Legacy C2 domain used by older Cav3rn HTTP module at /cac.aspx endpoint with XOR+Base32-encoded steganographic PNG transport