From rrhh2@sanatorio-anchorena.com.ar Mon Aug 16 16:22:58 2021 Return-path: Envelope-to: nyet@dataped.no Delivery-date: Mon, 16 Aug 2021 16:22:58 +0200 Received: from mail-bn3nam01on070f.outbound.protection.outlook.com ([2a01:111:f400:fe41::70f] helo=NAM01-BN3-obe.outbound.protection.outlook.com) by skapet.bsdly.net with esmtps (TLS1.2) tls TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1mFdVx-0009t1-PI for nyet@dataped.no; Mon, 16 Aug 2021 16:22:58 +0200 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mbLqtChwh6mtWNWHJbEl592xUp8ka/3YqrUIrcCmD9N3yTojrRWE/44Vmplif8rt6zavtPE18uudpT1SNywZFjaU+zDzbm3wq5VID4jkLhv4wB6BIbjrZVnKQ51l0UAM8sqhnorh0uoGoV0m0m9bkkWFKc4obLRE8aXy7JNWkTUndivZnS/kbJ1pDy1OtZrcMOB57xfo/YznxJI5fwWHIwjyFnzViqXG8bWJEV1DwjMtBHKlaInFEb6RJAReuvqsOvkAQ1SslEYDplnepxSUaByIplUJz4ABA0fUm2rKfbZZWcgy+LbsH4KbcwTCedaLPwSBc5Z9ONRlI/MTT30lZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YzXvLrk/jn7AvaO5ZmeBYdUw/bVbB7ovvrLcBgeqwfQ=; b=je2AWYi0nUIZUlsNAFxyRkcJqqVWsDuEe+IWkl9ySfOpbM0DyJuyYiy3ACLcxKfdysN0Tn5jW8XLa5dMl7EcPcabDENMRVyjSCBSGAqOcakqouHeGRsOlx33CeyAMizk/iT6nwzcl/zP4xWPDLpKl11XlYtofu8Xl1ecTcPBIzrcg9lALvUbsB+CnUfDyo56hMuyVpb//1WuJ4mPWvT1k0ALKg7mUh/Y9h+TqcdtvOfxcWdIbK74sDuH1/oH7oMo308deC1EcznlngQ+AhXEfyUb9pWyWMpKidHkzte8qHI4GrTqZbr75jKOW3JRSLDM2HBU18LZhUw09mWu0VUIpw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 200.45.226.28) smtp.rcpttodomain=dataped.no smtp.mailfrom=sanatorio-anchorena.com.ar; dmarc=pass (p=none sp=none pct=100) action=none header.from=sanatorio-anchorena.com.ar; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=unionpersonal.onmicrosoft.com; s=selector1-unionpersonal-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YzXvLrk/jn7AvaO5ZmeBYdUw/bVbB7ovvrLcBgeqwfQ=; b=QtvnUPhMvPe80S4Y9AlbH5t2ZktHUPgnR2htRBpGw0sXLx6Wd+V4XwX3S76TxoplyGqD8cwO/pIQWY/Y8zX5MK34ZeZUxUJY+JAL5OdOo4y6KTgqtZmdYMIqpZmh7t/f6uUh01Bj3xBMYDaKDE+I6UEzcCDQ3XcrAkKW4HIYFlc= Received: from BN0PR04CA0151.namprd04.prod.outlook.com (2603:10b6:408:eb::6) by FR1P215MB1275.LAMP215.PROD.OUTLOOK.COM (2603:10d6:203:4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4415.17; Mon, 16 Aug 2021 14:22:42 +0000 Received: from BN7NAM10FT013.eop-nam10.prod.protection.outlook.com (2603:10b6:408:eb:cafe::3d) by BN0PR04CA0151.outlook.office365.com (2603:10b6:408:eb::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4415.15 via Frontend Transport; Mon, 16 Aug 2021 14:22:42 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 200.45.226.28) smtp.mailfrom=sanatorio-anchorena.com.ar; dataped.no; dkim=none (message not signed) header.d=none;dataped.no; dmarc=pass action=none header.from=sanatorio-anchorena.com.ar; Received-SPF: Pass (protection.outlook.com: domain of sanatorio-anchorena.com.ar designates 200.45.226.28 as permitted sender) receiver=protection.outlook.com; client-ip=200.45.226.28; helo=webmail.sanatorio-anchorena.com.ar; Received: from webmail.sanatorio-anchorena.com.ar (200.45.226.28) by BN7NAM10FT013.mail.protection.outlook.com (10.13.156.156) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4415.16 via Frontend Transport; Mon, 16 