COPPERHEDGE
The COPPERHEDGE threat is a RAT (Remote Access Trojan) that also is known as Manuscrypt. This piece of malware first emerged two years ago - back in 2018. The COPPERHEDGE threat was deployed in attacks targeting systems located in South Korea. After analyzing the activity of the COPPERHEDGE Trojan, cybersecurity researchers concluded that this threat is likely a part of the arsenal of the nefarious North Korean hacking group called HIDDEN COBRA. This group of cybercriminals is also knowns as the Lazarus APT (Advanced Persistent Threat).
The HIDDEN COBRA APT has updated the COPPERHEDGE RAT several times over the years. So far, researchers have noted six variants of the COPPERHEDGE threat. Most of the copies of the COPPERHEDGE Trojan are almost identical. However, there are several, which include additional features. It is likely that different variants of the COPPERHEDGE malware were used against different targets of the Lazarus hacking group.
The COPPERHEDGE RAT allows its creators to carry out a wide variety of tasks on the compromised system like:
- Executing remote commands.
- Manipulating the settings of the payload.
- Creating new processes.
- Killing active processes.
- Listing drive partitions.
- Collecting information regarding the host's hardware and software.
- Delivering and executing additional payloads.
- Collecting files from the compromised PC.
- Self-destructing.
The COPPERHEDGE malware's C&C (Command & Control) infrastructure is impressively size-wised. There are tens upon tens of hardcoded IP addresses, which can be utilized by the COPPERHEDGE RAT. A significant percentage of the infrastructure used by the HIDDEN COBRA hacking group is hosted on genuine servers that have been breached by the APT.
The HIDDEN COBRA APT tends to target government institutions or high-profile companies that operate in sectors like defense, aerospace, science, technology, etc. This means that regular users are not likely to fall victim to the HIDDEN COBRA hacking group's harmful campaigns. It is best to protect your PC with the help of a trustworthy cybersecurity tool.
Table of Contents
File Details:
Sample: d8af45210bf931bc5b03215ed30fb731e067e91f25eda02a404bd55169e3e3c3
Name: 12C786C490366727CF7279FC141921D8
Size: 166400 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: 12c786c490366727cf7279fc141921d8
SHA1: a2e966edee45b30bb6bb5c978e55833eec169098
SHA256: d8af45210bf931bc5b03215ed30fb731e067e91f25eda02a404bd55169e3e3c3
SHA512: 3abe4cd0d287fdf38715feac4096a16ed8c9ed113897e8e8e26d22adb4346df3c8a14a2c6660fbc2e01beb98e5cc770616866e5e319cfd95624710011f5f60f3
ssdeep: 3072:G2K5QbCpgMFlQ0O4t5E13j0S0wBiCRcnHaApUiCDyY:G2bSQ0NS3jq6Apm
Entropy: 6.529499
Sample: 7985af0a87780d27dc52c4f73c38de44e5ad477cb78b2e8e89708168fbc4a882
Name: C6801F90AAA11CE81C9B66450E002972
Size: 176640 bytes
Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5: c6801f90aaa11ce81c9b66450e002972
SHA1: 4e30ebb98bb9f984c05eb0c0a365ff95305e8c55
