Trust you are doing great. Please I need a hint on KeepTryin. I was able to determine that it was data ex-filtration for text file secret.txt.
I have tried to extract the file but i keep hitting the wall. Here are what I have tried:
From the data transfer itself, i observed TXT record appears to be in form ....domainName.
I have concatenated the data, replaced characters "-" and "_" with "+" and "/" respectively to align with base64 supported characters; converted back to normal text and attempt to decrypt with RC4 using KeepTryin and S2VlcCB0cnlpbmcsIGJ1ZmZ5Cg== as key.