◆ SpookStack

“WTTA-4 Om@ O”vVGOO0000: © Pursuant to a Search Warrant issued in the 1( 1265A- NY- Te PG Northem District of California, the : ‘serial 355, 2OSA-NY- : | Pitisburgh Field Office obtained the | | _280350-CD serial contents of the Hotmail electronic mailbox 12322 &15960 belonging to Mohamed Alta | | (mohamedattah@hotmail.com), Included in this mailbox were two e- mail messages sent “fo ~ to Atta from the user | |: | 882001. 1 CO ‘awa@citycenterdoha.com. Both messages 4 | \contained file attachments infected with the | | W32/SitCam virus. The W32SirCam virus | | propagates by attaching itself to a file on the : I. "infected user's computer and then sending | | that file to all contacts listed in the user's | ! "Windows address book, Based on this : ibchavior it is possible to conclude that *. : 2626} Mohamed Atta] Mohamed Atta is listed in the Windows Mohamed [Cittco TP | Fount 6/2001 FIN | Atw/MARWA | | fo Soy. "Hudson United Bank accountpurchasesof| 7 | 780350-302, §, 8/8/2001 | FIN 1549.99, $51. 00, and $49.50 from Macy's, | : 163120, 302 8. 50713, )- Nawaf Alhazmi| Wayne, NI . | 3028; 103273. i [Checked ino V2 Fitness Center (Worl fo ce 7 po AOL | PHY Seed lghdyGym) _ a TMS ~ |Cash withdrawal Suntrust Bank, South _ |Florida, Sheridan 8/8/2001 | FIN : . , Plaza, Account ; a oe "Number Wail Alshebri | = 18003124059 | Po ~ |Hanjour completes | hour of flight training ~ fp ~|TA85244 and 2654- | 8/9/2001 ; at FREEWAY AIRPORT, INC, 3900 NY-280350-302 i | FP} Hani Hanjour \Church Road, Mithellville, MD 20721 _ {Serial : 24802 ono | em | ____atget (Terminal 16407) 7 Hudson United Bank | Abdul Alomani Statement 210 WORKING DRAFT CHRONOLOGY OF EVENTS FOR HIJACKERS AND ASSOCIATES “SEZRET 10/297 * 11/14/2003 7:53 AM -