SHA256: 7985af0a87780d27dc52c4f73c38de44e5ad477cb78b2e8e89708168fbc4a882
SHA512: 2568ed6468f6d6b4ec6a930e003b04a2fd9e3379ac9fa320f6130f789ff8471ef2ca596ef2699bc45fd0997a5972243627199eb94e42028fcaf0882639b45008
ssdeep: 3072:FhjE3GVSDW52icOf+CDqRHiEGK+M/0ivZSRMlxbs6D79vrXqx7C5:DE3o52Q+VRHiEGK+M/1hSmZ67
Entropy: 6.244198
Sample: e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292
Name: 912F87392A889070DBB1097A82CCD93F
Size: 128512 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: 912f87392a889070dbb1097a82ccd93f
SHA1: 58c5b86691dc922945c8204b465e76fc15c498fb
SHA256: e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292
SHA512: 968d7ff1a39b95428d139d0c7febd76ebcd37612c133ac238fb2a2accf853a2ceb5827f2344c09dafcd7e5936ddbc4da401bcb328d483158430f5f7dc482ba58
ssdeep: 1536:Jg6dIYHXVp0AMkysbkQfRkChJlTToZdRYKgZXTrP5Dr4vDQeAsWq8McdLEA8CHr:FdnXVpIsXRjlTToNYKgZjiDwLEA8CH
Entropy: 6.559526
Sample: 4838f85499e3c68415010d4f19e83e2c9e3f2302290138abe79c380754f97324
Name: EB6275A24D047E3BE05C2B4E5F50703D
Size: 128512 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: eb6275a24d047e3be05c2b4e5f50703d
SHA1: 62faf15eddb64dce9a2b1ba242254271facffd9f
SHA256: 4838f85499e3c68415010d4f19e83e2c9e3f2302290138abe79c380754f97324
SHA512: f2715f867a1729d3ff77a5ee561da0df0f736517d0f0197e726e2a5867d21c16f0558afd8e6b38d9a166d0715b51d95407943865e577fb01c172681edcbc822a
ssdeep: 3072:wIjV9Tmp7TvnhplTznm4qg5aHDwU+A8Yr:ljV9ap7TPPlmbay8Y
Entropy: 6.561793
Sample: e76b3fd3e906ac23218b1fbd66fd29c3945ee209a29e9462bbc46b07d1645de2
Name: AA7F506B0C30D76557C82DBA45116CCC
Size: 128512 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: aa7f506b0c30d76557c82dba45116ccc
SHA1: b12d174088629f4e3e0009661ca589fc9f17f66a
SHA256: e76b3fd3e906ac23218b1fbd66fd29c3945ee209a29e9462bbc46b07d1645de2
SHA512: 38e119207cf99b6b51f41f79f05a9796b5db68c96243596f25287a82454fc31fc7398fee78940308f2a141907e736f52c4a95efbd00c3d95e6a1cd366b598cad
ssdeep: 3072:MImnlpLjPVxPlTDYlI6gJow9DwUkA8pED8:hmnlpLjNJql7KR8qD
Entropy: 6.562090
Sample: 1faaa939087c3479441d9f9c83a80ac7ec9b929e626cb34a7417be9ff0316ff7
Name: 667CF9E8EC1DAC7812F92BD77AF702A1
Size: 128512 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: 667cf9e8ec1dac7812f92bd77af702a1
SHA1: 880fb67893d8ce559857ca783a701b5ca675eb40
SHA256: 1faaa939087c3479441d9f9c83a80ac7ec9b929e626cb34a7417be9ff0316ff7
SHA512: 83551fc0a12546380e0975f02fb2aff65ceab76885e9a1d47d7726b2e48d0c8cb0871c2036778c9beeaa6d9ad455501941eff51db00bec001457a68b8a2174a6
ssdeep: 3072:tIjV94Vp7TPnhalTDY2I6gJ66dDwUGA8Qr:qjV9mp7TvQq27Kf8Q
Entropy: 6.561257
Sample: 3ff4ebae6c255d4ae6b747a77f2821f2b619825c7789c7ee5338da5ecb375395
Name: A7C804B62AE93D708478949F498342F9
Size: 128512 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: a7c804b62ae93d708478949f498342f9
SHA1: 09db826a7b6dbb16e2d7b3046e0da9fe7342f00f
SHA256: 3ff4ebae6c255d4ae6b747a77f2821f2b619825c7789c7ee5338da5ecb375395
