`MAX WHITEHEAD 31-7-26- Fw_ Release of Information 1[.]eml

`MAX WHITEHEAD 31-7-26- Fw_ Release of Information 1.eml

SHA256 47e8b346fa975c2cacc072e5567aa7915e17bea3fe57e45e4112535bed179848
MD5 e869c920243b89a3c3a87d855b36aa10
SHA1 85a60b196175170be0a8e9ac41bd06d58ae18321
SHA512 98ef1bdeed08fba36e0d71d5d0beb9abb658db8894eae5243fc2b146b4ca284a404b7e447cdab4693beadeda556aa36976596233efe60ff229315622b1f5a64c
SSDEEP 24576:Zb9dGPL809ytZ+5RBetRdIsagNsQFSfzRmA:Zb641+5RIHNsQGzRmA
TLSH
T11E75F1F4DC062D828B205635F42F7E1A5DD42F836AF33289F66C750493F99B8D993928
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

Delivered-To

[email protected]

From

[email protected]

In-Reply-To

PSAPR02MB5350A7D00991D50BCC666E04FDC82@PSAPR02MB5350.apcprd02.prod.outlook.com

Return-Path

<[email protected]>

Date

Sat, 1 Aug 2026 05:32:52 +0000

Subject

Fw: Release of Information 1

Content-Type

multipart/mixed; boundary="_016_PSAPR02MB53508F93BE1EB954EF9EEBECFDD72PSAPR02MB5350apcp_"

Received

by 2002:ac0:e34b:0:b0:3fb:4a97:9d19 with SMTP id g11csp1360442imn; Fri, 31 Jul 2026 22:33:00 -0700 (PDT)

from TYPPR03CU001.outbound.protection.outlook.com (mail-japaneastazolkn190120002.outbound.protection.outlook.com. [2a01:111:f403:d405::2]) by mx.google.com with ESMTPS id 00721157ae682-81fccf4cf83si58110187b3.8.2026.07.31.22.32.58 for <[email protected]> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jul 2026 22:33:00 -0700 (PDT)

from PSAPR02MB5350.apcprd02.prod.outlook.com (2603:1096:301:5a::6) by SEYPR02MB7458.apcprd02.prod.outlook.com (2603:1096:101:1e5::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.16; Sat, 1 Aug 2026 05:32:52 +0000

from PSAPR02MB5350.apcprd02.prod.outlook.com ([fe80::e3fa:8959:b91b:6ca6]) by PSAPR02MB5350.apcprd02.prod.outlook.com ([fe80::e3fa:8959:b91b:6ca6%6]) with mapi id 15.21.0270.015; Sat, 1 Aug 2026 05:32:52 +0000

X-Received

by 2002:a05:690c:7409:b0:81e:8498:b970 with SMTP id 00721157ae682-81fd4b4a58fmr39906637b3.0.1785562380337; Fri, 31 Jul 2026 22:33:00 -0700 (PDT)

Received-Spf

pass (google.com: domain of [email protected] designates 2a01:111:f403:d405::2 as permitted sender) client-ip=2a01:111:f403:d405::2;

Message-Id

<PSAPR02MB53508F93BE1EB954EF9EEBECFDD72@PSAPR02MB5350.apcprd02.prod.outlook.com>

Extracted URLs

file http://www.whiteheadgroup.co.nz

2026.eml

SHA256 97c82e1eaf4073251294e337f846296fcd7137e2117c4b160f2755cd782bdf6b
MD5 21fa5337b1b49d0cc1795ef747d9268d
SHA1 578fe042eed40bfba94fa03b53a16c5de74f471d
SHA512 91f31ccd8d5e58a4234d13baaaf1b3b7e5227fbd06b0a37a847b40385ea822689a2e74c95d875080eda40d4c4ae551e0c20cb17167af51ba478bc7d83694fbf6
SSDEEP 96:VRVnBRg0RDEj+FzRpRRYv55Da+G+QReRwRRR4YD5wRfz3Rpy0i4nki6uglT4GIzt:pXhdQKlTprzOq/R8XBw2
TLSH
T1AF02D8F6D5221B187AC075D80E497C0132A0D6CB4DBBE1E016FB851CA6C66ACA7960EA
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Reply-To

[email protected]

Date

Wed, 25 Mar 2026 23:56:01 +0000

Subject

Disputes Tribunal Invoice DT 003920 / 2026

Content-Type

multipart/alternative; boundary="_000_1085448224145321774482961450pviaastcm01justicegovtnz_"

