\\diagtrack.dll\r\nc:\\Windows\\System32\\dialclient.dll",
"c:\\Windows\\System32\\dialer.exe\nc:\\Windows\\System32\\DialogBlockerProc.dll\r\nc:\\Windows\\System32\\DialogBlockingManager.dll\n",
"c:\\Windows\\System32\\DialogBlockingService.dll\r\nc:\\Windows\\System32\\dialserver.dll\nc:\\Windows\\System32\\DictationManager.dll\r\n",
"c:\\Windows\\System32\\difxapi.dll\r\nc:\\Windows\\System32\\dimsjob.dll\nc:\\Windows\\System32\\dimsroam.dll",
"c:\\Windows\\System32\\dinput.dll\nc:\\Windows\\System32\\dinput8.dll\r\nc:\\Windows\\System32\\Direct2DDesktop.dll",
"c:\\Windows\\System32\\directmanipulation.dll\nc:\\Windows\\System32\\DirectML.Debug.dll\nc:\\Windows\\System32\\directml.dll\r\n",
"c:\\Windows\\System32\\directxdatabasehelper.dll\r\nc:\\Windows\\System32\\directxdatabaseupdater.exe\r\nc:\\Windows\\System32\\discan.dll\r\n",
"c:\\Windows\\System32\\diskmgmt.msc\nc:\\Windows\\System32\\diskpart.exe\r\nc:\\Windows\\System32\\diskperf.exe",
"c:\\Windows\\System32\\diskraid.exe\nc:\\Windows\\System32\\DiskSnapshot.conf\nc:\\Windows\\System32\\DiskSnapshot.exe",
"c:\\Windows\\System32\\diskusage.exe\r\nc:\\Windows\\System32\\Dism.exe\r\nc:\\Windows\\System32\\DismApi.dll",
"c:\\Windows\\System32\\DispBroker.Desktop.dll\r\nc:\\Windows\\System32\\DispBroker.dll\nc:\\Windows\\System32\\dispdiag.exe",
"c:\\Windows\\System32\\dispex.dll\nc:\\Windows\\System32\\Display.dll\nc:\\Windows\\System32\\DisplayManager.dll",
"c:\\Windows\\System32\\DisplaySwitch.exe\r\nc:\\Windows\\System32\\DisplaySystemToastIcon.contrast-white.png\nc:\\Windows\\System32\\DisplaySystemToastIcon.png\n",
"c:\\Windows\\System32\\djctq.rs\nc:\\Windows\\System32\\djoin.exe\r\nc:\\Windows\\System32\\dllhost.exe",
"c:\\Windows\\System32\\dllhst3g.exe\r\nc:\\Windows\\System32\\dlnashext.dll\nc:\\Windows\\System32\\DMAlertListener.ProxyStub.dll",
"c:\\Windows\\System32\\DmApiSetExtImplDesktop.dll\r\nc:\\Windows\\System32\\DMAppsRes.dll\nc:\\Windows\\System32\\dmcertinst.exe",
"c:\\Windows\\System32\\dmcfghost.exe\r\nc:\\Windows\\System32\\dmcfgutils.dll\nc:\\Windows\\System32\\dmclient.exe",
"c:\\Windows\\System32\\dmcmnutils.dll\r\nc:\\Windows\\System32\\dmcommandlineutils.dll\r\nc:\\Windows\\System32\\dmcsps.dll\r\n",
"c:\\Windows\\System32\\dmdlgs.dll\nc:\\Windows\\System32\\dmdskmgr.dll\nc:\\Windows\\System32\\dmdskres.dll\r\n",
"c:\\Windows\\System32\\dmdskres2.dll\nc:\\Windows\\System32\\dmenrollengine.dll\r\nc:\\Windows\\System32\\dmenterprisediagnostics.dll\r\n",
"c:\\Windows\\System32\\dmintf.dll\nc:\\Windows\\System32\\dmiso8601utils.dll\nc:\\Windows\\System32\\dmloader.dll\n",
"c:\\Windows\\System32\\DmNotificationBroker.exe\nc:\\Windows\\System32\\dmocx.dll\nc:\\Windows\\System32\\dmoleaututils.dll",
"c:\\Windows\\System32\\DmOmaCpMo.exe\r\nc:\\Windows\\System32\\dmprocessxmlfiltered.dll\nc:\\Windows\\System32\\dmpushproxy.dll\n",
"c:\\Windows\\System32\\DMPushRouterCore.dll\r\nc:\\Windows\\System32\\DMRCDecoder.dll\r\nc:\\Windows\\System32\\DMRServer.dll",
"c:\\Windows\\System32\\dmsynth.dll\nc:\\Windows\\System32\\dmusic.dll\r\nc:\\Windows\\System32\\dmutil.dll",
"c:\\Windows\\System32\\dmvdsitf.dll\nc:\\Windows\\System32\\dmview.ocx\r\nc:\\Windows\\System32\\dmwappushsvc.dll",
"c:\\Windows\\System32\\dmwmicsp.dll\nc:\\Windows\\System32\\dmxmlhelputils.dll\r\nc:\\Windows\\System32\\dnsapi.dll",
"c:\\Windows\\System32\\dnscacheugc.exe\nc:\\Windows\\System32\\dnscmmc.dll\nc:\\Windows\\System32\\dnsext.dll",
"c:\\Windows\\System32\\dnshc.dll\nc:\\Windows\\System32\\dnsrslvr.dll\nc:\\Windows\\System32\\Docking.VirtualInput.dll\r\n",
"c:\\Windows\\System32\\DockInterface.ProxyStub.dll\r\nc:\\Windows\\System32\\doclient.dll\r\nc:\\Windows\\System32\\docprop.dll",
"c:\\Windows\\System32\\DocumentPerformanceEvents.dll\r\nc:\\Windows\\System32\\DolbyDecMFT.dll\nc:\\Windows\\System32\\domgmt.dll\r\n",
"c:\\Windows\\System32\\domiprov.dll\r\nc:\\Windows\\System32\\dosettings.dll\r\nc:\\Windows\\System32\\doskey.exe",
"c:\\Windows\\System32\\dosvc.dll\r\nc:\\Windows\\System32\\dot3api.dll\r\nc:\\Windows\\System32\\dot3cfg.dll\n",
"c:\\Windows\\System32\\Dot3Conn.dll\nc:\\Windows\\System32\\dot3dlg.dll\r\nc:\\Windows\\System32\\dot3gpclnt.dll",
