exclusively, the emails contain foundation-64 encoded strings which might be executed by means of the 'sh' shell to build and fall a webshell on the Zimbra server. thanks so much! My technician was great in finding us https://techsk.ca/computer-repair-saskatoon/virus.html