# Full Top-Level Email Headers (as delivered)
# Source: source_message.eml
# Extracted via Python email.parser for analyst convenience.
# All values are unmodified from the source .eml file.

Return-Path: <miriam.khor@Vanderbilt.Edu>

X-Original-To: fr0mTheCloud@proton.me

Delivered-To: fr0mTheCloud@proton.me

Authentication-Results: mail.protonmail.ch; dkim=pass (Good 2048 bit    rsa-sha256 signature) header.d=vanderbilt.edu header.a=rsa-sha256

Authentication-Results: mail.protonmail.ch; dmarc=pass (p=reject dis=none) header.from=Vanderbilt.Edu

Authentication-Results: mail.protonmail.ch; spf=pass smtp.mailfrom=Vanderbilt.Edu

Authentication-Results: mail.protonmail.ch; arc=pass smtp.remote-ip=52.101.43.57 arc.chain=:microsoft.com

Authentication-Results: mail.protonmail.ch; dkim=pass (2048-bit key) header.d=vanderbilt.edu header.i=@vanderbilt.edu header.b="ZKhh4FXs"

Received: from SJ2PR03CU001.outbound.protection.outlook.com (mail-westusazon11012057.outbound.protection.outlook.com [52.101.43.57]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)  key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mailinzur110.protonmail.ch (Postfix) with ESMTPS id 4flmy43vHrz3V; Wed,  1 Apr 2026 01:05:48 +0000 (UTC)

Received: from SJ0PR08MB8349.namprd08.prod.outlook.com (2603:10b6:a03:438::12) by LV3PR08MB9463.namprd08.prod.outlook.com (2603:10b6:408:214::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.16; Wed, 1 Apr 2026 01:05:36 +0000

Received: from SJ0PR08MB8349.namprd08.prod.outlook.com ([fe80::3f6c:ee4b:adca:6065]) by SJ0PR08MB8349.namprd08.prod.outlook.com ([fe80::3f6c:ee4b:adca:6065%6]) with mapi id 15.20.9745.027; Wed, 1 Apr 2026 01:05:36 +0000

Arc-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=PmMt6qC+l8vQByQTSjxzf1Dj+aPOVOvA5LAV8Q3wYZlzpVrS9j6pZLAf5eAhPrk7ub3L9cJC3jnP6SR7MWy7xKvYfGksxagr7SKcC87rif3SFmCrv6q7Fl2T3PMbUKc1Mr60I+8lSBxEtDPTxU2CkWI4yOu96gDsapcfbh6PnB6sL6P0SnpsiYp2KLr6OZ8PAEMtQCt3N7JR66y116XJT15/CB0QrWjumCQuPZ5SM2YtDeR9DmCszGTXTufzwsC9TsAqmymhswE7BgjJO2yox6ugPhPW77hg0diPmhhT3Po9s8II9EIRTZgrX6yyk5i0W5gheIy6lbROcIK8GfAWKQ==

Arc-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=KAXSSEJzsUsseoNcpKdO7BDbbUbL/dF2TfGT4+3x0Xc=; b=c3nBiJ7yVGCL9bUQ4wgt+SMSu/4dnYT4zrfxEGACLfmcxSDi6ZisOaAO5oqh8F4YAdmWAzuE0+QU+Ix/VMQrq7wnHFiDHebEu0+UQ2YFC9TEowESRP8/Kpem0dCds7vgG39eDTp3qVlIzwXkRM8UGkMcoXS+6DdJCSbQZAuh4BdDazbjEsIAcfpyAzvMZwO62aqBf1rPFejhDdjor9Rh1lhQpnLHyTxYQNSXf1MPWA3A3XzLhgMsktr593Ts5osIxxAzX82/hkOgSMGH4hF4K1eqfj2Qecd3hqC1P1zRCueG2k7UIGzqR5nVmcBeh4cDAbvMxFGgFftzmsBBvPx/EA==

Arc-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=vanderbilt.edu; dmarc=pass action=none header.from=vanderbilt.edu; dkim=pass header.d=vanderbilt.edu; arc=none

Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vanderbilt.edu; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KAXSSEJzsUsseoNcpKdO7BDbbUbL/dF2TfGT4+3x0Xc=; b=ZKhh4FXs/9RogzeUMKmlPztJA0/o7zLYPfYN3rYeD5uyBI/qMyA6xX8eihmvZl6uUcP+4zWhjooxsLso4H6UBNMJ2CoJSvXU/jx9VE2U/ZtNheCi+Djpb160dYq31iI8qks99ykwPLLZxohaPIwJP67UV+EhGI9ppVhBfa62B4uBtgWiwB2dmH+47pkiB0EsXs6hmROBXdvm7yu7sOPvkHVqbIgIMfBZ1PGfNt/ilyER0iqESMFzbY/Sjk6jgcYf/Ll9vv028uaKX+VEdRC1Gw3eqafdaHSm1sgr8kzoz+7HyFnlzbBpa/6uGXbgDOTmE4TLyUAwz36zxGGGhPgg6Q==

From: "Khor, Miriam" <miriam.khor@Vanderbilt.Edu>

To: Nakonmano <Nakonmano@proton.me>, "fr0mTheCloud@proton.me" <fr0mTheCloud@proton.me>

Subject: Re: PARALLAX Confirmed on My Devices — 12-Month Active Compromise — Thank You

Thread-Topic: PARALLAX Confirmed on My Devices — 12-Month Active Compromise — Thank You

Thread-Index: AQHcwAQInG168CzjO0KyJEhfbtbwRrXG+aOAgAB0tICAADjYAIAAD3mAgAGvzXU=

Date: Wed, 01 Apr 2026 01:05:35 +0000

Message-Id: <SJ0PR08MB83498BBD6B221DE976CEA90A9A50A@SJ0PR08MB8349.namprd08.prod.outlook.com>

References: <SJ0PR07MB9032E8DE234E192D9BCF333CAD57A@SJ0PR07MB9032.namprd07.prod.outlook.com> <ryIKZmp698w1q5125QffrkGUHzGrp-xqsUt3IO_Lf3m_dHQRPTiHK12zlzrZCOga_Nyhavb4ioKrofPqjZkiNBBDrrafet70blGyX8g7Ets=@proton.me> <40BD77CE-C69F-46B8-B17F-584F2D937D3C@dfensa.com> <qtNWJBzE09DxGdAk3BcfKbiMsuhvhatAr_tAS_WKKPM-EL8g01rnHz1xUcE9t14ClRQCoTrIXlgNmNvNbgh1ug2Han4BjGW2vjTFzQ15Kdg=@proton.me> <SJ0PR07MB90321802A02DCCF65752B03DAD52A@SJ0PR07MB9032.namprd07.prod.outlook.com> <-8hX1--SODjCWE6TBDY4w7rwbIHWPjnn-Dz0zNGi8zRIK9wSVHiuFybFtj8mTZOWV4VuqMtG-v1KFR0P0cPSaOLQ5f65CX2p0a_iOEnq1Y8=@proton.me> <L8FZobS2vYH3qV_6U50_VHx5opSviW8MhPi9vyS0GKNSFolfoFu6a4tflsMKHz0mBC3gTOdcIGkVlJox9gc-QO5JCs2QtUBBaeJYoR4DKis=@proton.me> <TcKtG44Q-3CiJAZ0-_i5y7IGXjG2ZT0GnqTqJTpeZr5z1QpXQOOwp4HBY313Ts_0UIniccxQAnrB8-vgIeSXxwkHyhJ6JbPFll_cjnIgUIQ=@proton.me> <mixQH6vIL6guhE1ZjAeE3nfWs_6p2lz1s4TCxzcvOwLvy8Gr4eJtvE6NjKaLfV-Cwae3cBHLS7K_VR-krVS3WNN3xFurEWUpUgvSS0bAwOo=@proton.me> <UO0TOFKUCblV8Da8NqoayVLlhtW-jwF7HckuRhvrY7AF1cV9YlZYNQzGbkIKBlhvCdyV871Ckm_0alUeWqxVNYBs4eykhIHvcjrraRT1c5w=@proton.me> <nXph-Q4xGHU2mbOwdqe0gQUpfeoz3DrbLJk-d1VWkG-mROwSPD-mXXoIWdDu9EAhHQMk56SX6UFQyeZbATL016M_wnwF5FwMapkAhwP7cT8=@proton.me>

