File name:

74704807.eml

Full analysis: https://app.any.run/tasks/8dc8f3df-a44e-45ba-b424-79a96fc41558
Verdict: Malicious activity
Analysis date: May 31, 2025, 06:34:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
attachments
attc-unc
susp-attachments
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with CRLF line terminators
MD5:

53FEA878DBD10FE6876C48752D5E82ED

SHA1:

DA1EAF55BC76ADA49B55FDB4CC20C207CB32357F

SHA256:

222925D9722580510B9BB8663474A62AEB5F1330621C4AFED70A51199FE8A7CA

SSDEEP:

24576:1+UzitOOF4xndnoARQLfv7pWs4edjF1+4WEQ2qJF:1+8i0s7Ye/xg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • OUTLOOK.EXE (PID: 5772)

  • SUSPICIOUS

    • Executes application which crashes

      • BL_Copy_pdf.exe (PID: 8068)
      • BL_Copy_pdf.exe (PID: 8140)
      • BL_Copy_pdf.exe (PID: 6072)
      • BL_Copy_pdf.exe (PID: 5384)
      • BL_Copy_pdf.exe (PID: 7980)
      • BL_Copy_pdf.exe (PID: 1072)
      • BL_Copy_pdf.exe (PID: 7188)
      • BL_Copy_pdf.exe (PID: 680)
      • BL_Copy_pdf.exe (PID: 2660)
      • BL_Copy_pdf.exe (PID: 2088)
      • BL_Copy_pdf.exe (PID: 2516)
      • BL_Copy_pdf.exe (PID: 516)
      • BL_Copy_pdf.exe (PID: 6512)

  • INFO

    • The sample compiled with english language support

      • OUTLOOK.EXE (PID: 5772)
      • WinRAR.exe (PID: 7848)
      • WinRAR.exe (PID: 8148)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7848)
      • WinRAR.exe (PID: 8148)

    • Reads mouse settings

      • BL_Copy_pdf.exe (PID: 8068)
      • BL_Copy_pdf.exe (PID: 5384)
      • BL_Copy_pdf.exe (PID: 6072)
      • BL_Copy_pdf.exe (PID: 8140)
      • BL_Copy_pdf.exe (PID: 680)
      • BL_Copy_pdf.exe (PID: 1072)
      • BL_Copy_pdf.exe (PID: 7980)

    • Manual execution by a user

      • WinRAR.exe (PID: 7848)
      • BL_Copy_pdf.exe (PID: 8068)
      • BL_Copy_pdf.exe (PID: 5384)
      • BL_Copy_pdf.exe (PID: 6072)
      • BL_Copy_pdf.exe (PID: 8140)
      • BL_Copy_pdf.exe (PID: 680)
      • WinRAR.exe (PID: 8148)
      • WinRAR.exe (PID: 2984)
      • BL_Copy_pdf.exe (PID: 7980)
      • BL_Copy_pdf.exe (PID: 1072)
      • BL_Copy_pdf.exe (PID: 2660)
      • BL_Copy_pdf.exe (PID: 2088)
      • BL_Copy_pdf.exe (PID: 2516)
      • BL_Copy_pdf.exe (PID: 516)
      • BL_Copy_pdf.exe (PID: 6512)

    • Create files in a temporary directory

      • BL_Copy_pdf.exe (PID: 8068)
      • BL_Copy_pdf.exe (PID: 8140)
      • BL_Copy_pdf.exe (PID: 6072)
      • BL_Copy_pdf.exe (PID: 5384)
      • BL_Copy_pdf.exe (PID: 7980)
      • BL_Copy_pdf.exe (PID: 1072)

    • Checks supported languages

      • BL_Copy_pdf.exe (PID: 8068)
      • BL_Copy_pdf.exe (PID: 5384)
      • BL_Copy_pdf.exe (PID: 6072)
      • BL_Copy_pdf.exe (PID: 8140)
      • BL_Copy_pdf.exe (PID: 1072)
      • BL_Copy_pdf.exe (PID: 680)
      • BL_Copy_pdf.exe (PID: 7980)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7264)
      • WerFault.exe (PID: 7788)
      • WerFault.exe (PID: 4748)
      • WerFault.exe (PID: 7712)

    • Reads the software policy settings

      • slui.exe (PID: 4120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
193
Monitored processes
47
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe sppextcomobj.exe no specs slui.exe ai.exe no specs winrar.exe bl_copy_pdf.exe svchost.exe no specs werfault.exe no specs bl_copy_pdf.exe svchost.exe no specs werfault.exe no specs bl_copy_pdf.exe svchost.exe no specs werfault.exe no specs bl_copy_pdf.exe svchost.exe no specs werfault.exe no specs slui.exe winrar.exe no specs bl_copy_pdf.exe bl_copy_pdf.exe svchost.exe no specs werfault.exe no specs svchost.exe no specs werfault.exe no specs bl_copy_pdf.exe svchost.exe no specs werfault.exe no specs winrar.exe bl_copy_pdf.exe svchost.exe no specs werfault.exe no specs bl_copy_pdf.exe bl_copy_pdf.exe svchost.exe no specs werfault.exe no specs svchost.exe no specs werfault.exe no specs bl_copy_pdf.exe svchost.exe no specs werfault.exe no specs bl_copy_pdf.exe bl_copy_pdf.exe svchost.exe no specs werfault.exe no specs svchost.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1072 -s 780C:\Windows\SysWOW64\WerFault.exe—BL_Copy_pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
516"C:\Users\admin\Desktop\BL_Copy_pdf.exe" C:\Users\admin\Desktop\BL_Copy_pdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\bl_copy_pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\wsock32.dll
632"C:\Users\admin\Desktop\BL_Copy_pdf.exe" C:\Windows\SysWOW64\svchost.exe—BL_Copy_pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
680"C:\Users\admin\Desktop\BL_Copy_pdf.exe" C:\Users\admin\Desktop\BL_Copy_pdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\bl_copy_pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
780"C:\Users\admin\Desktop\BL_Copy_pdf.exe" C:\Windows\SysWOW64\svchost.exe—BL_Copy_pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
1072"C:\Users\admin\Desktop\BL_Copy_pdf.exe" C:\Users\admin\Desktop\BL_Copy_pdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\bl_copy_pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
1812C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7980 -s 752C:\Windows\SysWOW64\WerFault.exe—BL_Copy_pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2088"C:\Users\admin\Desktop\BL_Copy_pdf.exe" C:\Users\admin\Desktop\BL_Copy_pdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\bl_copy_pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
2108C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2516 -s 760C:\Windows\SysWOW64\WerFault.exe—BL_Copy_pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2268"C:\Users\admin\Desktop\BL_Copy_pdf.exe" C:\Windows\SysWOW64\svchost.exe—BL_Copy_pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
39 138
Read events
38 630
Write events
434
Delete events
74