Received

from ONENETEX21.services.onenet.co.nz (10.10.8.32) by ONENETEX20.services.onenet.co.nz (10.10.8.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.58 via Mailbox Transport; Thu, 26 Mar 2026 13:00:36 +1300

from ONENETEX24.services.onenet.co.nz (10.10.2.102) by ONENETEX21.services.onenet.co.nz (10.10.8.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61; Thu, 26 Mar 2026 13:00:36 +1300

from mx03a.onenet.co.nz (10.10.131.43) by ONENETEX24.services.onenet.co.nz (10.10.2.102) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.58 via Frontend Transport; Thu, 26 Mar 2026 13:00:36 +1300

from SY8PR01CU002.outbound.protection.outlook.com (Not Verified[52.101.150.52]) by mx03a.onenet.co.nz with OneNet Message Protect (using TLS: TLSv1.3, TLS_AES_256_GCM_SHA384) id <B69c477220003>; Thu, 26 Mar 2026 13:00:34 +1300

from MEVP282CA0036.AUSP282.PROD.OUTLOOK.COM (2603:10c6:220:206::18) by ME0P282MB4697.AUSP282.PROD.OUTLOOK.COM (2603:10c6:220:223::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.22; Thu, 26 Mar 2026 00:00:26 +0000

from ML1PEPF00011308.ausprd01.prod.outlook.com (2603:10c6:220:206:cafe::33) by MEVP282CA0036.outlook.office365.com (2603:10c6:220:206::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.32 via Frontend Transport; Thu, 26 Mar 2026 00:00:22 +0000

from moj-trn-see1.justice.govt.nz (103.172.233.84) by ML1PEPF00011308.mail.protection.outlook.com (10.167.241.85) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Thu, 26 Mar 2026 00:00:26 +0000

from mail-australiasoutheastazlp17010000.outbound.protection.outlook.com (EHLO MEUPR01CU001.outbound.protection.outlook.com) ([40.93.137.0]) by moj-trn-see1.justice.govt.nz (moj-trn-see1.justice.govt.nz) with ESMTP ID -742880624 for <[email protected]>; Thu, 26 Mar 2026 12:56:06 +1300 (NZDT)

from ME3P282CA0070.AUSP282.PROD.OUTLOOK.COM (2603:10c6:220:f3::21) by SY7P282MB6267.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:330::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.22; Wed, 25 Mar 2026 23:56:04 +0000

from ML1PEPF0000F178.ausprd01.prod.outlook.com (2603:10c6:220:f3:cafe::76) by ME3P282CA0070.outlook.office365.com (2603:10c6:220:f3::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.33 via Frontend Transport; Wed, 25 Mar 2026 23:55:57 +0000

from webmail.justice.govt.nz (116.66.240.1) by ML1PEPF0000F178.mail.protection.outlook.com (10.167.241.69) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 23:56:03 +0000

from PVIAASEX01.corp.justice.govt.nz (10.98.10.11) by PVIAASHYB01.corp.justice.govt.nz (10.98.10.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61; Thu, 26 Mar 2026 12:56:01 +1300

from pviaastcm01.justice.govt.nz (192.168.80.171) by PVIAASEX01.corp.justice.govt.nz (10.98.10.11) with Microsoft SMTP Server id 15.1.2507.61 via Frontend Transport; Thu, 26 Mar 2026 12:56:01 +1300

Received-Spf

Pass (protection.outlook.com: domain of justice.govt.nz designates 116.66.240.1 as permitted sender) receiver=protection.outlook.com; client-ip=116.66.240.1; helo=webmail.justice.govt.nz; pr=C

Message-Id

<[email protected]>

email-html-2.txt

SHA256 14000e113d1b4fbc2a8b1961bf22544cab6b8bb247caf54aa7d08bbed6c39a44
MD5 cd7765bf1131f2b3fea66b17ef8bc09c
SHA1 0f851090a44458b4747a46bc827022a6466c9e01
SHA512 e54b3a15c590eedcc592bf5d1d7e7daacb85a4bc20f4ed520ea6b5fa38751639f4c0f194d1bdb1e622d2f4c3e818e5d8ca4f992f459434becefe7ca8f300570f
TLSH
T1AD2149E781C0DC3D4EB280B8C0015BEBD1D730AD736606D0755795B76B868A083B77C6
MD5 SHA1 SHA512 TLSH

email-plain-1.txt

SHA256 5839cb503f745c9531d5d7b53dc8cb132aca63b2f20f2baef7df949e2c0a56b4
MD5 13ebc0e8b5de19cdae8f7d56704f4adb
SHA1 70576ce4e31b9a005329d2a4dee18c21490e6d36
SHA512 f4f691c08a17b1d4822d301d58b21e28a6a2bd1576e317362d1769b1972681e31aa53b7750304185d976c5945fbc298fc0026246acd13722dd6eb515b62b0cda
TLSH
T18FF05CE6A80745F063E161E1040ACEC89253306FDADC0261311C828C0717EABDB4306E
MD5 SHA1 SHA512 TLSH