In-Reply-To: <nXph-Q4xGHU2mbOwdqe0gQUpfeoz3DrbLJk-d1VWkG-mROwSPD-mXXoIWdDu9EAhHQMk56SX6UFQyeZbATL016M_wnwF5FwMapkAhwP7cT8=@proton.me>

Accept-Language: en-US

Content-Language: en-US

X-Ms-Has-Attach: yes

X-Ms-Reactions: allow

X-Ms-Publictraffictype: Email

X-Ms-Traffictypediagnostic: SJ0PR08MB8349:EE_|LV3PR08MB9463:EE_

X-Ms-Office365-Filtering-Correlation-Id: 6126db63-c140-41d2-df30-08de8f8ac828

X-Ms-Exchange-Senderadcheck: 1

X-Ms-Exchange-Antispam-Relay: 0

X-Microsoft-Antispam: BCL:0;ARA:13230040|786006|6049299003|366016|1800799024|376014|8096899003|13003099007|4013099003|4053099003|38070700021|22082099003|18002099003|56012099003;

X-Microsoft-Antispam-Message-Info: wdFI/YxSp64ttPuOo2vX62OZwGQsHV5Slan9tiGhcgVcsD2Nld7neV5riFlyD2Me3kIZY/T0/3DGofgJfHkB4p6Oq5EFtRLrzH8p9LLIqgoZXliKbriczC1CFOIDHe2eGgu5mT00lP31Eay9C0BOlJ27yG76uoX2yqMHsPqLZRQnKkn+rjUML8QEgjuSqsYrMWYjGUB+arIW3iNOKcNTe1ZewU/fnp+YnKuOV2Wi3Tn1S7c73whUyPBAuQw+bBISxnJPqJSlGiZ0pkIiga0q+Mxvf+qXy8vguAZDdQfY/HoWzhqY0rTK7CeERkJQgp70H8uBrsJv/HwRSg98TmP1NAFk2jheCG8+3EZIgLQcR2pcVkMvZjdEWXwndYIkpNiPtxLuwtA9WQ5uqWzrCqm9EOf6xf9rerSA0ndrqBv6TTC4Y0HgNLaGLkpu2x+54x6vgYtn4uuYai7dKl0h93yownBggUIxBaNyIIx1xrOrlM85Uwg7p8pJFR7V+VblHRbWtTjpJScd9L2NX+mghz/t0m4QJril9og+Uk7RRQ8qkRN1PBDmmsREe03ECw89TNQ3uny2IwTvJda0wT1JyMabBgbecAkj/s1Kn3wdRGgUh0tRdxlsGLxV68L8Rrr0lPX0J/6LEQUGlZRtNB4GuyKt8A8Oq4H08Ie+xyOV+SZnPpkzaE3M0VNEY/wVH5dnsCYFFP4eKB9Y6QshOhZ8tZkCCkUycyxdua9a5fOt1MkhIm/rJRbt9PABGVo/UNKbkRGL

X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SJ0PR08MB8349.namprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(786006)(6049299003)(366016)(1800799024)(376014)(8096899003)(13003099007)(4013099003)(4053099003)(38070700021)(22082099003)(18002099003)(56012099003);DIR:OUT;SFP:1101;