Modification events

(PID) Process:(5772) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\OUTLOOK\1644
Operation:delete valueName:0
Value:
ซ渐�꿃僁赇臢섙䘱醛ꂾ樁င$驄摽鶲…ީ湕湫睯쥮Ȇ∢්ł¢ᣂ숁씀褎예ﴏ�뾙뚠ǭ჉砃㐶ᇅ೬ዒ漋甀琀氀漀漀欀⸀攀砀攀씀‖ៅ肀줄࠘㈲㈱䐭捥
(PID) Process:(5772) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\OUTLOOK\1644
Operation:delete keyName:(default)
Value:
(PID) Process:(5772) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\5772
Operation:writeName:0
Value:
0B0E106DE2E0F891BCCE4EAC40A7D8F593EDE6230046DBBAA5E9E0BEF4ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C50E8908C91003783634C5118C2DD2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(5772) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData
Operation:writeName:SessionId
Value:
F8E0E26D-BC91-4ECE-AC40-A7D8F593EDE6
(PID) Process:(5772) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootFailureCount
Value:
(PID) Process:(5772) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Preferences
Operation:delete valueName:ChangeProfileOnRestart
Value:
(PID) Process:(5772) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Licensing
Operation:delete valueName:EligibleForExtendedGrace
Value:
(PID) Process:(5772) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\outlook
Operation:writeName:BuildNumber
Value:
16.0.16026
(PID) Process:(5772) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs
Operation:writeName:CountryCode
Value:
std::wstring|FR
(PID) Process:(5772) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook
Operation:writeName:Expires
Value:
int64_t|0
Executable files
2
Suspicious files
53
Text files
31
Unknown types
1

Dropped files

PID
Process
Filename
Type
5772OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
5772OUTLOOK.EXEC:\Users\admin\Desktop\BL_Copy_pdf.R01compressed
MD5:7D7FF26A9366BB2B6E48410F4C52E64F
SHA256:B3AA57AB465B3C066D44AE43C0A12E86A124F3F4D98BC351693DBC5A2740312D
5772OUTLOOK.EXEC:\Users\admin\Desktop\BL_Copy_pdf.R01:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
5772OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:7F1B8FA85985A93E3531636230010830
SHA256:D8D23173A46F35353D8E58CD208DBDAD92D08F0A70150BE3936B140623B78947
5772OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\30TI8S6C\BL_Copy_pdf.R01compressed
MD5:7D7FF26A9366BB2B6E48410F4C52E64F
SHA256:B3AA57AB465B3C066D44AE43C0A12E86A124F3F4D98BC351693DBC5A2740312D
5772OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\30TI8S6C\BL_Copy_pdf.R01:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
5772OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:25ADC14094870B42E602A92CD0A89DD8
SHA256:8608D98E840E373FE0858741D0DD7A5DFC036DE024A64CFEEA8A934E3B8FBF04
7264WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BL_Copy_pdf.exe_acc72c4f243a1e28d25a7bb5891df0dc33ebf18_ef5cd9fe_8a1c1524-8079-4e8c-b8b3-f5d601bc6935\Report.wer —
MD5:—
SHA256:—
5772OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TableViewPreviewPrefs_2_D43678B536A9E342A01322A5D8311560.datxml
MD5:0E092DB99AEE99FDFF9B5B222C732CFD
SHA256:D1614AD99ADED9F6F5C1BE7FE7FFA5124BD04A526580DA3818EA8A954E852AA6
5772OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16026_20146-20250531T0634250053-5772.etlbinary
MD5:3A1F8A17F6D45386016146E1AF7B74C0
SHA256:4B43E6FDED5BF450089A22AEF39D90BFA05E58ED580307E2D25EB6D767ADFCCE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
28
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4164
svchost.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4164
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5772
OUTLOOK.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7676
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7676
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4452
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4164
svchost.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4164
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4164
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5772
OUTLOOK.EXE
52.123.128.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted
omex.cdn.office.net
  • 2.19.198.56
  • 2.19.198.58
whitelisted
messaging.lifecycle.office.com
  • 52.111.231.13
whitelisted
self.events.data.microsoft.com
  • 20.42.65.88
  • 51.104.15.252
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.129
  • 20.190.159.73
  • 20.190.159.23
  • 20.190.159.128
  • 20.190.159.4
  • 20.190.159.130
  • 40.126.31.3
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
74704807.eml