=?utf-8?B?UHJpdmFjeSBBY3QgUmVxdWVzdCDigJMgQ29zdHMgb2YgU3VwcGx5LnBkZg==?=

SHA256 8314480c15fa11e93cb3f96e63359538c6d4a82bfd173e10851ca03e24cc4c7d
MD5 67f98437439558bf510e3304ec310c90
SHA1 d6cf299bcc45d9ea46ef2ed19db1a1b4468cbd74
SHA512 512bd7468e80db98f34db0dc63cfde01e77c23aa3081d08ae7fa1c44da412040f0732beae5a9fe7e62e0cc72a0a1cde32971413beb6d6de6221d800480e9d3cc
SSDEEP 6144:8GkxvRs9TxZUwSLOeMYueNkByqrDTaoxP:89xvRs7mLOmZNLqrDT9Z
TLSH
T1113412487756F0683C822C7EAB4892D14416F109ABC5596A3B8EC8E72F41DF59CBCB23
MD5 SHA1 SHA512 SSDEEP TLSH

Extracted URLs

file http://gmail.com
file http://jasonclayton.nz
file http://whiteheadgroup.co.nz
file http://whiteheadgroup.co.nzwww.whiteheadgroup.co.nz
file mailto:[email protected]
file mailto:[email protected]
file mailto:[email protected]

image001.jpg

SHA256 b84ffd9ccb43cacc0e69e048ca72484f3b6d8d888003948d51de693c0514efcc
MD5 c49a619ef88885fa3ec62a18ac89f457
SHA1 0fa1ca732b94bff91ff3f84773c049cf93d9cfd6
SHA512 cb7c3cd83fbd268fc32009b71d1248fc06434e6061d8157414a788c2295e6c337ac99e94201c4ffe56d3fde5043baa2c3a673314bb137f709391ef8fac633600
TLSH
T12241D72F5263A3209C665E6F6A0D1373F5CF3B957140364E18E05EC26110CA8B355E68
MD5 SHA1 SHA512 TLSH

=?utf-8?B?UmU6IEZXOiBQcml2YWN5IEFjdCBSZXF1ZXN0IOKAkyBDb3N0cyBvZiBTdXBw?= =?utf-8?Q?ly.eml?=

SHA256 a558005792a443242fd451eac682fa27d05b13c5bd20afe13efb7a5ed4ae66c1
MD5 2b3378a06fd4a84a84489cbad582b459
SHA1 0ade271c4933c56fa890ca34b1a8057252ef4f89
SHA512 e8f7d150748524aebb8913736e4569fd656195aab8fa1482c445c136a5e393b212d39aea0b8cfbce177bd4c261cf3e5cee3ac38137183027389d52da6f1c1dc5
SSDEEP 384:kdSj2oR7Tzbri8Ap1NXJWdlTlYPDpJ4E+V6u40rbIxieyNXwIJIlPAKyUtmFBe9Q:k5ohb+DpTClTe7lo8xaVizdaVKm
TLSH
T180035D829DD72767DE154F309C191E97B024B74B3E97C8836A7E8BC6F0B9BA205C51C8
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

In-Reply-To

[email protected]

Date

Thu, 26 Mar 2026 08:47:06 +0000

Subject

=?utf-8?B?UmU6IEZXOiBQcml2YWN5IEFjdCBSZXF1ZXN0IOKAkyBDb3N0cyBvZiBTdXBw?= =?utf-8?Q?ly?=

Content-Type

multipart/related; boundary="_004_CAAZmmsKCTtN17XjpLFsw0hYiYgPhZq116EJvLebiZEsF8Ogmailgma_"; type="multipart/alternative"

Received

from ONENETEX16.services.onenet.co.nz (10.10.8.27) by ONENETEX20.services.onenet.co.nz (10.10.8.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.58 via Mailbox Transport; Thu, 26 Mar 2026 21:47:28 +1300

from ONENETEX17.services.onenet.co.nz (10.10.8.28) by ONENETEX16.services.onenet.co.nz (10.10.8.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.58; Thu, 26 Mar 2026 21:47:28 +1300

from mx02a.onenet.co.nz (10.10.131.42) by ONENETEX17.services.onenet.co.nz (10.10.8.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61 via Frontend Transport; Thu, 26 Mar 2026 21:47:28 +1300

from mail-pl1-f169.google.com (Not Verified[209.85.214.169]) by mx02a.onenet.co.nz with OneNet Message Protect (using TLS: TLSv1.3, TLS_AES_256_GCM_SHA384) id <B69c4f29e0000>; Thu, 26 Mar 2026 21:47:27 +1300

by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2ad9516a653so3417495ad.0 for <[email protected]>; Thu, 26 Mar 2026 01:47:26 -0700 (PDT)

