KevinTheJedi
Here's a example. I made the same subsitutions (for privacy) in both mails.
`Mail 1:
Received: from exchange.XXX.local (XX.XX.XX.X) by
exchange.XXX.local (XX.XX.XX.X) with Microsoft SMTP Server (TLS) id
15.0.1497.23 via Mailbox Transport; Fri, 27 Aug 2021 16:40:23 +0200
Received: from exchange.XXX.local (XX.XX.XX.X) by
exchange.XXX.local (XX.XX.XX.X) with Microsoft SMTP Server (TLS) id
15.0.1497.23; Fri, 27 Aug 2021 16:40:22 +0200
Received: from exchange.XXX.local ([X::X:X:X:X]) by
exchange.XXX.local ([X::X:X:X:X%12]) with mapi id
15.00.1497.023; Fri, 27 Aug 2021 16:40:22 +0200
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: FIRST NAME FIRST.NAME@Y.YY
To: DEPARTMENT si@XXX.XX
Subject: osticket & ssl
Thread-Topic: osticket & ssl
Thread-Index: AdebUWcZYojlsc4UTHa0oSmL0kR6IQ==
Importance: low
X-Priority: 5
Date: Fri, 27 Aug 2021 16:40:22 +0200
Message-ID: 7c7bc97c705b4b8e814f994f162aa3e3@exchange.XXX.local
Accept-Language: de-DE, lb-LU, en-US
Content-Language: de-DE
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: 7c7bc97c705b4b8e814f994f162aa3e3@exchange.XXX.local
MIME-Version: 1.0
X-MS-Exchange-Transport-FromEntityHeader: Hosted
X-MS-Exchange-Organization-MessageDirectionality: Originating
X-MS-Exchange-Organization-AuthSource: exchange.XXX.local
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 03
X-Originating-IP: [X.X.X.X]
X-MS-Exchange-Organization-Network-Message-Id: 57bc2c29-6790-4392-d01f-08d9696899a2
Return-Path: FIRST.NAME@Y.YY
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
X-TM-AS-Product-Ver: SMEX-14.0.0.3092-8.6.1018-26372.000
X-TM-AS-Result: No-10--16.766400-5.000000
X-TMASE-MatchedRID: vodvpEYj9V5HW+94FA8JFysIuzCLc2mNrogFtKd/P7cLBZEuqIL9Sp9x
0tmzvpK2F7bN6j0oZDXUSw7j5cyFSzw+HfGa1Awzfpjmznj57crBw1gX/y4CfEqa6TyhyXvPk/W
3dqvyXNMLwTxkKC1upZfrKASrZ1SthgwHglWZLURitzfafzhYemFLmZ/VV2VhnGLdjiSqk4Cuvl
MTgYvOTUdgNo8Hh3T7HN8E5V9DSKcYGF7zJ4U4G8b6dLbgzMd5oR125t7qTX4QS4VCDDktp1SFR
qUEow4brj8Zt49hVrs37RdgrkhHy0UuXkWTSi/Ri+m1DDPm2yK4zkaT0bJzujfBseKdwxZnb1BT
kDJfqeXi/DyNXEDesGEz0w7ROq2rTA8nCRTpGksD2WXLXdz+Ad2nS447+jIoKvldxywgwof2Li5
Ix70nAeD5CIcLwXN63JT0Jb3lWGrHlc3rs/u2NFy6ccWnLzE/TWGkPFstae0452hx28rHFTNgLu
zpjFymIeaM1LLgEiJvbi1SDSqmyEPps676UL+0uW3OvaGtWpLl1fVJSilsXoOUDOaVIRXSb7x2m
UKAsxKpf60XITsZq3wRNobRLU/hP9RwImUdS/8=
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No
X-TMASE-Result: 10--16.766400-5.000000
X-TMASE-Version: SMEX-14.0.0.3092-8.6.1018-26372.000
X-TM-SNTS-SMTP: A43FC826B000F7514DEBCC3F49E00D578EFFB738099D14E1940C1379E641B2132000:9
X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXIe@f;1692900;0;This mail has
