===== T1 =====

===== T2 =====
/home/sansforensics/cases/T2/evidence/T2_MID_cmdline.txt:105:5208	powershell.exe	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" 
/home/sansforensics/cases/T2/evidence/T2_PRE_pslist.txt:113:5208	3976	powershell.exe	0xbf05b0e692c0	14	-	1	False	2026-09-10 23:03:39.000000 UTC	N/A	Disabled
/home/sansforensics/cases/T2/evidence/T2_pslist.txt:98:4372	3992	powershell.exe	0xd105a50082c0	12	-	1	False	2026-09-10 19:16:46.000000 UTC	N/A	Disabled
/home/sansforensics/cases/T2/evidence/T2_malfind.txt:195:4372	powershell.exe	0x1d3e8580000	0x1d3e858ffff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
/home/sansforensics/cases/T2/evidence/T2_malfind.txt:209:4372	powershell.exe	0x1d3e8590000	0x1d3e859cfff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	N/A	
/home/sansforensics/cases/T2/evidence/T2_malfind.txt:240:4372	powershell.exe	0x1d3e8900000	0x1d3e890ffff	VadS	PAGE_EXECUTE_READWRITE	15	1	Disabled	N/A	
/home/sansforensics/cases/T2/evidence/T2_malfind.txt:255:4372	powershell.exe	0x7df4b9d70000	0x7df4b9d7ffff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	N/A	
/home/sansforensics/cases/T2/evidence/T2_malfind.txt:277:4372	powershell.exe	0x7df4b9d80000	0x7df4b9e1ffff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
/home/sansforensics/cases/T2/evidence/T2_pstree.txt:98:4372	3992	powershell.exe	0xd105a50082c0	12	-	1	False	2026-09-10 19:16:46.000000 UTC	N/A	Disabled
/home/sansforensics/cases/T2/evidence/T2_PRE_malfind.txt:138:5208	powershell.exe	0x1b057fe0000	0x1b057feffff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
/home/sansforensics/cases/T2/evidence/T2_PRE_malfind.txt:151:5208	powershell.exe	0x1b057fc0000	0x1b057fccfff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	N/A	
/home/sansforensics/cases/T2/evidence/T2_PRE_malfind.txt:185:5208	powershell.exe	0x1b070350000	0x1b07035ffff	VadS	PAGE_EXECUTE_READWRITE	10	1	Disabled	N/A	
/home/sansforensics/cases/T2/evidence/T2_PRE_malfind.txt:194:5208	powershell.exe	0x7df405670000	0x7df40567ffff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	N/A	
/home/sansforensics/cases/T2/evidence/T2_PRE_malfind.txt:216:5208	powershell.exe	0x7df405680000	0x7df40571ffff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:1:    "Rename-Item",
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:2:    "Rename-ItemProperty",
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:3:Rename-ItemI
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:4:Rename-ItemG
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:5:Rename-ItemI
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:6:Rename-ItemG
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:7:Rename-ItemF
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:8:.locked
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:9:.locked
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:10:!#PowerShell:Rename-ItemProperty
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:11:Vrename-itemproperty
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:12:.locked.
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:13:.locked.
