◆ SpookStack

‘ovso00000 a 0 ) ) < H i » “penn | co WORKING DRAFT CHRONOLOGY OF EVENTS FOR HIJACKERS AND ASSOCIATES Pursuant to a Search Warrant issued in the Northern District of California, the Pittsburgh Field Office obtained the contents of the Hotmail electronic mailbox belonging to Mohamed Alta (mohamedattah@hotmail com). Included i this mailbox were two €- mail messages sen {o Atta from the user ‘awa@citycenterdoha.com. Both messages |conained file attachment infected with he W32SirCam virus. The W32/SitCam virus; ‘propagates by attaching itself to 4 file ont ‘infected user's computer and then sending that file to all contacts listed in the user's. | ‘Windows address book. Based on this ‘behavior itis possible to conclude that inthe Windows NY-280350-FC| serial 355, 265A-NY- ! "280350-CD serial 132 &15960 \ ife 2401297 | | ‘Sums 92001 FIN. | AtMARWA| j l 2627 CNA : SS Niadson United Bank account purchisesof | 78050-2025. . | 8/8/2001 | FIN $49.99, $51.00, ad $49.50 from Macy's, | 63120, 302. $0713, 2628) Nal Ao Wayte Me (as. tos | | . Checked into Y2 Fitness Center (World [ ! : | ~ : 2525) S001 PRY | Sond Ahn Gy) cs AMIS \Cash withdrawal ‘Suntrust Bank, South Florida, Sheridan 88/2001 | FIN Plaza, Account Number 2630). Wail Alshebri . __ (0418003124059 im Hanjour completes | hour of flight training a TABS244 and 2654- 8/9/2001 al FREEWAY AIRPORT, INC, 3900 INY-280350-302 (2631). FT: | Hani Hanjour Church Road, Mithellville, MD 20721 ‘Serial : 24802 ‘Target (Terminal 4] 6407) Hudson United Bank 2632} 492001 | HN Abdul Aloman Statement 210 4411412008 7:53 AM