Aug 2021 14:22:40 +0000 Received: from [127.0.0.1] (unknown [45.168.31.175]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: rrhh2) by webmail.sanatorio-anchorena.com.ar (Postfix) with ESMTPSA id 322916095A for ; Mon, 16 Aug 2021 11:22:37 -0300 (ART) Message-ID: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 MIME-Version: 1.0 From: rrhh2@sanatorio-anchorena.com.ar Date: Mon, 16 Aug 2021 17:22:33 +0300 To: nyet@dataped.no Subject: =?UTF-8?B?UMOlbG9nZ2luZw==?= vellykket, alle dataene =?UTF-8?B?cMOl?= enheten din er kopiert. Les instruksjonene inni. x-job: 8.1.6 (https://sanatorio-anchorena.com.ar/PHPMailer/PHPMailer/) List-Subscribe: X-ClientProxiedBy: 90.9.182.158 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 2439351f-9701-42bf-fe60-08d960c14e2a X-MS-TrafficTypeDiagnostic: FR1P215MB1275: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:3276; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: ZDOwUMrLUEL2ySFRR6FCHOOQpxRtiNSadvZ4aPTswZoypheDoxpuUBCOntgQygpIOhrtIHbAME3sXJm7IcLRSKqGVyIjTGtvqhozCC+AVWJFJEJYRNz7IJTDGM02EGQbybfbmTgoKxwXinsQrTw6aK0Qi+xX2JKgJ3r6uxZ5RrbeY++twahe/lpEZ3YTAp2THkm8TBNHXDW2dhPy1lVnYRaVBrI3PqQMXGARUar//UShFuLxxIYW8WAwrDmZJM9ayprr2ZOkooUkVSrme/wR3UHXN43n2+DrVNUea8PvPK2nOfpuguc/iv8Fjv4x1Bmb/z6+lITeNUxFn1hhK7N9tXOwwV3luIKMjaFxd5YGpzDR/8H85m3Vo9gwN47gHhnbf0SxsvpSZxzQ80SdTwF39LlU8JjvgXtsKoUMp0OQ89/P3qpX39V1IXFGqSU4B8/8v+XRVboAu9lN1KT4ABcV35wbTWhsnUjzih+OZUvskvA+fwxHQpFbW7TixVPfJjmT3LN0Y8i7nrHpt1nMt6CSUo8xFKfhqfxMiqcmtOsmajmuyJBDhN2CmOaM7N+HftYsUAb7wfdqiHpEOhBEt6g9LeydgwMl5w9FQkPK8AjXokRSB6ROREWREmKVaeOkY0u47LU+7XVL7z779g5dMz8J12d9dAmvd1DJjopZ4E83QgEX8YEVAG/n+Vlrcf4I/YYnP6P/Nyx/FNFjV5Q7Tt3bT2PFoUPamnBi09Fxt89rusudXeemcxyb33KWSWBkXvCvrYGklZKajh9kS583axUW9FQYRWzRFmsRmpqJeLZTbo8/0rA7V6hc7GEZ6wgvckKI X-Forefront-Antispam-Report: CIP:200.45.226.28;CTRY:AR;LANG:nb;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:webmail.sanatorio-anchorena.com.ar;PTR:webmail.sanatorio-anchorena.com.ar;CAT:NONE;SFS:(46966006)(36840700001)(131006)(26005)(2616005)(5426002)(8936002)(336012)(186003)(508600001)(6966003)(956004)(7126003)(86362001)(7246003)(6916009)(224303003)(9686003)(6266002)(66574015)(82310400003)(36860700001)(2906002)(316002)(356005)(47076005)(5660300002)(70206006)(110100024)(7636003)(7596003)(70586007)(36756003)(6666004)(85206012)(5008540100006);DIR:OUT;SFP:1102; X-OriginatorOrg: sanatorio-anchorena.com.ar X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Aug 2021 14:22:40.2802 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2439351f-9701-42bf-fe60-08d960c14e2a X-MS-Exchange-CrossTenant-Id: 8e4207d9-5a8b-437f-9ad3-46b19c71ca6b X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=8e4207d9-5a8b-437f-9ad3-46b19c71ca6b;Ip=[200.45.226.28];Helo=[webmail.sanatorio-anchorena.com.ar] X-MS-Exchange-CrossTenant-AuthSource: BN7NAM10FT013.eop-nam10.