SHA512: c186485779ef22e6b65b3ba43a4290026d7b97b0d98ab8fe35f811c911be80402ea8bdf89e9c7169b3e7168d1e6a55eaa3fb8fd2165e55d9a4936be6f2b78594
ssdeep: 1536:JkkY5dY/p7aY3xkuvxaSfhkSn5lTToZkBYKgZXTrP5zr4t8DQeAsWq8McdC5vA8G:Ck0Y/p7TvFhllTToGYKgZj7DwC5vA8E
Entropy: 6.557876
Sample: c2f150dbe9a8efb72dc46416ca29acdbae6fd4a2af16b27f153eaabd4772a2a1
Name: 86685EC8C3C717AA2A9702E2C9DEC379
Size: 156672 bytes
Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5: 86685ec8c3c717aa2a9702e2c9dec379
SHA1: 29ddf9baad018518060814a03d424f4e08a0e914
SHA256: c2f150dbe9a8efb72dc46416ca29acdbae6fd4a2af16b27f153eaabd4772a2a1
SHA512: 5bfee5737aaa7b5c42f49d2963ca3fdb0212eb4b298366e6e15ce7b6a9c09b3a1d4971683414318e5b7463eb9fa0a508179b72a72ceba8298a9d8aa6ccade4cb
ssdeep: 3072:/ucPnT+MMMMRwVK77YWOj885LhaEuTiAQLvkkABYn9N:/ZnTwn77YWOjbL4hfq
Entropy: 6.192260
Sample: 1678327c5f36074cf5f18d1a92c2d9fea9bfae6c245eaad01640fd75af4d6c11
Name: 86D3C1B354CE696E454C42D8DC6DF1B7
Size: 129024 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: 86d3c1b354ce696e454c42d8dc6df1b7
SHA1: 4d17c0fb13b532ba5a680c1701026d29fb1931e7
SHA256: 1678327c5f36074cf5f18d1a92c2d9fea9bfae6c245eaad01640fd75af4d6c11
SHA512: cdb1338674ea9407bbffe3569fbd021df4ebefe1bc8fad2415506005d2c6bd7d6f134c89aa6c0bc5a539783fd293329d3d442cf313c8d0c70cf296e4f23f91eb
ssdeep: 1536:Qkj1G7eW0vV7qZx1kJMZKzO12lsSKwVDF1ZTgKTTkbv+DQeAsWq8McdsLA8+nr:QkW/0JqezblsSfx1VguFDwsLA8+n
Entropy: 6.568189
Sample: c0ee19d7545f98fcd15725a3d9f0dbd0f35b2091e1c5b9cf4744f16e81a030c5
Name: 5182E7A2037717F2F9BBF6BA298C48FB
Size: 157696 bytes
Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5: 5182e7a2037717f2f9bbf6ba298c48fb
SHA1: 47b5d2c3f741a896a26993dbbf4a5deec6f9ac53
SHA256: c0ee19d7545f98fcd15725a3d9f0dbd0f35b2091e1c5b9cf4744f16e81a030c5
SHA512: 016a80dbd78e5614e38388b3e107cb9c9f29a971dfb90cceb8e91ce0af448359ac8ad3a898e623b142f4b7bd2638ffcd7869575d50e44c05ff66fdb6d86a6788
ssdeep: 3072:HXyO7ibruDVtCuwxxy7Gwi6OnSaytibCCLUvg2/1Yn:HCO7ibruDVtCuIy7GwiBSaYSZ9x
Entropy: 6.194475
Sample: 9e4bd9676bb3460be68ba4559a824940a393bde7613850eda9196259e453b9f3
Name: 668D5B5761755C9D061DA74CB21A8B75
Size: 2212864 bytes
Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5: 668d5b5761755c9d061da74cb21a8b75
SHA1: 49da356fd99d4b7c8cb4e77f89877ee41f8948ca
SHA256: 9e4bd9676bb3460be68ba4559a824940a393bde7613850eda9196259e453b9f3
SHA512: 8ec530a1a3fba89589f6041fc5466befa2247f3829ae46bff91f341a0957abb2515168e1ac6eaf02d04fc8bcd37a237c9071b2fa295a9963e6bb30ad75313cce
ssdeep: 49152:h6nuk9DG/lEYtBgKPd3S7k1X2NDxDNWnnuTniH6:h6ukYEYtJV3S7aEDrWnnuTu
Entropy: 7.958398
Sample: eee38c632c62ca95b5c66f8d39a18e23b9175845560af84b6a2f69b7f9b6ec1c
Name: 35E38D023B253C0CD9BD3E16AFC362A7
Size: 129024 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: 35e38d023b253c0cd9bd3e16afc362a7
SHA1: c850e733f4e0d4abb34969678f2a1abe3b2f4c24
SHA256: eee38c632c62ca95b5c66f8d39a18e23b9175845560af84b6a2f69b7f9b6ec1c
SHA512: c605f9f895773b8a9a50581b490cfbf2434f687ec4faae0ce37082fb8fb5efa3e76f39fbc891bd38460b6ee56c240c09eada8b58cdaa9368c18dfafec620785e
