original[.]eml | Triage™

original.eml

SHA256 0ee96b65ec49b65efe3347fa3c3d4f18b0013fac0244dc52b128c5e54f0da211
MD5 d82fdde839b2788be898bb5b6e5a41fc
SHA1 c39bd4c0c37c769cb49b0f4d2f1bc40cfccbd3a5
SHA512 fcbe02e6c100ed791e2f81a69717af3a68462f8f8d1c81bb5b52c4807b35c68c70a0f4ff78cd6e18f782f99e5b0a85f04f02a9a4f66360e916223dea5b53945c
SSDEEP 1536:b0WvzgoYm+JPqPEnv4sivLd+eyJWrsdjFemetT3iS04PzAqt7Ut5pu73CFn56h5t:b0AqVJlv4nrK8m+T3iSvCW7w853lFZE2
TLSH
T133B3D2EEB446F8CCD611D078723A39C15AE13B5FC22293CE69497B0612B5394D3EEA74
MD5 SHA1 SHA512 SSDEEP TLSH

Password

[email protected]

Email Headers

To

[email protected]

From

[email protected]

Return-Path

<[email protected]>

Date

Thu, 23 Jul 2026 12:32:51 +0000

Subject

[Phish Alert] Ergo Report and Eval Worksheets

Content-Type

multipart/mixed; boundary="_004_DM8PR08MB736503E438B05AEB26EF7DFDACC02DM8PR08MB7365namp_"

Received

from PH0PR06CU001.outbound.protection.outlook.com (mail-westus3azon11021103.outbound.protection.outlook.com [40.107.208.103]) by inbound-smtp.us-east-1.amazonaws.com with SMTP id cn0p9ag76rukiefv52fmaa0r9el0i21k4q1h2bo1 for [email protected]; Thu, 23 Jul 2026 12:33:00 +0000 (UTC)

from DM8PR08MB7365.namprd08.prod.outlook.com (2603:10b6:8:12::24) by SJ0PR08MB6575.namprd08.prod.outlook.com (2603:10b6:a03:2d5::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.11; Thu, 23 Jul 2026 12:32:52 +0000

from DM8PR08MB7365.namprd08.prod.outlook.com ([fe80::cd2d:72a4:cac4:bc68]) by DM8PR08MB7365.namprd08.prod.outlook.com ([fe80::cd2d:72a4:cac4:bc68%6]) with mapi id 15.21.0245.010; Thu, 23 Jul 2026 12:32:51 +0000

Received-Spf

pass (spfCheck: domain of portsmouthnh.gov designates 40.107.208.103 as permitted sender) client-ip=40.107.208.103; [email protected]; helo=PH0PR06CU001.outbound.protection.outlook.com;

Message-Id

<DM8PR08MB736503E438B05AEB26EF7DFDACC02@DM8PR08MB7365.namprd08.prod.outlook.com>

Extracted URLs

file http://www.nhprimex.org/

email-html-2.txt

SHA256 c72a584e5cc117b3d0a6a8835112aeeb9bd40647172ece2379db1e13af860663
MD5 73bf642cc596f9741aa4e1e4651b5039
SHA1 afbb70fe287220d49387ace2728b4f8bd3231f3a
SHA512 510706f16e8a9c898baa47ad62ed8887411b6ba40a4451c5093f5100a1b058a1008a758c7ef9871a435dc9c7550f3279adda8a09daf8dca35c103ce999950840
SSDEEP 96:CmBtuc/KRv3SI4iSfiShvYPiShfqPiSIiqciS4NhiS4uiS4pcPiS4ViS4vPiS9ro:dKRvnd9QA6QC6hbxVOVvVpc6VUVv6yro
TLSH
T19091BD15F6290943A2FEE4E9F01F271180865789C3995BE4B67822F77E8AC74B21339C
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 70336b115e035f918de384c08bed751506e3f8598ab5d1a64b8db2a74b91b740
MD5 689917f4c0e3ebdc9ab0d0dc29603b6f
SHA1 eb38731353dde00d5055dc31edee985f68e1c8d9
SHA512 d703484c5df5bbf32b4a89f8473293fc0913f1c4f18e637a70ebc10e4eb981e802ebdc0932f30146a982b721bf82bcc906696ebe7a23826b8e4ff42c69cd6bbb
TLSH
T18FF0682FD70B22B721C470F65113A2FCF11545D2D3AC821B08946658333878E15E4195
MD5 SHA1 SHA512 TLSH