"c:\\Windows\\System32\\dot3gpui.dll\r\nc:\\Windows\\System32\\dot3hc.dll\nc:\\Windows\\System32\\dot3mm.dll\r\n",
"c:\\Windows\\System32\\dot3msm.dll\nc:\\Windows\\System32\\dot3svc.dll\nc:\\Windows\\System32\\dot3ui.dll\r\n",
"c:\\Windows\\System32\\dpapi.dll\r\nc:\\Windows\\System32\\dpapimig.exe\nc:\\Windows\\System32\\dpapiprovider.dll",
"c:\\Windows\\System32\\dpapisrv.dll\r\nc:\\Windows\\System32\\DpiScaling.exe\r\nc:\\Windows\\System32\\dplcsp.dll\n",
"c:\\Windows\\System32\\dpnaddr.dll\r\nc:\\Windows\\System32\\dpnathlp.dll\r\nc:\\Windows\\System32\\dpnet.dll\r\n",
"c:\\Windows\\System32\\dpnhpast.dll\r\nc:\\Windows\\System32\\dpnhupnp.dll\nc:\\Windows\\System32\\dpnlobby.dll\n",
"c:\\Windows\\System32\\dpnsvr.exe\nc:\\Windows\\System32\\dps.dll\r\nc:\\Windows\\System32\\dpx.dll",
"c:\\Windows\\System32\\DragDropExperienceCommon.dll\nc:\\Windows\\System32\\DragDropExperienceDataExchangeDelegated.dll\nc:\\Windows\\System32\\driverquery.exe",
"c:\\Windows\\System32\\drprov.dll\r\nc:\\Windows\\System32\\drt.dll\r\nc:\\Windows\\System32\\DrtmAuthTxt.wim\n",
"c:\\Windows\\System32\\drtprov.dll\nc:\\Windows\\System32\\drttransport.dll\nc:\\Windows\\System32\\drvinst.exe",
"c:\\Windows\\System32\\drvsetup.dll\nc:\\Windows\\System32\\drvstore.dll\r\nc:\\Windows\\System32\\dsauth.dll\n",
"c:\\Windows\\System32\\DscCore.dll\nc:\\Windows\\System32\\DscCoreConfProv.dll\r\nc:\\Windows\\System32\\dsclient.dll\r\n",
"c:\\Windows\\System32\\dscproxy.dll\r\nc:\\Windows\\System32\\DscTimer.dll\r\nc:\\Windows\\System32\\dsdmo.dll",
"c:\\Windows\\System32\\dskquota.dll\r\nc:\\Windows\\System32\\dskquoui.dll\r\nc:\\Windows\\System32\\DsmUserTask.exe\n",
"c:\\Windows\\System32\\dsound.dll\nc:\\Windows\\System32\\dsparse.dll\nc:\\Windows\\System32\\dsprop.dll",
"c:\\Windows\\System32\\dsquery.dll\nc:\\Windows\\System32\\dsreg.dll\nc:\\Windows\\System32\\dsregcmd.exe",
"c:\\Windows\\System32\\dsregtask.dll\r\nc:\\Windows\\System32\\dsrole.dll\nc:\\Windows\\System32\\dssec.dat\n",
"c:\\Windows\\System32\\dssec.dll\nc:\\Windows\\System32\\dssenh.dll\nc:\\Windows\\System32\\dssvc.dll\n",
"c:\\Windows\\System32\\dstokenclean.exe\nc:\\Windows\\System32\\Dsui.dll\r\nc:\\Windows\\System32\\dsuiext.dll\n",
"c:\\Windows\\System32\\dswave.dll\r\nc:\\Windows\\System32\\dtdump.exe\r\nc:\\Windows\\System32\\dtsh.dll\n",
"c:\\Windows\\System32\\DuCsps.dll\nc:\\Windows\\System32\\dui70.dll\r\nc:\\Windows\\System32\\duser.dll",
"c:\\Windows\\System32\\dusmapi.dll\nc:\\Windows\\System32\\dusmsvc.dll\nc:\\Windows\\System32\\dusmtask.exe\r\n",
"c:\\Windows\\System32\\dvdplay.exe\nc:\\Windows\\System32\\dwm.exe\nc:\\Windows\\System32\\dwmapi.dll\n",
"c:\\Windows\\System32\\dwmcore.dll\r\nc:\\Windows\\System32\\dwmghost.dll\nc:\\Windows\\System32\\dwminit.dll\n",
"c:\\Windows\\System32\\dwmredir.dll\nc:\\Windows\\System32\\dwmscene.dll\nc:\\Windows\\System32\\DWrite.dll\r\n",
"c:\\Windows\\System32\\DWWIN.EXE\r\nc:\\Windows\\System32\\DXCap.exe\r\nc:\\Windows\\System32\\DXCaptureReplay.dll",
"c:\\Windows\\System32\\DXCore.dll\r\nc:\\Windows\\System32\\DXCpl.exe\nc:\\Windows\\System32\\dxdiag.exe\r\n",
"c:\\Windows\\System32\\dxdiagn.dll\nc:\\Windows\\System32\\dxgi.dll\r\nc:\\Windows\\System32\\dxgiadaptercache.exe",
"c:\\Windows\\System32\\DXGIDebug.dll\nc:\\Windows\\System32\\dxgwdi.dll\r\nc:\\Windows\\System32\\dxilconv.dll",
"c:\\Windows\\System32\\dxmasf.dll\r\nc:\\Windows\\System32\\DXP.dll\nc:\\Windows\\System32\\dxpps.dll\r\n",
"c:\\Windows\\System32\\Dxpserver.exe\r\nc:\\Windows\\System32\\DxpTaskSync.dll\nc:\\Windows\\System32\\dxtmsft.dll",
"c:\\Windows\\System32\\DXToolsMonitor.dll\nc:\\Windows\\System32\\DXToolsOfflineAnalysis.dll\nc:\\Windows\\System32\\DxToolsReportGenerator.dll\r\n",
"c:\\Windows\\System32\\DXToolsReporting.dll\r\nc:\\Windows\\System32\\dxtrans.dll\nc:\\Windows\\System32\\dxva2.dll",
"c:\\Windows\\System32\\DynamicLong.bin\r\nc:\\Windows\\System32\\DynamicMedium.bin\r\nc:\\Windows\\System32\\DynamicShort.bin\r\n",
"c:\\Windows\\System32\\dynamoapi.dll\nc:\\Windows\\System32\\EAMProgressHandler.dll\nc:\\Windows\\System32\\Eap3Host.exe",
"c:\\Windows\\System32\\eapp3hst.dll\r\nc:\\Windows\\System32\\eappcfg.dll\r\nc:\\Windows\\System32\\eappcfgui.dll",