ssdeep: 1536:XbWB4W7YWyCNWf65xAkNbf+QFc9lvmKw77vliLlTrK+S31DQeAsWq8McdsX4A8PR:XbWt5yzf6kQolvmx7vliLh+DwsoA8PF
Entropy: 6.571364
Sample: f6e1a146543d2903146698da5698b2a214201720c0be756c6e8d2a2f27dcfaff
Name: 72FE869AA394EF0A62BB8324857770DD
Size: 157696 bytes
Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5: 72fe869aa394ef0a62bb8324857770dd
SHA1: de03860d8a43358554ee4fab22c3fb25cae8992b
SHA256: f6e1a146543d2903146698da5698b2a214201720c0be756c6e8d2a2f27dcfaff
SHA512: 54c86cef7f0b2b795d1e04323432acfeb78c751bcfdc1b693f2048b8f6af7fc06a6ef64d481764ec0c5261d5c4b020f079db6769433c705bc474ce704c1b3ff6
ssdeep: 3072:gXFP7wuoSeJOwxFLo7qJ/hCIEftBgbRFCLUv3w7uYngn:g1P7wuoSeJOAs7qJ5cfzkKq0G
Entropy: 6.200286
Sample: 37bb27f4eb40b8947e184afddba019001c12f97588e7f596ab6bc07f7c152602
Name: A8B6EC51ED88C0329FD3329CB615BBC9
Size: 95744 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: a8b6ec51ed88c0329fd3329cb615bbc9
SHA1: f744f5f97ace1a4862e764971449c28c4b880e8f
SHA256: 37bb27f4eb40b8947e184afddba019001c12f97588e7f596ab6bc07f7c152602
SHA512: 26e1558557e3b44d18a1d97a38cc9881bc025d4979e914d40ef42248d7c5b3d09cfa17ab3893d91d65c29ba9d94047726f42be91bcd424f54b9876eddd28ab13
ssdeep: 1536:fIbpjZh3Qj6T4T0PY0qBbxp35d5Nh3UCzsW8cdvZ1Q6B:fM3Qe4yY0qtf/hk+vZ1Q6B
Entropy: 6.373893
Sample: e6fc788b5ff7436da4450191a003966a68e2a1913c83f1d3aec78c65f3ba85ca
Name: 117FA0B8B8B965680C7B630C6E2BF01D
Size: 116736 bytes
Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5: 117fa0b8b8b965680c7b630c6e2bf01d
SHA1: 7202fea74865e085104f839574cd150613fbcf99
SHA256: e6fc788b5ff7436da4450191a003966a68e2a1913c83f1d3aec78c65f3ba85ca
SHA512: 454703dd49b4b8feb36b71d7a6d18f7811c221675e272b6fe0b3d9f60a7c5c61bb6b0d8f9d84eb13cf68685dd9ef482f39b6026dda8867d9017c50ba96655e43
ssdeep: 3072:iN9F81gu+0WsPxRr0T7V4P2F6U6V641B820D:iN81/+0JpJ0TJrq600D
Entropy: 6.008099
Sample: 284bc471647f951c79e3e333b2b19aa37f84cc39b55441a82e2a5f7319131fac
Name: DB590EA77A92AE6435E2EC954D065ED4
Size: 118272 bytes
Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5: db590ea77a92ae6435e2ec954d065ed4
SHA1: ef0c0ef95b1542184a6a1f4d1f4ece583046ba0a
SHA256: 284bc471647f951c79e3e333b2b19aa37f84cc39b55441a82e2a5f7319131fac
SHA512: 07d1da9735f468fd389bcf34052f94977ffc64028b54ae4a7f077aab8488bc5e82cde82671da84c0e649d1ffb3fe05491b7bfde967581799fc484a6690ef0f25
ssdeep: 1536:bUtygCBUwWkWtptf4W9wuJ9r82lVOwEnSMw/XjGCpsWBMdc9dlMLTQjP8PoRbB:oty7WkYwW9L98gVVZ/zGMWUUM8Ps
Entropy: 6.003427
Sample: a1cdb784100906d0ac895297c5a0959ab21a9fb39c687baf176324ee84095472
Name: 0856655351ACFFA1EE459EEEAF164756
Size: 119808 bytes
Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5: 0856655351acffa1ee459eeeaf164756
SHA1: fe0f8a37887c8f8fb5eb3e8252a8df395b3e66e7
SHA256: a1cdb784100906d0ac895297c5a0959ab21a9fb39c687baf176324ee84095472
SHA512: 1dec04eef52a9872de02fa6fc1afcc9ccdc0d756d1b2de35ebda83985aefe7111b21a1e2be45992f3a35e5f70528947f91f50d098571206c180b5aa4421b3be6
