correct C&C IP addresses (see appendix). If we repeat this process with the other XOR key we know of 0x1AB9C2D8 - we end up with the localhost IP 127.0.0.1 translating to the bogus IP of 167.194.185.27. No