emotet data for 5ff5840db95040133a6833d8c4a43c07

Sample:
 5ff5840db95040133a6833d8c4a43c07

Onboard config:
{'C2': ['173.3.29.123:7080', '105.185.141.205:80', '207.255.210.196:80', '190.211.207.11:443', '85.104.59.244:20', '67.209.208.130:8443', '187.233.152.78:443', '185.94.252.3:443', '5.230.147.179:8080', '64.13.225.150:8080', '203.143.86.111:8080', '87.106.139.101:8080', '201.239.154.191:443', '208.78.100.202:8080', '173.255.196.209:8080', '187.142.0.234:22', '45.33.49.124:443', '217.13.106.160:7080', '173.255.250.241:443', '94.76.200.114:8080', '87.106.210.123:80', '187.189.195.208:8443', '190.97.219.241:80', '58.171.215.214:8080', '83.222.124.62:8080', '133.242.156.30:7080', '67.248.56.82:22', '69.198.17.7:8080', '76.168.149.66:8080', '186.4.234.27:443', '213.191.168.93:80', '67.205.149.117:443', '147.135.210.39:8080', '70.57.82.196:80', '167.114.210.191:8080', '186.113.255.229:22', '178.62.37.188:443', '45.123.3.54:443', '187.209.46.240:21', '50.31.0.160:8080', '50.80.248.108:443', '59.103.164.174:80', '62.75.187.192:8080', '64.46.91.165:80', '200.50.185.54:80', '41.220.119.246:80', '200.113.185.229:8080', '78.188.105.159:21', '201.220.152.101:80', '108.188.116.179:80', '86.239.117.57:8090', '24.243.101.134:80', '138.201.140.110:8080'], 'PUBKEY': '-----BEGIN PUBLIC KEY-----\nMHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx\nS0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc\nhG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB\n-----END PUBLIC KEY-----'}



Decoded strings:

0x401068L String length: 20
Xor Key: 0x64da9f26
PEM%X
0x4010c4L String length: 29
Xor Key: 0x64da9f26
PEE%X
0x401138L String length: 20
Xor Key: 0x64da9f26
PEM%X
0x40118fL String length: 212
Xor Key: 0x64da9f26
PEE%X
0x40175dL String length: 168
Xor Key: 0x4581a82a
POST
0x401d51L String length: 444
Xor Key: 0x480a753c
WinSta0\Default
0x406841L String length: 852
Xor Key: 0xbc2d793
teapot,pnp,tpt,splash,site,codec,health,balloon,cab,odbc,badge,dma,psec,cookies,iplk,devices,enable,mult,prov,vermont,attrib,schema,iab,chunk,publish,prep,srvc,sess,ringin,nsip,stubs,img,add,xian,jit,free,pdf,loadan,arizona,tlb,forced,results,symbols,report,guids,taskbar,child,cone,glitch,entries,between,bml,usbccid,sym,enabled,merge,window,scripts,raster,acquire,json,rtm,walk,ban
0x406894L String length: 80
Xor Key: 0xbc2d793
---------------------------%08x%05x
0x4068e7L String length: 488
Xor Key: 0xbc2d793
Referer: http://%s/%s
Content-Type: multipart/form-data; boundary=%s
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate


0x406affL String length: 24
Xor Key: 0xbc2d793
%u.%u.%u.%u
0x4070edL String length: 96
Xor Key: 0x173ff219
advapi32.dll
0x40745bL String length: 96
Xor Key: 0x173ff219
shell32.dll
0x407b17L String length: 120
Xor Key: 0x173ff219
crypt32.dll
0x408939L String length: 508
Xor Key: 0x173ff219
urlmon.dll
0x408d37L String length: 340
Xor Key: 0x173ff219
userenv.dll
0x4092d5L String length: 200
Xor Key: 0x173ff219
wininet.dll
0x40a1dfL String length: 488
Xor Key: 0x173ff219
wtsapi32.dll
0x40a2c9L String length: 224
Xor Key: 0x173ff219
Global\E%X
0x40a33cL String length: 216
Xor Key: 0x173ff219
Global\I%X
0x40a3a7L String length: 196
Xor Key: 0x173ff219
Global\M%X
0x40c813L String length: 104
Xor Key: 0x41e9710f
%s\%s
0x40c895L String length: 232
Xor Key: 0x41e9710f
%s\%s.exe
0x40cd23L String length: 452
Xor Key: 0x11107ce2
%s:Zone.Identifier
0x40cd8cL String length: 516
Xor Key: 0x41e9710f
%X
0x40ce3bL String length: 168
Xor Key: 0x41e9710f
"%s"
0x40cf8bL String length: 584
Xor Key: 0x41e9710f
not,ripple,svcs,serv,wab,shader,single,without,wcs,define,eap,culture,slide,zip,tmpl,mini,polic,panes,earcon,menus,detect,form,uuidgen,pnp,admin,tuip,avatar,started,dasmrc,alaska,guids,wfp,adam,wgx,lime,indexer,repl,dev,mapi,resw,daf,diag,iss,vsc,turned,neutral,sat,source,enroll,mfidl,idl,based,right,cbs,radar,avg,wordpad,metagen,mouse,iprop,mdmmcd,jersey,thunk,subs
0x40d197L String length: 168
Xor Key: 0x41e9710f
"%s"
0x40d1deL String length: 448
Xor Key: 0x41e9710f
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
0x40d4a6L String length: 120
Xor Key: 0x3bec1bd
"%s"