"c:\\Windows\\System32\\eappgnui.dll\r\nc:\\Windows\\System32\\eapphost.dll\nc:\\Windows\\System32\\eappprxy.dll",
"c:\\Windows\\System32\\eapprovp.dll\r\nc:\\Windows\\System32\\eapputil.dll\nc:\\Windows\\System32\\eapsimextdesktop.dll\r\n",
"c:\\Windows\\System32\\eapsvc.dll\nc:\\Windows\\System32\\EapTeapAuth.dll\nc:\\Windows\\System32\\EapTeapConfig.dll",
"c:\\Windows\\System32\\EapTeapExt.dll\r\nc:\\Windows\\System32\\EarbudsSystemToastIcon.contrast-white.png\nc:\\Windows\\System32\\EarbudsSystemToastIcon.png\n",
"c:\\Windows\\System32\\easconsent.dll\nc:\\Windows\\System32\\EaseOfAccessDialog.exe\nc:\\Windows\\System32\\easinvoker.exe\r\n",
"c:\\Windows\\System32\\easinvoker.proxystub.dll\nc:\\Windows\\System32\\EASPolicyManagerBrokerHost.exe\nc:\\Windows\\System32\\EasPolicyManagerBrokerPS.dll\n",
"c:\\Windows\\System32\\easwrt.dll\nc:\\Windows\\System32\\edgeangle.dll\r\nc:\\Windows\\System32\\EdgeContent.dll\r\n",
"c:\\Windows\\System32\\edgehtml.dll\nc:\\Windows\\System32\\edgeIso.dll\r\nc:\\Windows\\System32\\EdgeManager.dll",
"c:\\Windows\\System32\\EdgeResetPlugin.dll\nc:\\Windows\\System32\\EditBufferTestHook.dll\nc:\\Windows\\System32\\EditionUpgradeHelper.dll\r\n",
"c:\\Windows\\System32\\EditionUpgradeManagerObj.dll\r\nc:\\Windows\\System32\\edpauditapi.dll\nc:\\Windows\\System32\\EDPCleanup.exe\n",
"c:\\Windows\\System32\\edpcsp.dll\r\nc:\\Windows\\System32\\edpnotify.exe\r\nc:\\Windows\\System32\\edptask.dll",
"c:\\Windows\\System32\\edputil.dll\r\nc:\\Windows\\System32\\EduPrintProv.exe\r\nc:\\Windows\\System32\\eeprov.dll",
"c:\\Windows\\System32\\eeutil.dll\nc:\\Windows\\System32\\efsadu.dll\nc:\\Windows\\System32\\efscore.dll\r\n",
"c:\\Windows\\System32\\efsext.dll\nc:\\Windows\\System32\\efslsaext.dll\nc:\\Windows\\System32\\efssvc.dll",
"c:\\Windows\\System32\\efsui.exe\nc:\\Windows\\System32\\efsutil.dll\r\nc:\\Windows\\System32\\efswrt.dll",
"c:\\Windows\\System32\\EhStorAPI.dll\r\nc:\\Windows\\System32\\EhStorAuthn.exe\nc:\\Windows\\System32\\EhStorPwdMgr.dll",
"c:\\Windows\\System32\\EhStorShell.dll\r\nc:\\Windows\\System32\\els.dll\nc:\\Windows\\System32\\ELSCore.dll\r\n",
"c:\\Windows\\System32\\elshyph.dll\r\nc:\\Windows\\System32\\elslad.dll\nc:\\Windows\\System32\\elsTrans.dll",
"c:\\Windows\\System32\\EmailApis.dll\r\nc:\\Windows\\System32\\embeddedmodesvc.dll\r\nc:\\Windows\\System32\\embeddedmodesvcapi.dll",
"c:\\Windows\\System32\\EmojiDS.dll\r\nc:\\Windows\\System32\\encapi.dll\r\nc:\\Windows\\System32\\energy.dll",
"c:\\Windows\\System32\\energyprov.dll\r\nc:\\Windows\\System32\\energytask.dll\r\nc:\\Windows\\System32\\enrollmentapi.dll",
"c:\\Windows\\System32\\EnterpriseAPNCsp.dll\r\nc:\\Windows\\System32\\EnterpriseAppMgmtClient.dll\nc:\\Windows\\System32\\EnterpriseAppMgmtSvc.dll",
"c:\\Windows\\System32\\EnterpriseAppVMgmtCSP.dll\nc:\\Windows\\System32\\enterprisecsps.dll\r\nc:\\Windows\\System32\\EnterpriseDesktopAppMgmtCSP.dll",
"c:\\Windows\\System32\\enterpriseetw.dll\nc:\\Windows\\System32\\EnterpriseModernAppMgmtCSP.dll\nc:\\Windows\\System32\\enterpriseresourcemanager.dll\n",
"c:\\Windows\\System32\\EoAExperiences.exe\r\nc:\\Windows\\System32\\eqossnap.dll\r\nc:\\Windows\\System32\\ErrorDetails.dll",
"c:\\Windows\\System32\\ErrorDetailsCore.dll\r\nc:\\Windows\\System32\\es.dll\nc:\\Windows\\System32\\EsclProtocol.dll",
"c:\\Windows\\System32\\EsclScan.dll\nc:\\Windows\\System32\\EsclWiaDriver.dll\r\nc:\\Windows\\System32\\EsdSip.dll\r\n",
"c:\\Windows\\System32\\esent.dll\r\nc:\\Windows\\System32\\esentprf.dll\nc:\\Windows\\System32\\esentutl.exe\n",
"c:\\Windows\\System32\\esevss.dll\nc:\\Windows\\System32\\eShims.dll\r\nc:\\Windows\\System32\\esimtool.exe",
"c:\\Windows\\System32\\esrb.rs\nc:\\Windows\\System32\\EthernetMediaManager.dll\nc:\\Windows\\System32\\ETWCoreUIComponentsResources.dll",
"c:\\Windows\\System32\\ETWESEProviderResources.dll\nc:\\Windows\\System32\\EtwRundown.dll\nc:\\Windows\\System32\\eudcedit.exe",
"c:\\Windows\\System32\\eUICCsCSP.dll\nc:\\Windows\\System32\\EULA.Microsoft.Application.Verifier.rtf\r\nc:\\Windows\\System32\\EventAggregation.dll",
