Antigen for Exchange found decrypt-password.exe matching =*.exe file filter. The file is currently Removed. The message, "Re: Your password!", was sent from wttsai@mail.ncku.edu.tw and was discovered in SMTP Messages\Inbound located at Unknown/Unknown/E2K1.