Download | 1676365588 Zip

: Attackers use the extended MAPI property PidLidReminderFileParameter to specify a Universal Naming Convention (UNC) path pointing to a malicious SMB share.

: When Outlook attempts to "play" the notification sound from that path, it automatically sends the user's NTLM authentication hashes to the attacker's server. Why this ZIP is significant Download 1676365588 zip

: The exploit triggers automatically when the email is received and processed by the Outlook client, even if the user never opens or previews the message. Download 1676365588 zip