"c:\\Windows\\System32\\eventcls.dll\nc:\\Windows\\System32\\eventcreate.exe\nc:\\Windows\\System32\\EventViewer_EventDetails.xsl\r\n",
"c:\\Windows\\System32\\eventvwr.exe\r\nc:\\Windows\\System32\\eventvwr.msc\r\nc:\\Windows\\System32\\evr.dll\n",
"c:\\Windows\\System32\\ExecModelClient.dll\r\nc:\\Windows\\System32\\execmodelproxy.dll\nc:\\Windows\\System32\\expand.exe\n",
"c:\\Windows\\System32\\ExplorerFrame.dll\r\nc:\\Windows\\System32\\ExSMime.dll\nc:\\Windows\\System32\\extrac32.exe",
"c:\\Windows\\System32\\ExtrasXmlParser.dll\nc:\\Windows\\System32\\f1db7d81-95be-4911-935a-8ab71629112a_HyperV-IsolatedVM.dll\nc:\\Windows\\System32\\f3ahvoas.dll",
"c:\\Windows\\System32\\f989b52d-f928-44a3-9bf1-bf0c1da6a0d6_HyperV-DeviceVirtualization.dll\nc:\\Windows\\System32\\facecredentialprovider.dll\nc:\\Windows\\System32\\Facilitator.dll",
"c:\\Windows\\System32\\Family.Authentication.dll\r\nc:\\Windows\\System32\\Family.Cache.dll\r\nc:\\Windows\\System32\\Family.Client.dll\r\n",
"c:\\Windows\\System32\\Family.SyncEngine.dll\nc:\\Windows\\System32\\FamilySafetyExt.dll\r\nc:\\Windows\\System32\\Faultrep.dll",
"c:\\Windows\\System32\\FaxPrinterInstaller.dll\nc:\\Windows\\System32\\fc.exe\nc:\\Windows\\System32\\fclip.exe\r\n",
"c:\\Windows\\System32\\fcon.dll\r\nc:\\Windows\\System32\\fdBth.dll\nc:\\Windows\\System32\\fdBthProxy.dll",
"c:\\Windows\\System32\\FdDevQuery.dll\nc:\\Windows\\System32\\fde.dll\nc:\\Windows\\System32\\fdeploy.dll\n",
"c:\\Windows\\System32\\fdPHost.dll\nc:\\Windows\\System32\\fdPnp.dll\nc:\\Windows\\System32\\fdprint.dll",
"c:\\Windows\\System32\\fdProxy.dll\r\nc:\\Windows\\System32\\FDResPub.dll\nc:\\Windows\\System32\\fdSSDP.dll",
"c:\\Windows\\System32\\fdWCN.dll\nc:\\Windows\\System32\\fdWNet.dll\r\nc:\\Windows\\System32\\fdWSD.dll\r\n",
"c:\\Windows\\System32\\FeatureToastBulldogImg.png\r\nc:\\Windows\\System32\\FeatureToastDlpImg.png\r\nc:\\Windows\\System32\\feclient.dll",
"c:\\Windows\\System32\\ffbroker.dll\r\nc:\\Windows\\System32\\fhcat.dll\nc:\\Windows\\System32\\fhcfg.dll",
"c:\\Windows\\System32\\fhcleanup.dll\nc:\\Windows\\System32\\fhcpl.dll\nc:\\Windows\\System32\\fhengine.dll\r\n",
"c:\\Windows\\System32\\fhevents.dll\r\nc:\\Windows\\System32\\fhmanagew.exe\r\nc:\\Windows\\System32\\fhsettingsprovider.dll",
"c:\\Windows\\System32\\fhshl.dll\nc:\\Windows\\System32\\fhsrchapi.dll\nc:\\Windows\\System32\\fhsrchph.dll",
"c:\\Windows\\System32\\fhsvc.dll\r\nc:\\Windows\\System32\\fhsvcctl.dll\nc:\\Windows\\System32\\fhtask.dll",
"c:\\Windows\\System32\\fhuxadapter.dll\nc:\\Windows\\System32\\fhuxapi.dll\nc:\\Windows\\System32\\fhuxcommon.dll",
"c:\\Windows\\System32\\fhuxgraphics.dll\nc:\\Windows\\System32\\fhuxpresentation.dll\nc:\\Windows\\System32\\fidocredprov.dll",
"c:\\Windows\\System32\\FileAppxStreamingDataSource.dll\nc:\\Windows\\System32\\FileDialogBroker.exe\r\nc:\\Windows\\System32\\FileHistory.exe\n",
"c:\\Windows\\System32\\filemgmt.dll\r\nc:\\Windows\\System32\\FilterDS.dll\r\nc:\\Windows\\System32\\find.exe\r\n",
"c:\\Windows\\System32\\findnetprinters.dll\r\nc:\\Windows\\System32\\findstr.exe\nc:\\Windows\\System32\\finger.exe",
"c:\\Windows\\System32\\fingerprintcredential.dll\r\nc:\\Windows\\System32\\Firewall.cpl\nc:\\Windows\\System32\\FirewallAPI.dll",
"c:\\Windows\\System32\\FirewallControlPanel.dll\nc:\\Windows\\System32\\FirmwareAttestationServerProxyStub.dll\r\nc:\\Windows\\System32\\fixmapi.exe\r\n",
"c:\\Windows\\System32\\FlightSettings.dll\nc:\\Windows\\System32\\fltLib.dll\nc:\\Windows\\System32\\fltMC.exe",
"c:\\Windows\\System32\\FluencyDS.dll\r\nc:\\Windows\\System32\\fmapi.dll\nc:\\Windows\\System32\\fmifs.dll\r\n",
"c:\\Windows\\System32\\fms.dll\nc:\\Windows\\System32\\FNTCACHE.DAT\nc:\\Windows\\System32\\FntCache.dll",
"c:\\Windows\\System32\\fodhelper.exe\r\nc:\\Windows\\System32\\Fondue.exe\r\nc:\\Windows\\System32\\fontdrvhost.exe\r\n",
"c:\\Windows\\System32\\fontext.dll\nc:\\Windows\\System32\\FontGlyphAnimator.dll\r\nc:\\Windows\\System32\\fontgroupsoverride.dll",
"c:\\Windows\\System32\\FontProvider.dll\nc:\\Windows\\System32\\fontsub.dll\nc:\\Windows\\System32\\fontview.exe\r\n",
"c:\\Windows\\System32\\forfiles.exe\nc:\\Windows\\System32\\format.com\nc:\\Windows\\System32\\fpb.rs\r\n",