X-Ms-Exchange-Antispam-Messagedata-Chunkcount: 1

X-Ms-Exchange-Antispam-Messagedata-0: B323Kmzn4WZDX36dBTMX1HvbNV3Oia27+tdv0T4HQ6vISIGyr36citfIv+6drt/J7f+5fcYZTrKaS2a2yH2jxfTw0GRZNDYm8OOSHFubzs1FJdxL4k3dm/4vIgm/D6tDLNvVyObJJwAgGALXIHx7ncnNu8jVmioxdkRm6zt99ZoqV1rI/g8VaDdtqa22h01br47fbyr2alx/ivRHJHUZAQj1UAVY/fTvo7+3tw0oLAy/bz4SwueXroXE2pdG+uI7OEfD3htERQCik09Apn77sVKG3gRh9jiIw4JxswEaUwWyE3YWH8XtRnOMUzwlWz1aFaZODff14n/v9pjA3kO33h8dmQMKLE80pdtt2rAUGOb1Hr82usM0nRGVAqqDbs49eIrFk9qRhTZUDFLOFEpAA+SVTB03xdRLfO56oiSHkgZT63I7RVIhdUKb1vO4Qx1iJtrOLc9J8wC1yIhle0OVNK2JZl5J5tbDxAdQ/RIF53h0xf4nToS2M4p8wzxSOHr/Fwu7dLwJeq63WdZTaByTcQlYvWjS9Ilts7c1EPPZ4TLWKXBy2XTUhYvbTK/A+73DaMpFdijkjuZrNmBpV7ZRlvG43IDPWDlvJuAVuVUpZRBJxWmRhzatpVMRRn9jCdQlQNFQxNIIwWzXDfKRoM2ojok/J5ai04u3tMPCIoaPv7jmyypIAjtQfaScrjfL7FUPSr3EaOD+b4/2ADbjbIazdFve9beVP/srfihsS+ZpgbIzprXbuX9UZlpHrBG8FJO90UExCm1s25y3naTmQ5kiovERbR4XQsSFTvxCDdHap/f/4iPyTtZt6x271AQHOJ4//+10lsIZzwpwWwPACWGuZEXa7Siw8iaCpuGC9yYHNluzvAmoTBgLYkJ9EzwZ62tP+Gm2yNDqmM0V752bbitunSwcetgsQLLe59pBA4j15ZlYTSOSUt65mPNoDfHuK5tLiZRpvGZD6NBWcdtoIrRgTbMY5MWYvdbCm0BwIts1uZ46PzqhdkAuI0o7z1TBtb5sJVHb6NN2iG7icjtgjIC1zp+OCXw5sDU4veKUxvqW+t7aOeDwW5DxVV1CM5pbJslKEfbYNoVkYQIZLaunKYv1vgLJ5+iFW9fziX5GVmhQ9ZIuur4d4/dLYj6AoaOU/aPOUxHrI5fYr9GFC4qyiq/DVTMsqzqEhSgroAfQrbLqjAM28/nOCqNQw5EpxVhEqEHiMWLbl61hU7WsrMIHCIq73MnT3yg8McT1Qg43amxU6/tkcC4ZHYLudWaN68HpQ5eCOk55YgKJ9qg3xykyc+0qnF7PNDpsfcqzLkOeib+AQyUnnDcFXUz7UaJrjnn9r82Ncj5LDXDjJ0GzBH99YSgffNEATRQ1PxEzn77Q8VNzjE19JLQDQs1hD/s+McSiRy1q67Qi6SAxM+ttc0lDQjXyvlZbRzEHrm5xD9GbNCGaKoCyZ5u6FslTWHxfamfbiycOIXTOPTVl8wKUjRFdeSiOvAmH2+a6TJax+BEaI8Gb3Lpr948ZxSTW57D5Du7dn5peW3dQUA+4ziQ+nqbk8hzHyXScOlVtjhmW5+X59do2XLmpQrbicCxEMypOAvRWnW58Dfp4RKOwsm/k5SaUBEDozICMEtQr1/zk++9KoghMk1UvNoDTrBKhNVMXrKviptXiMEmpGRfoIuK6SjHTgA7YKvPPYDie/1peKCXIeuTMeNib1Zno1ZKUsKD+A8ioJMBJKyH7J5j3Z/5jU6NJMSg4C1IeBQOL+mU6g45fmWG1ubL6BvIYXTDtOCupJegYBWjz