Message-Id

<CAAZmmsKCTtN1+[email protected]>

Extracted URLs

file http://www.whiteheadgroup.co.nz

email-html-2.txt

SHA256 e023a589108f40d3fbf0be5850c5443424601725d2b13e690d18b03e5d02fb90
MD5 74d47baf7572aff0924c7b448c840df6
SHA1 e89c60f18ab99cc4c53238ad92d34dfb8630da3f
SHA512 c0979c534be6b46631a8a90dd5fdff3e22a5385165ce5529ec7b5c72f4db05afdb77aa395bfd72d136ba25c98dc544dc385ff8512f8e805c18f77fc0cb6e15cb
SSDEEP 384:aIf6Zq6UCw0edAvdpzd4EWJc+dJdAdTk0E2Cs2Ie21d2V2Ug2U2qX7e2W22vGVaB:ajkmrmkre
TLSH
T168822043E6900D0741F282FFE02B1755B0C1655997136DE3A3E922F7BA9AC746E2B3C9
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 1f542df016504a0475985e43bdfa02bfa569941126f3abe9d034f9f50ed1f9eb
MD5 f3c033277ff6e8bb838913efdd912554
SHA1 0965b4177488ead9176448125c7eed823c3f5d72
SHA512 089fb97504034498669f14c9346de1b179638ad46d5aa38e2daf2a5ff29c558fb58a12cb3ff9004088ecb5edae72793d14969eaff23cafef74d6430960795afe
SSDEEP 96:AO3KGDtdvO+wv/6heQP+kTJakFOBX7E8ZFyJ26V8QH6F98lue:d6emJ/emkTxFWX7JT6V8j8lD
TLSH
T1E4C197CF97871322477242927DA95E9CEB5AC06FFB6A4A50781C835C1B36E24933B1DC
MD5 SHA1 SHA512 SSDEEP TLSH

image001.jpg

SHA256 b84ffd9ccb43cacc0e69e048ca72484f3b6d8d888003948d51de693c0514efcc
MD5 c49a619ef88885fa3ec62a18ac89f457
SHA1 0fa1ca732b94bff91ff3f84773c049cf93d9cfd6
SHA512 cb7c3cd83fbd268fc32009b71d1248fc06434e6061d8157414a788c2295e6c337ac99e94201c4ffe56d3fde5043baa2c3a673314bb137f709391ef8fac633600
TLSH
T12241D72F5263A3209C665E6F6A0D1373F5CF3B957140364E18E05EC26110CA8B355E68
MD5 SHA1 SHA512 TLSH

Candid advice before any ERA filing.eml

SHA256 5148389955e9fbde1d9f00abc178acf938f3edd995b13f27aa7ab174d0990eda
MD5 c56ea8def666aaf4564d2ab22fe448d0
SHA1 e38b5535546e750ecf071cb1d01b3294f3edebf2
SHA512 09b3100a139d3ff6e3cd8502d2106e2ca60a484a7116fc87c8223247058da0ce371c3fd6a5e98171232cb08fa52c801f62e983c3f9dcb417402303f8ec83aa96
SSDEEP 1536:ot8cHhLbz1Yx47DaQ1W3fm/mq/EvM+L9r3l:oewpzS4W3omDvdbl
TLSH
T169B32A10ACE62BD3DE990E751CDD7996393A7B9F3452488B9878CB87C45BFB014860EC
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

In-Reply-To

CAHYOhfdY2cfa8GDBZMYF4xrNOa_O=ELex9rAHpg7ypmLTY0JRQ@mail.gmail.com

Date

Mon, 16 Feb 2026 22:45:59 +0000

Subject

Candid advice before any ERA filing

Content-Type

multipart/related; boundary="_004_56e9a1d8758e49109d78ddf9a45a5f3cwhiteheadgroupconz_"; type="multipart/alternative"

Message-Id

<[email protected]>

email-html-2.txt

SHA256 b5ca6539d7e9d66d292a5efb3ea8563d82bc23a7b52bee2b395a8fa6f073fe2a
MD5 3e8578a90a65264e631fb529802f0dec
SHA1 f4fd22a29019813e0a0300e9d6052a9b5220d576
SHA512 d6baf06cd6c89f5a59f6a8b7f36470d11ac5664043d28445e0041908be4a4f86c94c8f4a49c8441a94037f9cd0b5603f6f5706de32eedaf863cdd6ff835369fa
SSDEEP 384:qKRkRwFFiDGkFZ+qwSS4jqAY7FDmsRglf2FIZ02C6KcMFkm0FVFXe0GqPFAuvENJ:q3ZmbSe7hpM4JvNun864FNhyflq
TLSH
T12A536432F7040286E2FAB2E1E1FE175560A1C708E30365E5A0355B373ACA9965ED36DF
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 93c3a0f893cc8ce71fe30854c8ec4e63ac783379ac62fabca371d4a23ff34315
MD5 58308f8a1bec1b36aaf9f9fe4b776455
SHA1 23fe1d59874f43cfab287c98cb60fb296fb315a9
SHA512 f2bba8ff521fd781bfbfe6abf6beb56d55825ad623eaf600e09d611f996c37a75892e0c73b8ab46eedadc2e7994307ccb65a023f5822e0e406c98a93401abfb9
SSDEEP 192:k+nkCFslFLTNSutEY19w9NmPsVz4QuTaj1TVQOaluh0RyFG5ONcYdUfD/hmkEb1a:k+1FslFhJB9whUcaRyoScYGbpzEn+3P
TLSH
T17452F75F678B137203734194EA4EA9DAFB19807CF35946707CAC829C2325A66D3379EC
MD5 SHA1 SHA512 SSDEEP TLSH