"c:\\Windows\\System32\\fphc.dll\nc:\\Windows\\System32\\framedyn.dll\r\nc:\\Windows\\System32\\framedynos.dll\r\n",
"c:\\Windows\\System32\\FrameServer.dll\r\nc:\\Windows\\System32\\FrameServerClient.dll\nc:\\Windows\\System32\\FrameServerMonitor.dll",
"c:\\Windows\\System32\\FrameServerMonitorClient.dll\nc:\\Windows\\System32\\FrameworkPerf.dll\nc:\\Windows\\System32\\frprov.dll",
"c:\\Windows\\System32\\fsavailux.exe\r\nc:\\Windows\\System32\\FsIso.exe\r\nc:\\Windows\\System32\\fsmgmt.msc",
"c:\\Windows\\System32\\FsNVSDeviceSource.dll\r\nc:\\Windows\\System32\\fsquirt.exe\nc:\\Windows\\System32\\fsutil.exe",
"c:\\Windows\\System32\\fsutilext.dll\nc:\\Windows\\System32\\fthsvc.dll\r\nc:\\Windows\\System32\\ftp.exe",
"c:\\Windows\\System32\\fundisc.dll\nc:\\Windows\\System32\\fveapi.dll\r\nc:\\Windows\\System32\\fveapibase.dll\r\n",
"c:\\Windows\\System32\\fvecerts.dll\nc:\\Windows\\System32\\fvecpl.dll\r\nc:\\Windows\\System32\\fvenotify.exe",
"c:\\Windows\\System32\\fveprompt.exe\r\nc:\\Windows\\System32\\fveskybackup.dll\r\nc:\\Windows\\System32\\fveui.dll\r\n",
"c:\\Windows\\System32\\fvewiz.dll\nc:\\Windows\\System32\\fwbase.dll\nc:\\Windows\\System32\\fwcfg.dll\n",
"c:\\Windows\\System32\\fwmdmcsp.dll\r\nc:\\Windows\\System32\\fwpolicyiomgr.dll\nc:\\Windows\\System32\\FWPUCLNT.DLL",
"c:\\Windows\\System32\\FwRemoteSvr.dll\r\nc:\\Windows\\System32\\FXSAPI.dll\nc:\\Windows\\System32\\FXSCOM.dll",
"c:\\Windows\\System32\\FXSCOMEX.dll\nc:\\Windows\\System32\\FXSCOMPOSE.dll\r\nc:\\Windows\\System32\\FXSCOMPOSERES.dll",
"c:\\Windows\\System32\\FXSCOVER.exe\nc:\\Windows\\System32\\FXSEVENT.dll\r\nc:\\Windows\\System32\\FXSMON.dll\n",
"c:\\Windows\\System32\\FXSRESM.dll\r\nc:\\Windows\\System32\\FXSROUTE.dll\nc:\\Windows\\System32\\FXSST.dll",
"c:\\Windows\\System32\\FXSSVC.exe\r\nc:\\Windows\\System32\\FXST30.dll\nc:\\Windows\\System32\\FXSTIFF.dll\n",
"c:\\Windows\\System32\\FXSUNATD.exe\r\nc:\\Windows\\System32\\FXSUTILITY.dll\nc:\\Windows\\System32\\g711codc.ax\n",
"c:\\Windows\\System32\\GameBarPresenceWriter.exe\nc:\\Windows\\System32\\GameBarPresenceWriter.proxy.dll\r\nc:\\Windows\\System32\\GameChatOverlayExt.dll",
"c:\\Windows\\System32\\GameChatTranscription.dll\r\nc:\\Windows\\System32\\GameInput.dll\nc:\\Windows\\System32\\gamemode.dll",
"c:\\Windows\\System32\\GamePanel.exe\nc:\\Windows\\System32\\GamePanelExternalHook.dll\nc:\\Windows\\System32\\gamestreamingext.dll",
"c:\\Windows\\System32\\GameSystemToastIcon.contrast-white.png\nc:\\Windows\\System32\\GameSystemToastIcon.png\r\nc:\\Windows\\System32\\gameux.dll",
"c:\\Windows\\System32\\gamingtcui.dll\nc:\\Windows\\System32\\gatherNetworkInfo.vbs\r\nc:\\Windows\\System32\\gb2312.uce",
"c:\\Windows\\System32\\gcdef.dll\nc:\\Windows\\System32\\gdi32.dll\nc:\\Windows\\System32\\gdi32full.dll",
"c:\\Windows\\System32\\GdiPlus.dll\nc:\\Windows\\System32\\generaltel.dll\nc:\\Windows\\System32\\GenValObj.exe\r\n",
"c:\\Windows\\System32\\Geocommon.dll\r\nc:\\Windows\\System32\\Geolocation.dll\nc:\\Windows\\System32\\getmac.exe\n",
"c:\\Windows\\System32\\getuname.dll\nc:\\Windows\\System32\\GfxValDisplayLog.bin\r\nc:\\Windows\\System32\\glmf32.dll\n",
"c:\\Windows\\System32\\globinputhost.dll\nc:\\Windows\\System32\\glu32.dll\r\nc:\\Windows\\System32\\gmsaclient.dll",
"c:\\Windows\\System32\\gpapi.dll\r\nc:\\Windows\\System32\\GPCSEWrapperCsp.dll\r\nc:\\Windows\\System32\\gpedit.dll\r\n",
"c:\\Windows\\System32\\gpedit.msc\nc:\\Windows\\System32\\gpprefcl.dll\nc:\\Windows\\System32\\gpprnext.dll\n",
"c:\\Windows\\System32\\gpresult.exe\nc:\\Windows\\System32\\gpscript.dll\nc:\\Windows\\System32\\gpscript.exe",
"c:\\Windows\\System32\\gpsvc.dll\r\nc:\\Windows\\System32\\gptext.dll\nc:\\Windows\\System32\\gpupdate.exe",
"c:\\Windows\\System32\\gpupvdev.dll\r\nc:\\Windows\\System32\\GraphicsCapture.dll\nc:\\Windows\\System32\\GraphicsPerfSvc.dll\r\n",
"c:\\Windows\\System32\\grb.rs\nc:\\Windows\\System32\\Groupinghc.dll\r\nc:\\Windows\\System32\\grpconv.exe\r\n",
"c:\\Windows\\System32\\hal.dll\nc:\\Windows\\System32\\HalExtIntcLpioDMA.dll\r\nc:\\Windows\\System32\\HalExtIntcPseDMA.dll",