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: FR1P215MB1275 Status: RO Content-Length: 3460 Lines: 91 Hilsen, Dette er den siste advarselen. Systemet ditt er kompromittert. All data kopieres fra enheten din til serverne v=C3=A5re. Du har ogs= =C3=A5 spilt inn en video fra kameraet ditt og sett p=C3=A5 porno. Viruset mitt infiserte enheten din via et voksent nettsted du nylig ha= r bes=C3=B8kt. Hvis du ikke vet hvordan det fungerer, forteller jeg detaljene. Trojan-viruset gir meg full tilgang og kontroll over enheten du bruker= . Som et resultat kan jeg se hele skjermen, sl=C3=A5 p=C3=A5 kameraet = og mikrofonen, og du vil ikke engang merke det. Jeg tok en videoopptak av skjermen og kameraenheten din og installerte= en video, hvorav den ene delen inneholder en video av deg som onaner= er, og den andre delen inneholder en pornovideo som du =C3=A5pnet for= =C3=B8yeblikket. Jeg ser hele kontaktlisten din fra telefonen din og alle sosiale medi= er. Jeg kan legge ut denne videoen p=C3=A5 hele telefon-, e-post- og konta= ktlisten din p=C3=A5 et =C3=B8yeblikk. I tillegg kan jeg ogs=C3=A5 send= e alle informasjon om e-posten din samt kommunikasjonsverkt=C3=B8y. Jeg kan =C3=B8delegge omd=C3=B8mmet ditt for alltid. Hvis du vil unng=C3=A5 disse konsekvensene, s=C3=A5:Overf=C3=B8r NOK 10= 602 (Norsk krone) til min Bitcoin lommebok (Hvis du ikke vet hvordan du gj=C3=B8r dette, skriv "Kj=C3=B8p Bitcoi= n" i Googles s=C3=B8kefelt). Min Bitcoin Wallet (BTC Wallet): bc1q6h4as8afdddx5erh9hl6w28gc6q00gu4c9y= d49 S=C3=A5 snart betaling kommer, vil jeg =C3=B8delegge videoen umiddelbart= og garantere at jeg aldri vil plage deg igjen. Du har 50 timer (litt= over 2 dager) til =C3=A5 fullf=C3=B8re betalingen. Jeg f=C3=A5r autom= atisk varsel n=C3=A5r jeg leser denne e-posten. P=C3=A5 samme m=C3=A5t= e sl=C3=A5s timeren automatisk av etter at du har lest den aktuelle e= -posten. Ikke pr=C3=B8v =C3=A5 klage p=C3=A5 noe, fordi vesken ikke f=C3=B8lger= , posten som brevet kom fra, og den ikke f=C3=B8lger og oppretter aut= omatisk, s=C3=A5 det gir ingen mening =C3=A5 skrive til meg. Hvis du p= r=C3=B8ver =C3=A5 dele denne e-posten med noen, vil systemet automatisk= sende en foresp=C3=B8rsel til serverne, som vil sende all informasjo= nen til sosiale nettverk. Endring av sosiale nettverk, e-postadresse og enhetspassord vil ikke hj= elpe deg fordi all informasjonen allerede er lastet opp til serverkly= ngen min. Lykke til, og ikke gj=C3=B8r noe dumt. Tenk p=C3=A5 omd=C3=B8mmet ditt= . AVISO LEGAL: Este mensaje y cualquier archivo anexo al mismo contiene infor= maci=C3=B3n CONFIDENCIAL y est=C3=A1 dirigido =C3=BAnicamente al destinatar= io en el consignado. Si usted no es el destinatario original de este mensaj= e o persona debidamente autorizada por =C3=A9l, por favor comunique tal sit= uaci=C3=B3n al emisor y proceda a su destrucci=C3=B3n de inmediato. La copi= a, reproducci=C3=B3n o distribuci=C3=B3n de este mensaje se encuentra estri= ctamente prohibida, el uso no autorizado por el emisor puede acarrear conse= cuencias legales. El emisor no acepta responsabilidad alguna por errores u = omisiones contenidos en este mensaje o sus anexos, ni garantiza la segurida= d, exactitud o tempestividad de lo transmitido por este medio debido a que = el mismo puede ser objeto de alteraci=C3=B3n, demora, p=C3=A9rdida, u otras= anomal=C3=ADas.