image001.jpg

SHA256 b84ffd9ccb43cacc0e69e048ca72484f3b6d8d888003948d51de693c0514efcc
MD5 c49a619ef88885fa3ec62a18ac89f457
SHA1 0fa1ca732b94bff91ff3f84773c049cf93d9cfd6
SHA512 cb7c3cd83fbd268fc32009b71d1248fc06434e6061d8157414a788c2295e6c337ac99e94201c4ffe56d3fde5043baa2c3a673314bb137f709391ef8fac633600
TLSH
T12241D72F5263A3209C665E6F6A0D1373F5CF3B957140364E18E05EC26110CA8B355E68
MD5 SHA1 SHA512 TLSH

Invoice INV-97919 150226.pdf

SHA256 7da6094b930827b3e513275511073b65b36dbcfadba7d17f528eba3d52e24ef2
MD5 7858260e552b093a857d69b51193016f
SHA1 b2e143aed2437e05d9e8bd3334233692547b2574
SHA512 f4aa6aa06519a02306c4a1bc4452bcbdd5e9f84c0a518f1c51a641dacc94a9ba5974478e621bb36592db8de6046a96c68461e3739048959ebb056024c1ef7069
SSDEEP 1536:m5JSyaWG4gMzErYBO00O8kiHH5QkF0JeosOQJf:mPwFMzErYgo8kpkye7n
TLSH
T1AA43CFC8E265DA1CDD11DE7974063B4890BDF0838BCA56B376E8498A44C0EBCBDD46E7
MD5 SHA1 SHA512 SSDEEP TLSH

Invoice disputed by JC.pdf

SHA256 1f941b5becb60cc53921f8e969313ee2213569b26bd1aa1182f760d4e492548b
MD5 fd6db6fda96c23510a942166bfb71870
SHA1 bf78121f008f1d5df384852264347f40dd76665d
SHA512 b83afc2465cc044f42413392e1ed7e494bcc1f8eefb9b1fe980040f5d059cd9b9d331f762c835ca5bfb1dfc5873ce6351153e308bf987cdfff8a59199fa68212
SSDEEP 6144:R+NODnGAdwJp6QqqPp3gPmV3lZOXXCALiGstLTSZLIIjOpo7FYSp:R+EDnGn3qqPlcu1ZiCfGst3SZDOCN
TLSH
T1966412F59729489200C3D73693B902DE80D7D2AD82BC6B79757D8D821B80CC31DE5AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Extracted URLs

file http://gmail.com
file http://goldencontracting.co.nz
file http://hotmail.com
file http://jasonclayton.nz
file http://whiteheadgroup.co.nz
file http://whiteheadgroup.co.nzwww.whiteheadgroup.co.nz
file http://www.whiteheadgroup.co.nz/
file mailto:[email protected]
file mailto:[email protected]
file mailto:[email protected]
file mailto:[email protected]
file mailto:[email protected]
file mailto:[email protected]
Show all

image001.jpg

SHA256 b84ffd9ccb43cacc0e69e048ca72484f3b6d8d888003948d51de693c0514efcc
MD5 c49a619ef88885fa3ec62a18ac89f457
SHA1 0fa1ca732b94bff91ff3f84773c049cf93d9cfd6
SHA512 cb7c3cd83fbd268fc32009b71d1248fc06434e6061d8157414a788c2295e6c337ac99e94201c4ffe56d3fde5043baa2c3a673314bb137f709391ef8fac633600
TLSH
T12241D72F5263A3209C665E6F6A0D1373F5CF3B957140364E18E05EC26110CA8B355E68
MD5 SHA1 SHA512 TLSH

Re: Candid advice before any ERA filing.eml

SHA256 e28b0199457e88845ef94c69ca7f091d051dd9013bb94d1a6564c53a1bad8552
MD5 ff43c95d8c3f2d9d6984411a3784f38a
SHA1 ab7f08efcfe5aa865f221ad178d167bfd11fce07
SHA512 214f3c6940957548921580d96e5fc2464834842de08dc37dca3af80426470095f352877ef3357d6344e9c45b2f6fcff8fd33db7f96f58bcfaeee1a1d9f0d475a
SSDEEP 1536:41h72RF5/C6ffSQvcCP8ebizjcczD2d8lmVIk7H8xeM4ZcFn4T4QoOo4loBd7:4uC8wemj/2d8Pk7cxeMTnS4z9gO7
TLSH
T128A35C506DD817A3EF610E31ACDDBE8FA634A78F35D24447063E8F8AD929E5209C91DC
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

In-Reply-To

[email protected]