"c:\\Windows\\System32\\HalExtPL080.dll\nc:\\Windows\\System32\\HandwritingSystemToastIcon.contrast-white.png\r\nc:\\Windows\\System32\\HandwritingSystemToastIcon.png\r\n",
"c:\\Windows\\System32\\HanjaDS.dll\r\nc:\\Windows\\System32\\hascsp.dll\nc:\\Windows\\System32\\HashtagDS.dll\n",
"c:\\Windows\\System32\\hbaapi.dll\r\nc:\\Windows\\System32\\hcproviders.dll\r\nc:\\Windows\\System32\\hcsdiag.exe",
"c:\\Windows\\System32\\HdcpHandler.dll\r\nc:\\Windows\\System32\\hdwwiz.cpl\r\nc:\\Windows\\System32\\hdwwiz.exe",
"c:\\Windows\\System32\\HeadphoneSystemToastIcon.contrast-white.png\r\nc:\\Windows\\System32\\HeadphoneSystemToastIcon.png\nc:\\Windows\\System32\\HeadsetSystemToastIcon.contrast-white.png",
"c:\\Windows\\System32\\HeadsetSystemToastIcon.png\r\nc:\\Windows\\System32\\HealthSystemToastIcon.contrast-white.png\nc:\\Windows\\System32\\HealthSystemToastIcon.png\n",
"c:\\Windows\\System32\\HearingAidSystemToastIcon.contrast-white.png\r\nc:\\Windows\\System32\\HearingAidSystemToastIcon.png\nc:\\Windows\\System32\\HeatCore.dll",
"c:\\Windows\\System32\\help.exe\nc:\\Windows\\System32\\HelpPaneProxy.dll\nc:\\Windows\\System32\\hgattest.dll",
"c:\\Windows\\System32\\hgclientservice.dll\r\nc:\\Windows\\System32\\hgclientserviceps.dll\r\nc:\\Windows\\System32\\hgcpl.dll\n",
"c:\\Windows\\System32\\hgsclientplugin.dll\nc:\\Windows\\System32\\HgsClientWmi.dll\r\nc:\\Windows\\System32\\hhctrl.ocx",
"c:\\Windows\\System32\\hhsetup.dll\nc:\\Windows\\System32\\hid.dll\r\nc:\\Windows\\System32\\HidCfu.dll",
"c:\\Windows\\System32\\hidphone.tsp\r\nc:\\Windows\\System32\\hidserv.dll\r\nc:\\Windows\\System32\\hlink.dll",
"c:\\Windows\\System32\\hmkd.dll\nc:\\Windows\\System32\\hnetcfg.dll\r\nc:\\Windows\\System32\\HNetCfgClient.dll",
"c:\\Windows\\System32\\hnetmon.dll\nc:\\Windows\\System32\\hnsdiag.exe\r\nc:\\Windows\\System32\\hnsproxy.dll",
"c:\\Windows\\System32\\HologramCompositor.dll\nc:\\Windows\\System32\\HologramWorld.dll\r\nc:\\Windows\\System32\\HolographicExtensions.dll\n",
"c:\\Windows\\System32\\HolographicRuntimes.dll\nc:\\Windows\\System32\\HoloShellRuntime.dll\r\nc:\\Windows\\System32\\HoloSHExtensions.dll\r\n",
"c:\\Windows\\System32\\HoloSI.PCShell.dll\nc:\\Windows\\System32\\HostGuardianServiceClientResources.dll\r\nc:\\Windows\\System32\\HOSTNAME.EXE",
"c:\\Windows\\System32\\HostNetSvc.dll\nc:\\Windows\\System32\\hotplug.dll\nc:\\Windows\\System32\\HrtfApo.dll",
"c:\\Windows\\System32\\HrtfDspCpu.dll\r\nc:\\Windows\\System32\\hspapi.dll\r\nc:\\Windows\\System32\\hspfw.dll\n",
"c:\\Windows\\System32\\html.iec\r\nc:\\Windows\\System32\\httpapi.dll\r\nc:\\Windows\\System32\\httpprxc.dll\n",
"c:\\Windows\\System32\\httpprxm.dll\nc:\\Windows\\System32\\httpprxp.dll\nc:\\Windows\\System32\\HttpsDataSource.dll",
"c:\\Windows\\System32\\htui.dll\r\nc:\\Windows\\System32\\hvax64.exe\r\nc:\\Windows\\System32\\hvc.exe",
"c:\\Windows\\System32\\hvhostsvc.dll\r\nc:\\Windows\\System32\\hvix64.exe\r\nc:\\Windows\\System32\\hvloader.dll\n",
"c:\\Windows\\System32\\hvsievaluator.exe\r\nc:\\Windows\\System32\\hvsigpext.dll\nc:\\Windows\\System32\\HvsiManagementApi.dll",
"c:\\Windows\\System32\\HvSocket.dll\r\nc:\\Windows\\System32\\hwreqchk.dll\nc:\\Windows\\System32\\Hydrogen.dll",
"c:\\Windows\\System32\\HyperVSysprepProvider.dll\nc:\\Windows\\System32\\IA2ComProxy.dll\nc:\\Windows\\System32\\ias.dll",
"c:\\Windows\\System32\\iasacct.dll\nc:\\Windows\\System32\\iasads.dll\nc:\\Windows\\System32\\iasdatastore.dll\n",
"c:\\Windows\\System32\\iashlpr.dll\r\nc:\\Windows\\System32\\IasMigPlugin.dll\nc:\\Windows\\System32\\iasnap.dll",
"c:\\Windows\\System32\\iaspolcy.dll\r\nc:\\Windows\\System32\\iasrad.dll\r\nc:\\Windows\\System32\\iasrecst.dll\r\n",
"c:\\Windows\\System32\\iassam.dll\r\nc:\\Windows\\System32\\iassdo.dll\nc:\\Windows\\System32\\iassvcs.dll",
"c:\\Windows\\System32\\iaStorAfsNative.exe\r\nc:\\Windows\\System32\\iaStorAfsService.exe\r\nc:\\Windows\\System32\\icacls.exe",
"c:\\Windows\\System32\\icfupgd.dll\nc:\\Windows\\System32\\icm32.dll\nc:\\Windows\\System32\\icmp.dll",
"c:\\Windows\\System32\\icmui.dll\r\nc:\\Windows\\System32\\IconCodecService.dll\nc:\\Windows\\System32\\IcsEntitlementHost.exe",