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:14:!#PowerShell:Rename-Item
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:15:Srename-item
/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:16:.h1w".h3m".h4r".h5".h_1033".ha".hbi".hbk".hbx".hdb".hdd".hdf".hdk".hdmov".hdp".hdr".hds".helpcfg".helpcfg6".hex".hh".hht".hi".hid".hid2".hif".hip".hipnc".his".hit".hkdb".hkf".hkx".hlp".hmi".hol".hol_1033".hpf".hpg".hpgl".hpi".hpl".hplg".hpp".hpt".hqx".hrs".hs".hsr".hst".hta".htc".htm".html".htpasswd".hts".htt".hvpl".hwp".hxc".hxc_1033".hxk".hxk_1033".hxl".hxn".hxs".hxs_1033".hxt".hxt_1033".hxx".hz".i2b".i3d".iam".ib".iban".ibank".ibd".ibdata".ibm".ibooks".ibz".icb".icc".icd".icm".icn".ico".icon".icpr".ics".icxs".id".idb".idc".idea".idf".idl".idml".idw".idx".idx_dll".idx_dll_1033".ie5".ie6".ie7".ie8".ie9".iec".ief".iem".ifc".iff".ifo".ifx".iges".igr".igt".igx".ihtml".ihx".iif".iii".iil".iiq".ilg".image".imb".imd".ime".img".img_jpg".imh".iml".imm".imp".ims".in0".inc".incpas".ind".indb".indd".index".indl".indt".inf".inf".inf_loc".info".info_".ini".ini0".ini2".ini4".ini8".ini_1033".inid".inih".inil".inip".init".inix".ink".inp".ins".int".int?".interim".intu".inv".inx".iobj".ipa".ipd".ipdb".ipe".ipf".ipg".ipn".ipt".ipx".iqy".ird".iros".irs".iso".isp".iss".issue".isu".isz".itc2".itdb".itf".itl".itm".its".its_1036".its_3082".itw".iv2i".ivf".iwa".iwd".iwi".j".j2c".j2e".j2k".ja".jac".jad".jag".jar".jarvis".jas".jav".java".jb2".jbc".jbig".jbig2".jbmp".jbr".jc".jdb".jfif".jge".jgz".jia".jif".jiff".jis".jks".jmf".jng".jnt".job".joe".jp1".jp2".jpc".jpe".jpeg".jpf".jpg".jpg2".jpg_1033".jpm".jpn".jps".jpw".jpx".jrs".jrtf".js".jsd".jsda".jsf".jsfl".jsm".json".jsonb".jsp".jspa".jspx".jss".jst".jsx".jt".jtd".jtf".jtp".jtt".jtx".just".jwl".jxr".k1f".k25".k2p".kar".karbon".kb1".kb7".kbx".kc2".kcf".kcl".kd3".kdb".kdbx".kdc".kde".kdi".kdk".kdtmp".kes".kexi".kexic".kexis".key".keynote".keystore".kf".kfo".kic".kix".klg".klq".kml".kmo".kmy".kmz".knt".kon".kor".kpdx".kpg".kpr".kpt".ksd".kvp".kwd".kwm".kwt".kxp".kys".l".laccdb".las".lasso".lassoapp".lastlogin".latex".lay".lay6".layout".lbf".lbi".lbl".lbm".lbt".lcc".lcd".lcf".lck".lcn".ldb".ldc".ldf".ldif".ldr".ldw".lef".let".lex".lex_1033".lex_1036".lex_3082".lgb".lgc".lgf".lgp".lgt".lha".lhr".lib".library-ms".lic".lid".lin".lis".lisp".list".lit".litcofee".litemod".litesql".ljp".lk_parts".lld".lmk".lmr".lnf".lng".lngttarch2".lnk".lnt".localstorage".localstorage-journal".lock".locked".log".log1".log2".log_0".logdat".lp2".lpa".lpd".lpr".lrc".lrf".lrm".ls".lsf".lst".lsx".ltm".ltr".lts".ltx".lua".lue".luf".lvivt".lvl".lwo".lwp".lws".lxa".lxfml".lxo".lyc".lyt".lyx".lz".lzh".lzma".lzo".lzx".m".m10".m11".m12".m13".m14".m15".m16".m1a".m1v".m2".m2a".m2p".m2t".m2ts".m2v".m3d".m3u".m3u8".m4".m4a".m4b".m4p".m4r".m4u".m4v".ma".mab".mac".maf".maff".mag".mam".man".manifest".map".mapimail".maq".mar".master".mat".matlab".maw".max".mb".mbd".mbm".mbox".mbsb".mbx".mcd".mcdat".mcdat".mcfi".mcfp".mcgame".mcl".mcmeta".mcrp".mcs".mcw".mcx".md".md0".md1".md2".md3".md5".md5txt".mda".mdb".mdbackup".mdbhtml".mdc".mddata".mde".mdf".mdi".mdinfo".mdl".mdlp".mdn".mdp".mds".mdt".mdw".mdx".me".mef".mel".mell".mem".menu".meo".mesh".met".meta".mfd".mfl".mft".mfw".mgcb".mgmf".mgmt".mgmx".mgtx".mht".mhtm".mhtml".mib".mic".micro".mid".midi".mim".mime".min".mip".mjd".mjf".mka".mkd".mkidx".mkv".ml".ml2".ml9".mlb".mlc".mll".mllr".mlp".mlx".mm3d".mm6".mm7".mm8".mmat".mmb".mme".mmf".mml".mmn".mmo".mmw".mmx".mn1".mn2".mn3".mn4".mn5".mn6".mn7".mn8".mn9".mne".mng".mni".mno".mnp".mnr".mnt".mnu".mny".mobi".mobileprovision".mocha".mod".model".mof".mon".mone".money".moneywell".moov".mos".mov".movie".moz".mp1".mp2".mp2v".mp3".mp4".mp4v".mpa".mpb".mpc".mpd".mpe".mpeg".mpeg4".mpega".mpf".mpg".mpga".mpj".mpk".mpkg".mpls".mpo".mpp".mpq".mpqge".mpqworld".mpt".mpu".mpv".mpv2".mpv4".mq4".mqh".mql".mrbak".mrc".mrg".mrimg".mrq".mrw".mrwref".mrxs".ms".ms11".ms12".msc".mse".msf".msg".msg_1033".mshdb".msi".msmessagestore".mso".msp".msstyles".mst".msu".mt9".mta".mtb".mte".mtrl".mts".mud".mui".mum".mus".mvb".mwb".mwf".mwi".mwp".mws".mx".mx0".mxd".mxf".mxl".mxlz".mxp".mxu".myd".mydocs".mye".myf".myi".myl".myo".myox".mzz".n43".n64".nam".nap".nav".nba".nbd".nbf".nbi".nbr".nbu".nbz".ncd".ncf".nco".ncr".nct".nd".ndd".ndf".nds".ndx".nef".nes".net".new".nexe".nfl".nfo".^Y

===== T3 =====