ssdeep: 1536:iZBO9DuBAnQ2Vv4+BjVHxcTtBEIxyvO1URh+EhmGCpsWBMdc9dlM4bzd2U8EfwVB:uBOZuBUQwPjV+TcIUvXh+NGMWU1J8E
Entropy: 5.978562
Sample: b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba
Name: 34C2AC6DAA44116713F882694B6B41E8
Size: 413696 bytes
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 34c2ac6daa44116713f882694b6b41e8
SHA1: 323258353c244b373c758906d88a2bf9663abf8d
SHA256: b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba
SHA512: 5d4368d9de8c15b8b2945ad0aebf1bdc9c5e14dfc2927fb43d254f129675285278116ac9f32e0e3b11aeac10b488fa78c9c57ef1634a911ab76a583b27c4af81
ssdeep: 3072:rNXQoaFxes6EiH6Zq2dIvkapOztAzfb7zgntbeGfCDQomoRoYohoYoloodocoomn:rNXQoaFA6TdIvbxHFGfCDtoLb779qPb
Entropy: 6.080481
Sample: 134b082b418129ffa390fbee1568bd9510c54bfdd0e6b1f36bc7b8f867e56283
Name: 633BD738AE63B6CE9C2A48CBDDD15406
Size: 110592 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: 633bd738ae63b6ce9c2a48cbddd15406
SHA1: 9807eadca9016f843ee35426d06bf67860d9cc39
SHA256: 134b082b418129ffa390fbee1568bd9510c54bfdd0e6b1f36bc7b8f867e56283
SHA512: 681c659813ab9e7dccfe4b3f86dfcc69dc63976a78ef93bff745543501c8cdfac988e7cd4f07a1a00f7432be12203b4f77f716f62b21616ffd1c4175379f3990
ssdeep: 3072:xZRo0uR/IjCCvWyBra4YUzCbBAHFbEQP:xZm+GCW2m4YUzCbOv
Entropy: 6.483560
Sample: 0a763da26a67cb2b09a3ae6e1ac07828065eb980e452ce7d3354347976038e7e
Name: 171B9135540F89BF727B690B9E587A4E
Size: 1778176 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: 171b9135540f89bf727b690b9e587a4e
SHA1: 930577d155c41ad843be09a5910a75160eb0eca9
SHA256: 0a763da26a67cb2b09a3ae6e1ac07828065eb980e452ce7d3354347976038e7e
SHA512: 811f9e5302b0a048d56fb54b70df2819c7219accf07c1f69f9d4c9342fbb4748017ae5acb3e3e8c6ab0d5c8c5660f9c0b542e06b306b96e78309bc92a735cc10
ssdeep: 49152:Z689410GBsVASqabr4nrhKCJiX1zBj7Is:Z604zehqabr4hli1zBH
Entropy: 7.951261
Sample: 1884ddc53ef66488ca8fc641b438895fcaada77c15210118465377c63223b3bc
Name: 22F8D2A0C8D9B54A553FCA1B2393B266
Size: 126976 bytes
Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5: 22f8d2a0c8d9b54a553fca1b2393b266
SHA1: 08bacda419c5c663bd16374ee690e8822af74af0
SHA256: 1884ddc53ef66488ca8fc641b438895fcaada77c15210118465377c63223b3bc
SHA512: 0a51be4e9d4d95d4e511b97bdfa2aaec5db39388eedf17285922f6057ca171f55734c2e5e7d556a7d3655c6b01430bae045045644013139f69b78948dcdbdbaf
ssdeep: 3072:hdnIUhpSA9IybNLYhsmbjzwI3tFMHBNu:vnIUhpS85WsmbnKN
Entropy: 6.417310
Sample: c24c322f4535def3f8d1579c39f2f9e323787d15b96e2ee457c38925effe2d39
Name: FDD55A38A45DE8AF6F8C34A33BAE11CB
Size: 141312 bytes
Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5: fdd55a38a45de8af6f8c34a33bae11cb
SHA1: f2da56d6a565ade77d7ebb0c31eda99b415bcced
SHA256: c24c322f4535def3f8d1579c39f2f9e323787d15b96e2ee457c38925effe2d39
SHA512: f81e0cb975269483f43a35b10b8f01efe708453e675f3909585c1332d477bff69d47abc570563ac1cf8dcecc4133a702db6b0ab19548f3e0e08f096d723fa514
ssdeep: 3072:RFoydrw7d4uA4LsuvitZmf5eXv91596YPG:PXG7d47wsOiXmfw1DG
Entropy: 6.089052
Aliases
15 security vendors flagged this file as malicious.