"c:\\Windows\\System32\\icsigd.dll\nc:\\Windows\\System32\\icsunattend.exe\nc:\\Windows\\System32\\icsvc.dll\r\n",
"c:\\Windows\\System32\\icsvcext.dll\nc:\\Windows\\System32\\icsvcvss.dll\nc:\\Windows\\System32\\icu.dll",
"c:\\Windows\\System32\\icuin.dll\r\nc:\\Windows\\System32\\icuuc.dll\r\nc:\\Windows\\System32\\IdCtrls.dll",
"c:\\Windows\\System32\\ideograf.uce\r\nc:\\Windows\\System32\\IDStore.dll\r\nc:\\Windows\\System32\\ie4uinit.exe\r\n",
"c:\\Windows\\System32\\ie4ushowIE.exe\r\nc:\\Windows\\System32\\IEAdvpack.dll\r\nc:\\Windows\\System32\\ieapfltr.dll",
"c:\\Windows\\System32\\iedkcs32.dll\r\nc:\\Windows\\System32\\ieframe.dll\r\nc:\\Windows\\System32\\iemigplugin.dll\r\n",
};
} |
|
Ha, kudos!. Wonder how much of this if any might help the .NET Framework case (where there's no string.Create(delegate)) (Btw I actually meant, does the scenario suggest changes/new API of some sort in .NET that would make this easier for them. Eg a way to create StringBuilder over a pooled buffer might help.) |
|
I think we can refactor this to be zero-alloc without jumping through any hoops in this method. Let me try that this afternoon before we proceed here.
I on board with this plan if my other refactor doesn't work, or causes dramatically worse perf when writing to the console (due to sending more smaller blocks to stdout).
We have So I'm not going to argue :) |
Well played, sir! |
|
Taking advantage of @stephentoub's work with Nerdsnipe, I added XPlatNerdsnipe. It takes advantage of Nerdsnipe's more efficient implementation of Not quite sure why the CPU ratio of XPlatNerdsnipe compared to Optimized on .NET 7 (~0.67) is so different from Nerdsnipe (~0.30), though. The only substantive difference I can see is that XPlatNerdsnipe doesn't use
```
| Method | Runtime | StringCount | Mean | Ratio | Allocated | Alloc Ratio |
|-------------------- |--------------------- |------------ |-------------:|------:|----------:|------------:|
| Optimized | .NET 7.0 | 2 | 808.5 ns | 1.00 | 976 B | 1.00 |
| CachedStringBuilder | .NET 7.0 | 2 | 849.7 ns | 1.05 | 1050 B | 1.08 |
| XPlatNerdsnipe | .NET 7.0 | 2 | 556.1 ns | 0.69 | 976 B | 1.00 |
| | | | | | | |
| Optimized | .NET Framework 4.7.2 | 2 | 911.5 ns | 1.00 | 979 B | 1.00 |
| CachedStringBuilder | .NET Framework 4.7.2 | 2 | 1,120.1 ns | 1.23 | 1057 B | 1.08 |
| XPlatNerdsnipe | .NET Framework 4.7.2 | 2 | 1,066.1 ns | 1.17 | 1057 B | 1.08 |
| | | | | | | |
| Optimized | .NET 7.0 | 4 | 1,416.6 ns | 1.00 | 1632 B | 1.00 |
| CachedStringBuilder | .NET 7.0 | 4 | 1,504.6 ns | 1.06 | 1779 B | 1.09 |
| XPlatNerdsnipe | .NET 7.0 | 4 | 941.9 ns | 0.66 | 1632 B | 1.00 |
| | | | | | | |
| Optimized | .NET Framework 4.7.2 | 4 | 1,624.0 ns | 1.00 | 1653 B | 1.00 |
| CachedStringBuilder | .NET Framework 4.7.2 | 4 | 2,007.6 ns | 1.24 | 1810 B | 1.09 |
| XPlatNerdsnipe | .NET Framework 4.7.2 | 4 | 1,851.7 ns | 1.14 | 1810 B | 1.09 |
| | | | | | | |
| Optimized | .NET 7.0 | 8 | 2,728.3 ns | 1.00 | 3096 B | 1.00 |
| CachedStringBuilder | .NET 7.0 | 8 | 2,872.3 ns | 1.05 | 3428 B | 1.11 |
| XPlatNerdsnipe | .NET 7.0 | 8 | 1,881.4 ns | 0.68 | 3096 B | 1.00 |
| | | | | | | |
| Optimized | .NET Framework 4.7.2 | 8 | 3,140.2 ns | 1.00 | 3145 B | 1.00 |
| CachedStringBuilder | .NET Framework 4.7.2 | 8 | 3,872.6 ns | 1.23 | 3448 B | 1.10 |
| XPlatNerdsnipe | .NET Framework 4.7.2 | 8 | 3,665.4 ns | 1.17 | 3448 B | 1.10 |
| | | | | | | |
| Optimized | .NET 7.0 | 16 | 4,839.3 ns | 1.00 | 5424 B | 1.00 |
| CachedStringBuilder | .NET 7.0 | 16 | 5,308.4 ns | 1.10 | 6176 B | 1.14 |
| XPlatNerdsnipe | .NET 7.0 | 16 | 3,229.0 ns | 0.67 | 5424 B | 1.00 |
| | | | | | | |
| Optimized | .NET Framework 4.7.2 | 16 | 5,710.2 ns | 1.00 | 5504 B | 1.00 |
| CachedStringBuilder | .NET Framework 4.7.2 | 16 | 7,209.0 ns | 1.26 | 6129 B | 1.11 |
| XPlatNerdsnipe | .NET Framework 4.7.2 | 16 | 6,812.8 ns | 1.19 | 6129 B | 1.11 |
| | | | | | | |
| Optimized | .NET 7.0 | 32 | 9,133.1 ns | 1.00 | 9920 B | 1.00 |
| CachedStringBuilder | .NET 7.0 | 32 | 9,834.4 ns | 1.08 | 11447 B | 1.15 |
| XPlatNerdsnipe | .NET 7.0 | 32 | 6,086.6 ns | 0.67 | 9920 B | 1.00 |
| | | | | | | |
| Optimized | .NET Framework 4.7.2 | 32 | 10,941.4 ns | 1.00 | 10102 B | 1.00 |