phish_alert_sp2_2.0.0.0.eml

SHA256 ba04cd8fd7264228f2da4777c0cb48e6f944fb4af55d1aeb87686325e529f385
MD5 d334b45495f230dbb80e4cdbba1596e5
SHA1 81e2f924e9bbe11e2f22a3d24f3c53c47b403d05
SHA512 3809572cab1114f97bddaa42ba3279df4b1ad5f688c9e8884ee3079e38d2a4da99d0dcaeba0dc99558a0b8f9222d61b0721939a4196f22856bf39529cc9ddafe
SSDEEP 768:7tHRVfNI6u3no0tXWM8+eF0bI8YZNHsaaEB2j:7tTVM3n3KmbI8YXH9aEB2j
TLSH
T157630809BD4B2CEB57B8ADD7C0EE11C15A0E7BCB26E000FD1A297F49165C5D91AF3298
MD5 SHA1 SHA512 SSDEEP TLSH

Password

[email protected]

Email Headers

To

[email protected]

From

[email protected]

Return-Path

[email protected]

Date

Wed, 22 Jul 2026 16:10:37 -0400

Subject

=?UTF-8?B?RXJnbyBSZXBvcnQgYW5kIEV2YWwgV29ya3NoZWV0cw==?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17848099711880.29557266867257703"

Received

from CYXPR08MB9160.namprd08.prod.outlook.com (2603:10b6:930:e7::21) by CH0PR08MB7371.namprd08.prod.outlook.com with HTTPS; Wed, 22 Jul 2026 20:11:17 +0000

from MW4PR04CA0196.namprd04.prod.outlook.com (2603:10b6:303:86::21) by CYXPR08MB9160.namprd08.prod.outlook.com (2603:10b6:930:e7::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Wed, 22 Jul 2026 20:10:52 +0000

from MWH0EPF000C6192.namprd02.prod.outlook.com (2603:10b6:303:86:cafe::92) by MW4PR04CA0196.outlook.office365.com (2603:10b6:303:86::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.10 via Frontend Transport; Wed, 22 Jul 2026 20:10:52 +0000

from us-smtp-delivery-160.mimecast.com (170.10.133.160) by MWH0EPF000C6192.mail.protection.outlook.com (10.167.249.102) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Wed, 22 Jul 2026 20:10:50 +0000

from null (us-sl-80.us.mimecast.lan [10.12.8.22]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id us-mta-232-7B41F90D-69C2-4A18-BF2A-ADBEA42740D5-1; Wed, 22 Jul 2026 16:10:38 -0400

Received-Spf

Pass (protection.outlook.com: domain of nhprimex.org designates 170.10.133.160 as permitted sender) receiver=protection.outlook.com; client-ip=170.10.133.160; helo=us-smtp-delivery-160.mimecast.com; pr=C

Message-Id

<Mimecast.b1d.385163d3765b574a.19f8b739cfa@us-sl-80.us.mimecast.lan>

Extracted URLs

file http://www.nhprimex.org/

Mimecast Large File Send Instructions.eml

SHA256 8a6a69d70107c8806d24069689cf41160662a786974a4cf1e89fa30192f6ff81
MD5 7a0b0c51ec4b9c99d34c0b176da010ac
SHA1 88353bd89ca74e2eecb91fa94f8a61074a681182
SHA512 80c5b4a959109147cbf2e30283fc5d49c5cfca5c50db0f8b3a6e1b6242faa2c4be4045b79d3d13eaf31dec6c5744c7eef10acf8195d8d53e08092230f1de265b
SSDEEP 384:5rzzTzz/Enc7iDZXKGCXjWpgn0xOyX832uPyRuTbyS8uSaTClOeXagBFgjP:hH5dM0WE
TLSH
T1D813613385D0DDD2597796A1750238F4EA413E5782430938B91EAB29DFBCC9BC3C6B98
MD5 SHA1 SHA512 SSDEEP TLSH

Password

[email protected]

Email Headers

To

[email protected]

From

[email protected]

Date

Wed, 22 Jul 2026 16:10:37 -0400

Subject

You've been sent large files

Content-Type

multipart/alternative; boundary="MCBoundary=_12607221610472911"