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:4:/home/sansforensics/cases/T2/evidence/T2_MID_cmdline.txt:105:5208	powershell.exe	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" 
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:5:/home/sansforensics/cases/T2/evidence/T2_PRE_pslist.txt:113:5208	3976	powershell.exe	0xbf05b0e692c0	14	-	1	False	2026-09-10 23:03:39.000000 UTC	N/A	Disabled
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:6:/home/sansforensics/cases/T2/evidence/T2_pslist.txt:98:4372	3992	powershell.exe	0xd105a50082c0	12	-	1	False	2026-09-10 19:16:46.000000 UTC	N/A	Disabled
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:7:/home/sansforensics/cases/T2/evidence/T2_malfind.txt:195:4372	powershell.exe	0x1d3e8580000	0x1d3e858ffff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:8:/home/sansforensics/cases/T2/evidence/T2_malfind.txt:209:4372	powershell.exe	0x1d3e8590000	0x1d3e859cfff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	N/A	
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:9:/home/sansforensics/cases/T2/evidence/T2_malfind.txt:240:4372	powershell.exe	0x1d3e8900000	0x1d3e890ffff	VadS	PAGE_EXECUTE_READWRITE	15	1	Disabled	N/A	
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:10:/home/sansforensics/cases/T2/evidence/T2_malfind.txt:255:4372	powershell.exe	0x7df4b9d70000	0x7df4b9d7ffff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	N/A	
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:11:/home/sansforensics/cases/T2/evidence/T2_malfind.txt:277:4372	powershell.exe	0x7df4b9d80000	0x7df4b9e1ffff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:12:/home/sansforensics/cases/T2/evidence/T2_pstree.txt:98:4372	3992	powershell.exe	0xd105a50082c0	12	-	1	False	2026-09-10 19:16:46.000000 UTC	N/A	Disabled
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:13:/home/sansforensics/cases/T2/evidence/T2_PRE_malfind.txt:138:5208	powershell.exe	0x1b057fe0000	0x1b057feffff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:14:/home/sansforensics/cases/T2/evidence/T2_PRE_malfind.txt:151:5208	powershell.exe	0x1b057fc0000	0x1b057fccfff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	N/A	
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:15:/home/sansforensics/cases/T2/evidence/T2_PRE_malfind.txt:185:5208	powershell.exe	0x1b070350000	0x1b07035ffff	VadS	PAGE_EXECUTE_READWRITE	10	1	Disabled	N/A	
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:16:/home/sansforensics/cases/T2/evidence/T2_PRE_malfind.txt:194:5208	powershell.exe	0x7df405670000	0x7df40567ffff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	N/A	
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:17:/home/sansforensics/cases/T2/evidence/T2_PRE_malfind.txt:216:5208	powershell.exe	0x7df405680000	0x7df40571ffff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:18:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:1:    "Rename-Item",
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:19:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:2:    "Rename-ItemProperty",
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:20:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:3:Rename-ItemI
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:21:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:4:Rename-ItemG
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:22:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:5:Rename-ItemI
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:23:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:6:Rename-ItemG
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:24:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:7:Rename-ItemF
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:25:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:8:.locked
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:26:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:9:.locked
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:27:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:10:!#PowerShell:Rename-ItemProperty
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:28:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:11:Vrename-itemproperty
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:29:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:12:.locked.