Date

Fri, 20 Feb 2026 05:02:05 +0000

Subject

Re: Candid advice before any ERA filing

Content-Type

multipart/related; boundary="_004_87152DB28F33472E979FDC63042AA3CDgmailcom_"; type="multipart/alternative"

Received

from ONENETEX21.services.onenet.co.nz (10.10.8.32) by ONENETEX20.services.onenet.co.nz (10.10.8.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.58 via Mailbox Transport; Fri, 20 Feb 2026 18:02:15 +1300

from ONENETEX19.services.onenet.co.nz (10.10.8.30) by ONENETEX21.services.onenet.co.nz (10.10.8.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61; Fri, 20 Feb 2026 18:02:15 +1300

from mx01a.onenet.co.nz (10.10.131.41) by ONENETEX19.services.onenet.co.nz (10.10.8.30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61 via Frontend Transport; Fri, 20 Feb 2026 18:02:15 +1300

from mail-pf1-f172.google.com (Not Verified[209.85.210.172]) by mx01a.onenet.co.nz with OneNet Message Protect (using TLS: TLSv1.3, TLS_AES_256_GCM_SHA384) id <B6997ead60000>; Fri, 20 Feb 2026 18:02:14 +1300

by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-82491fbf02cso906913b3a.1 for <[email protected]>; Thu, 19 Feb 2026 21:02:13 -0800 (PST)

from smtpclient.apple ([49.224.123.41]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-824c6b69f2asm21441220b3a.37.2026.02.19.21.02.07 for <[email protected]> (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 19 Feb 2026 21:02:09 -0800 (PST)

X-Mailer

iPhone Mail (19H402)

Message-Id

<[email protected]>

Extracted URLs

file http://www.whiteheadgroup.co.nz

email-html-2.txt

SHA256 c0738e384a56065bc3087a401aea817fda8c435a04f711981e9e8b5561d6c811
MD5 e749f5b7e272eb6b7febf398540bf8c1
SHA1 54583b004f76c4657f75386fa81f0679e589f983
SHA512 f4c64d7940be76472e978c77f8e3cfeb40700f02d8e6e9d2231ec84f3fab78731881015a4e2f3e57ebe2ed734d200f777d967332a7e3c3e2a09a0a2893b95edb
SSDEEP 768:0FyA6DPrRgAcQQQ6+wn6wD8hZZFHVLIIIPqsb:lA6L9TcQQQ6J6b0
TLSH
T114335421F5140D0E82FB62F5E05B1B18A143874DC751BEE2AA6AD6B7B84DF901B233DD
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 beed995b2a80cea2c84f694abdd2d2fe7e3f0c4206938ae2eb00287d557933a9
MD5 976b343da644e4e28bd3410251b05c23
SHA1 23bdf5aa30f03f75cd7b2aa90e38e43a4f02c3db
SHA512 9d7a8b117fdc8c6b9e56785171f69f9d8dab610fec0a078e59d0d91a8821fb3e61ff5a24373cbde63e6eed03ac22fc3f5927676c66552e2a5db445df220c4985
SSDEEP 384:9o9ChjRysEiRHFrOgg2FVMl9RRfMUM6RioSEQu75bkn+X3:9SCqsEsxOgFVc9RjR9X
TLSH
T16D92F79B238B133203B20190AE5D9ADEFB14807FF7658661789C825C2B36579D3379EC
MD5 SHA1 SHA512 SSDEEP TLSH

image001.jpg

SHA256 b84ffd9ccb43cacc0e69e048ca72484f3b6d8d888003948d51de693c0514efcc
MD5 c49a619ef88885fa3ec62a18ac89f457
SHA1 0fa1ca732b94bff91ff3f84773c049cf93d9cfd6
SHA512 cb7c3cd83fbd268fc32009b71d1248fc06434e6061d8157414a788c2295e6c337ac99e94201c4ffe56d3fde5043baa2c3a673314bb137f709391ef8fac633600
TLSH
T12241D72F5263A3209C665E6F6A0D1373F5CF3B957140364E18E05EC26110CA8B355E68
MD5 SHA1 SHA512 TLSH

Transaction Receipt.eml

SHA256 7ead5c8b3df112fe3a8c887f8f5516aac3b32473fdc3e688cb0f515d8f8346d2
MD5 ef5bbdf29b56e7f0560c501e690df190
SHA1 6bd5aade6f7575ad39290552349784f763173669
SHA512 5fcf273629e2a9cb1642c3142ea6cb97e83a87c9bfd25e7680a811a26d9718481dca37998569e57f2511fed6ca97b5f5ce834b319a85d1b50402166990dd3149
SSDEEP 192:YL0BOUPb3VlduGerBh8H77TIBwh/wABN40SsSlDB1DXj:YL0Ug3VloG2yk0juJj
TLSH
T13802E8A1D48011AD1556B1A1BB027C8826E4B06DD7C689F0FBFFA83D2F8669F524478D
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Date