Message-Id

<attach-12607221610472901@localhost>

Extracted URLs

file https://login-us.mimecast.com/lfs/app/?tkn=3.xa05XVuS7HyJovOoVx6H_Hssj6zvRrXD1xt6VdO0h54UADnq37ibjYTn7lV74yGzv2eoeHxhSjqyd8ch9f3L1oKjd71o6acxkWnskduHblY-lJ3f-fyXcnYNvfXygjunHMi0pLswK7_MdINTnUpBQA.ucHRx6HqdD6aPmEayAwygw#/landing?token=wRR2o7QleHxLL1ZRajy_wZseHxWB09H1iCuOrGu0e3vEs0mcc2znycqRgTDk32_-srj6J0nWhVVRfLxLjfpb_E2LkbDDLkuoXMwxxeMiVRvsxseCLCRTuUZgnVw3gZKe8UWFPBLGTD6UzBUFreHBWjuKzfnSZEIBUtFqUoBbr3NSV_tM9BSVSLC3AMk1TStUTywjQTAo1C98Mivy_hsyVla686dBC5L3yC7jXdxZZlabf0CXJcg63w-fyjIE3oY1oAssxRMkett0lvQn_8y1tGMeUduAKUvRT26A3u6L-m-b-W2LkTDiJN6NoFSg7kOJ6oyVFOEh1gR1xEl9WnYEL1p7bJ61C-ErS_83SKBgj_sXGb7QCDHkcwbGaAurGIlX&recipient=smjudd%40portsmouthnh.gov&sender=narmaganian%40nhprimex.org&go=download
file https://www.mimecast.com/lfs-and-sm-privacy-statement
file https://www.mimecast.com/lfs-and-sm-privacy-statement.

email-html-2.txt

SHA256 57abe1736a8cbb707e3229f257ee281f5eab5171701bef9772d3f33a0a9882fb
MD5 bd741f17ff2e0fcad8c7d60878e9978c
SHA1 c69721818a4aa5a79e423f3ff09778dc4a2ae523
SHA512 9604877634afe5c88fbdc1e8391065ec56e84c0a5f9eec83127cc8ae3632f7550e263f26790033eb3e19e02c0134451fa13402a63fc898ccaab41bef18623799
SSDEEP 384:U/g1nTl7vku4FqIn/wgjg6brE9o8zOrZGWqircltu8q4kb3ExgS7Y7hy:U/g1nTeo3TY0
TLSH
T14EF26421E1F06A26A96B9491B50279F82E40479392931D74F54FEB37EF4DCEB434AE0C
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 562b1650d431766b9383118e0c546f75e4460178a17924f410d1f191a0c4bfd9
MD5 aaa3c9c12bd119b8591911979c593831
SHA1 c9aca7ad5c3dc7a3047f862e5dacd4f67f5e967e
SHA512 ac93013d7eaa22c533de4de9c053d5d11c0525b7732cea273821e0e095e60c22dc38e8e85da5986d31e51d98543dacf3ce7b103773436f73025335d6e53e4e0c
TLSH
T18841D6B344E3111CA6D6CD9B9F0A36B0A21F904C0224E0F8AC9483784746F3C53BF684
MD5 SHA1 SHA512 TLSH

email-html-1.txt

SHA256 305b712bc9e51f530452ee4641c40714447a8c8b13c403ba6b671e571de73a41
MD5 96fbb920f3a8f56760ecde2096ede7a4
SHA1 2720913a468f70756f598b92e22966aeac481b28
SHA512 1ec73317cb0149ca4423a99b864b8bbf3e4e14d9c394a510a41e7e9e19bd283d818a0efb1414d3a2b835750edc6390f39818a903d333e9cb250a424b952adb95
SSDEEP 96:XcBWuc/KRmFUUSn9oSKzS1QHPoSgCsPzSC1sczS+NmzS+toSn0fePzS+2zS0kPor:XLKR0UUsyJsIA1lTvD4Di+CMDKuAzDJp
TLSH
T1A491EF25A5690482B3BDA9C9F06F2711C0C61689C3596FE0B77C3AF57D8AD3472133AC
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

original.eml

Email Headers

Extracted URLs

email-html-2.txt

email-plain-1.txt

phish_alert_sp2_2.0.0.0.eml

Email Headers

Extracted URLs

Mimecast Large File Send Instructions.eml

Email Headers

Extracted URLs

email-html-2.txt

email-plain-1.txt

email-html-1.txt