| CachedStringBuilder | .NET Framework 4.7.2 | 32 | 13,933.2 ns | 1.27 | 11429 B | 1.13 |
| XPlatNerdsnipe | .NET Framework 4.7.2 | 32 | 13,253.0 ns | 1.21 | 11429 B | 1.13 |
| | | | | | | |
| Optimized | .NET 7.0 | 64 | 18,955.3 ns | 1.00 | 19832 B | 1.00 |
| CachedStringBuilder | .NET 7.0 | 64 | 20,305.9 ns | 1.07 | 23019 B | 1.16 |
| XPlatNerdsnipe | .NET 7.0 | 64 | 12,412.4 ns | 0.66 | 19832 B | 1.00 |
| | | | | | | |
| Optimized | .NET Framework 4.7.2 | 64 | 22,375.4 ns | 1.00 | 20131 B | 1.00 |
| CachedStringBuilder | .NET Framework 4.7.2 | 64 | 28,966.9 ns | 1.30 | 22662 B | 1.13 |
| XPlatNerdsnipe | .NET Framework 4.7.2 | 64 | 27,949.3 ns | 1.25 | 22662 B | 1.13 |
| | | | | | | |
| Optimized | .NET 7.0 | 128 | 36,466.0 ns | 1.00 | 38136 B | 1.00 |
| CachedStringBuilder | .NET 7.0 | 128 | 40,436.7 ns | 1.11 | 44313 B | 1.16 |
| XPlatNerdsnipe | .NET 7.0 | 128 | 24,885.1 ns | 0.68 | 38136 B | 1.00 |
| | | | | | | |
| Optimized | .NET Framework 4.7.2 | 128 | 43,507.7 ns | 1.00 | 38827 B | 1.00 |
| CachedStringBuilder | .NET Framework 4.7.2 | 128 | 56,402.2 ns | 1.30 | 43672 B | 1.12 |
| XPlatNerdsnipe | .NET Framework 4.7.2 | 128 | 54,081.8 ns | 1.24 | 43672 B | 1.12 |
| | | | | | | |
| Optimized | .NET 7.0 | 256 | 71,974.4 ns | 1.00 | 73360 B | 1.00 |
| CachedStringBuilder | .NET 7.0 | 256 | 80,293.3 ns | 1.12 | 85106 B | 1.16 |
| XPlatNerdsnipe | .NET 7.0 | 256 | 49,495.1 ns | 0.69 | 73360 B | 1.00 |
| | | | | | | |
| Optimized | .NET Framework 4.7.2 | 256 | 86,352.2 ns | 1.00 | 74645 B | 1.00 |
| CachedStringBuilder | .NET Framework 4.7.2 | 256 | 110,981.4 ns | 1.29 | 84060 B | 1.13 |
| XPlatNerdsnipe | .NET Framework 4.7.2 | 256 | 109,097.8 ns | 1.26 | 84059 B | 1.13 |
| | | | | | | |
| Optimized | .NET 7.0 | 512 | 145,026.5 ns | 1.00 | 145728 B | 1.00 |
| CachedStringBuilder | .NET 7.0 | 512 | 160,869.5 ns | 1.11 | 166518 B | 1.14 |
| XPlatNerdsnipe | .NET 7.0 | 512 | 105,011.6 ns | 0.72 | 145728 B | 1.00 |
| | | | | | | |
| Optimized | .NET Framework 4.7.2 | 512 | 172,150.3 ns | 1.00 | 148296 B | 1.00 |
| CachedStringBuilder | .NET Framework 4.7.2 | 512 | 224,211.6 ns | 1.30 | 166100 B | 1.12 |
| XPlatNerdsnipe | .NET Framework 4.7.2 | 512 | 225,702.1 ns | 1.31 | 166101 B | 1.12 |
```
|
MemoryExtensions.Count was added in .NET 8, which is why it doesn't compile. It won't be quite as good, but you can try substituting something like: internal static int Count(this ReadOnlySpan<char> span, char c)
{
int count = 0;
while (true)
{
int i = span.IndexOf(c);
if (i < 0) break;
count++;
span = span.Slice(i + 1);
}
return count;
} |
|
I benchmarked XPlatNerdsnipe on .NET 8 vs .NET 7 and there was a notable improvement just by changing runtimes. It didn't account for 100% of the difference between it and Nerdsnipe, but it's close enough for me to no longer worry about it anymore. I'll push XPlatNerdsnipe to the PR... |
|
My investigations didn't pan out: on .NET Framework where there's no |
|
@jdrobison I have some nits I won't burden you with and I'll fix the unused warning while I'm in there. |
danmoseley
reviewed
Jun 30, 2023
Thanks, @rainersigwald! |
rainersigwald
approved these changes
Jun 30, 2023
|
@rokonec, I need a second approval on this PR. Could you take a look? Thanks |
davkean
approved these changes
Jul 12, 2023
rokonec
approved these changes
Jul 12, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes Bug 1828095: [GCPauseWatson] MSBuild: BaseConsoleLogger.IndentString uses String.Split and StringBuilder to create an indented string
GCPauseWatson telemetry showed that
BaseConsoleLogger.IndentStringis responsible for allocating 1.99 GB of memory in VS at the 95th percentile. This change aims to address that by replacing the multiple allocations ofString.SplitandStringBuilderwith code that makes a single allocation of a right-sized string and then builds the indented string directly in the new string's buffer.Benchmarking shows that -- depending on the target framework -- the new algorithm runs in 50-75% of the time of the code it replaces, and allocates 15-30% of the memory. The optimizations have more of an impact on net472 than on net7.0 due to the
StringandStringBuilderoptimizations included in net7.0.