Wed, 25 Mar 2026 23:35:51 +0000

Subject

Transaction Receipt

Content-Type

multipart/alternative; boundary="_000_a7a85ca670994532912a029b2d004b22exch1nz1windcavelocal_"

Received

from ONENETEX19.services.onenet.co.nz (10.10.8.30) by ONENETEX20.services.onenet.co.nz (10.10.8.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.58 via Mailbox Transport; Thu, 26 Mar 2026 12:35:59 +1300

from ONENETEX23.services.onenet.co.nz (10.10.2.101) by ONENETEX19.services.onenet.co.nz (10.10.8.30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61; Thu, 26 Mar 2026 12:35:59 +1300

from mx02a.onenet.co.nz (10.10.131.42) by ONENETEX23.services.onenet.co.nz (10.10.2.101) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61 via Frontend Transport; Thu, 26 Mar 2026 12:35:59 +1300

from smtp1.windcave.com (Not Verified[203.207.60.40]) by mx02a.onenet.co.nz with OneNet Message Protect (using TLS: TLSv1.2, ECDHE-RSA-AES256-GCM-SHA384) id <B69c4715e0000>; Thu, 26 Mar 2026 12:35:58 +1300

X-Mailer

WC Mail

Message-Id

<[email protected]>

Extracted URLs

file https://sec.windcave.com/pxmi3/F8EC91FE2FA6944C0176D43302C5F516599D7F6F7ECF195B5FD3CDF2A4BF74E93330B0B9E47A3E2847F121583A87D1E31?res=0101255f88783005&restime=18991230000000
file https://www.windcave.com

email-html-2.txt

SHA256 3f97105800f4d759919000e484bdae4dc752882ab80ee565ed93723b11f6007d
MD5 e160e82072d484b024e4d3873db18de6
SHA1 d6b2b193ca4e490d035bd974b95da431b5800835
SHA512 da40f571dff9f3684b6faad3bfc04e2758a1b2b684a26bea8f4663b6a6d57eec937149ef77a1fa263c3d8ae4f90cfb7404f169aba67aae7b6f94bdc302998780
SSDEEP 96:P+QyfBh8H77TtcXhKvb7KjKm1Q3Snfk7nSGSt8WUkcUkhzyOpGZaoNaNefLfLOQd:bsBh8H77TsovyumOSkSzDqlaDZ
TLSH
T1EEA164B1D890212C5129A062F626FCEC65E4B033C7864DB4FFAE983F7B461AB51907DD
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 b09bd7854c9588bb273fff4d8cf7d531accc647827ebafcef064576af46936ac
MD5 c9681ad00daf8b02ad502b159a22ae1d
SHA1 2dee28cf73038b6348a725111ea7fc494ad0774f
SHA512 ed004ba9ca9b5f60a1278d679c71f277a4917822639c5786d6d45bc4f1c69a6e70cee6a01ffd8d9bec76309584325362efd07681993d70622f3c700c40bf3005
TLSH
T18EF002A5F8C06E10A685E0E9A6447CC5E972302F7FC810A9B08CA41653917AD1729DA4
MD5 SHA1 SHA512 TLSH

Trojan- sent from Golden.eml

SHA256 ba836ee1b6edca0fa0c33f9751355874472e81c0c03a61fa7b0cb6f18175bcf6
MD5 1b8685225b5fa75ef4a9dd2ba6ff9fba
SHA1 c27f2eeb42bf8c8fd780cf07ab6bd7c46e8acab7
SHA512 b6644918eb664ea9bf2ab8bbaadbf08cedd78af3764a5049bc9e0c8c8c7065951607686c9e5c8f5473c8b5edde871db5ae167f348394ca99536621c4b128aa54
SSDEEP 1536:FtS8w1y0iqSb7/x87JHq6resaVW3fm/lPbQ2Tiu2f:4iqSv/x8HresaVW3o5TiXf
TLSH
T159B33C50ACE62BE3DE990E711CC97A5B7A297A8F345248875478CF47C06BFB151CA0EC
MD5 SHA1 SHA512 SSDEEP TLSH

Update on case.eml

SHA256 ee6644c0fcdfc6a76f0f87364a6b22628fa677f2841375842dcbd310fce9cf3c
MD5 d3793c191a07ad3114c03526f4c691d9
SHA1 505046c63c0626207c7a5396943d0431f4b9eac5
SHA512 0c0839a5c90b84ef2c72039dfe178cb8fa04225ccb0f1b43951401fa0d549c34ec89b8a1e06bd81734d843139161ae4bafa4f1d97402b1ae310e5a99a0c11c9a
SSDEEP 192:gf7eT8XfYdUTGif3UQvQpwdamq14fccc9REZEtdR4oZYEiWE7nG76lrW/N5wZmm:gf6TMRy2QudFvccc9OZEtdR4IPe7G76P
TLSH
T129325B72EE5131AABFD0EB215E25FC47D622938779A7C243396C4D8051A8D2335E83EC
MD5 SHA1 SHA512 SSDEEP TLSH