Content-Type: multipart/mixed; boundary="---------------------6407cb1f6664ce879017ee82f86b82e9"

Mime-Version: 1.0

X-Originatororg: vanderbilt.edu

X-Ms-Exchange-Crosstenant-Authas: Internal

X-Ms-Exchange-Crosstenant-Authsource: SJ0PR08MB8349.namprd08.prod.outlook.com

X-Ms-Exchange-Crosstenant-Network-Message-Id: 6126db63-c140-41d2-df30-08de8f8ac828

X-Ms-Exchange-Crosstenant-Originalarrivaltime: 01 Apr 2026 01:05:35.9169 (UTC)

X-Ms-Exchange-Crosstenant-Fromentityheader: Hosted

X-Ms-Exchange-Crosstenant-Id: ba5a7f39-e3be-4ab3-b450-67fa80faecad

X-Ms-Exchange-Crosstenant-Mailboxtype: HOSTED

X-Ms-Exchange-Crosstenant-Userprincipalname: Jj90uawa8+WsqJz+3kxj50nUAeVim/ScGO+REtEjs3M9Rvk8AQHfI1rwyIjYStxWvjk9dvD9xr0DuqwkhyJkW/Ku8tCBkz6kRJR9TnFV+Nc=

X-Ms-Exchange-Transport-Crosstenantheadersstamped: LV3PR08MB9463

X-Pm-Spam: 0yezJI6YSpyJec91ztFGcjIwoJyLCvXBZcQniisnOERJt9TTVOUdSRQUiwslOjLdFJEL CN0lSXZ1BElETjIbpAuLTsV0MIRkLf1USkVMFRfSUiVUQOsltx4CMSXiwRNSFNF9TRNVTFdUQjIbp0 sMFTk1IRl0ESZ0X0Tf1RBTVF0hXQRUF6IiUzWdBJTLCfEZUSVEMO91T0TF5pbIjsF0MINlQQ9lRVQT NpbIjdTBLfwSivN2cmciUAsOjjnNIbJ3l6ICZTLuA0sMXynNIIpj7jFmIGdvlI6biumlIY9m4iwiIW bfxNvc2imUcOsniPJFUCR6II1LTQCJLU9kESB1XURJRRJQ1i04TOAjsTJlIjIto45NCTCJLQIS6uAT LSMiwRlX2nnVYXl2ui8mZnOisJPUF6CIReJypnFWbVZu91lYWijoIaNH0rNWY2XpZVfbmuHVdZRWff VHcjMyAAzNjiDMMLJCtslWYzXwN9tcll2RbbIC6h1mIWazwItcHwTILMYjw2ATMnL0BwiIipWFbb8F zfJHcHcvJI6YiwC4MMADzwYzNDMwAA4MTxzQNMIj0tJCLWYslV4dGlF9dbJWlpRGZmbfd9kbWiWwZO JipmRnbGbh99tdC0WxdaxWp1dmbWYtwUtZTh21cbwGiwJCL3XwN0iYWujAOMADzzMTNjNxEIzND1zM MOYT5iwCNFcz9FtcGh2JXcU2iuAjODMzAMzNTxjENNIDz1MzMTO5YwiNCzF9cdl20fh2YGdf9hpcGp 2hcbcmiuAjODMwAI4MT5zcNNIz30cjNTN1UMsMD1nJIb9lul1WYjIioF0d2s2hYaNX0lNXLmblR1wc izV9ddl20ig2YXfs01hImfWxaMB3yyB3X2biIAuOjwDAMMcz2wADMDMwEc0ODyTIMN0HsyNnIWaiQI 2OijWNONYm3mhDMTYkhU0ODjzRNZIGyiMWZfX0=

X-Attached: img-558cec93-b715-4e03-9dd1-77b9d1ad276f.bin

X-Pm-Origin: external

X-Pm-Transfer-Encryption: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)

X-Pm-Content-Encryption: on-delivery

X-Pm-Spamscore: 0

X-Pm-Spam-Action: inbox