been scanned by Trend Micro ScanMail for Microsoft Exchange;
Mail2:
Received: from exchange.XXX.local (XX.XX.XX.X) by
exchange.XXX.local (XX.XX.XX.X) with Microsoft SMTP Server (TLS) id
15.0.1497.23 via Mailbox Transport; Fri, 27 Aug 2021 16:40:23 +0200
Received: from exchange.XXX.local (XX.XX.XX.X) by
exchange.XXX.local (XX.XX.XX.X) with Microsoft SMTP Server (TLS) id
15.0.1497.23; Fri, 27 Aug 2021 16:40:22 +0200
Received: from exchange.XXX.local ([X::X:X:X:X]) by
exchange.XXX.local ([X::X:X:X:X%12]) with mapi id
15.00.1497.023; Fri, 27 Aug 2021 16:40:22 +0200
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: FIRST NAME FIRST.NAME@Y.YY
To: DEPARTMENT si@XXX.XX
Subject: osticket & ssl
Thread-Topic: osticket & ssl
Thread-Index: AdebUWcZYojlsc4UTHa0oSmL0kR6IQ==
Importance: low
X-Priority: 5
Date: Fri, 27 Aug 2021 16:40:22 +0200
Message-ID: 7c7bc97c705b4b8e814f994f162aa3e3@exchange.XXX.local
Accept-Language: de-DE, lb-LU, en-US
Content-Language: de-DE
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: 7c7bc97c705b4b8e814f994f162aa3e3@exchange.XXX.local
MIME-Version: 1.0
X-MS-Exchange-Transport-FromEntityHeader: Hosted
X-MS-Exchange-Organization-MessageDirectionality: Originating
X-MS-Exchange-Organization-AuthSource: exchange.XXX.local
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 03
X-Originating-IP: [X.X.X.X]
X-MS-Exchange-Organization-Network-Message-Id: 57bc2c29-6790-4392-d01f-08d9696899a2
Return-Path: FIRST.NAME@Y.YY
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
X-TM-AS-Product-Ver: SMEX-14.0.0.3092-8.6.1018-26372.000
X-TM-AS-Result: No-10--16.766400-5.000000
X-TMASE-MatchedRID: vodvpEYj9V5HW+94FA8JFysIuzCLc2mNrogFtKd/P7cLBZEuqIL9Sp9x
0tmzvpK2F7bN6j0oZDXUSw7j5cyFSzw+HfGa1Awzfpjmznj57crBw1gX/y4CfEqa6TyhyXvPk/W
3dqvyXNMLwTxkKC1upZfrKASrZ1SthgwHglWZLURitzfafzhYemFLmZ/VV2VhnGLdjiSqk4Cuvl
MTgYvOTUdgNo8Hh3T7HN8E5V9DSKcYGF7zJ4U4G8b6dLbgzMd5oR125t7qTX4QS4VCDDktp1SFR
qUEow4brj8Zt49hVrs37RdgrkhHy0UuXkWTSi/Ri+m1DDPm2yK4zkaT0bJzujfBseKdwxZnb1BT
kDJfqeXi/DyNXEDesGEz0w7ROq2rTA8nCRTpGksD2WXLXdz+Ad2nS447+jIoKvldxywgwof2Li5
Ix70nAeD5CIcLwXN63JT0Jb3lWGrHlc3rs/u2NFy6ccWnLzE/TWGkPFstae0452hx28rHFTNgLu
zpjFymIeaM1LLgEiJvbi1SDSqmyEPps676UL+0uW3OvaGtWpLl1fVJSilsXoOUDOaVIRXSb7x2m
UKAsxKpf60XITsZq3wRNobRLU/hP9RwImUdS/8=
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No
X-TMASE-Result: 10--16.766400-5.000000
X-TMASE-Version: SMEX-14.0.0.3092-8.6.1018-26372.000
X-TM-SNTS-SMTP: A43FC826B000F7514DEBCC3F49E00D578EFFB738099D14E1940C1379E641B2132000:9
X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXIe@f;1692900;0;This mail has
been scanned by Trend Micro ScanMail for Microsoft Exchange;
`