CVE-2020-11651 (SaltStack RCE) – Defensive

Using the PCAP file located on the Desktop, what are the last five characters of the root_key that was sent to the attacker? I am stuck with question number 5. Any Hint? I tried tcp.payload matche...