| Anti-Virus Software | Detection |
|---|---|
| - | Trojan.Manuscrypt.Win32.10 |
| - | BScope.Trojan.Manuscrypt |
| - | Trojan.Win32.Genus.BGU |
| TrendMicro | TROJ_NUKESPED.B |
| - | malware.gen-ra |
| Symantec | Backdoor.Cruprox |
| Sophos | Troj/Agent-AYKU |
| - | Trojan.Win32.Malware |
| - | Trojan.Win32.Manuscrypt.eyleld |
| Microsoft | Trojan:Win32/Autophyte.M!dha |
| McAfee | HiddenCobra!12C786C49036 |
| K7AntiVirus | Trojan ( 005202c91 ) |
| Ikarus | Trojan-Spy.Agent |
| - | Gen:Variant.Graftor.452205 (B) |
| - | Win32/NukeSped.AG trojan variant |
File System Details
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | d8af45210bf931bc5b03215ed30fb731e067e91f25eda02a404bd55169e3e3c3 | 12c786c490366727cf7279fc141921d8 | |
| 2. | 7985af0a87780d27dc52c4f73c38de44e5ad477cb78b2e8e89708168fbc4a882 | c6801f90aaa11ce81c9b66450e002972 | |
| 3. | e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292 | 912f87392a889070dbb1097a82ccd93f | |
| 4. | 4838f85499e3c68415010d4f19e83e2c9e3f2302290138abe79c380754f97324 | eb6275a24d047e3be05c2b4e5f50703d | |
| 5. | e76b3fd3e906ac23218b1fbd66fd29c3945ee209a29e9462bbc46b07d1645de2 | aa7f506b0c30d76557c82dba45116ccc | |
| 6. | 1faaa939087c3479441d9f9c83a80ac7ec9b929e626cb34a7417be9ff0316ff7 | 667cf9e8ec1dac7812f92bd77af702a1 | |
| 7. | 3ff4ebae6c255d4ae6b747a77f2821f2b619825c7789c7ee5338da5ecb375395 | a7c804b62ae93d708478949f498342f9 | |
| 8. | c2f150dbe9a8efb72dc46416ca29acdbae6fd4a2af16b27f153eaabd4772a2a1 | 86685ec8c3c717aa2a9702e2c9dec379 | |
| 9. | 1678327c5f36074cf5f18d1a92c2d9fea9bfae6c245eaad01640fd75af4d6c11 | 86d3c1b354ce696e454c42d8dc6df1b7 | |
| 10. | c0ee19d7545f98fcd15725a3d9f0dbd0f35b2091e1c5b9cf4744f16e81a030c5 | 5182e7a2037717f2f9bbf6ba298c48fb | |
| 11. | 9e4bd9676bb3460be68ba4559a824940a393bde7613850eda9196259e453b9f3 | 668d5b5761755c9d061da74cb21a8b75 | |
| 12. | eee38c632c62ca95b5c66f8d39a18e23b9175845560af84b6a2f69b7f9b6ec1c | 35e38d023b253c0cd9bd3e16afc362a7 | |
| 13. | f6e1a146543d2903146698da5698b2a214201720c0be756c6e8d2a2f27dcfaff | 72fe869aa394ef0a62bb8324857770dd | |
| 14. | 37bb27f4eb40b8947e184afddba019001c12f97588e7f596ab6bc07f7c152602 | a8b6ec51ed88c0329fd3329cb615bbc9 | |
| 15. | e6fc788b5ff7436da4450191a003966a68e2a1913c83f1d3aec78c65f3ba85ca | 117fa0b8b8b965680c7b630c6e2bf01d | |
| 16. | 284bc471647f951c79e3e333b2b19aa37f84cc39b55441a82e2a5f7319131fac | db590ea77a92ae6435e2ec954d065ed4 | |
| 17. | a1cdb784100906d0ac895297c5a0959ab21a9fb39c687baf176324ee84095472 | 0856655351acffa1ee459eeeaf164756 | |