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:30:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:13:.locked.
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:31:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:14:!#PowerShell:Rename-Item
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:32:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:15:Srename-item
/home/sansforensics/cases/T3/evidence/FINAL_T1_T2_T3_COMPARISON.txt:33:/home/sansforensics/cases/T2/evidence/T2_MID_strings_ransomware.txt:16:.h1w".h3m".h4r".h5".h_1033".ha".hbi".hbk".hbx".hdb".hdd".hdf".hdk".hdmov".hdp".hdr".hds".helpcfg".helpcfg6".hex".hh".hht".hi".hid".hid2".hif".hip".hipnc".his".hit".hkdb".hkf".hkx".hlp".hmi".hol".hol_1033".hpf".hpg".hpgl".hpi".hpl".hplg".hpp".hpt".hqx".hrs".hs".hsr".hst".hta".htc".htm".html".htpasswd".hts".htt".hvpl".hwp".hxc".hxc_1033".hxk".hxk_1033".hxl".hxn".hxs".hxs_1033".hxt".hxt_1033".hxx".hz".i2b".i3d".iam".ib".iban".ibank".ibd".ibdata".ibm".ibooks".ibz".icb".icc".icd".icm".icn".ico".icon".icpr".ics".icxs".id".idb".idc".idea".idf".idl".idml".idw".idx".idx_dll".idx_dll_1033".ie5".ie6".ie7".ie8".ie9".iec".ief".iem".ifc".iff".ifo".ifx".iges".igr".igt".igx".ihtml".ihx".iif".iii".iil".iiq".ilg".image".imb".imd".ime".img".img_jpg".imh".iml".imm".imp".ims".in0".inc".incpas".ind".indb".indd".index".indl".indt".inf".inf".inf_loc".info".info_".ini".ini0".ini2".ini4".ini8".ini_1033".inid".inih".inil".inip".init".inix".ink".inp".ins".int".int?".interim".intu".inv".inx".iobj".ipa".ipd".ipdb".ipe".ipf".ipg".ipn".ipt".ipx".iqy".ird".iros".irs".iso".isp".iss".issue".isu".isz".itc2".itdb".itf".itl".itm".its".its_1036".its_3082".itw".iv2i".ivf".iwa".iwd".iwi".j".j2c".j2e".j2k".ja".jac".jad".jag".jar".jarvis".jas".jav".java".jb2".jbc".jbig".jbig2".jbmp".jbr".jc".jdb".jfif".jge".jgz".jia".jif".jiff".jis".jks".jmf".jng".jnt".job".joe".jp1".jp2".jpc".jpe".jpeg".jpf".jpg".jpg2".jpg_1033".jpm".jpn".jps".jpw".jpx".jrs".jrtf".js".jsd".jsda".jsf".jsfl".jsm".json".jsonb".jsp".jspa".jspx".jss".jst".jsx".jt".jtd".jtf".jtp".jtt".jtx".just".jwl".jxr".k1f".k25".k2p".kar".karbon".kb1".kb7".kbx".kc2".kcf".kcl".kd3".kdb".kdbx".kdc".kde".kdi".kdk".kdtmp".kes".kexi".kexic".kexis".key".keynote".keystore".kf".kfo".kic".kix".klg".klq".kml".kmo".kmy".kmz".knt".kon".kor".kpdx".kpg".kpr".kpt