WireVPN-controlled C2 domain; malware communicates with subdomains across this domain during execution