attachedTemplate.dotm xxx 11/15/18 05:35 11/15/18 05:35 109.248.148[.]42    Table 2 Remote templates downloaded by Dear Joohn delivery documents As seen in Table 1, the delivery documents accessed their respective remote templates from four C2 servers at the following IP addresses:  185.203.118[.]198 145.249.105[.]165 188.241.58[.]170  109.248.148[.]42  These initial C2 IP addresses not only hosted the remote templates that subsequently load the first-stage Zebrocy or Cannon payloads, but the IP addresses also hosted the C2 server for the first-stage payloads themselves