Your Correspondence.eml

SHA256 ffa49a321520fe8990f525cbcf6270b4fb64694e2a0f2a02de8341f3e4d77687
MD5 b1c6f65b971743dbc1921bd41a4a153b
SHA1 9aa000441199b0c8c2e5d63ea3438b70ac5722bd
SHA512 fa58436d3d5c6d4b08f9d6f7e0d9e761f33055a9feaec8c82361d57ae1c4e7003b88eef64e0be26f778656f3160194dcb3f0b35842d65438b593d5f2223f9118
SSDEEP 768:x93oPFN404bD5YBmfuThHzfAj/gCh45Oa:x9ua0W5YBmfuN0bg55Oa
TLSH
T17E135C505ED927A3DF510F60AC4EBE572A24FB4F3592488349398FCED61EB9214DA2CC
MD5 SHA1 SHA512 SSDEEP TLSH

email-html-2.txt

SHA256 b329edcde2df894ff39a05b257a43d7b2104656fb901a6c4259192e661ec83e6
MD5 bb52fdee09d5c277ba1376bc0c8ef422
SHA1 cd39af0a357b1656ef658b02c7e5c85ee458da94
SHA512 fbd338704fe0e9d382eeeb3250550927875ca27ebf27efe4ed26304dc158f6041b897ad4204cb373c6f85ec77a816028179036d40ea304224491dafea36dcc36
SSDEEP 384:dKROwwz4FjNX0hvHL4HduHy/HiHB0HhH7X7oHTHHAbU329UUOcZEYE5HHONW0Z1r:d9UivH8HIHSHiHB0HhH7roHTHHAbU32H
TLSH
T1F4922054F6540F8352FE93F9E06B271890C0538993537AD2B27829F77E8AD606A273CD
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 e8856bbed90a0ef7f35fe7eb9773798f98d9a447bd6c7f974ee13fe9f32c613d
MD5 c5d9fa4729e0c64fe354026efd15f47f
SHA1 3fea076c57bb5d49d6ed39c93b828ade3876ea34
SHA512 2b695b13661c34464b8806866a09edf56c760617994aa495fd3697a439e97ddd05a365217c164b6632084385ccc34a48ad0ee6ce4a8b19df75d2e3d7798fa249
SSDEEP 96:n4A4LRqZh3O8uo8Z1yFhMwv/6heGBynM7JqkFWxX7nwuo8Z16xI/698QH6t98luL:nIR+3o9cFF/soM7BFmX7f9T/698r8li
TLSH
T176D176DF92871322075202B6BA9F6DD8FB59C07CF76F4A61781C835C1226A24873B2DC
MD5 SHA1 SHA512 SSDEEP TLSH

image001.jpg

SHA256 b84ffd9ccb43cacc0e69e048ca72484f3b6d8d888003948d51de693c0514efcc
MD5 c49a619ef88885fa3ec62a18ac89f457
SHA1 0fa1ca732b94bff91ff3f84773c049cf93d9cfd6
SHA512 cb7c3cd83fbd268fc32009b71d1248fc06434e6061d8157414a788c2295e6c337ac99e94201c4ffe56d3fde5043baa2c3a673314bb137f709391ef8fac633600
TLSH
T12241D72F5263A3209C665E6F6A0D1373F5CF3B957140364E18E05EC26110CA8B355E68
MD5 SHA1 SHA512 TLSH

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

`MAX WHITEHEAD 31-7-26- Fw_ Release of Information 1.eml

Email Headers

Extracted URLs

2026.eml

Email Headers

email-html-2.txt

email-plain-1.txt

=?utf-8?B?UHJpdmFjeSBBY3QgUmVxdWVzdCDigJMgQ29zdHMgb2YgU3VwcGx5LnBkZg==?=

Extracted URLs

image001.jpg

=?utf-8?B?UmU6IEZXOiBQcml2YWN5IEFjdCBSZXF1ZXN0IOKAkyBDb3N0cyBvZiBTdXBw?= =?utf-8?Q?ly.eml?=

Email Headers

Extracted URLs

email-html-2.txt

email-plain-1.txt

image001.jpg

Candid advice before any ERA filing.eml

Email Headers

email-html-2.txt

email-plain-1.txt

image001.jpg

Invoice INV-97919 150226.pdf

Invoice disputed by JC.pdf

Extracted URLs

image001.jpg

Re: Candid advice before any ERA filing.eml

Email Headers

Extracted URLs

email-html-2.txt

email-plain-1.txt

image001.jpg

Transaction Receipt.eml

Email Headers

Extracted URLs

email-html-2.txt

email-plain-1.txt

Trojan- sent from Golden.eml

Update on case.eml

Your Correspondence.eml

email-html-2.txt

email-plain-1.txt

image001.jpg