".ksd".kvp".kwd".kwm".kwt".kxp".kys".l".laccdb".las".lasso".lassoapp".lastlogin".latex".lay".lay6".layout".lbf".lbi".lbl".lbm".lbt".lcc".lcd".lcf".lck".lcn".ldb".ldc".ldf".ldif".ldr".ldw".lef".let".lex".lex_1033".lex_1036".lex_3082".lgb".lgc".lgf".lgp".lgt".lha".lhr".lib".library-ms".lic".lid".lin".lis".lisp".list".lit".litcofee".litemod".litesql".ljp".lk_parts".lld".lmk".lmr".lnf".lng".lngttarch2".lnk".lnt".localstorage".localstorage-journal".lock".locked".log".log1".log2".log_0".logdat".lp2".lpa".lpd".lpr".lrc".lrf".lrm".ls".lsf".lst".lsx".ltm".ltr".lts".ltx".lua".lue".luf".lvivt".lvl".lwo".lwp".lws".lxa".lxfml".lxo".lyc".lyt".lyx".lz".lzh".lzma".lzo".lzx".m".m10".m11".m12".m13".m14".m15".m16".m1a".m1v".m2".m2a".m2p".m2t".m2ts".m2v".m3d".m3u".m3u8".m4".m4a".m4b".m4p".m4r".m4u".m4v".ma".mab".mac".maf".maff".mag".mam".man".manifest".map".mapimail".maq".mar".master".mat".matlab".maw".max".mb".mbd".mbm".mbox".mbsb".mbx".mcd".mcdat".mcdat".mcfi".mcfp".mcgame".mcl".mcmeta".mcrp".mcs".mcw".mcx".md".md0".md1".md2".md3".md5".md5txt".mda".mdb".mdbackup".mdbhtml".mdc".mddata".mde".mdf".mdi".mdinfo".mdl".mdlp".mdn".mdp".mds".mdt".mdw".mdx".me".mef".mel".mell".mem".menu".meo".mesh".met".meta".mfd".mfl".mft".mfw".mgcb".mgmf".mgmt".mgmx".mgtx".mht".mhtm".mhtml".mib".mic".micro".mid".midi".mim".mime".min".mip".mjd".mjf".mka".mkd".mkidx".mkv".ml".ml2".ml9".mlb".mlc".mll".mllr".mlp".mlx".mm3d".mm6".mm7".mm8".mmat".mmb".mme".mmf".mml".mmn".mmo".mmw".mmx".mn1".mn2".mn3".mn4".mn5".mn6".mn7".mn8".mn9".mne".mng".mni".mno".mnp".mnr".mnt".mnu".mny".mobi".mobileprovision".mocha".mod".model".mof".mon".mone".money".moneywell".moov".mos".mov".movie".moz".mp1".mp2".mp2v".mp3".mp4".mp4v".mpa".mpb".mpc".mpd".mpe".mpeg".mpeg4".mpega".mpf".mpg".mpga".mpj".mpk".mpkg".mpls".mpo".mpp".mpq".mpqge".mpqworld".mpt".mpu".mpv".mpv2".mpv4".mq4".mqh".mql".mrbak".mrc".mrg".mrimg".mrq".mrw".mrwref".mrxs".ms".ms11".ms12".msc".mse".msf".msg".msg_1033".mshdb".msi".msmessagestore".mso".msp".msstyles".mst".msu".mt9".mta".mtb".mte".mtrl".mts".mud".mui".mum".mus".mvb".mwb".mwf".mwi".mwp".mws".mx".mx0".mxd".mxf".mxl".mxlz".mxp".mxu".myd".mydocs".mye".myf".myi".myl".myo".myox".mzz".n43".n64".nam".nap".nav".nba".nbd".nbf".nbi".nbr".nbu".nbz".ncd".ncf".nco".ncr".nct".nd".ndd".ndf".nds".ndx".nef".nes".net".new".nexe".nfl".nfo".^Y