| 18. | b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba | 34c2ac6daa44116713f882694b6b41e8 | |
| 19. | 134b082b418129ffa390fbee1568bd9510c54bfdd0e6b1f36bc7b8f867e56283 | 633bd738ae63b6ce9c2a48cbddd15406 | |
| 20. | 0a763da26a67cb2b09a3ae6e1ac07828065eb980e452ce7d3354347976038e7e | 171b9135540f89bf727b690b9e587a4e | |
| 21. | 1884ddc53ef66488ca8fc641b438895fcaada77c15210118465377c63223b3bc | 22f8d2a0c8d9b54a553fca1b2393b266 | |
| 22. | c24c322f4535def3f8d1579c39f2f9e323787d15b96e2ee457c38925effe2d39 | fdd55a38a45de8af6f8c34a33bae11cb |
URLs
COPPERHEDGE may call the following URLs:
| 919xy.com/contactus/about.php |
| qdbazaar.com/include/footer.php |
| 028xmz.com/include/common.php |
| 168wangpi.com/include/charset.php |
| 33cow.com/include/control.php |
| 3x-tv.com/plugins/editors/about.php |
| 51shousheng.com/include/partview.php |
| 530hr.com/data/common.php |
| 92myhw.com/include/inc/inc_common.php |
| 97nb.net/include/arc.sglistview.php |
| aedlifepower.com/include/image.php |
| aisou123.com/include/dialog/common.php |
| aloe-china.com/include/bottom.php |
| anlway.com/include/arc.search.class.php |
| ap8898.com/include/arc.search.class.php |
| apshenyihl.com/include/arc.speclist.class.php |
| as-brant.ru/wp-content/themes/shapely/common.php |
| aurumgroup.co.id/wp-includes/rest.php |
| bogorcenter.com/wp-content/themes/index2.php |
| cabba-cacao.com/wp-content/themes/integral/about.php |
| castorbyg.dk/wp-content/themes/302.php |
| creativefishstudio.com/newbiesspeak/left.php |
| danagloverinteriors.com/wp-content/plugins/jetpack/common.php |
| duratransgroup.com/engl/lang.php |
| eventum.cwsdev3.biz/wp-includes/common.php |
| eygingenieros.com/wp-includes/common.php |
| growthincone.com/board.php |
| inverstingpurpose.com/head.php |
| locphuland.com/wp-content/themes/hikma/total.php |
| markcoprintandcopy.com/data/helper.php |
| marmarademo.com/include/extend.php |
| matthias-dlugi.de/wp-content/themes/twentyfifteen/helper.php |
| new.titanik.fr/wp-includes/common.php |
| nuokejs.com/contactus/about.php |
| pakteb.com/include/left.php |
| rhythm86.com/wp-content/themes/twentysixteen/about.php |
| rxrenew.us/wp-content/themes/hestias/index.php |
| sensationalsecrets.com/js/left.php |
| stokeinvestor.com/common.php |
| streamf.ru//wp-content/index2.php |
| theinspectionconsultant.com/wp-content/plugins/akismet/index1.php |
| vinhsake.com//wp-content/uploads/index2.php |
